The Water Line

Houthi missiles and drones struck Saudi Aramco's Jizan refinery and Yanbu export terminal on 25 July. Minnesota water utilities absorbed a coordinated probe of unpatched operational technology on 26 and 27 July. China's coast guard fired water cannon at Philippine vessels near Scarborough Shoal on 23 and 24 July. A Wisconsin utility told shareholders on 29 July that it already holds the collateral a state regulator has required since April, regardless of how the underlying dispute resolves. Four separate tests of the same underwriting question: a reported $60-70 million shipment of Chinese-made shoulder-fired missiles would put at risk the aircraft flying the low-altitude patrols that protect a corridor now carrying the large majority of Saudi Arabia's seaborne crude exports, and the same gap between what it costs to attack and what it costs to defend runs through the Minnesota and Scarborough Shoal tiles as well.

The fourth test, Wisconsin, has nothing to do with water and belongs to a different logic: US state-level regulators continuing to set the terms under which AI-grade data centre demand connects to the grid. That three of the four tiles happen to touch water, Jizan's refinery, Minnesota's utilities, Scarborough Shoal's water cannon, is a coincidence of subject matter and the reason for this issue's title, nothing more.

Yemen's Houthi movement struck Saudi Aramco's Jizan refinery and the Yanbu export terminal on 25 July, in what its military spokesman Yahya Saree described as retaliation for Saudi strikes on Hodeidah and Kamaran Island.¹ NASA's FIRMS satellite system detected a substantial thermal anomaly at Jizan at approximately 01:17 UTC, and the refinery, which processes 400,000 barrels of crude daily, was subsequently shut down, with repairs targeted for around 15 August according to a consultancy note cited by regional press.² It is the first direct Houthi strike on Saudi oil infrastructure in four years.

Yanbu's significance goes beyond the refinery complex. Since Iran's effective closure of the Strait of Hormuz earlier this year, Saudi Arabia has pushed crude westward through the 1,200-mile East-West Pipeline to Red Sea terminals, reaching a record throughput of 7 million barrels per day in March. Shipping data cited by AFP put Yanbu's share of Saudi seaborne crude exports at 92% in June and 78% so far in July, effectively Saudi Arabia's last functioning export corridor.¹ Brent crude broke back above $100 a barrel in early trading following the strikes, having already touched $101 intraday on 23 July, a roughly $28 rise over three weeks that UBS has described as a broader tightening of the oil market.²

The Jizan and Yanbu strikes followed a naval blockade the Houthis declared against Saudi shipping in mid-July and missile and drone strikes claimed against two Saudi tankers, the Encelia and the Layla, on 22 July; the Saudi Press Agency confirmed the Encelia had been hit, with all crew reported safe.³ The Institute for the Study of War reported at least seven vessels had diverted away from the Bab el-Mandeb Strait as of 23 July, and the US President said the same day that the US would hold Iran responsible for further Houthi attacks, following what CNBC reported as a twelfth consecutive night of US strikes on Iran.⁴

A closing development complicates the underwriting question further. Reuters reported on 29 July, citing three sources familiar with the matter, that Iran is expected to receive within weeks a first shipment from a contract for up to 400 Chinese-made man-portable air-defence systems, QW-12 and FN-16 models, valued at $60-70 million and signed via a Hong Kong-based intermediary, Zhongqing Baoshang International Investment, with deliveries planned initially via Urumqi in western China and transit through Pakistan.⁵ China's Foreign Ministry called the report "completely groundless," and Pakistan's military public affairs office denied any involvement; the claim rests on anonymous sourcing and should be weighted accordingly.⁵ If the shipment proceeds, it would put at risk the US A-10 and Apache aircraft that have used low-altitude patrols to keep Hormuz partially open, and make those patrols too dangerous to continue at the current tempo.¹⁹ Investors with exposure to Gulf energy costs, insurance premia on cargo transiting either corridor, or digital infrastructure assets dependent on Gulf power pricing now face a dual-chokepoint scenario, with both principal export routes exposed at once.

A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on 26 and 27 July, Minnesota IT Services confirmed in a statement on 28 July that activated the state's cybersecurity incident response capabilities.⁶ Four municipalities disclosed impacts: in Braham, the water treatment plant was briefly taken offline and computerised controls disabled before public works crews restored manual operation; in Plymouth, cellular communications at two elevated water towers and several wastewater lift stations were disrupted; South St Paul and Maple Plain both reported affected automated controls, with Maple Plain declaring a local state of emergency. No ransom demand was identified, and the Minnesota Department of Health said it was not aware of any municipality asking residents to change their water use.⁶

The FBI confirmed on 30 July that it was actively engaged with victims, and the investigation continues alongside the Minnesota Bureau of Criminal Apprehension.⁷ Officials have suggested, preliminarily, that the pattern resembles incidents previously attributed to Iran-aligned actors; a state IT spokesperson told Reuters that the timing, access methods, and targeted infrastructure share characteristics with other coordinated incidents federal partners have observed, while stressing that no formal attribution has been made.⁷ The incident sits inside an active CISA advisory, AA26-097A, on Iranian-affiliated exploitation of programmable logic controllers across US critical infrastructure, updated on 22 July to expand its scope beyond Rockwell Automation devices to include Schneider Electric and Siemens equipment, and to document project file exfiltration for the first time.⁸

The read-through for digital infrastructure operators is direct. Schneider Electric and Siemens controllers are common in the operational technology layer of hyperscale and colocation facilities: cooling systems, power management, building automation. The same probing logic that targeted thirty small water operators with thin security budgets applies wherever OT has historically received less investment than the IT layer sitting above it.

Confrontation returned to two flashpoints in the South China Sea this week, an update to the thread Issue 018 carried rather than a new geography. At Second Thomas Shoal on 20 July, the Philippine military said a China Coast Guard vessel dispatched a smaller boat toward the grounded BRP Sierra Madre outpost, and video showed an exchange of blows with wooden batons and oars; two Philippine servicemen were injured and evacuated. Beijing accused Manila of attempting to ram a Chinese patrol boat.⁹

On 23 and 24 July, the China Coast Guard used water cannon against Philippine vessels near Scarborough Shoal on consecutive days. On the second occasion, a Chinese vessel came within roughly seven metres of the Philippine fisheries ship BRP Datu Paduhinog, which the Philippine Coast Guard said created a serious risk of collision; Philippine officials additionally reported that the vessel experienced a temporary disruption to its satellite connectivity during the encounter, with the cause unconfirmed.¹⁰ China's Coast Guard said it had imposed "control measures" against Philippine vessels it accused of illegally gathering near the shoal, describing its own actions as "standard, professional and lawful."⁹

The confrontations bracketed a five-day joint maritime exercise, the 17th Multilateral Maritime Cooperative Activity, that the Philippines concluded with the United States and Japan on 25 July, involving warships, coast guard vessels, and aircraft aimed at improving interoperability.¹¹ The week also marked the tenth anniversary of the 2016 arbitral ruling rejecting China's nine-dash line claim, which Beijing continues to reject; both governments said this week they remain committed to completing a regional Code of Conduct by year end.¹¹ The satellite disruption detail is the one genuinely new TMT-adjacent data point in this thread; it would warrant a firmer tile on its own merits if independent confirmation of deliberate interference emerges, but stands as a footnote until then.

WEC Energy Group, We Energies' parent, told shareholders on its second-quarter earnings call on Wednesday, 29 July, that Oracle's ongoing dispute with Wisconsin regulators over data centre collateral requirements poses no threat to the timeline for the Port Washington campus. An executive said that even if Oracle's credit rating falls further, "we already have all the collateral we need." Wisconsin Watch reported the comments the following day.¹²

The underlying dispute predates this week. Wisconsin's Public Service Commission voted in April to require data centre developers below an A-/A3 credit rating threshold to post collateral covering new power infrastructure built on their behalf. We Energies, Vantage Data Centers and Cloverleaf Infrastructure petitioned the Commission on 10 June to loosen that requirement; the Commission did not take the petition up at its meeting on 9 July, and it was denied by operation of law the following day, 10 July.¹⁸ Oracle's credit rating was separately cut to BBB- by S&P on 9 July, placing it below the exemption threshold, and Oracle had already filed suit on 19 June in Ozaukee County Circuit Court, arguing the requirement could cost more than $100 million annually and require up to $7 billion in collateral for the roughly one-gigawatt campus built to support its Stargate partnership with OpenAI. That litigation continues.¹⁸

We Energies' public confidence reflects the utility's own risk position. The credit-rating threshold remains in force, the litigation remains unresolved, and other developers without Oracle's balance sheet or a utility parent willing to vouch for them would face the requirement as written.

This remains a distinct and, for underwriting purposes, more consequential test than the cost-allocation tariffs Wisconsin and North Carolina introduced earlier in 2026 and that Commentarii has tracked since Issue 008. Those tariffs govern who pays for grid infrastructure; this dispute governs who can access grid connection at all without posting collateral tied to a credit rating most AI-infrastructure-heavy technology companies do not currently hold.

• 01
  For any AI-grade data centre customer below an A-/A3 credit rating: does the underwriting model reflect Wisconsin's collateral requirement as written, rather than the parent utility's public confidence that it holds sufficient collateral regardless? Is a similar posture plausible in other large-load states?

  We Energies shareholder comments – Wisconsin Watch, 30 July 2026; underlying PSC decision, 10 July 2026
• 02
  For assets with revenue dependent on Saudi crude logistics or Gulf energy pricing: has the model been updated to treat simultaneous risk across both the Hormuz and Yanbu corridors, given Yanbu can no longer be assumed a mitigant?

  Jizan/Yanbu strikes – Türkiye Today, 25 & 28 July 2026
• 03
  For fibre and backbone assets: what proportion of spare capacity could realistically be repurposed for distributed AI compute traffic on Verizon/Google-type terms, and over what timeline?

  Verizon / Google dark fiber deal – Verizon Q2 2026 earnings call, 24 July 2026

• 04
  For any digital infrastructure asset using Schneider Electric or Siemens programmable logic controllers in its OT layer: has an independent security assessment been conducted since the 22 July CISA advisory expansion, and how does it compare to the exposure profile the Minnesota attack revealed in a comparably under-resourced operator?

  CISA Advisory AA26-097A update – Tenable, 22 & 28 July 2026
• 05
  For Gulf-region digital infrastructure assets: has physical and cyber security posture been reassessed since the direct strikes on Aramco infrastructure, and does the operator's business continuity plan assume a single-corridor or dual-corridor disruption scenario?

  Jizan/Yanbu strikes – Türkiye Today, 25 July 2026
• 06
  For quantum or advanced-compute hardware positions: what is the current foreign-fab dependency in the supply chain, and does the IonQ/SkyWater model of vertical acquisition represent a realistic option for this asset, or only for the largest platforms?

  IonQ / SkyWater Technology – IonQ press release, 28 July 2026

• 07
  Does the ownership chain include any entity within scope of the BIS 50% Rule effective 10 November 2026? Has external export compliance counsel been engaged given just over three months remain?

  BIS 50% Rule – carried from prior issues
• 08
  For assets in South China Sea-adjacent jurisdictions with satellite-dependent operations: is there a documented incident-response protocol for connectivity disruption of unconfirmed origin, and how quickly could deliberate interference be distinguished from routine outage?

  Scarborough Shoal encounter – Al Jazeera, CNN, 24 July 2026

• 09
  For financing structures reliant on OpenAI or Nvidia guarantee mechanisms similar to the reported Ohio arrangement: what happens to the underwriting thesis if the guarantee terms shift or the deal does not close, given sourcing describes negotiations as early-stage?

  Nvidia / OpenAI Ohio financing – Bloomberg via Quartz, 27 July 2026

• Reassess Gulf energy and corridor risk assumptions across the portfolio. With Yanbu now under direct attack alongside Hormuz, models built before the Yanbu strikes would benefit from revision to reflect co-exposed risk across both corridors, ahead of the next valuation event.
• Commission an OT security review for any digital infrastructure asset using Schneider Electric or Siemens controllers. The Minnesota incident demonstrates the exposure profile of under-resourced operators; portfolio companies with comparable OT vintage may share it.
• Map counterparty credit ratings against Wisconsin's A-/A3 collateral threshold for any pipeline data centre financing. Treat this as a precedent other state regulators are likely to cite in their own large-load tariff proceedings.

• Consider whether vertical acquisition of supply-chain-critical suppliers, on the IonQ/SkyWater model, is relevant to platform strategy in compute-adjacent hardware categories. May not be replicable at smaller scale, but worth assessing where foreign-fab dependency is a recognised risk.
• Commission BIS 50% Rule compliance mapping before Q3 2026 if not already complete. Just over three months remain to the 10 November enforcement date.

• Continue favouring captive-generation and fixed-price power assets over grid-dependent, credit-exposed alternatives. Both the Gulf energy shock and Wisconsin's collateral hardening point the same direction; the durability premium for insulated assets appears likely to widen further.