The Doctrine Statement Inside the FBI's World Cup Comments
When FBI deputy director Christopher Raia told ESPN that homegrown extremists striking soft targets were his primary concern about the 2026 FIFA World Cup, the headline read as a World Cup-specific warning. Read as a doctrine statement, it is something larger: the federal protective posture at every mega-event from this point forward assumes that the hardened venue is not the target. The surrounding city is.
That is not new. It is the operational reality protective professionals have been planning around since the 2017 Manchester Arena bombing, the 2017 Las Vegas shooting, the 2024 Trump-rally shooting in Butler, and the 2025 Bourbon Street attack. What is new is that the public-safety apparatus is saying it out loud, and that the World Cup makes the geometry of the problem unusually visible. The same geometry applies to the LA28 Olympics, every Super Bowl, the World Economic Forum at Davos, the G20, presidential inaugurations, and the major political conventions.
This article is about what changes — operationally, for executive travelers and family offices — when the protective center of gravity shifts from the venue to the rings around it.
Why The Center of Gravity Moved Outside the Venue
Three structural shifts pushed the threat outward, and they apply at every mega-event:
- Hardened-venue defenses got materially better. Magnetometers, K9 sweeps, drone-detection systems, secure perimeters, and federal coordination at venue ingress are now mature. Adversaries adapt to where defenses are weakest.
- Soft-target ecosystems got materially bigger. Mega-events spawn massive informal infrastructure — fan zones, watch parties, after-parties, sponsor activations, charter terminals at secondary airports, boutique hotels in suburban districts. Each is a venue without a hardened venue's resources.
- Adversary tooling got more distributed. Commercial drones, ride-share access to chokepoints, OSINT-driven targeting of named attendees, and small-cell coordination via encrypted messaging mean that the threat actor no longer needs to breach a stadium to generate a mass-casualty event or a high-profile targeted attack.
The FBI's World Cup language reflects these shifts. The same language has been used, almost verbatim, about the Olympics, the Super Bowl, Davos, and the G20 by their respective protective leads.
What "Soft Target" Actually Means for an Executive Traveler
In planning terms, a soft target at a mega-event is any location where:
- The principal is identifiable as an attendee of the larger event (apparel, lanyard, sponsor-branded transport, social-media context),
- The location has no integrated protective umbrella beyond ordinary commercial security, and
- Movement through the location is predictable in time and space.
That definition captures hotel lobbies, restaurant patios near venues, sponsor-hospitality offsites, the walk from the VIP entrance to the limo lot, the heliport, the charter FBO during peak ingress, the fan-festival edge where private cars stage. Every one of these we plan around at the World Cup. Every one of these we plan around at Davos, the Super Bowl, the Masters, and the Ryder Cup.
The Five Shifts That Soft-Target Doctrine Forces
When the threat center of gravity is outside the venue, five things change for the protective program — and they change identically at every mega-event.
1. The hotel becomes the primary planning surface
At a normal corporate trip, the hotel is a refuge. At a mega-event, the hotel is a soft target with a public address. Treat it as such. Pre-arrange lobby bypass through the property's security director. Require a named on-property contact for the floor. Confirm elevator-bank discipline so the principal does not share a car with unvetted guests. Hold a separate egress route for emergencies through back-of-house. This is the same doctrine we apply at every World Cup hotel, at every Davos property, at every Super Bowl host hotel, and at every Ryder Cup village. Our World Cup hotel doctrine is the most detailed public version of it.
2. The car becomes a protective asset, not transportation
When the principal is on foot in a soft-target ring, the car is the recovery option. That means it stages closer, departs faster, and is driven by a vetted protective driver — not a third-party rideshare and not a hotel limo desk. Our standing rule, applied at every mega-event: the car never leaves the principal's recovery radius during a soft-target window. That window is wider than most travelers expect — pre-event meal, post-event dinner, late-night transfers — and is where most protective failures occur.
3. The day's footprint compresses
Each additional restaurant, bar, or sponsor stop adds a soft-target exposure. The most consistent correction we make to incoming itineraries, regardless of event, is to compress them. Co-locate the meal and the brief. Replace the celebrity restaurant offsite with a vetted hotel restaurant. Hold the after-event reception at the hotel suite, not the trendy bar two miles away. The total experience does not degrade; the protective surface shrinks.
4. Intelligence becomes a daily product, not a pre-trip briefing
A mega-event soft-target environment changes shape every twelve hours — a fan-zone fight overnight, a credible drone sighting that morning, a planned protest in the afternoon, a road closure for a motorcade we did not know about. Our protective intelligence cell pushes a written daily read for every mega-event principal: what changed in the last 24 hours, what we are watching in the next 24, what triggers a movement change. This is the rhythm at the World Cup. It is the same rhythm at Davos, at the Super Bowl, and at every Olympic Games we have covered.
5. The principal's digital surface becomes part of the protective surface
Adversaries targeting soft-target environments at mega-events lean heavily on OSINT. Geotagged posts from the suite, sponsor-tagged photos at the lounge, the EA's LinkedIn flagging that the principal is "traveling to Dallas for the match" — each is an input to a hostile targeting cycle. Family-office and corporate security programs that ignore this surface are protecting half the principal. The same digital discipline carries identically across events; the World Cup digital hygiene playbook is the most current version we have published.
Where Family Offices Get This Wrong
Three patterns recur across incoming family-office clients in the months before a mega-event.
Pattern one: assuming the venue's hardened posture extends outside it. It does not. Federal-state-local coordination is built for public safety at scale, not for protecting a named principal at a named hotel on a named night. That gap is exactly what private protection fills, and it is unchanged from event to event.
Pattern two: outsourcing transport to whoever the hotel concierge recommends. A non-vetted driver in the principal's recovery radius during a soft-target window is the highest-leverage protective failure we see. The fix — vetted, named, protective-trained drivers booked early — is the same at every event we cover. Our perspective on this for the World Cup is laid out in match-day movement and secure transportation.
Pattern three: treating mega-events as one-off engagements. Family offices that build a doctrine and run it across the World Cup, the Ryder Cup, Davos, and the next presidential cycle face less protective risk than ad-hoc programs. The doctrine is laid out in our Family Office Security Strategy pillar.
The Underlying Principle
The phrase that comes up in our team's after-action reviews is simple: the hardest target in the hardened ring is the easiest target two blocks outside it. Soft-target doctrine is the discipline of recognizing that, of compressing the footprint, of resourcing the rings outside, and of treating every mega-event as one instance of the same recurring class.
The World Cup is the loudest version of this problem we will see this year. The Olympics, the Super Bowl, Davos, the G20, and the next presidential cycle will rerun it on different calendars. The protective doctrine does not change. The discipline of applying it is what separates programs that absorb the lesson from programs that re-learn it after the next incident.
If you are building or auditing a protective program against this class of event — for the rest of the World Cup, for Davos 2027, for LA28, or for a recurring family-office travel calendar — contact us. Scott takes every first call personally. Our event security service and protective intelligence work is built around exactly this doctrine.
---
General security planning commentary based on public reporting and AMERINE protective experience. Not legal, law-enforcement, or operational advice for any specific event. Travelers should verify all current security guidance through official sources for each event.
