From activism to event disruption

The portfolio uses calibrated probability language so terms such as ‘likely’ have a consistent analytical meaning. The ranges are indicative guides for judgement, not mathematical forecasts.

Probability language describes how likely an outcome is. Confidence measures the quality and reliability of the evidence supporting the assessment.

This section is the factual base for the intelligence products. Assessments draw on this information and the BLUF.

Event

Crestwell Leadership Forum, a fictional two-day UK industry conference

Event dates

16–17 September 2026

Monitored scenario period

8–17 September 2026

Scale

2,400 attendees, livestreamed keynotes and 18 senior corporate speakers

Exposure

Public speaker list, session times, sponsor information and high-visibility presentations

Primary concern

Issue-motivated disruption of selected presentations; executive exposure and event continuity

Actors and stated focus

• ✦People Against Tech and AI (PATAi) is a fictional activist network criticising a cloud-services sponsor over alleged links to Israeli government and defence activity. Its public messaging focuses on Gaza and calls for visible disruption of a keynote.
• ✦Animals Have Rights (AHR) is a separate fictional animal-rights network focusing on a facilities company over an alleged supplier relationship with a regulated research-animal business. Its messaging focuses on corporate supply chains and public accountability.
• ✦There is no evidence in the synthetic dataset that PATAi and AHR are coordinating. They converge on the same event because different speakers and sponsors offer high-visibility targets.
• ✦Previous demonstrations associated with the two fictional networks in the scenario have been largely peaceful and disruptive rather than violent.

Advocacy and peaceful protest do not automatically constitute a threat.

Synthetic reporting relevant to the assessment

356 public-source items and 104 observed accounts form the synthetic dataset. Indicator categories overlap and should not be added together. No credible direct threat, weapon reference, violent tactic, stalking pattern or plan to injure a person was identified.

Real-world context relevant to the industry assessment

These references provide trend context only, not evidence about the fictional networks or conference. The 19 September fashion example occurred after the 16–17 September scenario event.

• [1] Reuters, 5 April 2025 · A senior Microsoft presentation was interrupted by a protester raising concerns about the company's relationship with Israel and the use of its technology. Microsoft disputed claims that its technology had been used to harm people in Gaza.
• [2] Associated Press, 22 May 2025 · An employee interrupted a senior Microsoft presentation in May 2025 while raising concerns about the company's technology and its relationship with Israel. The allegations are attributed to the protesters.
• [3] PA / The Independent, 7 May 2026 · Barclays' May 2026 AGM was repeatedly disrupted by Palestine and climate activists challenging the bank over its relationships and financing.
• [4] UK Parliament, Hansard, 28 April 2025 · A parliamentary debate described a demonstration of several hundred people outside the MBR Acres beagle-breeding facility.
• [5] UK Parliament, 17 July 2025 · Parliamentary material describes MBR Acres as part of UK preclinical research infrastructure.
• [6] Reuters, 19 September 2026 · A PETA runway protest became a larger corporate issue after the CFDA chief physically intervened; he later apologised and resigned. This later real-world context is not pre-event scenario reporting.
• [7] NPSA, Guidance · Event-specific threat, vulnerability and risk assessment guidance for major events.
• [8] ProtectUK, Guidance · Demonstrations may intimidate but do not necessarily lead to a physical threat.

The same factual base is translated differently because each decision-maker needs a different level of detail and action horizon.

EVENT DETAIL → BLUF → ASSESSMENT → MLCOA / MDCOA → ADVISORY / DECISION

The case separates factual reporting, analytical judgement and real-world context so each judgement can be traced to information already presented.

Synthetic public activity

356 posts, comments and public event references across the ten-day scenario.

Accounts

104 observed accounts, grouped by fictional campaign affiliation, general amplification and press/attendee activity.

Targeting

29 company/commercial references; 18 speaker/session/time/location references; 11 calls to interrupt presentations.

Prior behaviour

Three accounts linked in the synthetic dataset to previous non-violent event disruption.

Threat indicators

No credible direct threat, weapon reference, violent TTP, stalking pattern or explicit plan to injure a person.

Event reporting

Synthetic incident log covering interruptions, removals, schedule impact, movement changes and communications response.

Real-world context

Documented corporate-event disruptions and official UK event-security guidance used only to support industry context, not to prove the synthetic event case.

Source discipline

• ✦Observation: what the synthetic reporting says happened.
• ✦Assessment: what the analyst judges is likely, using calibrated probability language.
• ✦Context: real-world cases showing that similar event-disruption patterns have occurred in multiple sectors.
• ✦Advisory: proportionate action tied to the assessed likelihood and consequence.

The same public post can matter operationally without being a threat. A call to protest outside a venue may affect event planning, but it does not establish violent intent.

Across the ten-day synthetic scenario, activity moved from broad criticism of organisations and commercial relationships toward event-specific mobilisation.

What the pattern shows

• ✦Early activity was mainly criticism of companies and their alleged relationships.
• ✦Mid-period activity shifted toward the conference, attendance and specific sessions.
• ✦The strongest concern emerged when named speakers and presentation times circulated alongside calls for interruption.
• ✦No corresponding shift toward weapons, stalking, violent language or plans to injure individuals was identified.
• ✦The pattern therefore supported a high likelihood of disruption while keeping the physical-harm judgement lower.

What would materially change the assessment?

A credible direct threat, repeated unwanted approaches to a named executive, surveillance of private movements, forced access, weapons, sabotage, or explicit intent to injure a person will almost certainly increase the personal-safety assessment. These are escalation indicators, not claims about the activists in this synthetic case.

1. 8 Sep

   Speaker list published

   General criticism begins around two sponsors.

2. 10 Sep

   Campaign accounts share event details

   Attendance and protest discussion becomes more specific.

3. 12 Sep

   First calls to interrupt a keynote

   Event-continuity risk moves from possible to likely.

4. 14 Sep

   Named speakers and session times circulate

   Executive and session exposure increases.

5. 15 Sep

   Accounts linked to previous non-violent disruptions engage with event posts

   Confidence in attempted live interruption increases.

6. 16 Sep

   Multiple posts encourage visible action inside or immediately around the event

   Security and communications planning is increased around selected sessions.

7. 17 Sep 09:40 · event day

   First verbal interruption

   Security separates the protester without executive involvement.

8. 17 Sep 11:15 · event day

   Banner and chant interrupt keynote

   Session pauses for eight minutes and resumes.

9. 17 Sep 13:05 · event day

   Small foyer sit-in

   One breakout session is moved; the main programme continues.

10. 17 Sep 16:30 · event day

    Event closes

    No injury, no forced access to private executive areas and no evidence of violent escalation.

Three explanations were tested rather than assuming the most alarming interpretation was correct.

Confidence statement

• High confidence: Selected sessions are highly likely to face deliberate disruption in the immediate term.
• Moderate confidence: The disruption will remain non-violent.
• Moderate confidence: The main objective is reputational pressure and online amplification.
• Low confidence: Any claim that the campaigns intend physical harm to a speaker.

What would change the analytical judgement

• ✦Credible direct threats or violent language tied to a named person.
• ✦Persistent attempts to follow or approach an executive outside the public-event context.
• ✦Evidence of weapons, sabotage or planned forced entry.
• ✦A shift from symbolic interruption toward explicit instructions to injure people.
• ✦New evidence linking PATAi and AHR to a coordinated plan.

• ✦Three actions were short verbal or banner interruptions.
• ✦One became a small foyer sit-in.
• ✦The targeted keynote paused for eight minutes and resumed.
• ✦One breakout session was moved.
• ✦Seven senior speakers used adjusted movement arrangements.
• ✦No executive personally confronted a protester.
• ✦No evidence emerged of an attempt to enter private executive rooms or intentionally injure anyone.

The outcome broadly matched the MLCOA: visible but non-violent disruption, amplified online, with short operational impact and no evidence of deliberate physical harm. This supports separating disruption likelihood from physical-harm likelihood before the event.

1. 01

   Define

   What does the organisation actually need to know?

3. 02

   Collect

   Gather relevant public-source, event and business information.

5. 03

   Connect

   Identify changes, relationships, patterns and gaps.

7. 04

   Test

   Consider alternative explanations rather than immediately accepting the most alarming one.

9. 05

   Assess

   Separate likelihood, consequence, uncertainty and escalation indicators.

11. 06

    Brief

    Explain what happened, why it matters and what should happen next.

Excel / Python / data visualisation / structured evidence registers / OSINT workflow concepts / event intelligence / risk scoring / Analysis of Competing Hypotheses / probability language / MLCOA / MDCOA / executive briefing / Power BI-ready data structures

Real-world references provide context for the industry assessment only. They are not evidence about the fictional Crestwell Leadership Forum, PATAi or AHR.

1. [1] Reuters, 5 April 2025: Microsoft AI CEO's remarks interrupted by pro-Palestinian protester
2. [2] Associated Press, 22 May 2025: Microsoft fires employee who interrupted CEO's speech to protest AI tech for Israeli military
3. [3] PA / The Independent, 7 May 2026: Barclays shareholder meeting targeted by Palestine and climate activists
4. [4] UK Parliament, Hansard, 28 April 2025: Westminster Hall debate on dogs and other animals in scientific and regulatory procedures
5. [5] UK Parliament, 17 July 2025: Written answer on MBR Acres and UK preclinical research infrastructure
6. [6] Reuters, 19 September 2026: US fashion council CEO Kolb resigns after clash with runway show protesters
7. [7] NPSA, Guidance: Protection at Major Events
8. [8] ProtectUK, Guidance: Personal security: demonstrations