Overview

  • City: Washington, D.C. Metropolitan Area (including linked corridors in Baltimore, MD, and Northern Virginia)
  • Population: ~693,000 (city); ~6.46 million (metro area)
  • Assessment Period: April 25, 2026 – May 25, 2026
  • Locations of Interest: Washington Union Station, Ronald Reagan Washington National Airport (DCA), Washington Dulles International Airport (IAD), Seagirt Marine Terminal, Baltimore Washington Thurgood Marshall International Airport (BWI), Alexandria Union Station, CSX Cumberland Yard.

Make faster, data-driven decisions to protect people and infrastructure with Dataminr and Esri | Learn More

Executive Summary

During the assessment period, the regional security posture was significantly challenged by concurrent infrastructure, criminal, and environmental stressors. Interconnected transit networks experienced severe operational friction due to systematic weather disruptions, rail maintenance delays, and targeted law enforcement investigations. Public safety data reveals a distinct divergence between high-frequency property thefts concentrated around logistics zones and low-frequency, high-impact violent incidents intersecting critical passenger transport hubs.

Operational risks center on prolonged utility vulnerabilities in regional rail corridors and cascading supply-chain backlogs stemming from mass aviation constraints. Grid stability issues, characterized by repeated large-scale power outages in Northern Virginia and lingering hazardous materials alerts in commercial sectors, require heightened readiness.

Transportation & Infrastructure Analysis (Last 30 days)

Traffic & Highways

  • Tunnel and Highway Closures: Vehicle accidents repeatedly restricted throughput along key shipping channels, including a multi-passenger bus crash inside the Fort McHenry Tunnel on May 21 that hospitalized 21 people and blocked the right tube of Interstate 95 northbound.
  • Construction Bottlenecks: Systematic roadway adjustments created persistent friction points, particularly around the intersection of University Drive and 1st Street in Alexandria, which experienced continuous construction closures throughout May.
  • Law Enforcement Transit Delays: Security incidents and active police investigations triggered sudden, severe disruptions to municipal bus routes, notably forcing multi-line delays for routes A11, A25, A27, A66, A90, F28, F29, and F44 at the Pentagon and Pentagon City stations following tactical deployments on May 4 and May 11.

Rail & Transit

  • Service Suspensions: Police activity north of Washington Union Station on May 19 prompted a total suspension of the MARC Penn Line service, disrupting regional commuter flows until tracks were cleared later that morning.
  • Mechanical Failures: Equipment malfunctions regularly degraded transit efficiency, including the cancellation of Penn Line Train 642 at Union Station on May 5 and multi-hour delays to Trains 408 and 418 across the BWI network.
  • Infrastructure Delays: Planned bridge work near the Alexandria Union Station caused the Virginia Railroad Commission to extend critical rail bridge construction and associated road closures through late May, modifying freight and passenger rail windows.

Aviation

  • Holding Patterns and Ground Stops: Severe weather systems and low ceilings triggered extensive ground stops at Ronald Reagan Washington National Airport (DCA) on May 25, with arrival delays averaging 46 minutes, alongside widespread holding patterns for regional carriers.
  • International Diversions: Severe weather on May 13 and May 20 forced multiple international and domestic flights bound for New York (JFK, LGA) and Newark (EWR) to divert to Washington Dulles International Airport (IAD) and Baltimore Washington International Airport (BWI).
  • Unruly Passenger Incidents: In-flight security disruptions caused major operational diversions to Dulles International Airport, notably a mid-flight passenger assault on a United Airlines flight on May 21, requiring emergency landings and law enforcement intervention.

Maritime

  • Terminal Perimeter Safety: Roadway accidents and localized fires directly impacted coastal logistics assets, notably a vehicle fire that disrupted access routes near the intersection of East Street NE on May 24.
  • Marina Infrastructure Fires: High-impact fires threatened localized dock facilities, including a major boat fire at the James Creek Marina on the 200 block of V Street SW on April 30, which required emergency containment.
  • Access Road Restrictions: Perimeter security was repeatedly compromised by traffic incidents on maritime access roads, including stalled service trucks on runway roads and freight routes feeding regional ports.

Utilities 

  • Critical Commercial Gas Leaks: Multiple urban intersections experienced hazardous commercial gas line ruptures, posing direct threats to structural safety. Major leaks occurred on May 10 and May 21 near Washington Union Station.
  • Repetitive Alexandria Grid Failures: The Northern Virginia transit corridor suffered four separate power outages between May 14 and May 24. These recurring failures impacted thousands of customers, local corporate assets, and Alexandria Station operations.
  • CSX Cumberland Yard Blackout: On May 23, a total grid failure struck the CSX Cumberland Yard. The outage disconnected power to more than 700 vital industrial and commercial links before emergency restoration work could be completed.

Transportation & Infrastructure Analysis (Last 6 months)

Compounding Traffic Delays Across Commuter Corridors: General traffic congestion and travel delays reflected the compounding impacts of accidents and active roadworks. This congestion was primarily driven by bottlenecking on major arterial routes, specifically Interstate 95, Interstate 395, and key peripheral airport access roads. As construction schedules stabilized and accident rates declined towards the end of spring, traffic delay notifications dropped by 15.44% from April to May 2026. 

Volatilities and Recovery in Urban Commuter Rail Systems: Public transit systems experienced operational variations over the spring, due to mechanical malfunctions, track hazards, and scheduled maintenance. However, conditions rebounded from April to May 2026, with system disruptions dropping by 29.03%. This operational improvement was directly caused by the completion of track maintenance and a reduction in mechanical signaling malfunctions near central transit hubs and routes serving Ronald Reagan Washington National Airport.

Escalation in Transit-Sector Assaults: Public transportation security environments faced a compounding risk profile, characterized by a sharp 128.6% spike in transit-specific physical assaults from March to April. This surge underscores a deteriorating safety landscape for commuters and transit personnel at key multi-modal hubs and rail corridors.

Key Infrastructure

Seagirt Marine Terminal

  • Activity: Extremely high for property theft and local traffic anomalies.
  • Summary: The perimeter of this logistics hub experienced a continuous wave of low-level criminal activity alongside acute roadway hazards throughout the month of May. Incidents were heavily concentrated on commercial retail blocks, involving frequent shoplifting, vehicle thefts, and physical altercations. Structural hazards were also present, highlighted by downed power lines and vehicle crashes directly impacting adjacent highway networks.
  • Operational Impact: Commercial and logistics perimeters experienced increased property theft volumes mid-month, while vehicular crashes on regional access roads caused multi-hour traffic delays feeding into the Fort McHenry Tunnel and Interstate 95 corridors. Hazardous materials responses were deployed following carbon monoxide detections and utility leaks on South Clinton Street, requiring temporary facility evacuations.

Washington Union Station

  • Activity: High for violence, mass transit delays, and civil infrastructure blocks.
  • Summary: Washington Union Station served as a primary nexus for high-impact security disruptions, transitioning from violence to severe transit delays. The station neighborhood was compromised by a fatal stabbing on First Street NE on May 2, which resulted in multiple days of heavy law enforcement presence and subsequent criminal arrests. Furthermore, the station area saw large-scale public safety events that routinely closed surrounding roadways.
  • Operational Impact: Commuter rail operations suffered severe delays and scheduling adjustments due to a total suspension of the MARC Penn Line following police investigations on May 19. Station security perimeters were locked down on May 20 when a suspicious package near the Russell Senate Office Building drew hazardous devices units, closing adjacent streets. Pedestrian logistics and facility entry paths were severely restricted during multi-day gatherings blocking First Street NE and Maryland Avenue. Emergency response resources were strained by multiple brush fires ignited along neighboring rail rights-of-way on K Street and New Jersey Avenue between May 4 and May 13.

Ronald Reagan Washington National Airport (DCA)

  • Activity: High on severe weather delays, transit station closures, and perimeter security responses.
  • Summary: DCA faced systemic operational restrictions driven primarily by weather-related ground management programs and scheduled station enhancements. The facility was subjected to multiple ground stops and extensive holding patterns, particularly during storm fronts on May 13 and May 25. Additionally, the airport transit network was modified by long-term construction projects that shut down regional rail stations feeding the main terminals.
  • Operational Impact: Airfield logistics and gate allocations experienced severe backlogs, with incoming flights subject to mandatory ground delay programs averaging nearly 50 minutes per aircraft. Ground transportation flows were altered significantly on May 16 due to the planned closure of the National Airport, Crystal City, and Potomac Yard rail stations for entrance construction. Roadway ingress was consistently throttled by ongoing construction along the George Washington Memorial Parkway and Interstate 395 interchanges.

Washington Dulles International Airport (IAD)

  • Activity: Moderate to high focused on international flight diversions, border enforcement, and public health mandates.
  • Summary: Dulles International Airport operated as the primary regional relief valve for flight diversions while simultaneously executing strict federal border and health enforcement mandates. The airport absorbed significant traffic overloads from storms fouling other East Coast hubs on May 13 and May 20. Concurrently, the terminal hosted specialized federal interventions and emergency landing management for unruly international passengers.
  • Operational Impact: Terminal health screening operations were heavily modified following a May 21 federal mandate forcing all US-bound residents traveling from Ebola-outbreak zones in Central Africa to route exclusively through IAD. Air traffic control workloads escalated rapidly during peak storm windows to safely integrate multiple unexpected domestic and international diversions. 

Alexandria Union Station

  • Activity: Moderate dominated by widespread utility infrastructure failures and localized safety risks.
  • Summary: The Alexandria transit corridor experienced substantial infrastructure instability, characterized by recurring electrical grid failures that degraded local commercial operations. Widespread power outages repeatedly left hundreds of customers without power, peaking on May 24 with over 1,000 affected accounts. The perimeter was further compromised by localized security events involving armed individuals on neighboring streets.
  • Operational Impact: Rail facility backup systems faced extended run-times due to persistent, multi-day power outages that destabilized local grid distribution. Logistical flows between rail connections and municipal roads were choked by emergency utility response repair crews managing downed infrastructure. Commuter parking and pedestrian access areas faced temporary restrictions during municipal responses to localized disturbances on Delaney Court.

Baltimore Washington International Thurgood Marshall Airport (BWI)

  • Activity: Moderate, serving as a secondary diversion hub with heavy roadway incident concentrations.
  • Summary: BWI operated primarily as a regional diversion center for aircraft unable to land at DCA or New York hubs due to severe weather. The airport’s ground infrastructure was heavily impacted by traffic accidents on adjacent peripheral loops, such as Elkridge Landing Road and Dorsey Road. These incidents frequently required response vehicles to manage roadway access blocks.
  • Operational Impact: Cargo and passenger ground transit experienced severe delays due to repeated vehicle rollovers and crashes directly blocking Aviation Boulevard and terminal off-ramps. Airfield maintenance schedules were disrupted by emergency NOTAM declarations closing Runway 15R/33L for repair blocks throughout mid-May. Rail-to-terminal shuttle services faced intermittent delays triggered by unruly passengers causing disruptions at the integrated BWI rail station.

CSX Cumberland Yard

  • Activity: Low and isolated to localized power grid disruptions.
  • Summary: This industrial freight logistics yard maintained standard operational flow with minimal security anomalies, save for targeted disruptions to its supporting utility grid. The facility was affected by regional outages that deactivated local power distribution networks.
  • Operational Impact: Industrial operations were forced to migrate to auxiliary power systems on May 23 during a grid failure that knocked out power to over 700 regional customers. Freight processing times suffered minor logistical friction until crews formally cleared the primary infrastructure failure lines.

Cyber-Physical Spotlight

US Department of Energy and National Transportation Network Breaches: Multiple advanced threat groups executed high-impact cyber operations successfully penetrating the data repositories of federal energy laboratories and primary passenger transit infrastructure. 

In a significant breach of federal research networks, an unauthorized threat actor infiltrated a U.S. Department of Energy database, claiming to have exfiltrated classified and highly confidential internal reports generated by its national laboratories. 

Simultaneously, commercial passenger rail network security was heavily compromised when a ShinyHunters-branded ransomware group targeted Amtrak’s network architecture, resulting in a severe data exfiltration incident that exposed over 9.4 million Salesforce records filled with customer personally identifiable information (PII) and proprietary internal corporate data. Further compounding the impact on national transportation metrics, an independent threat actor claimed a successful system breach of the Bureau of Transportation Statistics database, exfiltrating a massive dataset containing 20 million rows of sensitive, consumer-focused PII.

Events Calendar

Rail Bridge Structural Work Completion (Late-May 2026): The Alexandria Union Station Corridor will face continued roadway delays and detour adjustments as the Virginia Railroad Commission executes final line integration.

Long-Term Airfield Infrastructure Upgrades (Mid-July 2026): Washington Dulles International Airport will maintain planned taxiway closures (Y9, Z7, Y11) through July 26, restricting non-essential aircraft taxi movements.

Long-Term Bicentennial Infrastructure Restrictions (Mid-July 2026): The National Mall and Memorial Parks will maintain planned security perimeter closures (Constitution Ave, 15th St, Independence Ave) through July 26, restricting non-permitted pedestrian and vehicular movements.

Priority Risk Indicators

  • Judicial Perimeter and Core Intersection Blockades: Sudden traffic restrictions within a one-block perimeter, requiring proactive access control barriers and VIP escort routing along First Street and Maryland Avenue.
  • Rail Grid Failures and Power Anomalies: Recurring electrical substation overloads or transformer failures along rail lines, requiring immediate transition to auxiliary backup generator systems and emergency power routing sweeps surrounding the Alexandria corridor.
  • Terminal Perimeter Cargo and Asset Protection: Spikes in organized cargo thefts and vehicle break-ins, require immediate gate reinforcement, overnight patrol increases, and strict vehicle checkpoints around Seagirt Marine Terminal.

About the Risk Report

Dataminr is the global leader in AI-powered real-time intelligence, delivering the earliest actionable indicators of breaking events, emerging threats, and unexpected risks by leveraging 50+ specialized large language models (LLMs) and over 12 years of trusted historical data to instantly synthesize information from 1M+ publicly available data sources in 150+ languages across text, image, audio, video, and sensor data.

This report is a curated, retrospective analysis produced by Dataminr analysts using data surfaced by the platform. It’s intended to illustrate the types of hyperlocal events and risks Dataminr detects across a defined geography and time period. It is not a representation of the real-time intelligence experience Dataminr’s product provides.

A graphic with a globe and pinpoints in different countries to demonstrate Dataminr's AI-Powered global event and threat & risk intelligence capabilities.

Turn Public Data into Action

Gain critical context and increase decision-making speed with AI-Powered Real-Time, Event, Threat & Risk Intelligence.

REQUEST A DEMO

Author
Dan Pearce, VP Public Sector
June 17, 2026
  • Public Sector
  • Risk Report