A legal marijuana grow in Colorado. Photo Brett Levin/Flickr.

A bulletin from the El Paso Intelligence Center (EPIC) released to law enforcement in February 2017 describes how Mexican transnational criminal organizations (TCOs) are continuing to exploit legalized markets in the U.S. for the sale and distribution of marijuana.  In January 2016, EPIC produced a bulletin detailing how “data provided by the Drug Enforcement Administration (DEA) and open source reporting” indicated at the time that Mexican TCOs had not been adversely affected by marijuana legalization in numerous markets, noting instead “that the effort of legalization had conversely brought new opportunities for illicit profits from marijuana sales.”  The updated February 2017 bulletin, which was obtained by Public Intelligence, indicates that Mexican TCOs continue to exploit the legalization of Marijuana in these areas, operating in three distinct “co-equal marijuana markets in U.S. legalized states: a legal market; an illegal market, and a black market.”

Based on “analytical exchanges” between DEA and Northwest High Intensity Drug Trafficking Area (HIDTA) analysts, the bulletin states that TCOs are selling illegally grown marijuana in legal markets, including to “proscribed customers, such as children.”  In black markets, TCOs are selling illegally grown marijuana at lower prices in an attempt to undercut the profit margins on legally cultivated marijuana.  In all three markets, the TCOs are “evading state tax laws” and often utilizing public lands to grow the marijuana before transporting it back to non-legalized state markets.  The bulletin provides some specific examples of diversion from legalized markets:

• (U//DSEN) In November 2015, DEA reporting indicated that representatives of an unknown TCO were cultivating marijuana at indoor-grow houses in Colorado, and transferring marijuana to Florida, a state with strict medical marijuana requirements that ban recreational use.
• (U//DSEN) According federal and state law enforcement reporting, since the legalization of marijuana in Washington State in 2012, Washington State marijuana has been illegally diverted to forty-three states throughout the United States.
• (U) According to open sources, throughout 2016 federal agents and state law enforcement officers in Colorado have attempted to curtail illegally grown cannabis, and officials indicate that marijuana is being grown in the state for transfer and sale across the nation.
• (U//LES) Analysis of CY2015 seizure incidents on U.S. Interstate highways indicates Colorado State marijuana has been illegally diverted to states where marijuana is illegal .
• (U) In January 2017, according to press reporting, federal agents and authorities in El Paso County served several warrants and arrested several individuals in connection with an “out-of-state organization” for illegally growing marijuana outside Colorado Springs, Colorado, and illegally transporting and selling it in Texas, where sales are illegal.

The bulletin concludes by assessing that based on the “developing nature of marijuana legalization” Mexican TCOs will likely “continue to profit from marijuana sales in both legalized and still-illegal state markets.”  As legalization leads to more decriminalized markets, EPIC assesses that “rising marijuana demand will continue to encourage TCOs to meet that demand.”

A graphic from the 2017 National Counterterrorism Center handbook on indicators of mobilization to violence among homegrown violent extremists depicts a man watching a video of Anwar al-Awlaki.

The National Counterterrorism Center (NCTC) has released a 2017 version of their handbook for spotting indicators of mobilization to violence among homegrown violent extremists (HVEs).  The guide was originally intended for distribution among public safety personnel and is not intended for public release, but has since appeared on several publicly accessible law enforcement mailing lists and conference websites.  In 2014, the NCTC’s Office of National Intelligence Management formed an Interagency Analytic Focus Group with members from the Department of Homeland Security, Department of Energy, FBI, NSA, as well as representatives of state and local law enforcement.  The focus group “collaboratively developed the list of behavioral indicators and ranked them into three tiers of diagnosticity,” eventually developing a list to distribute to law enforcement personnel.  The 2017 handbook released by NCTC is a version of that list updated with new indicators observed since the handbook was last published.

Intended to provide “a roadmap of observable behaviors that could inform whether individuals or groups are preparing to engage in violent extremist activities,” the handbook is a slick 36-page publication with colorful graphics depicting dozens of behavioral indicators that an HVE is mobilizing to violence.  These behaviors are divided into three groups based on their overall diagnostic capacity.  Group A includes indicators that are “very diagnostic on their own” and thus require little else to indicate mobilization to violence.  These indicators include “preparing or disseminating a last will or martyrdom video/statement” as well as “planning or attempting to travel to a conflict zone to fight with or support an FTO.”  Group B includes indicators that are “moderately diagnostic, more so when observed with other indicators.”  These include more common activities that may not directly indicate an imminent threat of violence, such as “posting terrorist icons/flags/prominent figures to social media” and “expressing acceptance of violence as a necessary means to achieve ideological goals.”  Group C includes indicators that are even more common and thus are “minimally diagnostic on their own,” requiring the “presence of other indicators to gain diagnosticity.”  This group includes “unusual purchase of military style tactical equipment” and “blaming external factors for failure in school, career, or relationships.”

A graphic depicting the scale of threat levels assigned to various behavior indicators of mobilization to violence among HVEs.

The guide also introduces a scale for evaluating the overall threat level of indicators by ranking: how diagnostic they are in positively identifying mobilization to violence; how dependent they are on other indicators to positively diagnose mobilization; how easily observable the indicators are; as well as whether the indicators present a long-term, near-term, or imminent concern.  For example, someone “disseminating a last will or martyrdom video/statement” is ranked as highly diagnostic, independent of other indicators, and observable, presenting an imminent concern.  An indicator like “surveilling potential targets” is moderately diagnostic and observable, but is highly dependent on other indicators and only presents a near-term concern.

While some of the initial indicators in Group A seem plainly apparent as being indicators of mobilization towards violence, many indicators in the Group B and C are broad and at times confusing in their origin.  One indicator in Group C is “inappropriate use of what an individual perceives as ‘doctrine’ to manipulate the behavior of parents, co-workers, close friends and family.”  The guide offers examples of this indicator including “criticism of parents’ clothing choices, reading material choices, musical preferences, religious practices, interfaith friendships.”  Another broad indicator in Group B is “use of encrypted media applications to engage with unknown overseas individuals.”  Several indicators in Group C also relate to communications privacy, such as “utilizing communication security techniques” and “discussing operational security.”  Many of these indicators are rated as being dependent upon other evidence “pointing to terrorism and intent to take violent action” and the guide makes clear that “many of these signals or indicators—some of which might involve constitutionally protected activities—may be insignificant on their own.”  If any public safety personnel receiving the guide “reasonably believes” based on the information contained in the guide “that an individual may be mobilizing to violence “they are encouraged to “inform LE agencies with investigative authorities via mechanisms like E-Guardian or Suspicious Activity Reporting.”

A chart from the August 2016 bulletin issued by the Department of Homeland Security, FBI, and National Counterterrorism Center (NCTC) shows the increasing number of plots focusing on civilian targets.

A joint intelligence bulletin issued in late August by the Department of Homeland Security, FBI, and National Counterterrorism Center (NCTC) assesses that homegrown violent extremists (HVEs) are “increasingly favoring civilian targets” as part of a wider “variety of targeting choices.”  Previous assessments have found that HVEs are most likely to prioritize attacks on “law enforcement personnel, military members, and US Government-associated targets.”  However, a recent shift towards civilian targets has likely been driven by the accessibility of “soft targets” that are often less secure than government facilities and provide greater opportunities for conducting mass casualty attacks.

Over the last year, seventy-seven percent of the “thirteen HVE attacks and disruptions . . . focused on civilian targets, in contrast to eleven percent of the eighteen HVE attacks and disruptions in the first seven months of 2015.”  Three separate HVE plots in 2016 targeted religious institutions, the “first such cases since a 2009 plot against a New York-based synagogue” according to the bulletin.  Since 2015, HVEs have “plotted against or attacked restaurants, a nightclub, a concert, a public ceremony, a place of employment, and a college classroom, demonstrating the variety of targeting choices.”  The bulletin was issued prior to the recent bombings in New York and New Jersey which also targeted civilian locations including a train station, charity race, and numerous public streets.

The bulletin states that a combination of factors ranging from “perceived lower levels of security” as well as “violent extremist messaging glorifying recent attacks on civilians” have motivated this shift in tactics.  The bulletin also highlights a newer trend which has led HVEs to select “familiar targets of personal significance to simplify plotting,” often capitalizing on preexisting grievances or a desire for revenge.  This is particularly relevant to cases such as the December 2015 attack on the Inland Regional Center in San Bernardino, during which Syed Rizwan Farook and his wife Tashfeen Malik killed fourteen people at a training event and Christmas Party hosted by the San Bernardino County Department of Public Health.  Farook, who worked for the county as a health inspector, had been attending the event earlier in the day prior to conducting the attack.  In another example cited in the bulletin, an eighteen-year-old freshman at the University of California at Merced named Faisal Mohammad stabbed a classmate and three other individuals at the college before being shot by a campus police officer.  The FBI later stated that Mohammad had been viewing extremist material online and they believe the attack was inspired by the Islamic State of Iraq and the Levant (ISIL).

To help prevent HVE attacks, the bulletin recommends that state and local authorities be vigilant and “report suspicious activities related to potential mobilization to violence in the Homeland by US-based individuals inspired by foreign terrorist organizations.”

A screenshot released by the security company Kaspersky shows a malicious Microsoft Word document similar to one used by hackers in an December 2015 attack against the Ukrainian energy sector. The attack disrupted more than 200,000 customers and affected dozens of substations.

A Department of Homeland Security assessment released in April states that critical infrastructure throughout the U.S. faces “immeasurable vulnerabilities and attack vectors” due to the increasingly prominent role of information and communication technology (ICT) in critical infrastructure sectors.  The strategic risk assessment, authored by the Office of Cyber and Infrastructure Analysis within DHS, was obtained by Public Intelligence and describes the “convergence of cyber and physical domains” as a strategic threat to the nation’s infrastructure.

As ICT is increasingly depended upon in “all 16 critical infrastructure sectors,” there is an “inherent reliance on a network connection for functionality” that “creates numerous vulnerabilities” and makes “universal security extremely difficult and improbable, allowing cyber attackers to more easily exploit critical infrastructure.”  These vulnerabilities are also expected to affect the growth of smart cities and other developments related to the internet of things (IoT).  DHS cites a report estimating the smart cities market to be valued at $392 billion by 2019 and estimates that in five years 26-50 billion IoT devices to exist.  Warning that the growth of these technologies advantages comes with “inherent vulnerabilities,” DHS states that billions of “interconnected IoT devices creating, transmitting, and storing data will result in ‘data exhaust,’ which allows threat actors to gain significant insights into sensitive information such as telemetry, voice, video, health, and infrastructure component status data.”  Moreover, failures of  “critical infrastructure IoT devices” could result not just in “economic loss through lost productivity and damage to the national economy,” but also “adversely affect public safety through physical infrastructure damage or catastrophic infrastructure failure.”

Industrial control systems (ICS), such as supervisory control and data acquisition (SCADA) systems, that are connected to cloud infrastructure are also cited as a growing concern as “cloud providers are generally not prepared or equipped” to address many of the specialized security needs of these systems.  The report states that the “compromise of critical infrastructure SCADA systems that are connected to cloud infrastructure could have a direct physical effect on human life.”  However, the threat to ICS extends far beyond cloud security issues with more than 245 cyber-related incidents in FY2014 according to the Industrial Control Systems-Cyber Emergency Response Team (ICS-CERT).  Techniques used in these incidents included “access and exploitation of Internet facing ICS and SCADA devices, exploitation of zero-day vulnerabilities in control system devices and software, malware infections within air-gapped control system networks, Structured Query Language injection and application vulnerability exploitation, network scanning and probing, lateral movement between network zones, targeted spear-phishing campaigns, and strategic Website compromises (a.k.a. watering hole attacks).”

Similar concerns were expressed in a January 2016 intelligence assessment issued by DHS which found that nation-state cyber actors are actively “targeting US energy sector enterprise networks” to maintain “persistent access to facilitate the introduction of malware” in the event of “hostilities with the United States.”  While the assessment states that this activity is focused primarily on “data theft” as well as “accessing and maintaining presence on ICS” networks and systems, the report uses unusually blunt language to describe how this kind of access would likely be used as “part of nation-state contingency planning” only to be “implemented to conduct a damaging or disruptive attack in the event of hostilities with the United States.”  In December 2015, a coordinated attack on the Ukrainian energy sector demonstrated just how damaging this sort of access to ICS infrastructure can be, resulting in the loss of power for more than 225,000 customers and the disruption of at least fifty regional substations.  The attack is described in the DHS assessment as “consistent with our understanding of Moscow’s capability and intent, including observations of cyber operations during regional tensions.”

The restricted DHS assessment titled “Damaging Cyber Attacks Possible but Not Likely Against the US Energy Sector” was obtained by Public Intelligence and reveals that at least seventeen intrusions against the U.S. energy sector were traced back to APT actors in FY 2014.  The attacks never resulted in damage or disruption, but were instead focused on “data theft from enterprise networks” and “accessing and maintaining presence on ICS” networks and systems.  One example cited in the assessment is a piece of malware called Havex that was “likely developed by Russian state-sponsored cyber actors.”  The existence of the malware was first disclosed in a June 2014 blog post by Finnish security firm F-Secure which described how the remote access tool (RAT) was being used as part of an industrial espionage campaign.  DHS states that this campaign dates back to 2011 and that while the “main function is to gather information,” Havex can also run “specialized plug-ins for additional capabilities.”

The assessment also mentions an attack on the Ukrainian energy sector in December 2015 that resulted in at least 80,000 customers losing power for up to six hours.  At the time the assessment was written, ICS-CERT stated that they were “unable to confirm” the event was triggered by cyber means, but that a sample of the malware provided by the Ukranian Government had the capability to “enable remote access and delete computer content, including system drives.”  While DHS does not attribute the attack to any specific cyber actor, the assessment states that the attack is “consistent with our understanding of Moscow’s capability and intent, including observations of cyber operations during regional tensions.”

A month after the DHS assessment was published, ICS-CERT released an alert describing the attack in much greater detail and relaying the findings of a team that included representatives of the U.S. Computer Emergency Readiness Team (US-CERT), Department of Energy, FBI and North American Electric Reliability Corporation.  The alert increased the number of those affected by the attack to more than 225,000 customers, noting that the attack was “reportedly synchronized and coordinated, probably following extensive reconnaissance of the victim networks.”  The attackers reportedly “acquired legitimate credentials and leveraged valid remote access pathways” to cause 50 regional substations to experience “malicious remote operation of their breakers conducted by multiple external humans.”

ICS-CERT also released a restricted version of the alert marked For Official Use Only that included non-public details and analysis of the vulnerabilities exposed by the attack.  An updated version of the restricted alert from March was also obtained by Public Intelligence and states that “critical infrastructure [industrial control system or ICS] networks, across multiple sectors, are vulnerable to similar attacks.” ICS-CERT argues that the “incident highlights the urgent need for critical infrastructure owners and operators across all sectors to implement enhanced cyber measures that reduce risks” that could result from the use of a number of different techniques that were employed by the attackers, including:

• Theft of legitimate user credentials to enable access masquerading as approved users,
• Leveraging legitimate remote access pathways (VPNs),
• The remote operation of human-machine interface (HMI) via company installed remote access software (such as RDP, TeamViewer or rlogin)
• The use of destructive malware such as KillDisk to disable industrial control systems (ICSs) and corporate network systems
• Firmware overwrites that disable/destroy field equipment
• Unauthorized scheduled disconnects of uninterruptable power supplies (UPS) to devices to deny their availability
• The delivery of malware via spear-phishing emails and the use of malicious Microsoft Office attachments
• Use of Telephone Denial of Service (TDoS) to disrupt operations and restoration.

During the attacks, “remote human operators” accessed the workstations of dispatchers at the facilities using legitimately installed tools for remote access.  They used this access to trip the breakers, change the passwords for key systems, corrupt firmware of serial-to-ethernet converters used for substation communication and leverage backup battery systems to trigger shutdowns of connected servers and devices.  In one instance, the attackers used an uninterruptible power supply (UPS) to target an internal telecommunications server which cut off “all internal communications with regional offices and distribution substations.”

Despite the risks demonstrated in the Ukrainian attack, the DHS assessment from January tries to downplay the threat posed by state actors, noting that 63 percent of malicious cyber activity in FY 2014 was “unattributed, low-level activity” related to cybercrime using methods such as ransomware and denial-of-service attacks.  The assessment’s authors also include a section criticizing the media’s over-hyping of cyber attacks and cyber warfare as leading to “misperceptions about the cyber threat to the US energy sector.”  The term “cyber attack” is often used by the media and private sector to refer to incidents and activities that are not necessarily intended to “cause denial, disruption, destruction, or other negative effects” which would better be described as “cyber espionage, and even low-level, untargeted incidents of cybercrime.”  The assessment even speculates that overuse of the term could lead to “alarm fatigue” which could lead to less reporting of incidents and longer response times.

Cyber attacks against law enforcement, fire departments and other emergency services have become increasingly common and are likely to increase according to a recent intelligence assessment prepared by the Department of Homeland Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC).  The assessment, which was distributed to law enforcement in September 2015 and was obtained by Public Intelligence, reviewed a number of “cyber attacks against the [emergency services sector or ESS] between February 2012 and May 2015,” finding that “targeting of the ESS will likely increase as ESS systems and networks become more interconnected and the ESS becomes more dependent on information technology for the conduct of daily operations—creating a wider array of attack vectors for cyber targeting.”  Recent incidents involving the use of telephony-denial-of-service (TDoS) attacks, ransomware as well as the exploitation of “critical hardware and software” including call-center communications-management software, closed-circuit TV camera systems, interactive voice response systems, and emergency alert systems are detailed in the assessment.

DHS and MS-ISAC assess that the “most prominent cyber actors targeting the ESS” are “criminal hackers” who have engaged in “numerous attacks against state and local networks, particularly law enforcement, in response to perceived social and legal injustices” and are “prone to announcing attacks to increase visibility and support for their cause.”  The assessment defines “criminal hackers” as “individuals or groups that commit a crime by illegally accessing or altering systems, often in furtherance of an ideological goal.”  The use of the term “criminal hackers” marks a departure from previous law enforcement bulletins which have used the terms “hacktivists” or “hacker groups” to describe ideologically-motivated cyber actors.  The term is also used in an FBI bulletin released in May 2015 titled “Criminal Hackers Target Police to Protest Perceived Injustices.”  The assessment distinguishes between these criminal hackers and “cybercriminals” who “carry out illegal activities on computer networks, such as carding schemes, ransom and extortion, theft of personally identifiable information, and account information to facilitate fraud.”

Criminal hackers “gain support for their political agenda—or to exact retribution for perceived social or legal injustices—have shown repeated interest in targeting the ESS” as is “evidenced by the numerous attacks against state and local networks, particularly law enforcement, in response to perceived social and legal injustices.”  However, DHS and MS-ISAC assess that their capabilities are not particularly sophisticated, limiting them to “low-level cyber operations, such as [denial of service or DoS] attacks, website defacements, and doxing (publishing of personally identifiable information), often attacking targets of opportunity.”  These low-level operations have proliferated in recent years, particularly in response to increased political controversy surrounding police brutality and excessive use of force.  The assessment also discusses several examples of these operations, often involving DoS attacks or doxing, including a series of DoS attacks conducted by the hacker collective Anonymous against the City of Madison, Wisconsin in 2014 to protest an officer-involved shooting.  The attack reportedly “affected some police, fire, and medical dispatch services; as well as city government Internet and e-mail communications, and online payment services.”

Though so-called “criminal hackers” are the most prominent cyber actors in DHS and MS-ISAC’s assessment, cybercriminals working for financial gain pose a “persistent threat” and have launched attacks significantly impacting ESS operations.

• In May 2015, a Nevada county sheriff’s department and a Wisconsin police department were victims of a ransomware attack that encrypted both departments’ shared folders.  MS-ISAC later determined that the intrusions occurred as a result of visits to a legitimate website which had been compromised.
• A city in Southern California and several local public-safety agencies were hit by ransomware in June 2014.  The compromise affected 100 computers and 10 servers.
• A fire department in Northern California and a law enforcement agency in Southern California were infected by ransomware resulting in the compromise of one computer and one server in each location, making vital information unavailable.
• In 2013, telephony denial of service (TDoS) attacks affected approximately 600 critical government phone systems nationwide, including 200 public-safety answering points (PSAPs).  After several days, the attackers reportedly requested $5,000 to cease the attacks.

A nasal spray kit for Narcan, also called Naxolene, a drug that can be used to reverse the symptoms of acute opioid overdose.  The photo is taken from a handout produced by the Delaware Valley Intelligence Center.

Since 2009 Philadelphia has seen a 43 percent increase in drug-related overdose deaths, helping to make Pennsylvania the nation’s leading state for drug overdose death among young men.  Over the same period, the city has seen a 45 percent increase in overdose deaths where heroin was present in the individual’s system.  While heroin is still the primary source of drug overdose deaths, the city is also seeing a significant increase in deaths related to prescription drug abuse, particularly opioids.  Deaths related to Fentanyl, an extremely potent prescription painkiller, have increased more than 300 percent between 2013 and 2014.

Using data provided by the Philadelphia Medical Examiner’s Office, the DEA’s Philadelphia Field Division issued a report in July analyzing overdose deaths for the years 2013 and 2014.  The report which, was obtained by Public Intelligence, showed a 33 percent increase in drug-related overdose deaths in the city between 2013 and 2014.  Nearly two-thirds of those that died were male and the average age was 42 years old. The largest number of deaths occurred in the 46-60 age group.  The deaths are also highest among whites, which accounted for approximately 60 percent of overall deaths in 2013 and 2014.

A chart showing the number of deceased individuals in Philadelphia in 2013 and 2014 that tested positive for opioids other than heroin.

The increasing abuse of prescription painkillers has led to a significant increase in heroin-related deaths. The DEA report states that the “widely reported trend of prescription opioids abusers switching to heroin, with deadly results, is supported by the stability in toxicology test results for the opioids oxycodone and hydrocodone, while heroin-positive results increased substantially during the reviewed years.” However, the number of deaths where prescription opioids are a factor has also increased significantly. The presence of oxymorphone, marketed under the name Opana, increased 42 percent from 2013 to 2014 which supports “law enforcement reporting indicating that Opana is increasingly popular and sought after by prescription drug abusers in Philadelphia.” Likewise, the more than 300 percent increase in deaths where fentanyl was present in the decedent’s system demonstrates the highly increased “potential for overdose and death” due to the drug’s increased availability.

The DEA says the data “paints a clear and chilling picture of the impact of drug abuse in Philadelphia, especially related to heroin and fentanyl.”  The report also praised the recent passage of legislation in Pennsylvania allowing for law enforcement officers, fire fighters and EMS personnel to administer naloxone, also called Narcan, a drug which can reverse the symptoms of an opioid overdose.  A September 2015 report from the Delaware Valley Intelligence Center that was also obtained by Public Intelligence shows the statistics for Narcan administrations in Philadelphia between January and June of last year.  Narcan administration numbers can indicate the locations of “abuser populations” and also indicate areas where law enforcement should focus their attention.

A map showing the total number of Narcan administrations in Philadelphia between January and June 2015.

During the period analyzed, Narcan was administered in every zip code in Philadelphia excluding one small area south of the Wells Fargo Center and Lincoln Financial Field.  Many of the neighborhoods surrounding North Philadelphia saw the most administrations of Narcan, including one near Port Richmond that had 253 administrations during the period.  The second highest zip code only had 92 administrations during the same period.  The DEA hopes that this will reduce the number of overdose deaths, however, it notes that “although the number of fatal overdoses will fall, the rate of abuse will not be impacted without continued joint law enforcement and public health efforts to address supply and abuse.”

Images of suicide vests and belts from an FBI’s intelligence note released after the November 2013 .

An analysis of recent suicide bombings throughout the Middle East, Europe and Africa by the FBI Terrorism Explosive Device Analytical Center (TEDAC) that was released after the terrorist attacks in Paris, France last month states that “suicide vest and belt improvised explosive devices (IEDs) in the Middle Eastern, African, and European regions likely . . . have minimal correlation” and do not indicate tactical migration.

Following the attacks in Paris, which featured seven separate suicide bombings, media coverage has focused on the prominent use of suicide vests as indicative a tactical shift for the Islamic State of Iraq and the Levant (ISIL).  Though there are past examples of suicide attacks inside Europe, such as the 2005 London bombings, the use of suicide vests in the Paris attacks has been said to represent an entirely new type of threat, a tactic once relegated to the battlefields of Iraq and Syria now appearing in European cities.  However, an External Intelligence Note issued by TEDAC on November 17 titled “Suicide Vest and Belt Improvised Explosive Device Tactics in the Middle Eastern, African, and European Regions Show Minimal Signs of Tactic Migration” and obtained by Public Intelligence presents a different view, attributing the tactical similarities to factors such as “available materials, training, and local or national counter-IED policies.”

While TEDAC would normally assume that “similarities between suicide vests and belts from different regions likely indicate common training or common IED facilitators,” the intelligence note states that these similarities “may be a product of independent open source research, thus resulting in a false link between devices and subjects.”  Moreover, the similarities may “indicate tactic or construction influences” based on the nature of the devices and access to required materials.  Similarities can include everything from “overall IED construction, wiring techniques, common explosives, initiators, switches, electronic diagrams, enhancements, and employment.”

When broadly examined, the types of “suicide vests and belt IEDs observed in each region” covered in the intelligence note “differ broadly in many characteristics, resulting in an inconclusive determination that the suicide vest and belt IEDs prevalent in any one area translate to tactic migration.”

A study by the Institute of National Security Studies found that there were approximately 370 suicide bombings in the Middle East region in 2014 claiming the lives of over 2,700 victims.  Iraq, Yemen, Lebanon and Libya all saw a significant increase in the use of the tactic over the previous year.  Prior to the attacks in Paris, suicide bombings in Europe have been primarily limited to Turkey and Russia.

The intelligence note takes several quotes from an interview conducted by Der Spiegel with a captured ISIL leader named Abu Abdullah discussing the group’s target selection process and methods for constructing suicide vests.  He describes how he used “explosive fill removed from artillery shells for car bombs” and “drilled open the shells of anti-aircraft guns to construct suicide belts because he believed the effect of the powder was more intense.”  According to the interview, he would receive a potential bombers’ measurements in “advance from the leadership in order to be able to make a well-fitting belt” and “always had belts in different sizes prepared.”

Explosive vests in Yemen have also included similar design elements.  A suicide bomber tied to Al Qaeda in the Arabian Peninsula (AQAP) was killed in July 2015 by Houthi forces prior to detonating his vest, allowing for forensic analysis.  The device featured “dual grenade-pin detonators, a main charge wrapped with sheets of ball bearings, and detonation cord that was placed inside a pouch around the bomber’s waist.”

Similar to the Middle East, bombings in Turkey have often used either C4 or trinitrotoluene (TNT) in suicide vests.  Vests used in the Middle East often included other high-powered explosives such as Semtex or Research Development Formula X (RDX) or triacetone triperoxide (TATP), the explosive that was reportedly used in the vests detonated during the Paris attacks.

Seeing this increasing trend, the Department of Homeland Security, National Counterterrorism Center and FBI released a joint intelligence bulletin in late July warning of the dangers in traveling overseas to fight against ISIL forces.  The bulletin titled “Risks for US Persons Traveling to Combat the Islamic State of Iraq and the Levant” was obtained by Public Intelligence and discusses the “emerging trend of US persons traveling to combat ISIL.”

The bulletin states that a “number of US persons have traveled to Syria or Iraq of their own volition to combat ISIL over the past year, according to media interviews granted by these individuals” which “underscores a recent broader trend of Westerners mostly joining Kurdish forces and likely motivated by ISIL’s indiscriminate killing of civilians, aid workers, and journalists, as well as a desire to protect civilians, among other reasons.”

The bulletin notes that many of the “identified US persons do not appear to have ethnic or family ties to Syria or Iraq” and that the trend will likely continue “given the group’s ongoing atrocities, the publicity that US anti-ISIL fighters have received, the perception among some US persons that regional groups confronting ISIL need their help, and the prevalence of social media tools to facilitate communication and travel with anti-ISIL groups in the region.”

People’s Protection Units

The majority of U.S. and European individuals that have traveled to Iraq and Syria to fight against ISIL have joined Kurdish forces.  Some have elected to fight alongside the Peshmerga, the forces of Iraqi Kurdistan, while many others have joined the YPG, also known as the People’s Protection Units of Syrian Kurdistan.  The YPG has a robust online recruitment effort complete with a website providing useful information on what to expect when fighting alongside Kurdish forces and interviews with foreign fighters that have successfully made the journey to Syria.  Their Facebook page The Lions of Rojava has more than 30,000 likes and features many pictures of Western fighters along with other promotional items.

A photo from Jordan Matson’s Facebook page. Matson, second from the right, is one of a number of foreign fighters that have joined with Kurdish forces to fight against ISIL.

One fighter who has received significant media attention after joining the YPG is Jordan Matson, a 28-year-old man from Wisconsin who previously served in the U.S. Army.  Matson reportedly worked as a delivery driver for several months to save money prior to heading to Turkey in September 2014 to meet with Kurdish forces.  He was eventually escorted by a YPG representative into Iraq and posed as a doctor to get into Syria.  He has documented his journey on Facebook which contains dozens of photos of Matson with other Kurdish fighters.  In an interview with USA Today, Matson said that he is not paid for his efforts but that the Kurds “treat me like family.”  They provide little in the way of supplies and are their ranks are often made up of young men and women with minimal training.  “Sometimes it’s just kids.  That’s the way it is.  I have a Kalashnikov and that’s it.”

An image of Keith Broomfield distributed by the YPG.

In June, a 36-year-old from Massachusetts named Keith Broomfield was killed near Kobani, Syria while fighting with the YPG.   Broomfield is believed to be the first U.S. citizen killed while fighting with the Kurds against ISIL.  According to his father, Broomfield had gotten into trouble in his younger years and straightened his life out after finding religion.  He “believed it was God’s will that he go help the suffering Kurds.”  Broomfield’s brother said that “He knew the risk. He understood those. He believed in opposing evil, which I believe in, too.”  After his death, his sister posted a message on Facebook stating that “My brother died to defend my sisters who are being sold, enslaved, raped and murdered. To defend my brothers who are shot beheaded and dumped into piles off trucks.”

The joint intelligence bulletin issued by DHS, FBI and NCTC describes Broomfield’s death as underscoring the “risks of traveling to join anti-ISIL groups” which include “dying in accidents or being captured in combat.”  The bulletin adds that “ISIL almost certainly would seek to use captured US persons in its messaging videos, as it has done with captive Western journalists, aid workers, and coalition military personnel.”

ISIL Social Engineering

Due to the online recruitment efforts of Kurdish forces, one particular concern that is repeated numerous times in the joint intelligence bulletin is that individuals wishing to join the fight against ISIL are vulnerable to social engineering.  “Violent extremist hackers have commonly used various forms of social engineering to obtain information about their adversaries” and ISIL supporters in other countries “could use these techniques against US persons who express on social media a desire to travel to join anti-ISIL groups.”  The bulletin cites an incident in November 2014 where a Syrian civil rights group received an email claiming to be from Canadian activists and identifying the location of ISIL strongholds.  Instead, a link in the email led to “malware intended to collect the victim’s IP address and other system information to determine a victim’s physical location.”

The threat posed by social engineering is heightened due to the fact that “those with former US military affiliations may be more desirable targets for ISIL, particularly in light of ISIL’s September 2014 call for attacks against members of the military, law enforcement, and government personnel; a message the group continues to emphasize.”  Moreover, the FBI has received “reporting indicating individuals located overseas are spotting and assessing like-minded individuals in the United States who are willing and capable of conducting attacks against current and former US-based members of the US military.”  An FBI alert from early July reported that two Middle-Eastern men approached the wife of US service member in Colorado and asked if she was the “wife of a US interrogator.”  The men laughed when she denied this and “left the area in a dark-colored, four-door sedan with two other Middle-Eastern males in the vehicle.”  The alert added that similar “incidents in Wyoming have been reported to the FBI throughout June 2015” where “family members of military personnel were confronted by Middle-Eastern males in front of their homes” who attempted to “obtain personal information about the military member and family members through intimidation.”

The joint intelligence bulletin ends with a statement that “FBI, DHS, and NCTC urge vigilance and advise individuals who express anti-ISIL sentiment publicly—current and former military members in particular—to review their online social media accounts for any information that might serve to attract the attention of violent extremists, and to exercise operational security in their interactions online.”  It also advises that anyone planning to go to the region “regardless of their intent or motivation, should be aware of the limited consular access in Syria and Iraq, the potential to inadvertently violate US or Iraqi law, and the increased likelihood of being targeted by violent extremist groups, including but not limited to ISIL.”

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

We are switching keys as of September 20, 2015 from our old key:

pub   4096R/5FE1B448 2010-08-04 [expires: 2020-08-01]
      Key fingerprint = 26BB 850B 4764 B794 F2D7  5158 1461 A2E6 5FE1 B448
uid                  Public Intelligence <support@publicintelligence.net>
uid                  Public Intelligence <admin@publicintelligence.net>
uid                  Public Intelligence <legal@publicintelligence.net>
uid                  Public Intelligence <inquiries@publicintelligence.net>
uid                  Public Intelligence <info@publicintelligence.net>
sub   4096R/53B3CD8A 2010-08-04 [expires: 2020-08-01]

to our new key:

pub   4096R/D0516538 2015-09-05 [expires: 2020-01-01]
      Key fingerprint = 4D17 E7AA 79C5 6039 7924  A511 098D A386 D051 6538
uid                  Public Intelligence <info@publicintelligence.net>
sub   4096R/0F43412D 2015-09-05 [expires: 2017-09-04]
sub   4096R/710BFB6B 2015-09-05 [expires: 2017-09-04]

Here is a copy of the key: 

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2

mQINBFXrQi4BEADIo3gQSYaSkoQkgu3YWRhwRNdFU0HXsWaIC3baSnTL5vfbkXC2
M2U3BwiC/KG2/P7b9E2CMhkdakAnN6znxrfe6vL6Df57VXwBTgZQCSNJJInNahMT
4oUpElN1OEf6QwPFw6ExjQrk7jIxPiyWD88AdWuEWrF9iOfdGKDgai+gMi4fB0Iv
1uoM38yhVQNsCSE/q41LP39sz85Cosjo1QkhWLyfJ9mQSI/hUveRf6gFlBlSXmq2
p+lXMvh197H6udXrzYMxWupovfb9Anr7Ewnn+B8rohY3x6RxNbCNV7znsfxPFQSc
bsvJtEt92MK1kdrmPcYU1DbjJJxRbankUKcyEXZQ8wLcipHGpsHC9SqkBultzcm+
NZtL7Y/JRiehWRBYIE9SJ1yGZgS5MJ0+JvI+KDhfheSR10GlPzWnpibABk/lKd5e
McKtBJBRsnBYwSHn3Mtri6r610rX+Lw/9RUj1MN6yL3U104kzpprOs3cL0kKgbfp
YSHhcLJyOEelZjuQh/jySdWaPQoJxOl7wFtlpXHOgF3GrbZveUYfnrCHq/kR4ZiT
D4h1crIKVpOQJt/vhs2buO0eMj0qo6jF7vhjFirS/J2i08KvGcTKV2/+3OEVHNim
epDGrpC7XnGaIJi8nNx3RbHvGuSmMm/LEQg4PY2y1Uf6rEBRjImCHOAtpwARAQAB
tDFQdWJsaWMgSW50ZWxsaWdlbmNlIDxpbmZvQHB1YmxpY2ludGVsbGlnZW5jZS5u
ZXQ+iQI9BBMBCgAnAhsBBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJV9axxBQkI
IJ7SAAoJEAmNo4bQUWU4sAYQAJ/NOVrnjzDv1gVb5xMFG5LR06Fvl2hmRiVMFrw8
ibLO1JkuYLB32wGOsJ8yOL45Y6xvcQ/jbxkAJJPl/kTUUP0B1+m8DKDolZ48wNV4
q4364pEeAG8mCG5oZ5r42sNJ/VEJ8z0M2vFpZ17icw2dpukumZzIEoM6YVwDoC+m
oMVLBaHwgPVQvG6OaJaAKelOaGJaMa4pRfHylgnQlXbZIDwsqrxgdGfN4DtPwrvm
oQtp4cLxFzna/pIVMr6E7j7XyERgvi6e7OJeCoy3sI1T7lH8xdIbS+1lVo+dRqXE
0NcIaP3IEse8ucx0xqJHn++NnW2n28+MeLSv+9S8pMEWLNGoX4ziyC6Jo5I58nDL
pvyUAPWoP7QgL0+LIXr+tPIjkY7hTg/pGe3rPLSFJ9g2FsyWOtexDJabikCaiJTI
UY1alGP0oRFQcbuiR2vWfGME/DTVAaLu0/9kzZpTHzn6MwdaumpQIm1XT4DRRy/V
DaK+A4AxOmz+qvBZMk5boYHlPyhKDYzarSS7ghBww3lzewLQtdQizXG/SfxedIo0
T1IAdYbipSrEfBPQjDHUaH1MDyq0ErMiBl9fvchF38BbNvWYyw8nSAJBLkX6A0PF
GxGliHy8kaOniWNt90hwpcjoj7S+3cjVjrCRaL24zieWJsxeFw8zc8g+veCg1foA
Aq65uQINBFXrQqsBEACzPBESfcz8ShqTCChx6NE4d+1SKJZeCKjd+rI8tymq2x9H
7PgjN2ZfqwtDtEXRF8+BM1dZfXhekYXXkRXcgf5mqyrxRPc152ZSMXGYSb5dfEXH
e5w/ufI5dIn5nVSDsBMwtIWuL16bLIMoHEdsjjhppKzLPHCNt/zFMCtpeeBBIZGB
OGe0szVbbT28rfXs7cgag0Vb9ZcvQAPKw97e8qTDlpn+AXuR74RacC0YCmFxSEtH
anxmwFIUi424qkhI7patCHbmK8vP521yzqMDzkwlUYEaDZHA350I9It0nQhS/yfe
5W9lDN+B4Fo/aT/WTE9mbxs3jhG4Zsm2s8rxVjR9bvhKgG7wayYx1OgumrAcXQGc
DLVtD15TECHRB0PmphKv5sMqjV9N2dJ+C5OW17Q2S1kLcwItNzVmpk/w6STBrVIV
NAgkM4ibDsHsb2LcvAK29FgHAgGUp2QEUsmpi4HXEAKre64+UuBhDysfFY+3xqlL
E0Ub7x49Zn9ZGoFigD9ipX8vstSPsmCwhXsl3TfefP4WYSjqw357Xd5Gg0a2cOcI
adacd6zLjBJFwPJKspIqidBu1dGtXcnOlXvAfro2hCrY0Ri8L/VT/XLRvPedpa8n
ZYCXrzCAtRA7MT2okDkOwiNCK+TCjkDoBz9KjIadwoJ0U2Ze7y9dg53DIA+8vwAR
AQABiQIlBBgBCgAPBQJV60KrAhsMBQkDwmcAAAoJEAmNo4bQUWU4/SsQALAUroAL
2A5VBXnANJqiFASNaYiCAYhUvYf+VobRIBxBV/S8RsLq+9hGdeB76P4OeZ/o7iM4
/hFvzpr1ixU0ijZW29STEqEpdrzhpJiBl5RbIogETgzOw9iMzXBDwrD4TogAm9ao
dV4kSAR4EUi8ziiEoefHL0oCKL8lDaIGSV2Y1OPw8A/Vs0iv1KCTYbWINfmK8qCI
qz3y+cRft77TKQQTZzqVDTpyhHvtgOISeVokqecG8nQEutn5oxroIFTjtjXT3jTI
StoLGghJ+vjjbA6Jyz4HKNb//AIhymeFbg2OQAFeylMwGRENPEkuaBhXpQzPW9br
kpuqvMw9u7SGlbKfUthgQnqIQExrBgWnIeoti/EUoONxXzHh52LWnTnD5m1kPc6U
ujXamyJ/BHiiYH2ylLz6P3UswhKT4pzx+1oiT5uMuriKHeV5tsmfaqINOf0Davk3
M1BuTPtHnFg+YSCgxdL/h4p5Nas9zkbapLQnAOBBMCOc8c80Z91S925C6c6RPJzG
tTB+3cw10lNqqzGfvwx9HoCMEPlUbvJ0iiPK6MfgXMPaz3WKeRIk3lObCrg6yaXl
dMRYy2DDjRGTLIkdsqgBu/3P3ok394xzysWoOj5+4Xhx/ZmozRs/UADlrv8Zk8vv
Tvyi1aya8J6eCQ/iDPFVsYXubYGYllJBksmauQINBFXrQuEBEACewFINnjg2+ckl
pS/CwsJht9GyZVQoxNDTTheaYEuxJh4go+0xd8YDy4YzMZDl2env65/ShK4a0LxB
jVmhXcT1KZZX8xhV72VkJZYTmGRQ96UNJBjEB775V7yPNbT48D/qTdxHFJug55IN
baGeTeTHETzvKf/L0Am72AtJ/NMdm310MBdamyLh7iKZ31qykgv7R1xSyNijdzOs
t9PhXYcWzReYIgSvzUhfVrYNFo5m9LaBpEuB1+YH1SGJS/TsltkiEjkRtjcq94fe
5e8RUY58e1fzEcscRzjd6eI1VNaXsn6sADxpOwfABJeo5h20gwCz+mG0lQe5Vyev
VwtLUIAgWG3VTfMfdIkjW3/HIJrceF92OWyo+92IkVCK4JACwLlhmjD0blJTbEzu
K0VtQpV+s4C5z1YKYZoF74vZ1mm1J/xJ5NQOAxzCWxvCrALSo9M7+LZ5lb/6SnaI
JzteLlwN/dfvEQ2TbVSSn5eT9u/u4o93uWi6FRX8DXM61T247QJbG6nGDgWEKfV2
P+2QNZhgW978f4uYW5rmyyA1OWu6wNHnmjcKiZiREQPyrg1iwWQazcKO/nXN3T+b
mPBpyjPFksWrbLFFwuOPqcLfgJCZbH752byZ7pArNf6k0wfQmCDrFyAk6093Zdys
R9phP7WdPd5ItH9bbrXY00uqgynRaQARAQABiQREBBgBCgAPBQJV60LhAhsCBQkD
wmcAAikJEAmNo4bQUWU4wV0gBBkBCgAGBQJV60LhAAoJEFGOfHJxC/trf/oP/0Zu
GV1w6UZmoTKRfmQaxnOs3p067sxBd6vR/B0q/55dR5lERUI2QDIwlJeiceqExhCY
8BpdhLiyrqmC2/sSEXGIdBotV5Yk88fgbc0V+cVPjjcmPRUL6MJyxYd+0FDNZdYg
0xaZm+BdRYH412GHol4W0K1eYc+9dp3bMFlRpg75aUN8ULH1aeCNbcQABpsmOXU4
33aKxzXzLOESAEDIeLRGRS5xW00UdbC4tQsDPcp1EfxytylEcE4aSiZC0Npp1lYn
qK6S2qasLaF9ajypUGPBLH641xpoWEnnecXG9xk3yvaI3LfLaeuLSpqKfM7Eo54J
sIAEZkYEQsV2FHs50D/2bSyi21gbRfg91wY3RKVxm3V5DcgzO1oun4LCmoVWIGRR
EhwspbhtCu9I54x3X4/XhvS5SzlkDgLThoL45lrg/IiGLxaPqKH+lh+cszAIaCwQ
/ANkb8Itzk85CZ5CYNPZaSuNbvjWVwe/jUjoWtpFdiFzdNckFCNTXJkJ89ERuDll
YxEwBPSrgTyz6f1BYfdF5f4Fu3q6hjYj/djt/0N2SA0x6SO7WbTOgdDLLa05AEBh
GTbcGzKCKS8CPrOJolIyx1c2k0pSXGNj6J0Nh7ME5hpDWedJ1bC0aUypLOh3MsYm
QWv+JEJ/gZRfXMv35qWhfNqKfX6ORnW5V88c6cnYnHsP/ihWoiXdwkzXVzaP246V
tACe0f1oXPJRwCw98yIP9CYyb7Jr+1xHWiKCvSjxvLpm8aK/E11ahLKWX0yQKVVs
R3O4y853udeGDKYZ5jG8LdHplgSo1pJ2O6mYvJhsRjOxUx9PX94Kx9BVK2fnVR72
WGrTuH+E3CSNGHORRTbJIHnFmfJ3TkKfZ+hNkUrWhrt0JpsCwRCFR61ySF4W6hZF
mLeBVTwhAFRTCrCeub/7skehc3DfBj9RB6m6QYP/j1JduPWsotgqrS7UwOhsLxYw
Ghv7d6aVH4f3vigZG4K2/hngUG1J3hymxPDh/dDb+6VG/sxop0mSQTwdCb1T5PQO
rfO4JvLGrMkHs2Som0yeX7wLZXAydY2gVavDkl8TfNX6Vwez5KSII5hg+ytovREK
wc4nONRPp67/YgQUnEjwKYNdL+uTHI7QdJf0zVREyRnP8JHPbFLgetjThFvWPqk+
2NKd5MaJoXD1hNOWWd7KU9C2S5x4wJK90OnMrZhBiRAsxn7uZBmtXxJwx1CttEK3
qs0CtL5B4tFerZLiGXdRU+YlpCsriD42N3L6jUFpP+bV+5hjck9H9hTXuxp3aD2c
4vHOASQgoI8Ng6BunL1PMKYmEkx8AWlvBzYrP6NoA60CYx/pQQBRrDZwBh3zAOvZ
FNRTe4vy7gY77lSIODgyceel
=ZQsZ
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIbBAEBCgAGBQJV/aODAAoJEFGOfHJxC/trIkMP+LiyLBGvIWReiG6JO45SDk8C
FQZvtd+WGy+7k8qIiQAlYDWOmWU/xG/s1y8xvAJn3BoKuxB8HLWJ2/NsiDPSfElc
MK44kjZJ8o4xTK2aaguGAKneZag9ux8QPb7JWuDoHB7xKsWQsR0PoRJZEBYKsfos
kLJuBTGylCDy6TcIaPtS/4ucZwZ7Jxz3z9q5+5MVBqnPMDISMrRHCIGj46C0vXTw
kOifFAjQyeq8OyaWWzQ+1/eSP5jXO7AK6/qC9PzslzP/VOFk2LPkucIJchm13uUv
bjB47kmKTGCmW1pB4G7IST2eCILZEkQzBqdlzk0mEuCxhRWmelohjMZyTycbBT0N
uMyyCA8GJhYYaPS7tgEJTvo9MGlacuFsqVD/k1C+da9D+3fBhg6aLTGeJCsJZndb
7SgLLTHTdNKg12rHzTCELqbnnr5SNWUMvKkwDp9N5XXP4gyZvQv0+PcVVtIulel0
OC0/NkMDuLZzfIvnhZLBAiUHwjFatMevstBLA3LFBEk/J16jnhi4sDGgxmO+U//D
pD9+M65GhEG3995j6RESt8CEALjHTgXXtzc0oF4t77iUNmE60BYI4N+Mp6HQKrS3
4RR7LG6jEuLrltZCrhYoSiF2aYApXME2R3GuLrmixEyNcoImDj+h02K3CyBicV7k
RFafPVkiaOXw/NVCcTI=
=8sb1
-----END PGP SIGNATURE-----

The USNS Hughes Glomar Explorer (T-AG-193), now known as the GSF Explorer, from which the so-called “Glomar response” derives its name.

The Central Intelligence Agency (CIA) and Department of Homeland Security Office of Intelligence and Analysis (I&A) have both responded to recent requests under the Freedom of Information Act (FOIA) for all records “related to or mentioning the website Public Intelligence” with a Glomar response, refusing to admit the existence or nonexistence of records related to the request.

The response from I&A states that the request is denied specifically pursuant to Title 50 US Code § 3024(i) and 6 U.S.C. § 121(d)(11), two statutes protecting intelligence sources and methods. The denial states that “the fact of the existence or nonexistence of records pertaining to your request would be exempted from disclosure pursuant to the third exemption of the Freedom of Information Act (FOIA)” and though specific statutes are cited “I&A neither confirms nor denies that such records may or may not exist.”

The response from CIA states that the request is denied due to section 102A(i)(1) of the National Security Act of 1947 as well as section 6 of the CIA Act of 1949. Section 102A(i) of the National Security Act of 1947 as amended requires the Director of National Intelligence to protect “intelligence sources and methods from unauthorized disclosure.” Section 6 of the CIA Act of 1949 as amended references section 102A(i)(1) of the National Security Act and further affirms that the Agency is exempt from the “provisions of any other laws which require the publication or disclosure of the organization, functions, names, official titles, salaries, or numbers of personnel employed by the Agency . . .” In 2010, John Young of Cryptome previously requested information on himself and his website and received a nearly identical response citing the same statutes.

A “Glomar response” is generally provided when an agency’s denial of a request would indicate that records pertinent to the request do, in fact, exist and thus expose either classified information or impact an individual’s privacy.  For example, the Department of Justice Office of Information Policy states that a “FOIA request seeking records which would indicate that a particular political figure, prominent businessman or even just an ordinary citizen has been the subject of a law enforcement investigation may require an agency to flatly refuse to confirm or deny whether such records exist.”  This is also true if the records in question are properly classified as “confirmation or denial of the existence of responsive records would, in and of itself, reveal exempt information.”

The “Glomar response” takes its name from the U.S. Navy Ship Hughes Glomar Explorer, a vessel built by Howard Hughes for his company Global Marine Development Inc.  Though the ship was ostensibly a marine research vessel, it was actually built on behalf of the CIA for an operation called Project Azorian that was focused on salvaging a Russian submarine that had sunk in the middle of the Pacific Ocean in 1969.  After news stories that exposed the operation appeared in both the Los Angeles Times and New York Times in 1975, journalists for both publications revealed that the CIA had made significant efforts to prevent the stories from being published.  A journalist named Harriet Ann Phillippi filed a request for records related to the Agency’s censorship attempts and was provided a response that read “in the interest of national security, involvement by the U.S. Government in the activities which are the subject matter of your request can neither be confirmed nor denied.”

While this may mean that more “lone offender” attacks against U.S. targets are on the way, an assessment from the DHS Office of Intelligence and Analysis sees more sophisticated plots on the horizon. Focusing on a plot disrupted in January 2015 by Belgian authorities in which “a large group of terrorists possibly operating under ISIL direction” were found to have stockpiled explosive precursors and sophisticated weaponry, DHS concludes that the group may have “developed the capability to launch more complex operations in the West.” The assessment titled Future ISIL Operations in West Could Resemble Disrupted Belgian Plot was released to law enforcement last month and was also obtained by Public Intelligence.

An Increase in Suspicious Activity

In the second half of 2014, the volume of ISIL-related suspicious activity reports that were received by state, local and federal authorities “increased sharply,” indicating a trend that “signifies a penetration of ISIL’s messaging into the Homeland.” This increase coincides with the group’s recent military successes including “rapid territorial gains” and the “self-declared re-establishment of a caliphate.” ISIL has also rapidly expanded its English-language messaging to include armies of social media accounts, elaborate and gruesome videos as well as an English-language magazine that highlights life inside of the Islamic State, including “government services” such as “banking, health care and education.” Previous assessments from DHS have noted the “savvy” use of media by ISIL, though the Field Analysis Report studying the group’s legitimacy focuses on the activity this messaging has inspired domestically. According to the report, graffiti, symbols, paraphernalia and other ISIL-related imagery has been reported to law enforcement throughout the U.S.  Personnel at Marine Corps Base Quantico reportedly discovered leaflets with an ISIL banner discussing “coming from Mexico on a train.” Small ISIL flags were found on the windshields of vehicles in a residential neighborhood in Falls Church, Virginia. ISIL stickers have also been reported on highway signs and other public structures in Arizona, Nevada and Texas.

Though suspicious activity reports related to ISIL have increased significantly, many of the reports are likely not a legitimate indicator of ISIL activity. In preparing their Field Analysis Report, fusion center personnel reviewed a number of incidents that resulted in suspicious activity reports being filed into the national Information Sharing Environment and found that half of those were based on anonymous tips “that were likely not credible.” These reports often described “aspirational threats of violence against family or friends, where ISIL-affiliation appeared to be used only as a means to intimidate the victim(s).” The other incidents reviewed, “most of which . . . were also likely not credible” related to public threats against political targets. These include threats made against the President as well as public calls for the assassination of Twitter employees following the company’s suspension of accounts associated with ISIL in 2014. Over one-third of the reports were related to “social media postings” including the dissemination of “official ISIL messaging.”

ISIL’s Legitimacy Surpasses al-Qaeda

Whether the increase in suspicious activity reporting related to ISIL is an accurate indicator of the group’s increasing operational presence or simply an artifact of the group’s increasing notoriety, the Field Analysis Report argues it is a reflection of the group’s increasing legitimacy.  Through its bloody tactics, the group wins converts by asserting their defense of “Muslims against enemy attacks” as well as the defense of the “self-proclaimed re-establishment of the caliphate.”  Citing surveillance of inmate communications conducted by the Bureau of Prisons, the Field Analysis Report lists a number of incidents where U.S. involvement in the Middle East was listed as a justification of ISIL’s tactics.  In multiple conversations with family members, one inmate reportedly stated his belief that the group needed to “finish Shiites and other disbelievers.”  Criminal indictments of U.S. persons inspired by ISIL to either travel overseas or conduct attacks domestically also indicate a “general desire to fight overseas, defend Muslims against aggressors and join like-minded violent extremists.”

ISIL’s attraction among domestic extremists has become so strong that the formal division between the group’s leadership and al-Qaeda has had little effect on their support for both groups.  Individuals arrested for trying to join ISIL, as well as individuals who have traveled overseas to fight with the group, have expressed support for Anwar al-Aulaqi, al-Qaeda in the Arabian Peninsula as well as Jabhat al-Nusra.  This support indicates that potential “homegrown violent extremists” may “embrace the groups’ similarities more than their distinctions.”  However, U.S.-based extremists are “more likely to derive inspiration from ISIL than [al-Qaeda]” or other groups, a judgment which DHS states is “consistent with [the Office of Intelligence and Analysis’] review of all-source reporting on the topic.”  In fact, DHS states that it concurs with the Field Analysis Report’s judgment that “ISIL’s 2014 successes on the ground in Iraq and Syria–especially its declaration reestablishing the caliphate–and sophisticated English-language messaging campaign . . . are key drivers contributing to the group’s support among a small subset of US-based individuals.”

Increasingly Sophisticated Attacks

Along with their rising legitimacy and increasing popular appeal, ISIL has also likely “developed the capability to launch more complex operations in the West.”  An assessment authored by the DHS Office of Intelligence and Analysis in May concludes that future attacks conducted by ISIL could reflect an increasingly “complex, centrally planned plotting” over the “more-simplistic attacks by ISIL-inspired or directed individuals.”  The assessment focuses on a plot disrupted in Belgium earlier this year “involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operatives—some of whom were returning foreign fighters—possibly targeting police or the public.”  The plot may have been directed by members of ISIL and was apparently in an early planning phase as there is no publicly available information about the group’s target.  The raid of a safe house in Verviers, Belgium on January 15, 2015 resulted in a firefight between three suspects involved in the plot and police.  Two of the suspects were ultimately killed and the third was arrested by Belgian authorities.  Items recovered from the safe house as well as other locations in Belgium and several other European countries included “automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash.”

With more than a dozen individuals associated with the plot spread out throughout Europe, including France, Spain, Greece and the Netherlands, the group sought to exploit the “significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing of information about emerging and ongoing threats.”  In fact, the group’s leader Abdelhamid Abaaoud reportedly directed other members via a cell phone from a safe house in Athens, Greece and was able to return to Syria even after the raid in Belgium, despite having international warrants for his arrest.  The group also employed sophisticated operational security measures and were able to acquire weapons and other supplies without being detected by law enforcement due to knowledge gained during their extensive criminal histories.

The DHS assessment finds that the “countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.” One group member reportedly changed his cell phone five times, instructed other members of the group to frequently switch vehicles and to examine their surroundings for hidden microphones and other surveillance equipment. Communications between group members often occurred in several different languages and used coded language to hinder translation efforts. The group utilized an assortment of fraudulent identification documents and kept a large amount of cash “intended to fund some of the group’s procurement activities and to conceal purchasing patterns.”

These efforts to conceal their activities indicate that the group was “likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.”  One group member Souhaib el Abdi reportedly “had previous experience with trafficking forged documents” and much of the equipment held in their Belgian safe house “including Kalashnikov rifles, handguns, ammunition, and materials to make explosives” is believed to have been acquired illegally.  Though security measures employed by the group could make it more difficult for law enforcement to discover potential plots, the DHS assessment argues that they may also provide an opportunity to “detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious intentions” and “awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States.”

The post The Increasing Sophistication and Legitimacy of the Islamic State first appeared on Public Intelligence.]]> https://publicintelligence.net/the-increasing-sophistication-of-the-islamic-state/feed/ 0 https://publicintelligence.net/dod-blocks-public-intelligence/ https://publicintelligence.net/dod-blocks-public-intelligence/#respond Fri, 22 May 2015 02:42:20 +0000 http://publicintelligence.net/?p=31032 U.S. Cyber Command (CYBERCOM) has blocked access to the Public Intelligence website (publicintelligence.net) as well as at least 2,484 other "WIKILEAKS-related websites" on their unclassified network.

Read more →

The post U.S. Cyber Command Blocking Public Intelligence and Nearly 2,500 “WikiLeaks-Related” Websites first appeared on Public Intelligence.]]>

A block page displayed when users on military networks attempt to access this website.

U.S. Cyber Command (CYBERCOM) has blocked access to the Public Intelligence website (publicintelligence.net) as well as at least 2,484 other “WIKILEAKS-related websites” on their unclassified network.

The block was first reported in June 2012 by a regular contributor to Phibetaiota.net, a website run by former CIA officer and longtime proponent of open-source intelligence Robert David Steele.  An anonymous contributor to the blog reported that CYBERCOM had “blocked access to www.publicintelligence.net from DoD computers” for unstated “operational reasons.”  The article described the contents of the notice that is displayed when users attempt to access the site and stated that the “block category” was listed as: “USCC_WIKILEAKS_BLOCK.”  According to other individuals who have experienced the block, a message is displayed indicating that you have “attempted to access a blocked website” and that access has been denied for unstated “operational reasons by the DOD Enterprise-Level Protection System.”  The notice also instructs the user to “contact your local Network Control Center” to gain access to blocked websites that are “mission essential.”

An email from an intelligence analyst with the U.S. Army TRADOC G2 Intelligence Support Activity (TRISA) requesting access to this website.

In March 2013, a U.S. Army intelligence analyst did just that: she requested that an exception be made for her unit to access the site in order to conduct official research.  The analyst’s request is contained in a 15-page document from the U.S. Army’s Network Enterprise Technology Command (NETCOM) that was released following a request under the Freedom of Information Act (FOIA).  The document contains a chain of emails between members of the U.S. Army TRADOC G2 Intelligence Support Activity (TRISA) and IT Specialists with NETCOM.  In an email dated March 7, 2013, an analyst with the Contemporary Operational Environment and Threat Integration Directorate (CTID) within TRISA states that “CTID requests access to this website http://publicintelligence.net/” and adds that “we all use this website for official open source research to support [REDACTED].”

The request was referred to members of the 106th Signal Brigade under NETCOM who requested a memorandum for record stating that access was required for official business and had been approved by the unit’s information assurance manager.  The request appeared to be moving along until late April 2013 when the 106th Signal Brigade informed the IT personnel at TRISA that the block was a CYBERCOM block related to WikiLeaks.  In an email from April 23, 2013, NETCOM informed all parties involved in the effort to unblock the site that “TRISA has withdrawn their request for access to the site” after being informed by IT personnel at TRISA that “this was considered a wiki leak [sic] type site so this can be closed with no further action and if she needs access to this site she can use [REDACTED].”  In another email regarding the retraction of the request, NETCOM personnel discussed how “once the user requesting the unblock realized the site was a wiki leaks block, they decided they would use the [REDACTED].”

A response from the 106th Signal Brigade stated that “info.publicintelligence.net is blocked by the United States Cyber Command under the category of wikileaks” and cites several tasking orders and all army activities (ALARACT) messages distributed in support of the WikiLeaks block.  Two of those ALARACTs were previously obtained by Public Intelligence and discuss preventative measures taken to limit the unauthorized dissemination of information and protect “sensitive information in the public domain.”  ALARACT 245-2010 explicitly forbids Army personnel from viewing any classified information released by WikiLeaks because it would introduce classified material onto unclassified networks where it may not be properly safeguarded:

ARMY PERSONNEL MUST BE VIGILANT WITH REGARD TO THE INFORMATION POSTED ON THE WIKILEAKS WEBSITE AND ANY OTHER WEBSITE THAT PURPORTS TO PUBLISH CLASSIFIED INFORMATION. VIEWING, DOWNLOADING OR PRINTING INFORMATION FROM THE WEBSITE COULD POTENTIALLY EXPOSE ARMY NETWORKS TO SENSITIVE DATA OR CREATE SITUATIONS IN WHICH DATA IS IMPROPERLY SAFEGUARDED THUS HARMING OUR ABILITY TO CONDUCT MISSIONS VITAL TO OUR NATIONAL DEFENSE. INFORMATION MARKED AS CLASSIFIED BUT IN THE PUBLIC DOMAIN IS NOT CONSIDERED DECLASSIFIED UNTIL ASSESSED BY THE APPROPRIATE ORIGINAL CLASSIFICATION AUTHORITY AND A DETERMINATION ON ITS DISPOSITION AND CONTINUED CLASSIFICATION IS RENDERED.

Similar notices were disseminated by the Air Force, Navy, White House and a number of other government agencies in 2010 following the release of hundreds of thousands of U.S. diplomatic cables by WikiLeaks.

In response to a FOIA request for records related to the WikiLeaks block, CYBERCOM confirmed that in November 2013 there were 2,484 “WIKILEAKS-related websites” blocked on “their unclassified network.”  However, the release of a forty-six page document listing these websites was denied on the grounds that the information was properly classified and its release could “risk circumvention of the law.”

A Pattern of Blocking

In June 2013, it was revealed that the DoD has been blocking access to news stories regarding the disclosure of classified NSA documents by Edward Snowden.  According to Pentagon spokesman Lt. Col. Damien Pickart, any website that chooses to “post information the department deems classified” will have that content “filtered” rendering it “inaccessible from DoD networks so long as it remains classified.”  Public Intelligence has not posted any of the material revealed by Snowden or WikiLeaks and hosts only a small number of previously classified documents that have been publicly revealed in media reports.  Lt. Col. Pickart told U.S. News & World Report that the DoD “does not determine what sites its personnel can choose to visit while on a DoD system, but instead relies on automated filters that restrict access based on content concerns or malware threats.”

Pickart also made clear that DoD is not “going to block websites from the American public in general, and to do so would violate our highest-held principle of upholding and defending the Constitution and respecting civil liberties and privacy.”  However, Pickart’s statements are contradicted by the experiences of individuals who have encountered the CYBERCOM block.  Users report encountering the block on documents that are unclassified and, in some cases, have no control markings at all.

In addition to the CYBERCOM block, the army’s Continental U.S. (CONUS) Network Operations and Security Center (C-TNOSC) has also previously blocked portions of the Public Intelligence website from being accessed on army computers.  Visitors report that attempts to access information on the site have been met with the following notice:

“The site you have requested has been blocked by Team CONUS (C-TNOSC/RCERT-CONUS) due to malware being hosted on the site”

The U.S. Army block has apparently been in effect since at least February 2012.  A number of forum postings and comments on a variety of websites make reference to the block.  There are no independent reports of malware being hosted on the Public Intelligence website and all public security directories list the site as safe.  When contacted for comment, U.S. Network Enterprise Technology Command spokesperson Gordon Van Vleet told Public Intelligence that he was unable to provide any information on the block.

The post U.S. Cyber Command Blocking Public Intelligence and Nearly 2,500 “WikiLeaks-Related” Websites first appeared on Public Intelligence.]]> https://publicintelligence.net/dod-blocks-public-intelligence/feed/ 0 https://publicintelligence.net/persistent-domestic-extremist-threat/ https://publicintelligence.net/persistent-domestic-extremist-threat/#respond Sun, 19 Apr 2015 23:01:20 +0000 https://publicintelligence.net/?p=35593 A joint intelligence bulletin released by the Department of Homeland Security and FBI to coincide with the twentieth anniversary of the Oklahoma City Bombing warns that "domestic extremism will remain a persistent threat through the end of 2015 and beyond" with "high confidence that lone offenders and those who pursue leaderless resistance continue to pose the greatest threat of violence." The bulletin, which is based on "recent patterns of extremist activity" often "taken by those who plan and act alone or in small cells," states that domestic extremism "remains a persistent threat, and the United States has experienced violent ideologically-motivated criminal acts, both prior to and after the Oklahoma City attack" including "assaults, arsons, shootings, and use, or attempted use, of improvised incendiary and explosive devices, resulting in death, injury, and property damage." Moreover, the bulletin states that "many of the same motivations used by domestic extremists to justify their criminal acts in the mid-1990s—anti-government and anti-law enforcement sentiment; racial, ethnic, and religious hatred; and advocacy of violent conspiracy theories—continue to influence domestic extremists and their targeting choices in 2015."

Read more →

The post On Twentieth Anniversary of Oklahoma City Bombing, Feds Warn of Domestic Extremist Threat first appeared on Public Intelligence.]]>

A photo of the Alfred P. Murrah Federal Building following the Oklahoma City Bombing on April 19, 2015.

A joint intelligence bulletin issued by the Department of Homeland Security and FBI to coincide with the twentieth anniversary of the Oklahoma City Bombing warns that “domestic extremism will remain a persistent threat through the end of 2015 and beyond” with “high confidence that lone offenders and those who pursue leaderless resistance continue to pose the greatest threat of violence.”  The bulletin, which is based on “recent patterns of extremist activity” often “taken by those who plan and act alone or in small cells,” states that domestic extremism “remains a persistent threat, and the United States has experienced violent ideologically-motivated criminal acts, both prior to and after the Oklahoma City attack” including “assaults, arsons, shootings, and use, or attempted use, of improvised incendiary and explosive devices, resulting in death, injury, and property damage.”  Moreover, the bulletin states that “many of the same motivations used by domestic extremists to justify their criminal acts in the mid-1990s—anti-government and anti-law enforcement sentiment; racial, ethnic, and religious hatred; and advocacy of violent conspiracy theories—continue to influence domestic extremists and their targeting choices in 2015.”

The bulletin, titled “Twenty Years after Oklahoma City Bombing, Domestic Extremism Remains a Persistent Threat,” was originally posted online to a public website associated with the Northwest Warning, Alert and Response Network (NW-WARN), a “collaborative effort between government and private sector partners” throughout the region “with a goal to maximize real-time sharing of situational information without delay and provide immediate distribution of intelligence to those in the field who need to act on it.”  The bulletin has since been removed.  However, Public Intelligence was able to obtain a copy of the bulletin prior to its removal from the site.

To illustrate the “scale of the current threat” from domestic extremists, the bulletin cites eighteen incidents between January 1, 2014 and April 1, 2015 that were “conducted by individuals inside the United States in furtherance of political or social agendas without foreign direction, are criminal and violent in nature and caused, or could have reasonably caused death, grievous harm, or financial losses of at least $1 million.”  The incidents vary both in scope and motivation, from a 52-year-old woman from Austin, Texas who threw a Molotov cocktail at a Planned Parenthood facility in March to a plot by a “Moorish sovereign citizen” to kill the police chief of Ferguson, Missouri following protests over the killing of Michael Brown last year.  In addition to attacks perpetrated by Earth Liberation Front members and other left-wing extremists, the bulletin also highlights the events that occurred in April 2014 at the Bundy Ranch in Bunkerville, Nevada in which dozens of “militia extremists converged on a Nevada ranch to prevent [the Bureau of Land Management] from executing a court order to seize cattle in a dispute over unpaid grazing fees.”  These “militia extremists” in association with “individuals from across the country . . . who reacted to reports about altercations between BLM personnel and the rancher’s family and supporters that alleged unnecessary excess on the part of the US Government” eventually engaged in an “armed standoff and the ultimate suspension of the BLM operation due to militia extremist threats.”

The bulletin also contains a list of the various types of domestic extremists recognized by the DHS and FBI, including animal rights extremists, black separatist extremists, militia extremists and sovereign citizen extremists:

(U//FOUO) Domestic Extremists: individuals present in the United States who seek to further political or social goals, wholly or in part, through unlawful acts of force or violence. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected. This definition does not include or describe homegrown violent extremists, who are defined by the FBI as al-Qa‘ida-inspired individuals based in the United States and radicalized primarily in the United States, and are not directly collaborating with a foreign terrorist organization.

(U//FOUO) Animal Rights Extremists: individuals who seek, wholly or in part, through unlawful acts of force or violence, to further their opposition to people, businesses, or government entities perceived to be exploiting or abusing animals. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

(U//FOUO) Black Separatist Extremists: individuals who seek, wholly or in part, through unlawful acts of force or violence, to attain separation from the non-black US population. This separation includes, but is not limited to, physical separation, political separation, or social separation as demonstrated by separate communities, political institutions, or social organizations. This desire for separation is typically based on either a religious or political belief system, which is sometimes formed around or includes a belief in racial superiority or supremacy. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

(U//FOUO) Environmental Extremists: individuals who seek, wholly or in part, through unlawful acts of force or violence, to further their opposition to people, businesses, or government entities perceived to be destroying, degrading, or exploiting the natural environment. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

(U//FOUO) Lone Offenders: individuals who, operating alone or without the witting support of others, seek to advance, wholly or in part, a particular ideology or social agenda through unlawful acts of force or violence in violation of federal law.

(U//FOUO) Militia Extremists: individuals who seek, wholly or in part, to engage in unlawful acts of force or violence in response to perceived abuses of power or authority by government, perceived threats to Constitutional rights by government, or bureaucratic incompetence in attending to critical tasks. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

(U//FOUO) Sovereign Citizen Extremists: individuals who openly reject their US citizenship status, believe that most forms of established government, authority, and institutions are illegitimate, and seek, wholly or in part, through unlawful acts of force or violence, to further their claim to be immune from government authority. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

(U//FOUO) White Supremacist Extremists: individuals who seek, wholly or in part, through unlawful acts of force or violence, to support their belief in the intellectual and moral superiority of the white race over other races. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics may not constitute extremism, and may be constitutionally protected.

The post On Twentieth Anniversary of Oklahoma City Bombing, Feds Warn of Domestic Extremist Threat first appeared on Public Intelligence.]]> https://publicintelligence.net/persistent-domestic-extremist-threat/feed/ 0 https://publicintelligence.net/isil-savvy-media-western-youth/ https://publicintelligence.net/isil-savvy-media-western-youth/#respond Thu, 26 Mar 2015 02:34:28 +0000 https://publicintelligence.net/?p=35490 The "innovative use of social media and messaging" by the Islamic State of Iraq and the Levant (ISIL) "has played a key role in motivating young Western males and females to travel to the Syrian conflict to join and support the self-declared Islamic State" according to a join intelligence bulletin released by the Department of Homeland Security and FBI last month. The 5-page bulletin titled "ISIL Social Media Messaging Resonating with Western Youth" was disseminated to law enforcement throughout the country at the end of February to report on the "continuing trend" of Western youth being inspired to travel to Syria and join ISIL forces. According to the bulletin, this trend is aided by the fact that "Western youth are willing to connect over social media with like-minded persons, and have proven adept at obfuscating such social media usage from their parents and guardians."

Read more →

The post Feds Issue Bulletin Warning ISIL’s “Savvy” Use of Media is Resonating with Western Youth first appeared on Public Intelligence.]]>

Three British teenagers Shamima Begum, 15, Kadiza Sultana, 16, and Amira Abase, 15, who traveled last month to Turkey before crossing the border into Syria to join the Islamic State of Iraq and the Levant (ISIL).

The “innovative use of social media and messaging” by the Islamic State of Iraq and the Levant (ISIL) “has played a key role in motivating young Western males and females to travel to the Syrian conflict to join and support the self-declared Islamic State” according to a joint intelligence bulletin released by the Department of Homeland Security and FBI last month.  The 5-page bulletin titled “ISIL Social Media Messaging Resonating with Western Youth” was disseminated to law enforcement throughout the country at the end of February to report on the “continuing trend” of Western youth being inspired to travel to Syria and join ISIL forces.  According to the bulletin, this trend is aided by the fact that “Western youth are willing to connect over social media with like-minded persons, and have proven adept at obfuscating such social media usage from their parents and guardians.”

ISIL’s “savvy media packaging” has helped it gain “widespread attention” among both male and female youth demographics, particularly those “who are already radicalized to violence.”  The group’s “Western-focused messaging frequently features fluent English speakers, including Western youth, with whom audiences probably are able to relate” including “several videos featuring high-tech filming and editing” that likely intensifies the “appeal of these messaging efforts.”  Their videos “often include dramatic shots and sound effects to further the viewer’s tension and interest” as well as “graphics and chronological layout” making them “more like documentary films.”

Moreover, ISIL’s resonance with “with female youths is unprecedented and has prompted a number to attempt to travel to Syria.”  While “most females appear motivated to travel based on a desire to live in ISIL’s self-declared state” rather than participate in the conflict, the effectiveness of the group’s messaging demonstrates “ISIL’s broad appeal across demographic boundaries.”  The joint intelligence bulletin cites a number of instances where Western youth have attempted to travel to Syria to join ISIL and states that “Western teenagers currently in Syria are known to have accessed violent extremist messaging for guidance on means and routes for traveling to Syria.”  An article earlier this month in the British newspaper The Independent cited Helen Ball, the London Metropolitan Police Service Senior National Coordinator for Counterterrorism, as saying that at least sixty British women, including girls as young as fifteen, have traveled to Syria in the hopes of joining ISIL.

A significant number of American youths have also attempted to “radicalize others to violence, establish contact with like-minded individuals, and travel to Syria to join the group.”  The Wall Street Journal reported earlier this month that at least one-hundred and eighty Americans have traveled or attempted to travel to join ISIL in Syria.  The Justice Department has prosecuted nearly thirty cases related to ISIL in the last eighteen months and the FBI claims to have ISIL-related investigations open in all fifty states.

Some of the cases do not involve direct attempts to travel to Syria, but rather efforts to help others join ISIL often using social media.  One case cited in the joint intelligence bulletin involves a Virginia teenager who was arrested in February for encouraging others to join ISIL and even facilitating travel arrangements.  The DHS-FBI bulletin states that “ISIL messaging likely influenced [the teenager] to create, produce, and disseminate violent extremist messaging via social media to radicalize other youth to violence” as well as “establish connectivity with violent extremists overseas, connect with like-minded aspirants, and distribute ISIL messaging to a network of friends and followers.”  One of his associates reportedly was successful in traveling to Syria to join ISIL.  An article in the Washington Post about the case states that the boy was viewed by community members who knew him as a quiet, though typical teenager.  He was “taking Advanced Placement classes and listed some of his interests as civil rights and social action.”

The post Feds Issue Bulletin Warning ISIL’s “Savvy” Use of Media is Resonating with Western Youth first appeared on Public Intelligence.]]> https://publicintelligence.net/isil-savvy-media-western-youth/feed/ 0 https://publicintelligence.net/vfc-violent-protesters-reddit/ https://publicintelligence.net/vfc-violent-protesters-reddit/#comments Tue, 17 Mar 2015 02:25:40 +0000 https://publicintelligence.net/?p=35457 A bulletin issued in December 2014 by the Virgina Fusion Center (VFC) warned law enforcement and first responders that emergency vehicles could be targeted by violent protesters seeking to retaliate against the perceived surveillance of their activities. The bulletin, which is titled "Malicious Activists May Promote Harm to Emergency Management Vehicles Observed During Violent Protests," draws its conclusion that "violent or malicious activity" could be directed toward emergency vehicles "operating near protest areas" based primarily upon comments to a post on Reddit and a protest guide posted anonymously on Pastebin.

Read more →

The post Comments on Reddit Led to Virginia Fusion Center Warning on Protesters Attacking Emergency Vehicles first appeared on Public Intelligence.]]>

A video posted to YouTube in December 2014 by activists associated with Anonymous that appears to show Chicago police officers discussing surveillance of protesters.

A bulletin issued in December 2014 by the Virgina Fusion Center (VFC) warned law enforcement and first responders that emergency vehicles could be targeted by violent protesters seeking to retaliate against the perceived surveillance of their activities. The bulletin, which is titled “Malicious Activists May Promote Harm to Emergency Management Vehicles Observed During Violent Protests,” draws its conclusion that “violent or malicious activity” could be directed toward emergency vehicles “operating near protest areas” based primarily upon comments to a post on Reddit and a protest guide posted anonymously on Pastebin.

Following the decision last year by a Missouri grand jury not to indict police officer Darren Wilson in the killing of unarmed black teenager Michael Brown, protests have taken place throughout the nation.  One particular protest held in Chicago on November 28, 2014, just days after the decision, gained attention online after numerous protesters noticed a Chicago Office of Emergency Management and Communications (OEMC) vehicle that followed them as they marched through the city streets. Several posts on Twitter and other social media platforms include pictures of the vehicle with some protesters noting that their phone begins to malfunction and behave strangely when the vehicle is near. After the photos began to spread on social media, there was rampant online speculation that the vehicle may have contained a Stingray IMSI-catcher produced by Harris Corporation and used by law enforcement to intercept cellular communication content including calls, text messages and other data.

The protesters’ speculations were further bolstered when a video was posted on YouTube by activists associated with the group Anonymous that featured recordings of police scanner traffic where an officer appears to discuss the ability of the local police fusion center to intercept cellular phone calls made by the protesters:

Dispatch: “CPIC [Crime Prevention and Information Center] on the air for a mobile”
CPIC Officer: “Go ahead”
Car 41 Officer: “Yeah one of the girls is kind of an organizer here, um, she’s been on her phone a lot. Are you guys picking up any information, uh, where they’re going, possibly?”
CPIC Officer: “Yeah we’ll keep an eye on it, we’ll let you know if we hear anything.”
Car 41 Officer: “10-4. They’re compliant, and they’re, they’re doing ok now but she’s spending a lot of time on the phone.”
CPIC Officer: “10-4”

A post on the excellent PrivacySOS blog authored by Kade Crockford, director of the ACLU of Massachusetts’ Technology for Liberty Project, covered the protesters’ observations as well as video released by Anonymous. The post, which is directly cited in the VFC bulletin, also mentioned that a local news outlet had identified the potential target of the police surveillance mentioned in the Anonymous video as Kristiana Rae Colón, daughter of Chicago alderman Rey Colón and organizer of the #BlackLivesMatter protest that was being held that day.  The blog post on PrivacySOS was later linked to in the news section of Reddit, leading to more than five-thousand positive votes and two-thousand comments. The VFC issued its bulletin warning law enforcement that “emergency management vehicles operating near protest areas may be targeted by precipitating violent or malicious activity” primarily because a few comments on Reddit, several of which appear to be facetious, suggest using violent tactics against the Chicago OEMC vehicle or otherwise sabotaging its surveillance capabilities.

One comment highlighted in the bulletin states if “someone were to accidentally operate a device at protests that happened to operate at the frequencies that truck is using” that it would “block their transmissions.” Another commenter says “if you see one of those cars” at a protest, just “make a bunch of calls saying ‘I think I just overheard someone saying there was a bomb'” on the other side of town. More interestingly, a comment is included in the bulletin because it references Virginia, despite the fact that the comment simply notes that a vehicle like this exists in “Chesterfield VA and it’s only supposed to be used with a court order or a search warrant.” These comments are described in the bulletin as commenters expressing “interest in responding to similar vehicles via technical, subversive, or violent means.”

These violent or malicious intentions are further exemplified, according to the bulletin, by an anonymous post on Pastebin from December 6, 2014 titled “Stingback: A Short, Emergency Guide for Activists Being Spied on by Chicago Police Stingrays (and very likely other police departments).” The guide provides a few simple actions protesters can take to help protect themselves from police surveillance while organizing, including using separate phones for personal and protest activities, using encrypted communication apps such as the products of Open Whisper Systems including TextSecure, RedPhone and Signal, as well as turning off a phone’s location tracking features. One of the last suggestions in the guide, which mentions physically inhibiting the movements of the vehicle, is what led to it being cited in the VFC bulletin. VFC warns law enforcement that “emergency management vehicles deployed to potential protest areas, particularly areas which may have a propensity for violence, should exercise caution” and “be aware that they may be targeted by non-violent methods in order to inhibit their vehicle movements in the area.”

At no point in the VFC bulletin is the fundamental claim of the protesters addressed: that surveillance of the protesters’ communications based solely on the fact that they are engaging in free speech activities is a violation of their Constitutional rights. In fact, this point is made explicitly clear in the Department of Homeland Security and Department of Justice’s guidelines on policing First Amendment-protected events which states that “collecting, maintaining, using, or sharing information regarding persons or groups solely because they are involved in constitutionally protected activity” is prohibited, as is “collecting, maintaining, using, or sharing information regarding persons or groups solely because of the content of their speech.”

The post Comments on Reddit Led to Virginia Fusion Center Warning on Protesters Attacking Emergency Vehicles first appeared on Public Intelligence.]]> https://publicintelligence.net/vfc-violent-protesters-reddit/feed/ 1 https://publicintelligence.net/fbi-copy-cat-police-attacks/ https://publicintelligence.net/fbi-copy-cat-police-attacks/#respond Thu, 01 Jan 2015 03:09:29 +0000 http://publicintelligence.net/?p=35151 The FBI has issued a National Situational Information Report (NSIR) to law enforcement around the country warning of "copy cat assassinations" following the murder of two New York Police Department (NYPD) officers in December. The report, which was issued days before Christmas and posted online by a lodge of the Chicago Fraternal Order of Police, states that the "recent murders of New York City Police Officers Wenjian Liu and Rafael Ramos have spawned numerous threats" against law enforcement personnel.

Read more →

The post FBI Warns Law Enforcement of Copy Cat Attacks Following Murders of Two NYPD Officers first appeared on Public Intelligence.]]>

Photos of NYPD officers Rafael Ramos and Wenjian Liu who were murdered on December 20, 2014 by Ismaaiyl Brinsley in apparent retaliation for the deaths of Michael Brown and Eric Garner.

The FBI has issued a National Situational Information Report (NSIR) to law enforcement around the country warning of “copy cat assassinations” following the murder of two New York Police Department (NYPD) officers in December. The report, which was issued days before Christmas and posted online by a lodge of the Chicago Fraternal Order of Police, states that the “recent murders of New York City Police Officers Wenjian Liu and Rafael Ramos have spawned numerous threats” against law enforcement personnel. The report states that Ismaaiyl Brinsley, the man who reportedly shot the two NYPD officers, claimed to be part of a nationwide group planning to kill police officers:

“As of November 2014, USPER Ismaaiyl Brinsley, responsible for the shooting of two New York City Police officers on 20 December 2014, claimed to be a member of an unidentified group that was “going to get a lot of cops in Florida, Las Vegas, and California for New Year’s.” Ismaaiyl Brinsley also discussed travel plans via Amtrak with two other individuals known as “Larry” and FNU LNU (NFI) [First Name Unknown Last Name Unknown (No Further Information)].”

Brinsley, who was initially identified in the media as a member of the national prison gang the Black Guerrilla Family, was later said to have no connection to the gang. However, the day before the murders were committed, the Baltimore FBI office issued a bulletin stating that they had received “reliable information” that members of the gang were planning to target white law enforcement officers to “send a message.” The FBI NSIR mentions this as well as information that indicates the “Heartless Felons Gang, an Ohio street gang, gave its members orders to kill white police officers in the Cleveland area to avenge black lives taken by white police officers.”

Several online threats against law enforcement are also documented in the FBI NSIR including statements made by a man on the East Orange New Jersey Police Department’s Google plus page that he wanted to kill law enforcement officers. The Department of Homeland Security questioned another man at his home in Memphis, Tennessee after he posted online that he was “heading to New York City to kill two more police officers.” The man allegedly wrote “Good Job #F-K12 Kill em all i’m on my way to NY now #shootthepolice 2 more going down tomorrow.” No charges were ultimately filed as the man stated he was intoxicated when he wrote the post.

The FBI NSIR also includes a YouTube comment made by a man later identified as Jeremiah Perez of Colorado Springs:

“SINCE DARREN WILSON our group has killed 6 retired sheriffs and cops……because of this event we will hunt two more in colorado this week…..for every innocent citizen that cops kill WE, VETERANS WILL KILL RETIRED HELPLESS COPS……..we already started and MORE TO COME NOW…….join us and kill any cop or any retired cop !!!!!!! MORE PEOPLE HAVE BEEN KILLED SINCE THE PROTEST !!! THEY DONT CARE, SO NOW REAL HEROS WILL HUNT THEM ALL !!! fuck ISIS, COPS ARE THE REAL ENEMIES OF FREEDOM LOVING AMERICANS and TIME TO STRIKE BACK IN ALL OUT WAR IS NOW !!”

The comment ultimately led to the man’s arrest on federal charges under 18 USC §875, using interstate communications to convey threats of injury against an individual. A criminal complaint written against Perez and posted on the Department of Justice’s website states that the FBI was alerted to Perez’s comment after Google voluntarily notified law enforcement because of the comment’s threatening content. The complaint includes the entire notice provided to the FBI by Google, which states that “based on the content of a post/comment to a YouTube video on Google Plus Social Media, Google Inc. believes that there presently exists an emergency involving imminent death or serious bodily injury to a person or persons, and that immediate disclosure to you of certain information is required to avert the emergency.” After obtaining a search warrant based on the IP address provided by Google, the FBI seized Perez’s computer and interviewed him. He admitted posting the comments and stated that his comments “were the result of misplaced frustration and a way of experimenting with words.”

Forensic examination conducted by the FBI of Perez’s computer revealed a number of other posts to YouTube and other websites using the screen name “Vets Hunting Cops,” including searches that were conducted for the following terms:

“Kill Sara Palin, Kill Barack Obama, Kill Cory Gardner, Kill Darren Wilson, Find and Kill Darren Wilson, Kill Fox Pundints, Fox News Headquarters, Kill Fox News Racist, Kill Bill O’Reilly, Fox News Headquarters gets bombed, Someone Kill Fox News, Kill the Cops, Beaver Creek City Police Department, How to Find Somebody on YouTube, How to Find Somebody’s IP Address Through YouTube, Kill Ted Cruz, Kill M itch McConnell, Calls to Assassinate GOP Leaders, Google Maps for Fox News Headquarters, Hunt Darren Wilson’s Family, St. Louis Police Officer’s Association, Darren Wilson Prosecutor, Locate Bill O’Reilly’s house.”

Perez reportedly admitted to FBI agents that he had conducted the searches, but said that he had no intention of following through with the actions he was researching. Perez now faces up to five years in prison.

A photo of Michael Zehaf-Bibeau who shot a Canadian solider on October 22, 2014 in an attack on Parliament Hill that was reportedly inspired by Islamic State of Iraq and the Levant (ISIL).  The photo was taken by a tourist at the beginning of Zehaf-Bibeau’s attack.

An intelligence assessment released last month by the Department of Homeland Security’s Office of Intelligence and Analysis found that a domestic terrorist attack conducted by individuals affiliated with or inspired by the Islamic State of Iraq and the Levant (ISIL) would most likely “employ tactics involving edged weapons, small arms, or improvised explosive devices (IEDs).”  The assessment, which was obtained by Public Intelligence, was released in October following several recent attacks conducted in Europe and Australia by individuals sympathetic to ISIL.  Based on a review of these and other planned attacks, analysts at DHS evaluated the tactics and targets, as well as operational security measures employed in order to determine “tactics, targets, and tradecraft that potentially could be used in the Homeland by individuals associated with or inspired” by ISIL.

The assessment concludes that the “most likely perpetrators of a potential ISIL-directed or inspired Homeland attack include individuals acting under the direction of foreign-based terrorists, returning foreign fighters, and those who are inspired by the ongoing conflict in Syria and Iraq but who cannot or will not travel overseas.”  These individuals would likely use “edged weapons, small arms, or improvised explosive devices (IEDs)” to attack targets that provide an “opportunity to successfully execute an attack that would garner media attention.”  For example, recent plots in Europe and Australia have targeted public gatherings, government employees and Jewish facilities.

Several attacks in Europe over the last year have shown the willingness of former ISIL fighters to conduct attacks once they return to their home countries.  In February, a man named Ibrahim Boudina was arrested in France after returning from Syria where he reportedly fought with ISIL.  During a search in Greece, where Boudina had been entering into Europe, authorities discovered a USB drive with instructions on making explosives.  A French-Tunisian friend of Boudina was also arrested in Italy after returning from Syria.  A week after the arrest, members of the French security service reportedly discovered “a handgun, bomb-making instructions, and three soda cans filled with the high-explosive compound TATP” in an apartment complex owned by Boudina’s father.

In May, a French citizen that is believed to have fought with ISIL in Syria shot and killed four people at a Jewish museum in Brussels, Belgium.  When the man was arrested several weeks after the attack, he was found to be in possession of an ISIL flag as well as an automatic rifle that was believed to have been used in the attack.

An image from the DHS intelligence assessment released in October highlights various plots in Europe and Australia, providing examples of their tactics and targets as well as operational security measures employed by the attackers.

In September, Australian authorities arrested fifteen individuals suspected of planning to kidnap and behead members of the public on behalf of ISIL.  The plot was allegedly foiled after communications were intercepted between a “Syria-based Australian senior ISIL member and a Sydney-based group member discussing a plot reportedly centered on filming the murders of randomly selected individuals in Sydney, which would then be sent to ISIL’s media wing to disseminate via social media.”  According to the DHS assessment, the plot is an example of the “potential threat posed by individuals who have not traveled to Syria or Iraq, but who maintain contact and take some level of direction from overseas-based ISIL leaders.”

A similar incident mentioned in the assessment also occurred in September when an eighteen-year-old Australian who had publicly expressed his support for ISIL stabbed two police officers after volunteering to meet with counterterrorism task force members as part of an ongoing investigation.  Less than a week after the assessment’s publication by DHS, a Canadian citizen named Michael Zehaf-Bibeau shot a soldier at the Canadian War Memorial in an attack that was reportedly inspired by ISIL and entered a building on Parliament Hill before being shot by police.

A Twitter account purporting to be operated by Junaid Hussain, also known as Abu Hussain Al Britani, who was sentenced to six months in prison in 2012 for hacking an email account associated with former Prime Minister Tony Blair and flooding the U.K. national anti-terror hotline with automated calls.

The FBI Cyber Division has issued a notification to private industry and law enforcement to be aware of the potential for retaliatory cyber attacks following recent U.S. military actions in the Middle East. While the FBI has “no information at this time to indicate specific cyber threats to US networks or infrastructure in response to ongoing US military air strikes against the terrorist group known as the Islamic State of Iraq and the Levant (ISIL)” the bulletin states that the FBI believes that “extremist hackers and hacktivist groups, including but not limited to those aligned with the ISIL ideology, will continue to threaten and may attempt offensive cyber actions against the United States in response to perceived or actual US military operations in Iraq or Syria.”

The bulletin titled “Threat of Cyberterrorist and Hacktivist Activity in Response to US Military Actions in the Middle East” was released last Wednesday and is based on “recent, nonspecific, and probably aspirational threats made on social media platforms to carry out cyber as well as physical attacks in response to the US military presence in the Middle East.” The bulletin, which was obtained by Public Intelligence, states that “Middle East-based hacktivist groups and extremist cyber actors have previously targeted US commercial and government Web sites in response to a range of US military actions and foreign policy positions” using tactics such as “Cross Site Scripting (XSS), Structured Query Language (SQL) Injection, and TCP/UDP Flooding for defacement and DDoS attacks.” According to the FBI, web site defacements “conducted by these actors will likely contain messages expressing support for ISIL, and/or contain imagery such as the black ISIL flag or graphic imagery, e.g., pictures or videos of ISIL executions.”

Previous examples of hacktivist attacks motivated by U.S. military actions are included in the bulletin including an incident in May 2014 in which the “Tunisian Hackers Team threatened Distributed Denial of Service (DDoS) attacks against the US financial sector unless US military forces were withdrawn from presumed-Islamic lands.” The bulletin also cites numerous threatening posts on Twitter and identifies several accounts that have expressed support for ISIL, some of which have even provided guidance on tools that could potentially be used in a cyber attack.  One particularly interesting example cited in the bulletin is the case of Junaid Hussain, a British man who pleaded guilty in 2012 to charges related to the hacking of an email account connected with former Prime Minister Tony Blair.  Hussain, who was just sixteen at the time the hacking occurred, was involved in the compromise of a Gmail account used by Blair’s adviser Katie Kay and later posted private contact information obtained from the account.  As part of the hacking group TeaMp0isoN, Hussain also participated in an attack that flooded the the U.K.’s national anti-terror hotline with automated calls, including some prank calls that are still available on YouTube.  After serving six months in a youth detention facility, Hussain was arrested on suspicion of “violent disorder” in late 2013 and while on bail fled to Syria with a 24-year-old rapper named Abdel-Majed Abdel Bary.  He is now reportedly fighting with ISIL and goes by the name Abu Hussain Al Britani.  A Twitter account reportedly operated by Hussain features a profile photo depicting him pointing an AK-47 at the camera and a bio that reads “random British mujahid somewhere in the Islamic State.”

A recent tweet from Junaid Hussain featuring a photo of a RPG and AK-47.

Several recent law enforcement bulletins issued by the Department of Homeland Security and local fusion centers have warned about online threats made by supporters of ISIL. A joint DHS-FBI intelligence bulletin from August 22, 2014 obtained by Fox News warned that following the “start of US military air strikes on 8 August against the ISIL in Iraq, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the Homeland and US interests overseas.” The bulletin went on to say that social media is increasingly being used by ISIL supporters to encourage violent attacks on U.S. interests. Another fusion center bulletin from early July, also obtained by Fox News, cited specific tweets threatening the lives of U.S. military personnel. One tweet from a British jihadist cited in the bulletin reportedly instructed supporters to use LinkedIn and Facebook to look up information on U.S. service members prior to staging attacks: “You could literally search for soldiers, find their town, photos of them, look for address in Yellowbook or something. Then show up and slaughter them.”

While no specific plots have been identified, online threats against U.S. service members are evidently credible enough to warrant a response from the U.S. Army.  The Army Threat Integration Center (ARTIC) issued a special assessment on Thursday warning soldiers about the threat posed by the “Islamic State of Iraq and the Levant (ISIL), its supporters, those swayed by radical Islam, and lone offenders with the intent or inclination to act on ISIL’s behalf.”  Given the “continued rhetoric being issued by ISIL’s media services and supporters through various social media platforms,” the assessment states that ARTIC is concerned of the possibility of attacks conducted against U.S. military personnel and their families:

Over the past year, ISIL has threatened violence against the United States and US interests overseas in response to ongoing counterterrorism pressure. Following the start of US air strikes in Iraq in early August 2014, and then Syria in late September 2014, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the United States. Additionally, a recent audio message from an ISIL spokesman called, for the first time, for lone offender attacks in the Homeland in retaliation for US military operations in Iraq and Syria.

The assessment includes tips on basic home security precautions that service members should take to protect against an individual “conducting an attack while you or your family members are home.”  These tips include using the “peephole before opening the door to anyone” and not opening the door to “solicitors or strangers.”

An Afghan National Police patrolmen poses for a photo at a Police Sub-station under construction and under guard in Kandahar City. (U.S. Navy photo by Petty Officer 2nd Class Ernesto Hernandez Fonte)

“First time I ever saw an Afghan Police Station I thought it was something straight out of the dark ages, complete with zero electricity, mud structure, and no sewage drainage. Immediately I knew this mission would be challenging and wondered what the heck I got myself into?”

This quote from a U.S. Army Captain is just one example of the unusually blunt assessments contained in the Joint Center for International Security Force Assistance (JCISFA) guide for advising the Afghan National Police (ANP). The 2010 version of the JCISFA ANP Mentor Guide, which was obtained by Public Intelligence along with a guide for troops assisting the Afghan National Army (ANA), contains a number of revealing observations on the often poor condition of Afghan National Security Forces, in particular the ANP.

The JCISFA guide explains to would-be advisers that an ANP station will not “resemble anything close to what an American police station would look like” and are often constructed from mud and straw. Though the Combined Security Transition Command–Afghanistan (CSTC-A) is reportedly funding numerous station rebuilds and renovations throughout the country, the guide warns that advisers could encounter the following conditions:

• Electricity (1 to 2 kerosene lanterns for light) in rural areas up to 2 to 4 hours of power each day.
• Lack of heat and air conditioning.
• Generators that work poorly (if at all).
• Latrines that are almost all “Eastern style” and have plumbing problems.
• Limited water and an unworkable sewage system.

The introduction to the mentor guide states that “public perception of the ANP is poor” and that police officers “have been known to establish Vehicle Control Points (VCP’s) or Traffic Control Points (TCP’s) for the purpose of exacting tolls” or “stealing from the population.”  They will often ask to see the vehicle’s registration papers and then require a bribe, referred to as a “baksheesh” which literally means gift, before they return the registration to the vehicle’s owner.  Local or tribal leaders will even utilize the ANP at times to “oppress their rivals in inter-family squabbles” which leads to a low public opinion of the national police force.  While the ANA is often well regarded by the population, the ANP has a negative reputation among the Afghan people which is used to the advantage of insurgents.  According to the guide, ANP are killed at three times the rate of ANA soldiers.

Here are some other revealing observations found in the JCISFA guide:

• Police Stations are Often Not Staffed Properly: “In order for a district station to function properly, the ANP need to fill key staff and leadership roles. Unfortunately, in many stations, some of the positions are unfilled, while in other stations the chief is the only key position filled.”
• Centralized Leadership Can Cause Inaction: “Control in the ANP is very centralized. As a result, subordinate officers rarely have the latitude to make decisions without first consulting with the chief. In some ways, this centralized control makes the advisor’s job easier since once he convinces the chief of the need to do something, he has convinced the whole station. On the down side, however, subordinate leaders will rarely take the initiative to solve problems without direction, and if the chief is not present they will often defer a decision, even a critical one, until his return.”
• Many Police Chiefs are Appointed Due to Patronage: “Many ANP chiefs owe their position not to leadership ability or police experience, but to the patronage of a local leader. As a result, advisors must often guide them very closely to help them do the right things.”
• Police Chiefs Often Feel They Can Fleece the Population: “Many chiefs also feel that their position grants them the right to certain ‘benefits’ including skimming pay or demanding additional compensation from the community.”
• Afghan Police Lack Muzzle Awareness: “Muzzle awareness is a major problem with many ANP, especially those who have never had an advisor team before. Developing muzzle awareness takes patience and constant spot corrections. Over time, these efforts will have an impact. ANP will also have a tendency to carry loaded weapons with the safety disengaged. A Kalashnikov-type weapon with a selector switch in a position other than ‘safe’ is easy to spot. Advisors need to maintain vigilance regarding the condition and position of ANP weapons.”
• Afghan Police Lack Fire Discipline: “Accountability of weapons and ammunition remains problematic due to poor record keeping, theft, maintenance issues, and, in the case of ammunition, operational use. Since the ANP are not known for their fire discipline, keeping stations stocked with sufficient ammunition in areas with a lot of enemy activity will become a constant challenge for the advisor teams.”
• There is “Rarely” a Formal Work Schedule: “ANP normally work a ‘fire house’ schedule where they will live and work at the station for a number of days followed by some time off. Unfortunately, the work schedule of the ANP is rarely formalized. Therefore neither the chief nor the advisors can accurately predict how many ANP will be at the station from day to day. This lack of predictability is exacerbated when the ANP conduct a major operation. It is not unusual on the day after an operation for the ANP to have almost no one on duty due to poor schedule management. Typically, advisors can expect to find 50-70% of a station’s assigned strength on duty at any given time. While some of the absences are authorized (time off, sick, injured, leave) some of the absences may be “ghost” police who either do not exist or exist only to collect a pay check.”
• Police Can Often Have Ties to Illegal Militias or the Taliban: “That many ANP owe their jobs to the influence of these local leaders has led to the perception that many of them have ties to insurgents or the Taliban, work with illegal militias, or have questionable loyalty to the ANP over their tribal benefactors. Unfortunately, in many cases, these perceptions are reality. The lack of a comprehensive national criminal database also makes weeding out the bad very difficult. In a country where mid to upper level Taliban leaders can freely travel the streets because no one is able or willing to identify them makes infiltration of the ANP by criminals and insurgents a foregone conclusion.”
• New Recruits Often Skip Their Training: “A new ANP hire is expected to attend basic police training at either the Central Training Center (CTC) in Kabul or one of the seven Regional Training Centers (RTC) in Kandahar, Gardez, Herat, Kunduz, Jalabad, Mazar-i-Sharif, and Bamian. New hires are expected to attend training within 1-3 months of hire, since they are paid full ANP from the date of hire, often there is no impetus for them to go. Poor record keeping further exacerbates the problem resulting in a large number of untrained ANP.”
• Police Stations Often Use Hand Drawn Maps: “Districts often lack maps or may have hand-drawn maps. Maps in Dari can be requested, but land navigation training must be provided in order for the map to be read accurately. Dividing an area of responsibility into sectors based on recognizable terrain features and given simple code names based on colors or numbers, along with specific check points based on easily recognizable points will assist in intelligence gathering, operational planning, and communications.”
• Police Corruption is Rampant: “Corruption can be found at all levels, and may be justified by reasoning that the ANP risk much and are underpaid. One favorite tactic is to ‘shake down’ travelers at [traffic control points]. Another is to steal various items while conducting the search of a home. Leaders must be encouraged to follow up on reported acts such as these and to resolve them. Unresolved issues such as these can and will lead to more violence against the ANP and more support for insurgents.”

An example of a “Google dork” query with accompanying responses.

A bulletin issued by the Department of Homeland Security, the FBI and the National Counterterrorism Center earlier this month warns law enforcement and private security personnel that malicious cyber actors can use “advanced search techniques” to discover sensitive information and other vulnerabilities in websites.  The bulletin, titled “Malicious Cyber Actors Use Advanced Search Techniques,” describes a set of techniques collectively referred to as “Google dorking” or “Google hacking” that use “advanced operators” to refine search queries to provide more specific results.  Lists of these operators are provided by Google and include the following examples:

Here is an example of a query constructed from these operators:

“sensitive but unclassified” filetype:pdf site:publicintelligence.net

The bulletin warns that malicious cyber actors can use these techniques to “locate information that organizations may not have intended to be discoverable by the public or to find website vulnerabilities for use in subsequent cyber attacks.”  Hackers searching for “specific file types and keywords . . . can locate information such as usernames and passwords, e-mail lists, sensitive documents, bank account details, and website vulnerabilities.”  Moreover, “freely available online tools can run automated scans using multiple dork queries” to discover vulnerabilities.  In fact, the bulletin recommends that security professionals use these tools “such as the Google Hacking Database, found at http://www.exploit-db.com/google-dorks, to run pre-made dork queries to find discoverable proprietary information and website vulnerabilities.”

Several security breaches related to the use of “advanced search techniques” are also referenced in the bulletin.  One incident in August 2011 resulted in the compromise of the personally identifiable information of approximately 43,000 faculty, staff, students and alumni of Yale University.  The information was located in a spreadsheet placed on a publicly accessible File Transfer Protocol (FTP) server and was listed in Google search results for more than ten months prior to being discovered.  Another incident in October 2013 involved attackers using Google dorking to discover websites running vulnerable versions of vBulletin message board software prior to running automated tools that created administrator accounts on the compromised sites.  As many as 35,000 websites were believed to have been compromised in the incident.

An intelligence assessment released July 22 by the Department of Homeland Security Office of Intelligence and Analysis warns of an increasing trend of “anti-government violence” from what are described as “domestic violent extremists” inspired by the recent standoff at the Bundy Ranch in Bunkerville, Nevada.  The report, titled “Domestic Violent Extremists Pose Increased Threat to Government Officials an Law Enforcement,” was originally obtained and published by Public Employees for Environmental Responsibility, a non-profit alliance of local state and federal resource professionals that has been advocating for criminal charges against Cliven Bundy and “militia snipers” involved in the April standoff with the Bureau of Land Management.  In recent months, the report suggests that there has been a notable increase in violence from domestic extremists motivated by “anti-government ideologies.”  Compared to the previous four years, DHS assesses that the “perceived victory by militia extremists in a show of force against the Department of Interior’s Bureau of Land Management (BLM) will likely inspire additional anti-government violence over the next year.”  The report reflects a current trend in the national law enforcement community that views the rise of domestic extremist groups, variously referred to as militia or anti-government extremists as well as sovereign citizens, as a significant threat to the safety of government officials, law enforcement and first responders.  In fact, a recent survey conducted by the National Consortium for the Study of Terrorism and Responses to Terrorism (START) at the University of Maryland found that law enforcement throughout the country identifies sovereign citizens as the top terrorist threat, greater even than the threat posed by Islamic extremists.

Domestic Violent Extremists and The Victory at Bunkerville

Though law enforcement agencies have been warning for years of the potential for violence perpetrated by members of the so-called sovereign citizen movement, who believe that the U.S. government is “operating outside of its jurisdiction and generally do not recognize federal, state, or local laws, policies, or governmental regulations,” the DHS’ recent assessment does not focus on members of this group.  Instead, the assessment focuses on domestic violent extremists motivated by “anti-government ideologies” and a common perception of “government overreach and oppression.”  Unlike sovereign citizens, these groups and individuals “recognize government authority,” however they may engage in acts of violence due to “their perception that the United States Government is tyrannical and oppressive” and “needs to be violently resisted or overthrown.”  The assessment also refers repeatedly to “militia extremists” who are defined as facilitating or engaging in acts of violence “directed at federal, state, or local government officials or infrastructure in response to their belief that the government deliberately is stripping Americans of their freedoms and is attempting to establish a totalitarian regime.”  These individuals often “oppose many federal and state authorities’ laws and regulations (particularly those related to firearms ownership), and often belong to paramilitary groups.”

The DHS assessment finds that a “recent spike in anti-government attacks and plots since November 2013” is a departure from the previously sporadic occurrence of “domestic extremist violence.”  The increase is believed to be motivated by “perception of government actions (or lack of action) addressing political issues such as gun control, land-use, property, and other activities as interfering with their individual rights and as oppressive measures that warrant violent reprisal against US Government entities and law enforcement.”  Historically, spikes in violence have followed “high-profile confrontations” involving the U.S. government including Ruby Ridge and Waco.  DHS identifies the recent standoff with BLM agents in Bunkerville, Nevada as an example of such an event that could “inspire further violence”:

(U//LES) I&A assesses that the belief among militia extremists that their threats and show of force against the BLM during the April Bunkerville standoff was a defining victory over government oppression is galvanizing some individuals-particularly militia extremists and violent lone offenders-to actively confront law enforcement officials, increasing the likelihood of violence. Additionally, this perceived success likely will embolden other militia extremists and like-minded lone offenders to attempt to replicate these confrontational tactics and force future armed standoffs with law enforcement and government officials during 2014.

Several incidents in 2014 are identified as having a “connection to the events in Bunkerville” based on news reports and information provided by law enforcement.  The most significant incident discussed in the assessment is the recent murder of two Las Vegas police officers and another civilian committed by Jerad and Amanda Miller.  The pair, who had attended the Bunkerville standoff, “expressed that violence was necessary to fight a perceived tyrannical US government apparatus intent on stripping Americans of their rights” according to the Southern Nevada Counterterrorism Center.  The couple also left a note on the murdered police officers that “exclaimed the attack was the start of a ‘revolution,’ and a ‘new day,’ suggesting they anticipated further violence, and made statements on their social media profiles indicating their willingness to ‘shed blood,’ and ‘die fighting,’ to stop government oppression.”

A timeline included in the DHS intelligence assessment documenting a “surge” in violent plotting from domestic extremists.

In all, DHS found that there had been eight incidents of “anti-government” violence since March 2011, either in the form of an actual attack or an arrest stemming from a plot that was interrupted prior to to an attack taking place, including:

• March 2011 – Four members of the militia extremist group The Alaska Peacemakers Militia (APM) – including its leader – were arrested in March 2011 for conspiracy to kill judges and law enforcement.  APM’s leader was sentenced in January 2013 to 26 years in prison.  Three other members received sentences of 26, 12 and 5 years, respectively.
• November 2011 – Four militia extremists were arrested in November 2011 for planning to obtain explosives, guns and a biological toxins for attacks against government personnel, including employees of the Internal Revenue Service, the Bureau of Alcohol Tobacco Firearms and Explosives and local law enforcement.  Two were convicted in 2012 for plotting to obtain explosives and two were convicted in 2014 for plotting to obtain the toxins.
• December 2011 – Georgia-based US Army soldiers – arrested in December 2011 – were convicted in 2012, 2013 and 2014 for involvement in a homicide to cover up the plans of their militia extremist group called F.E.A.R. (Forever Enduring Always Ready) that plotted to attack government and critical infrastructure targets including a hydroelectric dam and Ft. Stewart military base.  According to court documents, the individuals allegedly stockpiled over $87,000 in firearms and bomb-making components.
• November 2013 – An armed lone offender extremist with an anti-government ideology entered Terminal 3 of LAX on November 1, 2013 and proceeded to the security screening area where he opened fire with an AR-15 style assault rifle.  The gunman subsequently shot and killed one TSA Transportation Security Officer (TSO) and wounded two other TSOs, plus a civilian.  Another individual was injured fleeing the scene.  The suspected gunmen was wounded and is awaiting trial.
• February 2014 – Three militia extremists in February 2014 were arrested by federal law enforcement attempting to buy explosives in furtherance of a plot to allegedly attack the electrical grid and government targets, including DHS personnel and facilities.  They are awaiting trial.
• March 2014 – A militia extremist in March 2014 was arrested by federal law enforcement for a series of plots culminating in a plan to allegedly acquire weapons and travel to Washington, D.C. to kill law enforcement and government officials.  He is awaiting trial.
• April 2014 – Militia Extremists – many of whom traveled from around the country – joined peaceful protesters at a ranch in Bunkerville, NV and additionally surrounded officers with firearms during an armed standoff over grazing rights.
• June 2014 – Two violent lone offender extremists motivated by anti-government ideology ambushed and killed two Las Vegas Metropolitan Police Department officers and a civilian, wounding one more officer before dying in a shootout.

According to DHS analysis, the common link between these incidents is the targeting of “government facilities and personnel, followed by law enforcement personnel and critical infrastructure and key resources (CIKR).”  Law enforcement is targeted “because these individuals perceive it as an extension of state control over individuals and CIKR is targeted to undermine the government’s perceived economic and societal power and control.”

Government and Law Enforcement are Primary Targets

Over the last few months, fusion centers around the country have issued a number of bulletins on the potential threat to law enforcement by sovereign citizens and other “domestic extremists.”  In May, the Pennsylvania Criminal Intelligence Center released a bulletin to law enforcement on “Targeting First Responders” describing a number of recent incidents where individuals have sought to bring firefighters, paramedics and law enforcement to a location for the purposes of conducting a subsequent attack.  In early June, the New York State Intelligence Center issued a bulletin stating that suspects “motivated by elements of a far right anti-government ideology with a particular fixation on law enforcement” had conducted attacks on government targets, including a recent incident in which Dennis Marx attempted to enter the courthouse in Forsyth County, Georgia with an an assault rifle, an assortment of grenades, body armor, and a gas mask.  Marx wounded a sheriff’s deputy who returned fire, preventing him from entering the courthouse where he was scheduled to have a hearing on eleven felony drug and weapons charges.  According to the bulletin, Marx had “long running issues with law enforcement and was a self-identified sovereign citizen.”

In July, the New Jersey Office of Homeland Security and Preparedness issued a bulletin to firefighters warning about the threat posed by the “anti-government sovereign citizen movement” which has been “catapulted into the forefront of public attention due to an increase in criminal activity by sovereign citizens nationwide.”  The bulletin notes that while there “have been no reported incidents of fire service personnel being targeted or coming in contact with confirmed or suspected sovereign citizens” it is nonetheless important to know the indicators that one is dealing with a sovereign citizen, such as the use of “unusual language regarding self-identity, such as ‘freemen,’ state citizens, non-resident aliens, sovereign citizens, or common law citizens.”

Last August, the FBI’s San Antonio Division issued a bulletin stating that a Sovereign Citizen group was organizing youth groups to participate in door-to-door fundraising campaign with the actual intent of identifying the homes of law enforcement and first responders.  The youth traveled in “small teams of at least two, traveled throughout neighborhoods knocking on doors” telling the homeowners that “they worked for a fund raising organization designed to help young individuals with public speaking.”  The groups were “instructed that the information they collected counted as ‘points'” and that the “team with the most points would win a college scholarship and a large sum of money.”   A yellow reference card was provided to each of the groups listing approximately fifteen professions that corresponded to a point value ranging from 500 to 2000 points.  Professions listed on the card included firefighters, nurses, doctors as well as members of the military.  However, the profession with the highest point value of 2000 was “police officer.” Following the release of the FBI bulletin, the New Jersey Regional Operations Intelligence Center later issued a request for information describing incidents where government officials had been threatened and instructing law enforcement to be careful when providing their personal information to unknown parties.

A joint bulletin released in March by the Department of Homeland Security, FBI and National Counterterrorism Center instructs firefighters and paramedics to use emergency medical treatment as an opportunity to identify violent extremists.  The March 2014 bulletin obtained by Public Intelligence titled “Emergency Medical Treatment Presents Opportunity for Discovery of Violent Extremist Activities” is part of the Fire Line series distributed to firefighters, emergency medical service personnel and other first responders around the country.

The bulletin states that efforts to “gain expertise with explosive, incendiary, and chemical/biological devices may lead to injuries and emergency treatment, which may provide potential indicators of violent extremist activities to responding emergency medical service (EMS) personnel.”  An initial “size-up” of the scene and “patient assessment” provide first responders with the ability to “evaluate whether an injury is a genuine accident or related to violent extremist activity.”  For example, “hastily or expediently treated injuries” observed by first responders “may be an indicator of illicit activity as actors injured in nefarious activity are often not inclined to seek legitimate medical attention, or use efforts that are designed to mislead or obscure the genuine nature of the injury.”  Other indicators include “shock or infection accompanying healing wounds, or corrective treatment for healed wounds” often without plausable explanation “may be signs of suspicious activity.”

To support its claims, the bulletin cites the January 2014 arrest of a Maryland man named Todd Dwight Wheeler Jr. for making and possessing explosive materials.  According to the Baltimore Sun, Wheeler was arrested after one of his relatives called 911 and reported that he may be suicidal.  Paramedics reportedly found Wheeler “suffering from injuries caused by ‘chemical or mechanical reactions'” including “burns to one of his limbs that paramedics determined could have come from a blast.”  After speaking with Wheeler, first responders “became suspicious of his story, suspicious of his injuries and suspicious of his distinct chemical odor.”  Police later searched the home with help from Bureau of Alcohol, Tobacco, Firearms and Explosives agents finding several “completed bombs”, “more than 100 pounds of chemicals, including acids, fuels, oxidizers and explosives precursors”, “components of destructive devices, including igniters and detonators”, “an automatic Ruger Mini-14 rifle, other guns and knives” as well as “manuals and books detailing explosive manufacturing and booby traps, with titles like The Poor Man’s James Bond, Booby Traps, Deadly Brew and Highly Explosive Pyrotechnic Compositions.”  Under a plea agreement entered in May, Wheeler pled guilty to one count of “being a prohibited person in possession of firearms.”  He faces up to ten years in prison.

At the 39th Joint Doctrine Planning Conference, a semiannual meeting on topics related to military doctrine and planning held in May 2007, a contractor for Booz Allan Hamilton named Paul Schuh gave a short presentation discussing doctrinal issues related to “cyberspace” and the military’s increasing effort to define its operations involving computer networks.  Schuh, who would later become chief of the Doctrine Branch at U.S. Cyber Command, argued that military terminology related to cyberspace operations was inadequate and failed to address the expansive nature of cyberspace.  According to Schuh, the existing definition of cyberspace as “the notional environment in which digitized information is communicated over computer networks” was imprecise.  Instead, he proposed that cyberspace be defined as “a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures.”

Amid the disagreements about “notional environments” and “operational domains,” Schuh informed the conference that “experience gleaned from recent cyberspace operations” had revealed “the necessity for development of a lexicon to accommodate cyberspace operations, cyber warfare and various related terms” such as “weapons consequence” or “target vulnerability.”  The lexicon needed to explain how the “‘four D’s (deny, degrade, disrupt, destroy)” and other core terms in military terminology could be applied to cyber weapons.  The document that would later be produced to fill this void is The Cyber Warfare Lexicon, a relatively short compendium designed to “consolidate the core terminology of cyberspace operations.”  Produced by the U.S. Strategic Command’s Joint Functional Command Component – Network Warfare, a predecessor to the current U.S. Cyber Command, the lexicon documents early attempts by the U.S. military to define its own cyber operations and place them within the larger context of traditional warfighting.  A version of the lexicon from January 2009 obtained by Public Intelligence includes a complete listing of terms related to the process of creating, classifying and analyzing the effects of cyber weapons.  An attachment to the lexicon includes a series of discussions on the evolution of military commanders’ conceptual understanding of cyber warfare and its accompanying terminology, attempting to align the actions of software with the outcomes of traditional weaponry.

Defining Cyber Warfare

One of the primary reasons for creating a lexicon devoted to cyber warfare is that there are “significant underlying differences” between traditional military operations and so-called “non-traditional weapons” such as those employed in cyber warfare.  The lexicon was intended to reduce these differences by integrating and standardizing the “use of these non-traditional weapons” while providing “developers, testers, planners, targeteers, decision-makers, and battlefield operators . . . a comprehensive but flexible cyber lexicon that accounts for the unique aspects of cyber warfare while minimizing the requirement to learn new terms for each new technology of the future.”  Described as a Language to Support the Development, Testing, Planning, and Employment of Cyber Weapons and Other Modern Warfare Capabilities, the lexicon is designed to facilitate the construction and employment of cyber weapons:

The cyber warfare community needs a precise language that both meets their unique requirements and allows them to interoperate in a world historically dominated by kinetic warfare. Mission planners must be able to discuss cyber weapons with their commanders, the intelligence analysts, the targeteers, and the operators, using terms that will be understood not just because they have been defined somewhere in doctrine, but also because they make sense. Giving the weapons planners a well-founded lexicon enables them to have far-reaching discussions about all manner of weapons and make important decisions with a significantly reduced likelihood of misunderstanding and operational error.

To understand what exactly constitutes a cyber weapon and what makes it so different from the kind of weapons employed in traditional warfare, it is important to understand the objectives of cyber warfare.  Cyber warfare is defined in the lexicon as the creation of “effects in and through cyberspace in support of a combatant commander’s military objectives, to ensure friendly forces freedom of action in cyberspace while denying adversaries these same freedoms.”  This can be accomplished through cyber attacks, cyber defense as well as cyber exploitation, with each option providing its own unique set of associated capabilities and potential outcomes.  Cyber attacks bare the greatest resemblance to popular notions of cyber war, incorporating actions to “deny or manipulate information and/or infrastructure in cyberspace” through methods like a computer network attack (CNA) that are intended to “disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves.”  Cyber defense is primarily focused on defending U.S. military networks from similar attacks conducted by other nations or non-state actors and protecting the integrity of the Department of Defense’s Global Information Grid (GIG) which carries military communications worldwide.  Cyber exploitation is focused primarily on the collection of intelligence and other useful data from targeted computer systems to enable improved “threat recognition” that can contribute to future operations in cyberspace.

These components of cyber warfare rely on capabilities that are used to construct cyber weapon systems.  A cyber warfare capability is a “device, computer program or technique” that includes any combination of “software, firmware, and hardware” that is “designed to create an effect in cyberspace, but has not been weaponized.”  Weaponization is a process that takes these capabilities and implements “control methods, test and evaluation, safeguards, security classification guidance, interface/delivery method” and other tactical considerations to ensure that the capability can be properly employed to produce the intended effect.  A completed cyber weapon system is a combination of one or more of these capabilities that have been weaponized and are ready for deployment.  These weapons can then be categorized based upon specific uses and issues related to their employment, such as who is authorized to use them.  One suggested schema in the lexicon provides three categories: the first for weapons that require approval from the combatant commander, a second for weapons that are pre-approved for specific uses and a third that requires the approval of the President or Secretary of Defense before the weapon can be utilized.

Brig. Gen. Robert Brooks, director of the Massachusetts Air National Guard gets a eyes-on 3D tutorial of how to analyze data in the Virtual Reality Center at the University of Arkansas at Little Rock, during the 2014 Cyber Shield Exercise held in May.

One of the “Discussions on Cyberspace Operations” contained in the lexicon follows the military’s historical apprehension toward describing software programs and other cyber capabilities as weapons.  Throughout the early 1990s, the term “tool” was widely favored in the initial phases of the military’s cyber warfare mission.  One reason for this reluctance was military commanders’ concerns about the lack of authority under Title 10 for conducting cyber operations.  However, given that there are six “Joint functions” recognized in military doctrine “C2 [command and control], Intel, Fires, Maneuver, Protection and Sustainment,” the use of any offensive cyber capabilities “unquestionably” is a form of fires, making the cyber capability itself a kind of weapon.  The idea that software and computer hardware could be considered a weapon is further complicated by the fact that many offensive cyber capabilities consist of nothing more than “cyber techniques” that involve “keystrokes, but where no hardware or software is introduced into the target system.”  When “last minute changes in the target render the approved weapon inert, an operator might need to use cyber techniques to complete an assigned mission, particularly one that has been approved for effect or objective,” making the certification process and training of the “operator” critical to considering cyber capabilities as a “weapon system.”  There must be control methods, testing and evaluation, safeguards, certified personnel, mission logs, a concept of operations as well as tactics, techniques and procedures on how to employ the weapon system.  This is similar to the situation with conventional weapons as “the very first M-16 rifle ever made, while a ‘weapon’ in the dictionary sense of the word, was not deployed until it was operationally tested, had a training program, spare parts inventory, etc.”  It was only after this process that “each new M-16 was part of a ‘weapon system’ and could be crated and shipped to the front lines directly from the assembly line.”

Cyber Weapons and Their Effects

A fundamental distinction discussed in the lexicon, one which separates cyber weapons from those used in conventional warfare, is the distinction between kinetic and non-kinetic weaponry.  Kinetic weapons are those that “use forces of dynamic motion and/or energy upon material bodies” whereas non-kinetic weapons are those that “create their effects based upon the laws of logic or principles other than the laws of physics.”  Within each of these broad categories, there are further distinctions based upon the lethality of the weapon being described.  For example, a Mark-84 bomb is an example of a lethal kinetic weapon capable of inflicting physical damage to material entities based upon the use of motion and force.  The Active Denial System, a directed-energy weapon which uses millimeter waves to create a sensation of heat on the skin of human targets, is an example of a non-lethal kinetic weapon.  As a non-kinetic weapon creates its effect through the use of logic or other principles, the category necessarily encompasses a much wider array of weapon systems from diverse fields like information warfare and psychological operations.  Biological and chemical weapons are examples of lethal non-kinetic weapons that rely upon biological factors rather than physical force to create their effect.  Computer network attack (CNA) software, on the other hand, is an example of a non-lethal non-kinetic weapon, creating an effect based solely on the logical operations it performs on a targeted computer system.

While cyber weapons are considered to be non-lethal in their effects, this doesn’t mean that non-lethal weapons are “required to have zero probability of causing fatalities, permanent injuries, or destruction.”  To better understand the effects that non-lethal non-kinetic weapons can have, the lexicon attempts to align cyber weapons with the traditional terminology of the “Four D’s” used throughout the information operations community: deny, destroy, degrade and disrupt.  One discussion in the lexicon introduces a construct to understand these effects in terms of a scope, level and time of “denial” in a targeted system, causing “reduction, restriction, or refusal of target operations.”  Using this framework, “degrade, disrupt, and destroy” would all be considered different forms of denial that have varying scopes.  Disrupt introduces a “time aspect of denial” and degrade adds an “amount or level of denial.”  The final term “destroy” is saved for the “special case that includes the maximum time and maximum amount of denial.”  The lexicon even proposes a function for calculating denial:

Quantitatively, denial (D) can be expressed as a function of scope (s), level (l), and time (t), i.e. D(s,l,t). Defining effects in this manner makes it clear to the planning staff that each of the parameters of the function must be considered and specified as necessary as indicated by, or derived from, commander’s objective. As the level (l) or amount approaches 100% and time (t) approaches infinity, destruction is achieved.

The true effects of a cyber weapon often differ significantly from simply denying or even destroying an enemy system.  Every weapon “takes an action” when it is triggered and this action is “intended to have an effect.”  For a traditional bomb, that action is a “kinetic explosion and the effect is normally target damage,” whereas a cyber weapon may result in “the execution of some software and the effects, some form of denial or manipulation.”  However, weapons also have “outcomes that are not expected and are not required to achieve the objective.”  The lexicon describes these as indirect effects that can result in consequences for unintended targets.  When these consequences affect unlawful targets or cause “damage to persons or objects that would not be lawful military targets,” they are considered “collateral effects” that are similar to the traditional notion of collateral damage.

Vulnerabilities and Target States

Past worries about collateral damage from cyber weapons have proven to be well founded.  In the summer of 2010, copies of an unknown computer worm began replicating throughout the internet using a vulnerability in Microsoft Windows to find its way into the control systems of major corporations like Chevron.  However, the malicious program was not the work of Chinese hackers or sophisticated cyber criminals, it was a cyber weapon called Stuxnet created as part of a joint U.S. and Israeli intelligence operation targeting Iran’s nuclear program that was codenamed “Olympic Games.”  Stuxnet would later claim other unintended targets, including a Russian nuclear power plant.  Unintended effects associated with cyber weapons are dangerous for a number of reasons, including the risk that an adversary might be able to use the weapon, once discovered, against the originator of the attack.  According to the lexicon, these vulnerabilities of cyber weapons can be separated into six distinct categories:

• (U//FOUO) Detectability risk – The risk that a weapon will be unable to elude discovery or suspicion of its existence. This includes the adverse illumination risk of hardware weapons.
• (U//FOUO) Attribution risk – The risk that the discoverer of a weapon or weapon data will be able to identify the source and/or originator of the attack or the source of the weapon used in the attack.
• (U//FOUO) Co-optability risk – The risk that, once discovered, the weapon or its fires will be able to be recruited, used, or reused without authorization.
• (U//FOUO) Security Vulnerability risk – The risk that, once discovered, an unauthorized user could uncover a security vulnerability in the weapon that allows access to resources of the weapon or its launch platform. This includes the risk of an adversary establishing covert channels over a weapon’s C2 link.
• (U//FOUO) Misuse risk – The risk that the weapon can be configured such that an authorized user could unintentionally use it improperly, insecurely, unsafely, etc.
• (U//FOUO) Policy, Law, & Regulation (PLR) risk – The risk that the weapon can be configured such that an authorized user could intentionally use it in violation of existing policy, laws, and regulations.

These vulnerabilities are “mostly unfamiliar to the kinetic weapons community, and are due to the complexity of the weapons, the dynamic nature of the ‘atmosphere’ of cyberspace, and the difficulty of gathering detailed intelligence about cyber targets.”  A discussion on cyber weapon vulnerabilities in the lexicon argues that “the crowded nature of cyberspace and the proliferation of anonymizing technologies can work to both our advantage and disadvantage, in that attribution can be very difficult for both our adversaries and ourselves.”  Once a network target has been “accessed and subverted,” the implanted cyber weapon should be “considered like a mine or an improvised explosive device (lED) where there are no longer any delivery considerations for the weapon, but only survivability and transferring of commands and updates.”

In several portions of the lexicon, attacking unaffiliated infrastructure that happens to be used by an adversary is discussed as a viable means of creating a “second order” effect on the target.  For example, if “privileged access in not possible, we may still be able to create our desired effect in the first order by using public access to the target” such as “a distributed denial of service (DDOS) that floods a port on the target.”  When the intended target “cannot be directly accessed via either public or privileged means, the desired effect can still be achieved by targeting an intermediating link or node so that the desired effect cascades from the first order effect.”  An example of this is “conducting a DDOS attack on a critical link” leading to the target or “degradation through packet flooding” by assuming the “maximum data bus speed and a maximum input/output processor throughput on the target.”  A ping flood attack can be “directed at a single IP address or broadcast to a whole Class B IP domain with thousands of recipients.”

The effectiveness of a cyber weapon corresponds to its ability to place a target into a particular state of operation.  The target state “corresponds to the condition of the target with respect to a military objective” such as creating a root shell for privileged access.  A typical cyberspace target state can typically be considered to operate in one of the following “five states relative to achieving a commander’s primary objective”:

• Unconfirmed: Unknown if there is an access path to target.
• Confirmed/Nominal: Access path to target established.
• Unprivileged access: Unprivileged access to target established.
• Privileged access/At risk: Privileged access to target established.
• Goal/Other condition: Target has been placed in the desired or other intermediate condition.

Using a real world example, the lexicon asks us to “consider the use of a ‘buffer overflow’ capability to achieve ‘root’ level (privileged) access on a computer operating system in order to disable an adversary’s computer program.”  The use of a “buffer overflow creates an initial effect (access to unauthorized portion of memory) and, by including in the buffer overflow capability other carefully crafted code, it can also enable another effect (e.g. gaining root access) and place the target in a different state.”  Whereas the previous state of the target was “nominal,” the new state of the target is “compromised.”  If the system administrator has implemented “a mechanism to log and report all creations of a root shell,” the outcome can still create unintended consequences because the cyber weapon could be detected and then be susceptible to attribution or manipulation.  With certain types of cyber weapons this sort of discovery or attribution could present serious problems, though with others it may prove to be of little use to the weapon’s discoverer.  As cyber weapons only “deliver information or some other information-related effect to the target and not high explosive or high energy,” they can be used “as long as we have electrical power.”

U.S. Strategic Command Cyber Warfare Lexicon

Select a term from the following list to read the full definition. All definitions are taken from U.S. Strategic Command (USSTRATCOM) Cyber Warfare Lexicon Version 1.7.6.

cyberspace

(U//FOUO) cyberspace: a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers. (from 12 May 2008 SECDEF memo)

[(U//FOUO) Previous version – cyberspace: A domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. (from NMS-CO)]

↑ Return to the top

cyberspace operations (CO)

(U//FOUO) cyberspace operations (CO): All activities conducted in and through cyberspace in support of the military, intelligence, and business operations of the Department. (based on NMS-CO description)

(U//FOUO) cyberspace operations (CO): The employment of cyber capabilities where the primary purpose is to achieve military objectives or effects in or through cyberspace. Such operations include computer network operations and activities to operate and defend the global information grid. (from 29 Sep 2008 VJCS Memo, however it is inconsistent with NMS-CO and improperly limited)

↑ Return to the top

cyber warfare (CW)

(U//FOUO) cyber warfare (CW): Creation of effects in and through cyberspace in support of a combatant commander’s military objectives, to ensure friendly forces freedom of action in cyberspace while denying adversaries these same freedoms. Composed of cyber attack (CA), cyber defense (CD), and cyber exploitation (CE).

↑ Return to the top

cyber attack (CA)

(U//FOUO) cyber attack (CA): Cyber warfare actions intended to deny or manipulate information and/ or infrastructure in cyberspace. Cyber attack is considered a form of fires.

↑ Return to the top

cyber defense (CD)

(U//FOUO) cyber defense (CD): Cyber warfare actions to protect, monitor, detect, analyze, and respond to any uses of cyberspace that deny friendly combat capability and unauthorized activity within the DOD global information grid (GIG).

↑ Return to the top

cyber exploitation (CE)

(U//FOUO) cyber exploitation (CE): Cyber warfare enabling operations and intelligence collection activities to search for, collect data from, identify, and locate targets in cyberspace for threat recognition, targeting, planning, and conduct of future operations.

↑ Return to the top

cyber warfare capability

(U//FOUO) cyber warfare capability: A capability (e.g. device, computer program, or technique), including any combination of software, firmware, and hardware, designed to create an effect in cyberspace, but that has not been weaponized. Not all cyber capabilities are weapons or potential weapons.

↑ Return to the top

cyber weapon system

(U//FOUO) cyber weapon system: A combination of one or more weaponized offensive cyber capabilities with all related equipment, materials, services, personnel, and means of delivery and deployment (if applicable) required for self-sufficiency. (Note: adapted directly from JP 1-02 of weapon system.)

↑ Return to the top

cyber weaponization

(U//FOUO) cyber weaponization: The process of taking an offensive cyber capability from development to operationally ready by incorporating control methods, test and evaluation, safeguards, security classification guidance, interface/ delivery method, certified and trained personnel, employment recorder, CONOP, TIP, life-cycle support, and launch platform.

↑ Return to the top

cyber weapon characterization

(U//FOUO) cyber weapon characterization: The process of determining and documenting the effect producing mechanisms and assurance factors of cyber weapons. Characterization includes aspects of technical assurance evaluation, OT&E, risk/protection assessments, and other screening processes. Answers the question: “What do I need to know about this weapon before I can use it?” [Note: Cyber Weapon Characterization is one step in the Cyber Weaponization process.]

↑ Return to the top

cyber weapon categorization

(U//FOUO) cyber weapon categorization: A binning of cyber weapon capabilities into categories, based on risk assessment and the release authority required for their use. Useful for answering the question: “Who can authorize use of this weapon?” Example categories might be:

• Category I- Combatant commander release

• Category II – Pre-approved for combatant commander use in specific OPLANs

• Category III- President/SECDEF release only

↑ Return to the top

cyber weapon delivery mode

(U//FOUO) cyber weapon delivery mode: The method via which a cyber weapon (or a command to such a weapon) is delivered to the target. Delivery may be via direct implant or remote launch. Hardware cyber weapons often require direct implant. Remote launched cyber weapons and/or commands may be placed via wired and/or wireless paths.

↑ Return to the top

cyber weapon flexibility

(U//FOUO) cyber weapon flexibility: The extent to which the cyber weapon’s design enables operator reconfiguration to account for changes in the target environment.

↑ Return to the top

cyber weapon identification

(U//FOUO) cyber weapon identification: The manner in which a cyber weapon is represented for inventory control purposes, based on the weapon’s forensic attributes (e.g. for software: file name, file size, creation date, hash value, etc., for hardware: serial number, gram weight, stimulus response, x-ray image, unique markings, etc.).

↑ Return to the top

cyber weapon vulnerability

(U//FOUO) cyber weapon vulnerability: An exploitable weakness inherent in the design of a cyber weapon. Weaknesses are often in one of the following risk areas:

• detectability risk – The risk that a weapon will be unable to elude discovery or suspicion of its existence. This includes the adverse illumination risk of hardware weapons.
• attribution risk – The risk that the discoverer of a weapon or its effect will be able to identify the source and/or originator of the attack or the source of the weapon used in the attack.
• co-optability risk – The risk that, once discovered, the weapon or its fires will be able to be recruited, used, or reused without authorization.
• security vulnerability risk – The risk that, once discovered, an unauthorized user could uncover a security vulnerability in the weapon that allows access to resources of the weapon or its launch platform. This includes the risk of an adversary establishing covert channels over a weapon’s C2 link.
• misuse risk – The risk that the weapon can be configured such that an authorized user could unintentionally use it improperly, insecurely, unsafely, etc.
• policy, law, & regulation (PLR) risk – The risk that the weapon could be configured such that an authorized user could intentionally use it in violation of existing policy, laws, and regulations.

↑ Return to the top

access

(U) access: Sufficient level of exposure to or entry into a target to enable the intended effect.

↑ Return to the top

collateral effect

(U) collateral effect: Unintentional or incidental effects, including injury or damage, to persons or objects that would not be lawful military targets in the circumstances ruling at the time.

↑ Return to the top

deny

(U) deny: To attack by degrading, disrupting, or destroying access to or operation of a targeted function by a specified level for a specified time. Denial is concerned with preventing adversary use of resources.

• degrade(U) degrade: (a function of amount) To deny access to or operation of a targeted function to a level represented as a percentage of capacity. Desired level of degradation is normally specified.
• disrupt(U) disrupt: (a function of time) To completely but temporarily deny access to or operation of a targeted function for a period represented as a function of time. Disruption can be considered a special case of degradation where the degradation level selected is 100%.
• destroy(U) destroy: To permanently, completely, and irreparably deny access to, or operation of, a target. Destruction is the denial effect where time and level are both maximized.

↑ Return to the top

dud

(U) dud: A munition that has not been armed or activated as intended or that failed to take an expected action after being armed or activated. (Note: adapted directly from JP 1-02 of dud.)

↑ Return to the top

effects assessment (EA)

(U) effects assessment (EA): The timely and accurate evaluation of effects resulting from the application of lethal or non-lethal force against a military objective. Effect assessment can be applied to the employment of all types of weapon systems (air, ground, naval, special forces, and cyber weapon systems) throughout the range of military operations. Effects assessment is primarily an intelligence responsibility with required inputs and coordination from the operators. Effects assessment is composed of physical effect assessment, functional effect assessment, and target system assessment. Note: Battle Damage Assessment (BDA) is a specific type of effects assessment for damage effects. ” (This is a direct adaptation from the JP 1-02 definition of BDA.)

↑ Return to the top

intended cyber effect

(U//FOUO) intended cyber effect: A sorting of cyber capabilities into broad operational categories based on the outcomes they were designed to create. These categories are used to guide capability selection decisions. Answers the question: “What kind of capability is this?” Specifically:

• denial – degrade, disrupt, or destroy access to, operation, quality of service, or availability of target resources, processes, and/or data.

• manipulation – manipulate, distort, or falsify trusted information on a target.

• command and control – provide operator control of deployed cyber capabilities.

• information/data collection – obtain targeting information about targets or target environments.

• access – establish unauthorized access to a target.

• enabling – provide resources or create conditions that support the use of other capabilities.

↑ Return to the top

kinetic

(U) kinetic: Of or pertaining to a weapon that uses, or effects created by, forces of dynamic motion and/ or energy upon material bodies. Includes traditional explosive weapons/ effects as well as capabilities that can create kinetic RF effects, such as continuous wave jammers, lasers, directed energy, and pulsed RF weapons.

↑ Return to the top

non-kinetic

(U) non-kinetic: Of or pertaining to a weapon that does not use, or effects not created by, forces of dynamic motion and/ or energy upon material bodies.

↑ Return to the top

lethal

(U) lethal: Of or pertaining to a weapon or effect intended to cause death or permanent injuries to personnel.

↑ Return to the top

non-lethal

(U) non-lethal: Of or pertaining to a weapon or effect not intended to cause death or permanent injuries to personnel. Nonlethal effects may be reversible and are not required to have zero probability of causing fatalities, permanent injuries, or destruction of property.

↑ Return to the top

manipulate

(U//FOUO) manipulate: To attack by controlling or changing a target’s functions in a manner that supports the commander’s objectives; includes deception, decoying, conditioning, spoofing, falsification, etc. Manipulation is concerned with using an adversary’s resources for friendly purposes and is distinct from influence operations (e.g. PSYOP, etc.).

↑ Return to the top

misfire

(U) misfire: The failure of a weapon to take its designed action; failure of a primer, propelling charge, transmitter, emitter, computer software, or other munitions component to properly function, wholly or in part. (Note: adapted directly from JP 1-02 of misfire.)

↑ Return to the top

probability of effect (PE)

(U) probability of effect (PE): The chance of a specific functional or behavioral impact on a target given a weapon action.

↑ Return to the top

target state

(U) target state: The condition of a target described with respect to a military objective or set of objectives.

↑ Return to the top

targeted vulnerability

(U) targeted vulnerability: An exploitable weakness in the target required by a specific weapon.

• objective vulnerabilityobjective vulnerability: A vulnerability whose exploitation directly accomplishes part or all of an actual military objective.
• access vulnerabilityaccess vulnerability: A vulnerability whose exploitation allows access to an objective vulnerability.

↑ Return to the top

weapon action

(U) weapon action: The effect-producing mechanisms or functions initiated by a weapon when triggered. The weapon actions of a kinetic weapon are blast, heat, fragmentation, etc. The weapon actions of a cyber attack weapon might be writing to a memory register or transmission of a radio frequency (RF) waveform.

↑ Return to the top

weapon effect

(U) weapon effect: A direct or indirect objective (intended) outcome of a weapon action. In warfare, the actions of a weapon are intended to create effects, typically against the functional capabilities of a material target or to the behavior of individuals. Effect-based tasking is specified by a specific target scope, desired effect level, and start time and duration.

• direct effectdirect effect: An outcome that is created directly by the weapon’s action. Also known as a first order effect.
• indirect effectindirect effect: An outcome that cascades from one or more direct effects or other indirect effects of the weapon’s action. Also known as second, third, Nth order effects, etc.

↑ Return to the top

Mohammad Zahid was not the target of a joint military operation that came through his village in Khost Province in late February 2012.  However, that day the twenty-two year old man who claimed to be a student was arrested and eventually convicted in an Afghan court because his fingerprints reportedly matched those found on an improvised explosive device (IED) cache that had been discovered the previous year.

Zahid was one of more than a hundred military-age males that were scanned that day by the joint coalition forces and Afghan National Army operation.  As part of its effort to combat insurgent forces interspersed within an indigenous population, the use of biometrics has become a central component of the U.S. war effort.  Having expanded heavily since its introduction during the war in Iraq, biometric identification and tracking of individuals has become a core mission in Afghanistan with initiatives sponsored by the U.S. and Afghan governments seeking to obtain the biometric identifiers of nearly everyone in the country.

Though there is no formal doctrine or universally accepted tactics, techniques, and procedures for using biometrics throughout the U.S. military, a 2011 U.S. Army handbook and several other documents obtained by Public Intelligence provide insight into the practical use of biometrics in Afghanistan, showing both the level of collection and the functional use of the data for intelligence gathering, force protection and even obtaining criminal convictions.  By collecting vast amounts of information on the population of Afghanistan, including both friend and foe alike, the U.S. military has sought to achieve identity dominance by undermining the fluid anonymity of terrorist and criminal networks and attaching permanent identities to malicious actors.

What is biometrics?

While the use of biometrics has become an increasingly important part of the war in Afghanistan, there is a fundamental lack of agreement about the doctrine surrounding the collection and use of biometric information.  An introduction to the 2011 U.S. Army Commander’s Guide to Biometrics in Afghanistan states that there is “no formal doctrine; universally accepted tactics, techniques, and procedures; or institutionalized training programs across the Department of Defense” for biometric capabilities.  Despite this lack of formal doctrine, the U.S. military is currently using more than 7,000 devices to collect biometric data from the Afghan population.  Though biometrics can take the form of any “measurable biological (anatomical and physiological) and behavioral characteristic that can be used for automated recognition,” the biometric identifiers being collected in Afghanistan consist primarily of fingerprints, iris scans and facial photographs.  Other biological characteristics, which are referred to as modalities, that can be used to identify a person include certain types of voice patterns, palm prints, DNA, as well as behavioral characteristics such as gait and even keystroke patterns on a keyboard.

The U.S. military currently uses three devices for collecting the bulk of the biometric data harvested in Aghanistan: the Biometrics Automated Toolset (BAT), Handheld Interagency Identity Detection Equipment (HIIDE) and Secure Electronic Enrollment Kit (SEEK).  The BAT is used primarily by the Army and Marine Corps and consists of a laptop computer and separate peripherals for collecting fingerprints, scanning irises, and taking photographs.  The HIIDE is more mobile, providing a handheld device capable of collecting fingerprints, scanning irises and taking photographs.  Like the BAT, the HIIDE can connect to a network of approximately 150 servers throughout Afghanistan to upload and download current biometric information and watchlists.  The SEEK is also a handheld device with many of the same capabilities of the HIIDE, though it also has a built-in keyboard for remotely entering biographical information on the subject.  Used primarily by special operations forces, the SEEK will eventually replace the HIIDE as the standard collection device for the Army and Marine Corps.

Airman 1st Class Michael Vue, 455th Expeditionary Security Forces Squadron entry controller, scans an Afghan woman’s iris in the waiting area of the Egyptian Hospital at Bagram Airfield, Afghanistan, on April 16. Medical teams use biometrics to identify and track the records for all incoming patients by scanning their iris and fingerprints and then inputting the information into a database. Photo via U.S. Air Force.

Data from these devices is stored in local and national databases which can be searched and compared with other intelligence information to help identify enemy combatants.  All biometric data collected in Afghanistan is ultimately sent back to the DOD’s Automated Biometric Identification System (ABIS) located in West Virginia, where it is stored and also shared with the Department of Homeland Security (DHS) and FBI.  Partnerships with other nations also allow the DOD to run data against biometrics collected by foreign governments and law enforcement.

Enroll Everyone

Though the use of biometrics is relatively new for U.S. forces, collection efforts in Afghanistan have become ubiquitous, taking in data on large swaths of the population from government officials to local villagers.  In 2009, it was reported that even foreign journalists covering the war in Afghanistan would be required to provide their biometric data before being accredited and provided access to military facilities.  The collection of biometric data is viewed as being so essential to the war effort that the Afghan Ministry of Interior was enlisted to help run a program called Afghan 1000, which provides a comprehensive framework for collecting biometric data on the citizens of Afghanistan.  The program established a goal of enrolling eighty percent of the country’s population by 2012, covering nearly 25 million people.  While the actual enrollment numbers are not public, the Afghan 1000 program has been in operation for several years, collecting data for every traveler passing through Kabul International Airport, border crossings and Afghan Population Registration Department offices throughout the country.

The stated goal of the Afghan effort is no less than the collection of biometric data for every living person in Afghanistan.  At a conference with Afghan officials in 2010, the commander of the U.S. Army’s Task Force Biometrics Col. Craig Osborne told the attendees that the collection of biometric data is not simply about “identifying terrorists and criminals,” but that “it can be used to enable progress in society and has countless applications for the provision of services to the citizens of Afghanistan.”  According to Osborne, biometrics provide the Afghan government with “identity dominance” enabling them to know who their citizens are and link actions with actors.  “Your iris design belongs only to you and your left and right irises are different,” Osborne said at the conference.  “A name can be changed or altered illegally or even legally, but once your iris is formed at the age of six months, it cannot be altered, duplicated or forged.”

The U.S. Army Commander’s Guide to Biometrics in Afghanistan recommends that “all combat outposts and checkpoints throughout Afghanistan make it a priority to collect biometric data from as many local nationals as possible.”  During cordoning operations, the guide advises soldiers to “enroll everyone” including the dead, from which DNA is often collected using buccal swabs to capture the cells that line the mouth.  While Afghanistan offers “an extraordinarily complicated environment for the broad employment of biometrics,” the guide notes that the “payoff to U.S. and coalition forces is so great in terms of securing the population and identification of bad actors in the country, that commanders must be creative and persistent in their efforts to enroll as many Afghans as possible.”

U.S. Army Spc. Robert Irwin, serving with 2nd Platoon, D Company, 3rd Battalion, 509th Infantry Regiment, 25th Infantry Division, Task Force Gold Geronimo, uses his Handheld Interagency Identity Detection Equipment (HIIDE) to scan a local Afghan man’s fingerprints, Paktya Province, Afghanistan, Jan. 30, 2012. Photo via U.S. Army.

In a section titled “Population Management,” the U.S. Army’s guide recommends that “every person who lives within an operational area should be identified and fully biometrically enrolled with facial photos, iris scans, and all ten fingerprints (if present).”  The soldiers must also record “good contextual data” about the individual such as “where they live, what they do, and to which tribe or clan they belong.”  According to the guide, popuation management actions “can also have the effect of building good relationships and rapport” by sending the message that the “census” is intended to protect them from “the influence of outsiders and will give them a chance to more easily identify troublemakers in their midst.”  A checklist included in the section includes the following instructions:

• Locate and identify every resident (visit and record every house and business). At a minimum, fully biometrically enroll all military-age males as follows:
  • Full sets of fingerprints.
  • Full face photo.
  • Iris scans.
  • Names and all variants of names.
  • BAT associative elements:
    • Address.
    • Occupation.
    • Tribal name.
    • Military grid reference of enrollment.
• Create an enrollment event for future data mining.
• Listen to and understand residents’ problems.
• Put residents in a common database.
• Collect and assess civil-military operations data.
• Identify local leaders and use them to identify the populace.
• Use badging to identify local leaders, and key personnel.
• Cultivate human intelligence sources.
• Push indigenous forces into the lead at every possible opportunity.
• Track persons of interest; unusual travel patterns may indicate unusual activities.

Widespread enrollment of the population or the “census” as the guide refers to it, is seen in Afghanistan “as supportive of the local government, particularly if accompanied with a badging program that highlights the government’s presence in an area.”  Tribal leaders and clan heads can use biometrics to control their local area which can lend “authority to tribal leadership by helping them keep unwanted individuals out of their areas.”

Biometric Watch Lists

One of the most essential products of the widespread collection of biometric data in Afghanistan is the Biometric Enabled Watch List (BEWL).  Known as “the watch list,” the BEWL is a “collection of individuals whose biometrics have been collected and determined by [biometrics-enabled intelligence (BEI)] analysts to be threats, potential threats, or who simply merit tracking.”  When loaded onto a biometrics collection device like the HIIDE, the BEWL “allows for instantaneous feedback on biometrics collections without the need for real-time communications to the authoritative biometrics database,” allowing the soldier to immediately identify persons of interest.

Once BEI analysts combine all of the data from biometric enrollments, forensic evidence, and other forms of intelligence they develop the BEWL in cooperation with numerous other intelligence agencies and organizations throughout the government.  At least twenty-nine dedicated BEI analysts located throughout Afghanistan work to create the BEWL and individual units can request that specific individuals be added or removed from the list.  When a person’s biometric data is collected in Afghanistan and they are not matched to an entity on the watch list, the data and “associated contextual information required for enrollment” are transmitted back to the ABIS in West Virgina for matching against all other collected biometrics, including the 90 million fingerprint entries collected by DHS and 55 million from criminal enrollments made by the FBI.  If a match is found there, the information is sent to the National Ground Intelligence Center (NGIC) in Charlottesville, VA which generates a biometrics intelligence analysis report (BIAR) detailing the history and potential threat posed by the individual.  NGIC then contacts Task Force Biometrics in Afghanistan which notifies the proper unit in the operational environment.  Depending on the unit collecting the biometric data, this process can take anywhere from a few minutes to several days if the match is made against a latent fingerprint.  Whether a match is ultimately found or not, all information is stored for further use in the BEI process.

A figure from the U.S. Army Commander’s Guide to Biometrics in Afghanistan explaining the linkage between exploitation of biometric information and enrollment on the battlefield.

Even when it is obvious that the people being enrolled have no connection to the insurgency, the Commander’s Guide to Biometrics in Afghanistan emphasizes that “all collections are important.”  The guide states that identification of the “population in a particular area is essential to effective counterinsurgency operations” and essential to a unit’s capacity for “owning ground” in a combat zone.  Units must know “who lives where, who does what, who belongs, and who does not.”  Mapping the “human terrain” is described as key to security, allowing U.S. forces to know “who they are, what they do, to whom they are related” and to help “separate the locals from the insurgents.”  To aid this effort, the guide recommends demonstrating the “value of biometrics” to subordinates and having a “belief in biometrics” so that the “support staff and leaders do not treat biometrics operations as a check-the-block activity.”

Obtaining Convictions

While biometrics are best known for helping U.S forces identify and locate suspected insurgents in Afghanistan, battlefield forensics has become an increasingly important part of the Afghan justice system, helping to convict individuals of aiding the Taliban by hiding weapons caches or constructing roadside bombs.  The U.S. Army’s guide notes that forensics are “being used at an increasing rate by the Afghan criminal justice system, and convictions are now occurring in the Afghan courts based solely on biometric evidence.”  The U.S. Army’s Afghanistan Theater of Operations Evidence Collection Guide advises soldiers on how to collect various forms of biometric evidence for forensic investigators to provide to Afghan prosecutors in the hopes of obtaining a conviction.  This reliance on criminal convictions is part of a “transition from law of war-based detentions to evidence-based criminal detentions” where U.S. and coalition forces must “coordinate with the relevant local, provincial, or national prosecutors and judges to determine the specific type and amount of evidence deemed credible” by providing “evidence and witness statements for use in an Afghan court of law to enable the National Security Prosecutor’s Unit (NSPU) or a provincial criminal court to prosecute and convict criminal suspects.”  The guide advises soldiers to “enroll all subjects on-site” following a criminal activity and “ensure that a full enrollment is collected, to include iris scans, ten digit fingerprints, a full facial photograph, and other biometric data.”  Complex instructions are included on collecting latent fingerprints from pieces of evidence and collecting DNA samples from potential suspects.  The International Security Assistance Force (ISAF) Guide to Evidence Collection also contains similar instructions including how to make plaster casts of footprint and tire tracks to provide to investigators.

A summary of the conviction of an Afghan man last year for building and emplacing improvised explosive devices (IEDs) that was based entirely upon biometric evidence.

A study in the January 2014 issue of National Defense University’s Joint Force Quarterly found that Afghan courts are increasingly looking for “biometrics as a component of the prosecution’s case.”  Focusing particular attention on the Afghan National Security Court located at the Justice Center in Parwan (JCIP), which is described as a “model for successful use of biometric evidence in criminal prosecutions,” the study describes the “prominent role” that biometrics now play in obtaining convictions at the facility.  In fact, the Afghan National Security Court has obtained convictions in “almost every case where a biometric match has been made between the defendant and the criminal instrument.”  The study also found that sentences are consistently longer for individuals convicted using biometric evidence like fingerprints or DNA.  “Collections and enrollments matter and increase the effectiveness of all other operations” the authors state at the conclusion of the study, instructing their readers to “treat every event as a means to collect additional biometrics.”

The number of convictions in Afghan courts based solely on biometric evidence is unknown, as is the accuracy of the systems used for determining a biometric match.  However, we do know that the number of prosecutions is going up.  One such example is the case of Mohammad Zahid, the twenty-two-year-old man arrested in Khost Province in February 2012.  Zahid was arrested with nothing on his person.  He claimed to be a student and said he had no connection with the Taliban, yet a latent fingerprint from an IED found in a cache the previous year along with cell phones, battery packs and other bomb-making supplies reportedly matched his own.  Zahid was one of over a hundred military-age males enrolled in that village in Khost on February 23, 2012.  Now, he will spend years in prison and, according to his testimony, does not know why his fingerprints were found on the bomb-making equipment discovered by coalition forces.

A slide from a February 2014 presentation showing the combined state and local contributors to the National Data Exchange (N-DEx).

Public Intelligence

The Law Enforcement National Data Exchange (N-DEx) run by the FBI Criminal Justice Information Services (CJIS) Division now contains approximately 223 million records on nearly two billion entities.  An FBI CJIS presentation from February 2014 posted on the website of the Integrated Justice Information Systems Institute includes detailed information on state and local data contributors including a tally of the total number of records contributed by state.

The FBI describes N-DEx as “a mechanism for sharing, searching, linking, and analyzing information across jurisdictional boundaries” including “incident and case reports, booking and incarceration data, and parole/probation information.”  Sypherlink, contractor involved in implementing N-DEx data sharing around the country, describes the system as being able to detect “relationships between people, vehicle/property, location, and/or crime characteristics.”  Slides from the February 2014 N-DEx presentation indicate that at least 34 states are contributing data to the system with Texas, Arkansas, California, Virginia and Tennessee each providing at least ten million records.  Texas has contributed more than any other state, adding more than 68 million records to the system, nearly three times its nearest competitor.  Federal agencies have added another 23 million records to the system.  According to an updated listing of N-DEx data contributors listed in the presentation, federal and state contributions amount to more than 191 million records in total.  However, other slides in the presentation brag that their are “approximately 223 million records” on “nearly 2 billion entities” stored in N-DEx.  It is unclear where the more than 30 million records not contributed by states and federal agencies listed in the presentation are obtained from.

A privacy impact assessment issued by the FBI in January 2007 stated that “during initial deployment” it was “estimated that the number of records in the N-DEx may be approximately 30-35 million records.”  In an article for Police Chief Magazine, a N-DEx “outreach liaison” stated that the system had “more than 145 million records” in November 2012 and “one billion searchable entities.”  N-DEx program manager Michael Haas stated in a October 2013 interview with Computer World that he hoped future developments will make the system a “gateway for access to other CJIS databases, including the division’s Next Generation Identification system, an updated version of its Integrated Automated Fingerprint Identification System database that contains wanted lists and arrest warrants, criminal histories, fingerprints, palm prints, facial images and other biometric data used for identification purposes.”  The FBI Next Generation Identification system, which has been in development for several years, promises to offer law enforcement around the country the ability to use facial recognition software and other tools to automatically search through vast troves of biometric data to identify suspects and conduct investigations.  Haas also said that the growth of the system has been expanding because CJIS has encouraged “states to submit records from prosecutions, court records, corrections, probation and other related areas” so that in addition to the “incident information” already added to the system, N-DEx will begin to obtain more data over time on “pretrial investigations, warrants, supervised release details, citations, field interviews and incarceration information.”

N-DEx Data Contributors Listed By State

Public Intelligence

In the first weeks of 2013, police officers were combing through a bloody scene in the Indian state of Jharkhand where a dozen security personnel had died in a shootout with local rebels.  The Naxalite fighters, who promote a Maoist ideology through their ongoing guerrilla conflict with the Indian government, had killed the men, including five Central Reserve Police Force members, in a gun battle days before.  When local villagers and police tried to remove the bodies, a bomb went off killing four more people.  After the incident, a group of doctors in nearby Ranchi were performing an autopsy on one of the bodies when they encountered something metal lodged inside the body.  A bomb squad was called in and an explosive device triggered by shifts in pressure that had been sewn into the police officer’s body was successfully defused.

A Department of Homeland Security and FBI bulletin sent to law enforcement around the county in May 2013 warns of the same thing happening in a U.S. city.  The bulletin describes how “insurgents in India placed improvised explosive devices (IEDs) in the bodies of two police officers who were killed during an ambush . . . designed to target first responders, medical personnel, and medical facilities.”  Though this “concealment method” has not been “encountered in the Homeland,” the bulletin warns that the “incident received broad English-language media coverage overseas, which could prompt technically-competent violent extremists to consider adopting the tactic.”

The DHS-FBI bulletin credits Indian medical personnel with preventing detonation of the device because of their alertness to the “suspicious indicators” that a bomb had been placed inside the body.  First responders are advised to look for “unusual or fresh—possibly still bleeding or seeping—incisions accompanied by crude stitching” as well as “signs of post-mortem incisions or stitching.”  Other signs include “abnormal bloating or swelling of the body” or “foreign objects protruding from the body” as well as human remains ” placed in a manner/location requiring responders to immediately remove them from the encountered position/location.”

U.S. Secretary of State John Kerry speaks with U.S. Marine Corps General Joseph Dunford, as U.S. Ambassador to Afghanistan James Cunningham listens, in Kabul, Afghanistan, March 26, 2013.  Ambassador Cunningham issued the new U.S. Civil-Military Strategic Framework for Afghanistan in August which was signed by General Dunford.  Photo via State Department.

Public Intelligence

Afghan President Hamid Karzai’s recent refusal to sign a bilateral security agreement with the U.S. has fueled a growing sense of frustration and confusion among those charting the future of Afghanistan.  The agreement, which authorizes the continued presence of American troops in Afghanistan beyond 2014, has been described as “critical to Afghanistan’s future stability.”  One unnamed Afghan official quoted in a recent report from NBC News said that without the thousands of U.S. troops that are expected to maintain a presence in the country “the government could collapse and Afghanistan would enter a civil war.”  Former Ambassador to Afghanistan Ryan Crocker told Foreign Policy that he worries about a lack of “sustained administration engagement at a high level,” which has the potential to set the stage for a repeat of “pretty horrible” past events, referring to the civil war in the early 1990s that led to the Taliban’s rise to power.

While Karzai has signaled that he will likely sign the agreement, stating earlier this month that he wants to wait until after the April 2014 presidential elections, he continues to find new reasons for failing to do so, including most recently disagreeing with the U.S. government’s definition of terrorism.  Assuming the agreement is eventually signed, what does the future actually hold for the Afghan people?  Public Intelligence has obtained the most recent version of the U.S. Civil-Military Strategic Framework for Afghanistan, the second revision of the document dated August 2013, detailing the U.S. government’s goals and priorities for rebuilding Afghan society.  Issued by the U.S. Ambassador to Afghanistan James Cunningham and signed by the commander of U.S. forces Joseph Dunford, the framework covers U.S. priorities related to governance, the rule of law, socioeconomic development as well as the gradual transfer of authority to the Afghan government.  When compared with a previous version of the framework from March 2012, also obtained by Public Intelligence, the document solidifies the prospect of long-term U.S. involvement in Afghanistan, removing optimistic statements about turnover dates and self-sustaining funding estimates and replacing them with measured assessments reinforcing the notion that U.S. and international forces will be present in Afghanistan far into the next decade.

The Transformation Decade

The U.S. Civil-Military Strategic Framework for Afghanistan has evolved substantially since its first edition, issued by Ambassador Crocker in March 2012.  The document has abandoned much of its original optimism to embrace a more grounded view of the realities of a war-torn developing nation.  The most recent version of the U.S. Strategic Framework, revised in August, places a much greater focus on the process of transferring power to Afghan authorities, emphasizing  “transition” as a guiding concept of U.S. operations in the country.  Transition is defined as shifting “security responsibility for Afghanistan to the Afghan Security Institutions (ASI) and the Afghan National Security Forces (ANSF)” as well as embracing a “more traditional diplomatic and development model” for U.S. efforts.  According to the framework, much of this will be achieved during the so-called “Transformation Decade,” a period from 2015-2024 that will see Afghanistan working to reduce its dependence on “international assistance, improving delivery of government services, and promoting fundamental freedoms and human rights.”  By 2025, the framework envisions Afghanistan having “reduced its dependence on international assistance in non-security sectors to levels consistent with other least developed nations,” increasing “peace and stability” through “effective development” and improving the “delivery of government services.”  By 2030, this transformation will allow Afghanistan to “emerge as a model of a developing democratic Islamic nation.”

Despite its optimism, the framework is remarkably frank about its diminishing expectations for Afghanistan, noting that even with “a strong partnership between the U.S. and Afghanistan, the Transformation Decade will be fraught with challenges” requiring “constant evaluation.”  Even under “the best of circumstances,” the framework says “Afghanistan will continue to be in the category of ‘least developed nations’ with high levels of poverty, unemployment, and illiteracy, as well as underdeveloped infrastructure.”  Moreover, the nation will continue to be threatened by “non-state actors” that will decrease stability and challenge the Afghan government’s capacity to govern.

The Framework’s Structure

The U.S. Strategic Framework is conceived of as a structure with a foundation and three pillars that support long-term U.S. strategic goals in Afghanistan.  The structure is founded on security, which focuses on “creating an environment that enables progress in governance, rule of law, and socio-economic development.”  The process of supporting Afghan security involved a gradual transition over time from operations led by NATO International Security Assistance Force (ISAF) personnel, to partnered combat operations, to the current state “where ANSF is leading combat operations.”  This transition has been achieved through a series of “tranches” that have involved specific provinces and districts within Afghanistan taking responsibility for the security of their own area the country.  The final tranche was announced in June 2013 indicating that all districts have now begun the process of “security transition.”

The viability of this transition remains to be seen as U.S. troops have previously voiced concerns about the readiness of Afghan forces.  A 2012 survey of several U.S. Army companies stationed in Khost and Paktiya provinces found that nearly half of soldiers surveyed said the Afghan National Army (ANA) had improved little, not much or not at all during their partnership.  Many soldiers cited in the report list Afghan forces’ lack of motivation and rampant illiteracy as factors undermining their training efforts.  Nearly 62% of soldiers responding to the survey said that so-called “ANA-led” missions are rarely or never actually planned and executed by Afghan forces.  One soldier quoted in the survey described how a recent “ANA-led” mission required him to “spoon-feed” his Afghan counterpart the entire operations order and planning.  “We do the heavy lifting, they put a face on it,” another soldier said.

A graphic depicting the theoretical structure of the U.S. Civil-Military Strategic Framework for Afghanistan.

There are also a number of significant challenges threatening the “three pillars” of the U.S. Strategic Framework.  The governance pillar, which is particularly important to the future of Afghanistan, is primarily focused on strengthening the “Afghan people’s confidence in their government” by working to enhance its legitimacy and eliminating corruption.  The U.S. hopes to do this by supporting a “credible” and “transparent” election in 2014, when Afghan President Hamid Karzai will finally be forced to step down from his position.  The U.S. will also work to build Afghan government infrastructure from the ground up, strengthening “governance architecture and functionality, revenue collection and budget prioritization, execution, and accountability at both the national and sub-national levels, leading to more efficient, effective, and accountable service delivery for all Afghan citizens.”

Much of the success that will come from strengthening Afghan governance will depend on the second pillar of the U.S. framework: the “rule of law.”  This requires that the U.S. and Afghan government work to create a justice system providing access to “fair, efficient, and transparent justice based on Afghan law and international obligations” while also minding the “linkages between formal and customary justice” currently operating in the country.  The existing structure of Afghan justice is poor after “over thirty years” of “social and political upheavals, corruption, and technical and material deprivation.”  Afghans have little “confidence in their governments’ ability to provide fair, efficient, and transparent justice to all citizens” which discourages “economic growth by deterring investment and licit business opportunities.”  The rampant corruption throughout Afghanistan is a significant factor in this lack of trust, enabling a system of informal justice that often exploits “society’s most vulnerable members,” delegitimizing the Afghan government and making “harsh justice more acceptable to many Afghans.”

The final pillar of the U.S. framework focusing on socioeconomic development will depend largely on the success of U.S. initiatives to strengthen the legal and governance environment in Afghanistan.  A growing economy is described by the framework as increasing “stability within Afghanistan and the broader region” by providing jobs as well as “an adequate tax base to fund government-provided services.”  Economic growth will help bolster people’s confidence in the Afghan government, providing for “healthy and educated Afghans with jobs” that are able to provide for their families, making them “less likely to participate in the insurgency.”  The U.S. hopes that this will be accomplished through support of several key industries in Afghanistan, including telecommunications and extractives.  The original version of the U.S. Strategic Framework from March 2012 places heavy emphasis on the potential for cultivating Afghanistan’s extractives industry, which has previously been estimated to be worth trillions of dollars.  “Development of minerals and hydrocarbons is Afghanistan’s best chance to draw foreign investment and reduce its dependence on foreign assistance,” the March 2012 version of the framework states.  This development will “increase demand for the construction of regional rail, road, and energy networks that can generate significant revenue and create jobs.”  However, it will be at least “five to ten years” before the Afghan government begins to “realize revenue from its significant mineral deposits.”  In the interim, U.S. policies will support “trade policy liberalization, commercial law development, customs process reform” and “removal of barriers to cross-border trade.”

Public Intelligence

A federal law passed in February 2012 to help middle class families by creating jobs and cutting payroll taxes included a section mandating the creation of a nationwide interoperable broadband communications system for law enforcement and first responders. The system, which is being created under the direction of the First Responder Network Authority (FirstNet), seeks to create a nationwide broadband network capable of being used for a variety of law enforcement purposes including remote surveillance, mobile biometric applications like field fingerprint scanning and facial recognition, as well as automated license plate reading. The system is currently in a pilot phase with less than a dozen locations around the country participating in the initial rollout of the FirstNet network. However, comments from FirstNet board members indicate that the future goals of the system include an interoperable network operating in all 56 states and territories of the U.S. that is capable of integration at the state, local and federal level.

FirstNet was created by the Middle Class Tax Relief and Job Creation Act of 2012 which mandates the creation of a “nationwide public safety broadband network” with a “nationwide level of interoperability.” Section 6203 of the Act mandated that a board of experts, in consultation with NIST and the National Telecommunications and Information Administration (NTIA), draft minimum technical requirements for the nationwide system. A board of directors comprised of telecommunications executives and law enforcement officials from around the country, including former Secretary of Homeland Security Janet Napolitano, was assembled and announced in August 2012.

The public safety network being created by FirstNet has many positive applications, enabling police, firefighters, paramedics and other first responders to communicate more effectively, increasing coordination of emergency response efforts and increasing situational awareness. The network’s capabilities could potentially enable novel applications such as “enabling firefighters to download blueprints of burning buildings in order to plan their entry route” or “allowing emergency medical technicians to remotely access a victim’s medical records from an ambulance.” However, the network will also enable a number of capabilities that are concerning to privacy advocates including facial recognition technology, mobile iris scanning and fingerprinting devices, automated license plate recognition and much more. These capabilities will be facilitated by a network that is interoperable with federal and state authorities including the FBI, Department of Homeland Security and even the Army National Guard.

What is FirstNet?

FirstNet received initial funding of over $2 billion as part of the Middle Class Tax Relief and Job Creation Act of 2012. Future stages of the project will eventually be funded through spectrum auctions that are expected to generate approximately $5 billion. The FirstNet network will function in a portion of the frequency spectrum at 7000MHz known as Public Safety Broadband Band 14. The spectrum allocation was certified by the FCC in October, paving the way for construction and sales of devices to first responders. The decision was hailed by the FCC commissioner Ajit Pai as a first step towards helping “the equipment market for the 700 MHz public-safety band to develop and for innovation to flourish.”

There are less than a dozen locations around the country that are currently serving as test sites for FirstNet’s broadband network, including Mississippi, Colorado, New Jersey, New Mexico, North Carolina and California. These sites were selected because of their participation in the NTIA Broadband Technology Opportunities Program, which provides billions in dollars in grant money to local communities for broadband projects. In July, FirstNet issued 17 requests for information covering all aspects related to the construction of the network infrastructure. According to a presentation by FirstNet board member Ed Reynolds in June of this year, FirstNet will have a “diverse network architecture” with three main components: multiple terrestrial networks, including both dedicated public safety and commercial networks, mobile satellite systems as well as publicly deployable systems that could be installed in vehicles.

Though still in its infancy, FirstNet’s work towards building an interoperable nationwide network has not been without controversy. In April, a FirstNet board member decried the fledgling organization’s overreliance on private sector consultants motivated by their own commercial interests. Sheriff Paul Fitzgerald of Story County, Iowa described FirstNet’s network as being “developed largely by consultants” with “board members having a commercial-wireless point of view” receiving more documentation and having more input over “board members with a public-safety point of view.” Fitzgerald also noted his concerns with the organization’s lack of transparency, saying that certain financial information was not being provided to all board members. “I worked hand-in-hand with [the] Public Safety Alliance for quite some time to see this network created, and I will not sit by and watch it built by my industry board-member colleagues in accordance with their commercial vision, rather than the vision of the public-safety users of the public-safety broadband network,” Fitzgerald said in a statement to his fellow board members.

Introducing Mobile Biometrics

The creation of the FirstNet network is primarily intended to enable communication between first responder entities including police, medical response, firefighters. The system is intended to facilitate interoperable communication during disasters, mass casualty events and other catastrophic situations that could threaten traditional communications systems, such as the land mobile radio (LMR) systems currently used by emergency services. However, the broadband capabilities of the FirstNet network, based on the 4G LTE standard, enable entirely new applications of wireless technology for law enforcement. The high bandwidth network’s powerful capabilities enabling large file transfers and remote database access are already being explored by a number of companies seeking to create the next generation of law enforcement technology.

One of the primary focus areas for companies seeking to exploit FirstNet’s capabilities is mobile biometrics. Until now, biometric identification using fingerprints or iris scans has remained a tool limited to the context of active war zones or high-security government facilities. FirstNet’s broadband network is set to change this by enabling police around the country to use mobile biometric devices to scan the fingerprints of suspects, scan their irises or even match their face against a central database of criminal mugshots. Promotional materials for FirstNet explicitly list the use of facial recognition technology and other biometric identification techniques as part of the “vision” and “promise” of the national network they are building. FirstNet lists the use of “specialized applications that allow police to quickly identify criminal suspects and accident victims through technologies such as facial recognition, iris scanning, and fingerprint identification” on the first page of its recruitment prospectus.

A presentation slide describing potential future applications of FirstNet’s nationwide broadband network.

With the advent of the distributed data network created by FirstNet, law enforcement throughout the U.S. will soon have access to the same capabilities currently used in Afghanistan to track and monitor the population. A study released in June 2013 by Sandia National Laboratories and co-sponsored by the Department of Homeland Security Science and Technology Directorate (DHS S&T) sponsored a series of “pilot projects” to obtain information and feedback from the “first responder law enforcement community on further identification of requirements for mobile biometric device technology.” The study involved 62 jurisdictions around the country with many testing the very same devices currently used by U.S. forces in Afghanistan, such as the SEEK II made by CrossMatch Technologies and the HIIDE 5 made by MorphoTrust. According to the study’s conclusions, mobile biometric devices (MBDs) are currently used only in a limited number of jurisdictions in the U.S. that rely on “intermediate communication links and Wi-Fi proximity to either Blackberries or patrol car mobile data terminals.” FirstNet’s capabilities would expand this reach to enable any police department in the country to implement or expand the use of MBDs, something the study says many departments want to do. This includes “technologies for subject/suspect/detainee enrollment in the field” which is currently of “definite interest” to a number of law enforcement and first responder stakeholders who “have also identified a need for a truly integrated MBD that uses fingerprint, facial recognition, iris recognition, and voice recognition technologies.”

The Future of Crime Fighting

While still years away, the promise of advanced law enforcement technologies made possible by FirstNet’s broadband network has driven a number of companies to begin capitalizing on what they hope will someday be a lucrative market.  At the 2013 International Wireless Communications Expo, Alcatel-Lucent demonstrated mobile biometric technologies for facial recognition that would rely on FirstNet’s broadband network.  Through the company’s ng Connect Public Safety Program, Alcatel-Lucent is building a coalition of companies that focus in facial recognition, location tracking using GPS and other law enforcement technologies facilitated by the “commercial deployment of an all IP Network (4G LTE) with high bandwidth and low latency” known as FirstNet.  Touting the U.S. government’s allocation of $7 billion for the construction of FirstNet, an infographic created by Alcatel-Lucent proudly displays the estimated annual value of the U.S. homeland security and public safety market at over $100 billion by 2020.  The nG Connect Public Safety Program combines the expertise of several companies to redefine the “art of the possible” by building applications that help law enforcement to incorporate “award winning tracking solutions for fleet management and leading edge law enforcement surveillance and covert operations capabilities” as well as “proprietary recognition engines for analysis of video streams to identify ‘people of interest’ by biometric and personal characteristics.”

Mutualink, another company working to leverage FirstNet’s capabilities, is taking the concept of mobile biometrics one step further with its Google Glass for Public Safety.  “Robocop may not be real, but his efficiency is something worth aspiring to,” begins an article about the product published in Government Technology.  The technology will integrate with the Google Glass heads up display to allow users to “look to the right in their peripheral vision and view information that is being served to them, like maps, blueprints, surveillance video feeds, or other documents.”  According to Mutualink’s Senior Vice President Joe Mazzarella, the technology could be “very useful for first responders and soldiers alike.”  An article in the law enforcement publication PoliceOne.com provides examples of potential applications for the Google Glass for Public Safety, suggesting an “officer interviewing a suspected gang member could run the suspect’s image through a facial recognition database of known gangsters, or pull up a photo record of a tattoo to compare against one on the person in front of them.”  During a search of a building, officers could “see their own location and those of everyone else involved in the effort on a stored floor plan of the structure” or, as a Mutualink press release states, they could “watch video feed from school security cameras in real-time during an active shooter scenario.”

A presentation from the acting Chief Technology Officer of FirstNet Craig Farrill at a regional workshop in May 2013 indicates that FirstNet intends to foster a “vibrant developer community contributing useful apps for first responders.”  These applications would be vetted by FirstNet prior to being offered for download to devices on the broadband network, something like an iTunes for law enforcement and first responders.  Similar plans were discussed in a prospectus issued by the Major Cities Chiefs’ Association in 2012 which called for the creation of a “secure, socially driven interface” resembling Facebook to enable “state and local intelligence and counterterrorism personnel to effectively network,” allowing “a detective in Las Vegas . . . to securely customize a profile page, build a network of ‘friends’ who are in fact colleagues in other agencies, and network by sharing nonsensitive information through wall posts, messages, and status updates . . .”  In June, Bill Bratton, who has headed police departments in Boston, New York and Los Angeles, announced the creation of BlueLine, described as a “Facebook for cops” that is “geared toward collaboration on policing issues like gangs or drugs and product and technology advances.”  The network will reportedly be funded through law enforcement product sales including everything from “from socks to Glocks” according to the project’s Chief Strategy Officer Jack Weiss.

Local Interest in Mobile Biometrics

Though adoption of many of the advanced technologies made possible by FirstNet’s broadband network will ultimately remain up to local municipalities, several local jurisdictions have already expressed interest in mobile biometrics and other applications.  At a meeting in August, the Bay Area Regional Interoperable Communications Systems Authority (BayRICS), a joint powers authority of 12 counties throughout the San Francisco Bay Area, used a slide from FirstNet describing facial recognition, field fingerprinting and automated license plate reading as part of the “promise of broadband” coming soon to the area.

Likewise, an Oregon Statewide Interoperability Coordination technical report issued in December 2012 titled “Planning for FirstNet” discusses introducing a number of “labor saving applications incorporating license plate recognition, scanning of driver licenses, facial recognition, and other advanced technologies” once the FirstNet broadband network is operational.  A section of the report listing public safety broadband applications includes remote access to database including “mug shots, finger prints, reporting, NCIC, criminal history, hot files” as well as “video surveillance, remote monitoring” and “automated license plate recognition.”  A press release issued in February by the Texas Department of Public Safety titled “FirstNet Ready to Boost Texas Public Safety” states that the network will not only “give emergency responders a common and instant connection, it will allow them to share information through automatic license plate readers, facial recognition systems, field fingerprint analysis processers and much more.”

The National Association of Counties even issued a policy brief in June 2013 advising counties that it is “imperative” that they “engage in the consultation process and actively seek out the designated state coordinator” to take advantage of the more than “$7 billion of spectrum auction proceeds and valuable spectrum bandwidth toward deployment of the nationwide network” as well as $135 million allocated by Congress for a new “State and Local Implementation Grant Program administered by NTIA to support State, regional, tribal and local jurisdictions’ planning work with FirstNet.”  The network is described in the brief as working to provide a “secure and interoperable network” that will “also support cutting-edge applications – for example, enabling firefighters to download blueprints of burning buildings in order to plan their entry route, allowing emergency medical technicians to remotely access a victim’s medical records from an ambulance, or helping police to identify criminal suspects through facial recognition or iris scanning technologies.”

A chart from Chairman of the Joint Chiefs of Staff Instruction 3160.01A depicts collateral damage estimation levels and their representative risk to overall operations.

Public Intelligence

An updated instruction issued by the Chairman of the Joint Chiefs of Staff in October 2012 incorporates significantly modified language in numerous sections of the document that describe the process for estimating collateral damage prior to conducting drone strikes and other military actions.  These subtle, but important changes in wording provide insight into the military’s attempts to limit expectations in regards to minimizing collateral damage and predicting the lethal effects of military operations.

The update to Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 3160.01A “No-Strike and the Collateral Damage Estimation Methodology” incorporates technical updates to the process for estimating collateral damage as well as lessons learned from the conflicts in Libya and Afghanistan.  Despite its release restrictions, a previous version of the instruction was provided in full to the ACLU in 2011 after the group filed a Freedom of Information Act request for documents related to the military’s use of armed drones.  The version of the instruction obtained by the ACLU, which is dated February 2009, contains significantly different language in numerous key sections of the document that describe the accuracy and processes for predicting collateral damage.

While much of the actual technical methodology for predicting collateral damage remains unchanged, language throughout the document is modified in a way that minimizes expectations about the ability of U.S. forces to accurately predict collateral damage and includes qualifying statements regarding the compliance of U.S. military operations with international law.  In a section of the document detailing procedures related to no-strike entities (NSEs), which have “protected status” and cannot be targeted in military operations, the new version of the instruction no longer describes the U.S. as “adhering to” international law, but instead states that the U.S. is “bound by” international law which “regulates”, rather than “requires” certain conduct during military operations.  A few paragraphs later, a sentence warning against the “infliction of unnecessary suffering or damage to civilian persons or property that is excessive in relation to the concrete and direct military advantage anticipated” is removed from the document, as is the statement that the conduct is “inconsistent with international law.”  A section requiring “all military personnel to take reasonable precautions to ensure that only military objectives are targeted” and ensure that civilians are not made the object of attack is changed to require only that military personnel “avoid targeting (i.e., attacking) civilian or noncombatant persons or objects.”

The new version of the instruction also modifies a requirement that commanders limit “unnecessary suffering and disproportionate damage.”  Instead, commanders are now only required to mitigate “human suffering and property damage.”  The overall process for estimating collateral damage is described as “a conservative characterization” of the risks involved rather than the previous “best judgment of potential damage to collateral concerns.”  Several additions are also made in the new version of the instruction including an allowance for “weapon delivery uncertainties” and a statement indicating that U.S. forces are not responsible for “secondary explosions” from fuel or other supplies on the ground.

A small selection of some of the differences between the two versions of the instruction is included in the table below.  Blue indicates text modified from the previous version of the instruction.  Red indicates text that was inserted into the new version of the instruction.

A map of school shootings throughout the U.S. from January 2008-August 2013 included in a report from the Los Angeles Joint Regional Intelligence Center.

Public Intelligence

Law enforcement has struggled in recent years with the issue of mass shootings and how to provide the public with adequate ways to detect and possibly catch shooters before they strike. School shootings, in particular, have vexed criminal analysts trying to help school officials ensure the safety of their students by identifying at-risk individuals that might engage in acts of violence. This has led to some strange and seemingly arbitrary speculations about the nature of school shooters.

A 2009 document released by the FBI and the National Center for the Analysis of Violent Crime titled “The School Shooter: A Quick Reference Guide” is one example of this sort of speculation. The guide warns that “repeated viewing of movies depicting school shootings” such as Zero Day and Elephant could indicate a fascination with school shootings. According to the guide, school shooters often exhibit “violence in their own writings, poems, essays, and journal entries” and have an interest in violent movies. Law enforcement and school officials concerned about a student are encouraged to monitor the subject’s online videos, blogs, and social networking activities to look for signs of grief and desperation.

Another guide produced in 2006 by the Regional Organized Crime Information Center contained similarly broad and speculative observations that could likely be applied to large swaths of the student body at your local high school. In a section on “warning signs” of a school shooter, the guide lists an “attitude of superiority” and “exaggerated sense of entitlement.” The guide goes on to say that school shooters are often “fans of violent media, especially first-person shooter games” and “social outcasts who pride themselves on exclusion from popular circles.”

Analyzing School Shootings

Moving away from these basic speculations, law enforcement has expanded its efforts to embrace statistical analysis in the hopes of discovering common attributes among school shooters and mass shootings generally. Over the last year, fusion centers in several states have released studies, deriving useful information from aggregate analysis that can actually help the public understand the phenomenon of school shootings and what drives people to engage in this sort of seemingly random violence.

A statistical analysis of school shootings released in August by the Los Angeles Joint Regional Intelligence Center (LAJRIC) studied school shootings throughout the U.S. from January 2008 to August 2013. In that five-year span, there were 85 school shootings that took place in 29 states, a majority of the country, with most states experiencing between one and three incidents over the last five years. California ranked highest with 18 incidents, followed by Michigan and Tennessee. The majority of school shootings, about 52%, took place at high schools, with the rest equally distributed between colleges/universities and elementary/middle schools.

A chart from the Los Angeles Joint Regional Intelligence Center study of school shooting incidents from January 2008-August 2013 depicts motivations for school shooters.

These shootings were perpetrated by 97 people, almost entirely male, with only 4% being perpetrated by females. Most of the shootings involved the use of small arms and only 11% involved the use of multiple weapons. Less than half of the shootings (46%) were committed by current or former students at the school and only 8% were committed by current or former employees. Significantly, at least 40% of school shooters during the five-year period had no connection to the school where the attack occurred.

Half of the victims of school shootings were intentionally targeted by the gunman with only 21% being killed or wounded due to indiscriminate gunfire. In 57% of the incidents the perpetrator directly knew the victims. The majority of the perpetrators were between 16‐18 years old (31%) with the second largest group being 13‐15 year old (23%). Demographics and motivations for school shooters vary widely, with most being perpetrated for unknown reasons. Gang-related shootings happening in and around school campuses account for nearly three-times the amount of incidents as murders/suicides and retaliation for bullying. In fact, only 27% of school shooters commit suicide or are killed by authorities. Most school shooters (61%) end up being arrested after having killed one or more victims.

Digging Deeper

A similar report released in March by the Massachusetts Commonwealth Fusion Center (CFC) studied school shootings from 1992-2012, obtaining significantly different results from the study conducted by LAJRIC due to the use of more stringent criteria. The CFC study found that 80% of school shooters were current or former students at the targeted school, as opposed to the figure of 40% in LAJRIC’s report. CFC found that 40% of perpetrators used two or more weapons and that 43% entered the building normally with their weapons concealed. According to the CFC’s findings, most school shootings (42%) occur in the morning between 7-11:30 AM. One particularly interesting finding from the CFC report is the high number of victims from a few specific incidents versus the relatively low number of victims from most school shootings. Though 87% of incidents resulted in 0-3 fatalities, CFC found that three incidents accounted for 45% of all fatalities during the period.

The CFC report notes that a history of mental health issues was cited in 28% of school shootings as a motivating factor. Other common motivations include “difficulty coping with significant losses or personal failures” or specific grievances, including bullying. Both the CFC report as well as an analysis released last year by the New Jersey Regional Operations Intelligence Center (NJROIC) found that school shooters often indicate their intentions to others prior to the incident. The CFC found that in 33% of incidents one or more people knew directly of some aspect of the perpetrator’s intentions through direct statements or online posts using social media. The NJROIC analysis states that “the majority of students who have conducted plots or attacks against their schools have publicized their anger or intentions through the use of social media” and provides several examples of school shootings that followed online threats. For example, the perpetrator of a 2011 school shooting in Omaha, Nebraska that resulted in the death of a school administrator posted a Facebook update prior to the shooting that read:

“Everybody that used to know me, I’m sorry but Omaha changed me and fucked me up. And the school I attend is even worse. You’re gonna here [sic] about the evil shit I did but that fucking school drove me to this. I want you guys to remember me for who I was before this. I greatly affected the lives of the families ruined but I’m sorry. Goodbye.”

Likewise, the perpetrator of a school shooting at an Ohio high school in February 2012 that resulted in the deaths of three students posted a poem filled with violent imagery on Facebook several months prior that ended with the phrase: “Die, all of you.” If caught in time, these indicators can actually help stop attacks from happening. A plot to bomb a Utah high school in early 2012 was foiled after one of the potential perpetrators sent a text message to another student stating “If I tell you one day not to go to school, make damn sure you . . . are not there.” The text messages went on to document parts of the teens’ alleged plot to steal an airplane following the attack and flee the country: “I get the feeling you know what I’m planning . . . explosives, airport, airplane. We ain’t gonna crash it, we’re just gonna kill and fly our way to a country that won’t send us back to the U.S.” Due to the text messages being reported to authoirities, the plan to attack the school was thwarted. Investigators said they later found detailed blueprints of the school and bomb-making materials at the suspect’s home.

An example photo of a “weapons cache” included in a Department of Homeland Security and FBI bulletin to law enforcement. Photo via Maine State Police.

Public Intelligence

A joint bulletin issued in early August by the Department of Homeland Security and FBI warns state and local law enforcement agencies to look out for people in possession of “large amounts” of weapons and ammunition, describing the discovery of “unusual amounts” of weapons as a potential indicator of criminal or terrorist activity.

Citing the example of Norwegian mass-murderer Anders Behring Breivik, who reportedly “stockpiled approximately 12,000 pounds of precursors, weapons, and armor and hid them underground in remote, wooded locations,” the bulletin instructs law enforcement to look for “large amounts of weapons, ammunition, explosives, accelerants, or explosive precursor chemicals” that “could indicate pre-operational terrorist attack planning or criminal activity.”  Weapons do not have to be “cached” in remote locations to meet the standard for suspicious activity.  According to the bulletin, weapons could be stored in an “individual’s home, storage facility, or vehicle” and may include common firearms such as “rifles, shotguns, pistols” as well as “military grade weapons.”  The illegal possession of large amounts of ammunition is also listed as a potential indicator of “criminal weapons possession related to terrorism.”  While the bulletin never clarifies what constitutes a “large” or “unusual” quantity of weapons or ammunition, it does say that such a quantity would “arouse suspicion in a reasonable person.”

The joint DHS-FBI Roll Call Release distributed to police, first responders and private security throughout the U.S. is part of a series of bulletins describing activities “reasonably indicative of criminal activity associated with terrorism.”  The suspicious activities described in the bulletins are derived from criteria in the Information Sharing Environment (ISE) Functional Standard for Suspicious Activity Reporting signed in 2009.  The ISE Functional Standard governs the collection of information for the Nationwide Suspicious Activity Reporting Initiative (NSI), an interagency program to collect suspicious activity reports from law enforcement agencies around the country.  Other bulletins in the series focus on everything from surveillance and theft to photography and even “eliciting information,” an activity described as “questioning individuals at a level beyond mere curiosity.”

Like other bulletins in the DHS-FBI series on suspicious activity reporting, the document notes that “constitutional activities should not be reported” unless the circumstances “support the source agency’s suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism.”  However, no guidance is provided on potential legal issues related to the reporting of constitutionally-protected activities.

DHS-FBI Roll Call Release: Suspicious Activity Reporting (SAR) Weapons Discovery (Text)

A chart from a Central Florida Intelligence Exchange (CFIX) study released in July shows cases of mass shootings believed to be attributable to mental illness.

Public Intelligence

Analysis conducted by the Central Florida Intelligence Exchange (CFIX) has found that 79% of mass shootings since 2011 have been perpetrated by individuals with “demonstrated signs of continuous behavioral health issues and mental illness.”  In a July case study titled “Acts of Violence Attributed by Behavioral and Mental Health Issues“, CFIX analyzed 14 mass shooting incidents that occurred between 2011 and 2013 and found that only three of the shooters had no history of mental illness.

The study, which focuses primarily on “violence perpetrated against healthcare providers and emergency responders” particularly “by patients with behavioral and mental health issues”, also discusses the correlation between mental health issues and mass shootings.  According to the CFIX analysts, across the country “the numbers of mass shootings involving perpetrators with behavioral health issues have noticeably increased” with 79% of mass shooting occurrences between January 2011 to May 2013 involving perpetrators that exhibited “continuous behavioral health issues” and “mental illness”.  In the same period, the only mass shootings found to have been committed by individuals with no previous history of mental health issues were the Sikh temple shooting in Oak Creek, Wisconsin, which is described as a hate crime, and the “work-related” shooting spree perpetrated by Christopher Dorner in early 2013.  Another incident in New York which involved a man named Kurt Myers killing several people at a car wash and barber shop in March 2013 has no known motive, though speculation centered on the shooter’s money problems.

The analysis provided by CFIX is useful for understanding the connection between mental health issues and senseless acts of large-scale violence, though the analysts’ conflation of mental disorders and mental illness leads to some conclusions that may not be warranted.  For example, Adam Lanza, the perpetrator of the mass killing at Sandy Hook Elementary School in Newtown, Connecticut, had been reportedly diagnosed with mental disorders including Asperger syndrome that are fairly common and do not constitute mental illness.  These issues are further complicated by the fact that many perpetrators of mass shootings suffer from mental illness throughout their lives, though are never formally diagnosed.  Due to the fact that many perpetrators of mass shootings commit suicide or are killed by police during the incident, this diagnosis often never occurs leaving only vague statements from friends and family members about the perpetrator’s history of unusual behavior.

A list of the perpetrators of mass shootings that were found by CFIX to be linked to “mental illness” is included below with a brief synopsis of the shooters’ actions and history of mental health issues.

Mass Shootings Attributed to History of Mental Illness

• Jared Loughner; January 8, 2011; 6 killed, 13 injured – Loughner went to an event with U.S. Representative Gabrielle Giffords in a Safeway parking lot in Tucson, Arizona and killed six people, including a U.S. District Court Judge John Roll and a 9-year-old girl.  Loughner was later diagnosed with paranoid schizophrenia and was initially ruled incompetent to stand trial.
• Eduardo Sencion; September 6, 2011; 4 killed, 7 injured – Sencion killed 4 and injured 7 in and around an IHOP restaurant in Carson City, Nevada using a Norinco Mak 90 semiautomatic rifle illegally converted to fully-automatic mode.  Sencion was diagnosed with paranoid schizophrenia at age 18.
• Scott Evans Dekraai; October 12, 2011; 8 killed, 1 injured – Dekraai went into Salon Meritage hair salon where his ex-wife worked in Seal Beach, California and opened fire with several handguns killing 8 in the salon and injuring 1 in the parking lot.  Dekraai had been diagnosed with posttraumatic stress disorder in September 2008.
• Jeong Soo Paek; February 21, 2012; 4 killed – Paek walked into a spa owned by his sisters’ families, killing his sisters and their husbands with a .45-caliber handgun before killing himself.  Paek had a history of mental health issues according to court filings and had been described as suicidal in the years leading up to the attack.
• One L. Goh; April 2, 2012; 7 killed, 3 injured – Goh, a former student at Oikos University, a Korean Christian college in Oakland, California, stood up in a nursing classroom while class was in session, ordered classmates to line up against the wall, and opened fire with a .45-caliber semi-automatic handgun killing 7.  Goh was later diagnosed with paranoid schizophrenia by court-appointed psychiatrists.
• Ian Lee Stawicki; May 30, 2012; 5 killed, 1 injured – Stawicki walked into Café Racer in the University District of Seattle, Washington and opened fire with two .45-caliber handguns, killing four patrons and wounding the café’s chef.  Stawicki’s father later said his son suffered from mental health issues throughout his life and may have been manic depressive.
• James Eagan Holmes; July 20, 2012; 12 killed, 58 injured – Holmes used a Smith & Wesson M&P15 semi-automatic rifle, Remington tactical shotgun and two Glock 22 handguns to kill 12 and wound 58 during a midnight premiere screening of The Dark Night Rises at the Century 16 multiplex in Aurora, Colorado.  Holmes was seeing a psychiatrist at the University of Colorado prior to the shooting who later reported that he had made “homicidal statements” and said he a was a threat to others.  Holmes reportedly asked other students at the University of Colorado about dysphoric mania, a mental disorder characterized by simultaneous symptoms of mania and depression.
• Andrew Engeldinger; September 27, 2012; 5 killed, 3 injured – Engeldinger opened fire with a Glock 19 9mm pistol killing 6 and injuring 2 at his workplace Accent Signage Systems in Minneapolis, Minnesota after being fired.  According to his parents, Engeldinger had a history of undiagnosed mental illness.
• Adam Lanza; December 14, 2012; 27 killed, 2 wounded – Lanza killed his mother, then took several firearms in his mother’s car to Sandy Hook Elementary School where he killed twenty children and six employees of the school with a semi-automatic Bushmaster XM15-E2S rifle.  Lanza had behavioral problems throughout childhood and was said by family members to have a personality disorder.  Lanza was reportedly diagnosed with sensory processing disorder as a child and family friends claimed that he had been diagnosed with Asperger syndrome.
• William Spengler; December 24, 2012; 3 killed, 2 wounded – Spengler killed his sister, then intentionally set their house on fire, firing an illegally-acquired Bushmaster semi-automatic rifle at firefighters responding to the scene, killing two and injuring two more.  Spengler was convicted of manslaughter in 1980 after murdering his grandmother with a hammer and had spent years in a correctional mental health facility.
• John Zawahri; June 7, 2013; 5 killed, 4 wounded – Zawahri killed his father and brother after setting their house on fire, then hijacked a passing car, forcing the driver to drive him to Santa Monica College where he killed 3 more people and wounded 4.  While attending high school, Zawahri had communicated to a classmate his desire to hurt other students and was later admitted to UCLA’s Neuropsychiatric Institute for a brief period of time.

A portion of a table from the FBI Cyber Division July 8 bulletin “APT Actors Increased Interest in the Aviation Industry” describes the advanced persistent threat cycle.

Public Intelligence

Since June, advanced persistent threat (APT) actors have been targeting the aviation industry and attempting to extract confidential information by sending “spear-phishing” emails designed to trick recipients into opening malicious attachments or follow links to infected websites.  According to an FBI Cyber Division bulletin from July 8, “individuals associated with the air travel industry” have received an increased number of spear-phishing emails often using spoofed senders “in an attempt to make the e-mail appear more legitimate.”

APT actors conduct targeted attacks seeking “precise information rather than monetary gain” which separates them from hacktivists or cyber criminals.  Most APT activity is thought to originate from China, leading some to say that APT is basically a euphemism for China’s state-sponsored cyber espionage activities.  However, the FBI bulletin never mentions a particular country in relation to the recent targeting of the aviation industry, saying that while “the activity cannot often be definitively linked to any particular nation state, the sophistication, resources, and types of information sought suggests governmental support.”

The bulletin goes on to describe APT actors as “semi-sophisticated and difficult to detect while on network systems.”  They harvest “enormous amounts of critical information including proprietary data, source code, negotiation tactics, and strategic operational plans” which has reportedly cost the U.S. “hundreds of millions of dollars over the past decade.”  APT actors have also “breached networks containing sensitive national security information” according to the bulletin.

While the bulletin does not provide much in the way of defensive measures, such as physically separating or “air gapping” certain systems from networked devices, the idea of mitigating data loss is emphasized.  Private sector recipients of the bulletin are encouraged to ask themselves, “If proprietary data, personally identifiable information (PII), research and development-related data, e-mail, or other critical information were stolen, what would the current and future consequences be?”  Employees of targeted industries should be aware of “unsolicited or unexpected e-mail containing attachments or links with caution, even (and perhaps especially) when the e-mail appears related to known events or projects.”  The bulletin adds that APT activity will only eventually be mitigated by “paradigmatic shifts in cyber security.”

An image from the Major Cities Chiefs’ Intelligence Commanders Group proposal for a National Criminal Intelligence Enterprise (CIE) shows the three layers of national intelligence collection.  The CIE plan would strengthen the top layer, focusing on locally-led collection operations.

Public Intelligence

An organization representing police chiefs from major cities around the U.S. is promoting an initiative to strengthen intelligence collection at the local level, increasing the integration of state and local law enforcement into the larger structure of the U.S. intelligence community.

In 2011, the Major Cities Chiefs’ Association (MCCA) began the initiative aimed at strengthening domestic intelligence collection efforts and creating a “more defined, whole-of-government architecture that interconnects and better integrates state and local criminal intelligence and counterterrorism operations.”  The Major Cities Chiefs’ Criminal Intelligence Enterprise (CIE) is an effort to create “better connectivity” between “state and local counterterrorism and intelligence units and among locally-led operations, fusion centers, and federally-led operations” such as Joint Terrorism Task Forces (JTTFs) and Field Intelligence Groups (FIGs). The initiative is being organized around the  pre-existing infrastructure of the Major Cities Chiefs’ Intelligence Commanders Group (MCCICG), a working group of the MCCA that played a significant role in creating the unified national suspicious activity reporting process.

A nine page proposal for the CIE written in March 2012 by MCCICG Steering Committee Chair Greg McCurdy argues that the “unprecedented growth of transnational organized crime” poses a significant threat to national security and public safety” requiring that “criminal intelligence and information sharing should be enhanced, and collaboration with state and local law enforcement should continue to grow and improve.”  Criminal threats including “well-organized and disproportionately funded drug trafficking, human smuggling, and weapons trafficking” continue to threaten American communities as well as “violent extremism” and homegrown terrorism.  In order to dismantle these criminal enterprises, McCurdy argues that “community engagement programs” including those designed to enable citizens to report suspicious activities are insufficient:

“While community engagement programs help in this identification, relying solely on citizens to report suspicious activity or a crime may leave law enforcement dependent on a limited window of opportunity to respond. As such, to ensure that law enforcement has the information needed to disrupt criminal activity before it occurs, state and local law enforcement agencies must also conduct criminal and terrorism-related investigations and intelligence operations when appropriate. Provided that the collection of information is adherent to strict privacy, civil rights, and civil liberties guidelines; these efforts offer a proactive approach for identifying violent extremism and the activities of criminal enterprises.”

To address this deficiency, McCurdy outlines four objectives for the CIE.  The first objective is increasing “connectivity among state and local counterterrorism and intelligence units and among locally-led operations, fusion centers, and federally-led operations.”  Discussing this objective, McCurdy emphasizes that “transnational crime and terrorism know no geographic boundaries” and therefore “the law enforcement intelligence community must virtually eliminate theirs.”  He adds that “actions that occur in a different state or, for that matter, in a different country now become relative.”

The second objective of the CIE is the “development and sharing of local threat domain assessments so that the collection component of each major locality can better address the specific threats that affect their individual communities.”  This involves local law enforcement agencies working with fusion centers to assess their “respective domains to identify what criminal or terrorist groups pose the greatest threat” and establish “Standing Information Needs (SINs), Prioritized Information Needs (PINs), and Intelligence Directives.”

Third, the CIE will coordinate the “development, implementation, and sharing of local collection plans” for intelligence gathering.  The CIE will “provide the necessary template that state and local counterterrorism and intelligence units need to establish a standardized systematic process that identifies the tools and methods that can be used to effectively and properly collect crime and terrorism information from within their threat domain.”  Increased interconnection generated by the CIE will “enable local law enforcement agencies to expand their geographical reach while physically maintaining their jurisdictional boundaries.”  Utilizing “interconnected collection efforts”, the CIE will allow local law enforcement to “effectively but appropriately” transcend borders.

The fourth objective of the CIE initiative is to develop and deploy a “secure, socially driven interface” resembling Facebook that enables “state and local intelligence and counterterrorism personnel to effectively network while still adhering to strict privacy guidelines.”  McCurdy says that “in the state and local criminal intelligence and counterterrorism environment where collaboration is of the utmost importance, the use of socially driven networking becomes advantageous” allowing “a detective in Las Vegas . . . to securely customize a profile page, build a network of ‘friends’ who are in fact colleagues in other agencies, and network by sharing nonsensitive information through wall posts, messages, and status updates . . .”

Besides McCurdy’s proposal, little information about the initiative is publicly available, though the initiative is mentioned in the 2012 annual report for the MCCA as a “continuing priority.”  Congressional testimony from the former head of the MCCA shows that the group was asking as early as 2009 to use the MCCICG to construct a “integrated national intelligence capability.”