Nine Licences Fall, Sanctions Desks Strain On Two Fronts

The Travel Industry Council pulled the licences of a tour guide and the two agencies that kept sending her out today, Cheung Kwok-keung reports from the HK Desk. This is the guide who cornered a tour group weeks ago and threatened them into a jade shop. Three strikes, and today the council said out. Cheung's desk makes the comparison: Hong Kong wants five clean years before it will let a human sit next to a driverless car in Tseung Kwan O, but this system took three strikes to stop trusting someone with a busload of tourists. Same government, two different clocks, and today one of them ran out.

Elsewhere, the machinery built to punish bad actors from a distance is being asked to do more than it was built for. North Korea commissioned its second nuclear-capable destroyer on September 6, timed to the opening day of a joint US-Japan-South Korea drill, and Vincent Lai's Geopolitical Ledger notes that the US Treasury's OFAC desk, not the Pentagon, has to draft the sanctions response. The same week, the US, UK, France and Germany moved to refer Iran to the UN Security Council over blocked nuclear inspections, the first such referral in two years. Lai's point is not that the two crises are related. It is that both sanctions programs draw on the same interagency drafting capacity in Washington, so a staffing choice made this month decides which regime gets the sharper follow-through. Separately, Mei Chen's desk counted 17 PLA vessels operating around Taiwan in the 24 hours ending today, a number that matters less for its size than for how ordinary it has become to log.

On the technical side of the ledger, Kai Tanner's Cyber Intel desk has a MikroTik campaign worth any HK bank's attention: attackers are taking full administrative control of internet-facing routers over SSH with no password at all, not through a new exploit but through a configuration default MikroTik has warned about for years. There is no CVE number and no patch coming, because there is no vulnerable code to patch, just a firewall rule nobody wrote. Tanner's advice is blunt: run the port scan against your own fleet this week rather than wait for an advisory that will not arrive.

The guide's badge and Washington's ledgers share the same lesson in different clothing. Systems that look slow, whether a licensing board or a sanctions regime, are still bound by capacity, not intention. Hong Kong had the paperwork to strip a badge the moment it chose to spend the enforcement effort. Washington has the same choice ahead on North Korea and Iran, and which track gets the follow-through will say more about priorities than about either country's behavior.