Archive for the ‘CounterIntelligence’ Category
Insider Threat SNOWDEN:
The insider threat has always been and always will be the bigger of the threats or so the aphorism goes. In reality it certainly seems to be the case in the Snowden affair and the NSA is still stinging from it as I write this. Snowden leveraged his administrative access where he could and used technical and social means as well to gather the information and access he wanted to ex-filtrate out of Ft. Meade. Since Snowden was so successful and the NSA and IC has been blindsided by the ease of the attack and their stunning lack of controls the government and IC has been re-thinking their security around insider threats. Since much of today’s technology allows for ease of access and people tend to be the weakest link in the security chain (on average) the NSA is looking to more proactive controls against this type of exploit. Since they failed logically and technically to stop an insider attack I assume that they are in a real bind trying to assert control over not only the data they house but also the custodians of that data and architecture as well.
The Insider Threat Has Always Been The Largest:
Since the dawn of time the insider threat has always been a go to if possible in waging war against anyone. The Trojan Horse for example is the greatest use of the “insider” by placing outsiders inside and making the opposition the method of their own doom. Insiders though are commonly traitors or spies (sleeper or other) inserted or bought to work for the opposition to gain access inside the confines of the sanctum. In the case of hacking and digital malfeasance this often times takes the shape of an insider who feels they have been wronged in some way and either steals IP or destroys operations within a company or org to cause great damage. What has come to light though over the years and now has been brought to the fore are the psychological and social cues or traits that make a person more likely to be an insider threat.
In the case of espionage the recruitment of spies really is the tale of an insider threat. What makes someone become an asset for a service like the CIA? Within the IC (CIA) a lot of time was spent on the psychology of recruitment and handling of assets. MICE was the standard by which the CIA handled recruitment and handling up until recently when a new paradigm was put forth (RASCLS) which is much more reciprocal instead of just carrot and stick. Where all of this touches on insider threats though in the common vernacular of INFOSEC is where the motivation lies for someone’s actions. In a paper put out recently called “Inside the Mind of An Insider” the focus is on technologists and insider attacks that they have or may carry out and their personal motivations as well as proclivities to do so within the tech sector. I however would assert that this take is only a sub header within the larger umbrella of motivations and actions that an insider whether or not they are a spy or just an aggravated tech worker would have or carry out.
in the paper (cited above in picture at top) the writers lay out the “six characteristics” that coincidentally make up much of the same ideals and motivations that you will find in a recruit-able asset within the IC sphere. In fact, I would assert as well that if in fact Snowden were at all contacted by an outside security services to do what he did, these motivations would have been leveraged within him as well. What it all comes down to human nature. We are all subject to wants and desires as well as feelings of being under appreciated or not appreciated at all in our daily lives. This makes anyone potentially an insider whether they self activate or are handled by someone.
Countermeasures And Technologies:
The NSA though has been working on some technical means of detection and deterrence of an insider attack where other logical means have failed. These consist of programs that monitor behaviour patterns of users and access as well as I can only assume their outside activities such as internet access, browsing, and comments on sites. Can such programs really detect accurately the mind of a person and their motivations to lock down on them as a potential threat? I am sure that the technology is getting much better at this heuristic behaviour detection so sure but I don’t think it will be infallible however. I also suspect that it will also mark people as bad actors when in fact they may never even entertain the thought of actually carrying out some plan against the NSA or whatever company that might employ such tech. I would also assume that the people at the NSA will be undergoing more frequent and rigorous Poly sessions as well as perhaps psychological profiling which does not bode well for many I think who want to feel as though they are part of a team. Generally the job is stressful enough when you cannot talk about anything you do and are always fearing that you might slip at some point and give away information that you shouldn’t. The psychological stress of cleared life is hard and this will all just make it a little harder in the post Snowden world.
Whether you call it an “insider threat” or a spy, saboteur, or insurgent the same psychology applies. People are motivated by things that are personal to them. Desires they have for money, power, or fame as well as a myriad of other reasons for their actions. To attempt to detect and deter this activity will be quite the undertaking and hard enough in the classified world. Now imagine that you are not a cleared individual but instead an corporate employee, how are you going to feel about such activities and programs attempting to tell whether or not you might turn on the company and damage their servers? I somehow doubt that many corporations will undertake the threat modelling here for insider threats as seriously as the NSA but I can see where some might want some insight. We already have things like Websense and IDS/IPS/SIEM tech that follows traffic but with the advent of the likes of Facebook, how long will it be until they offer a service that tracks users behaviour and sells it to your security department? If companies are sufficiently worried about their insider threats then they will begin profiling and putting in countermeasures.
Welcome to the brave new world…
THE SNOWDEN AFFAIR:
Since the revelations began and the man without a country odyssey started all of our lives have changed at a fundamental level regarding our digital and private lives. The now million plus document trove is being parsed out by Glen Greenwald and others for the public to get a look into the inner workings of the state surveillance apparatus much to the consternation of the IC as well as the government and the dismay of the public. However you look upon Mr. Snowden and his choice you have to admit that the information does lend an insight into the great potential for abuse of the apparatus that the NSA has put together no matter what they may tell you they are doing or not doing to protect us. You see the point is no matter what alleged safeguards and altruism may lie within the apparatus and it’s employees it’s still ripe for abuse that will never see the light of day because it’s all classified and codified by the government. This is the point of the exercise as I see it from Mr. Snowden’s point of view and the aegis behind his doing what he did. Of course from day one darker minds would make assertions that there were darker geopolitical machinations at play and this was all just a dastardly plan to destroy us as a country. Of course as the passion play played out it was first China, the go to country for all our woe’s of late (APT etc) but as time wore on and Snowden found a perch in Russia, it’s now “clear” to some in the government that the plot was in fact Russian all along.
Mike Rogers has been the bell ringer on the idea that Snowden from the get go was in fact a handled and groomed asset by a foreign power. His most recent bellowing without any real evidence is that Snowden was in fact an asset for Russia from the start and furthermore that all of this was done to damage the US and seek primacy once again on the international stage. Of course as I mentioned already Mike cannot offer any evidence and he alludes to “secrecy” of the data but in reality until you have proof that you can emphatically state and present the people it’s all just wild speculation and a form of conspiracy or propaganda in and of itself. While it is possible that Snowden was from the start an asset of the
KGB FSB, the evidence thus far for motive, methods, and follow through are somewhat thin and I cannot go on the record as thinking he was handled from the start by Russia or any other nation state. The fact that Snowden ended up in Russia at Sheremetyevo may in fact be because of the machinations of Assange and Wikileaks brokering the deal to get him there and then to get him allowed into the country not as a plan all along. There is more evidence to say that this is in fact the case then there is of any KGB FSB actions.
Using the paradigm of “Occam’s Razor” here let’s run through the possibilities on whether or not the claims being made by Mike Rogers and others out there that this was a carefully planned operation that cultivated Ed Snowden to become the largest leaker in history.
- Ed Snowden is a naive individual who became through a sequence of events, an administrator within the IC networks and began to see things he thought were illegal and immoral
- He used his knowledge of hacking and technologies to accumulate data through his own administrative access and social engineering
- Once he saw the data he decided to leak all that he could and after seeing what happened to Manning made a plan to go to a country that in all the spy novels is easy to infiltrate and ex-filtrate out of
- The NSA itself had poor OPSEC and threats from insiders were poorly covered thus making this possible (proven to be the case)
- The NSA could not even keep track of internal access and exploitation (proven to be the case)
- He contacted the press and was turned down by some until he met Greenwald and Poitras who then planned with him how to release the data and to firewall Snowden off
- While in HK it became clear he could not stay there once the NSA/USA/UKUSA and other apparatus began working in the background to extradite him
- Poitras, Greenwald, and then Wikileaks ex-filtrated Snowden out of HK and to Russia where a brokered interim solution of the airport no mans zone was at least possible
- Snowden is a prize for the
KGBFSB after the fact from not only an intelligence perspective but also a political one that thumbs its nose at the US (a win win for Putin)
- Edward Snowden was a carefully orchestrated long term asset by the
KGBFSB trained by them to infiltrate the NSA and then use his domain admin/root access to steal them blind, exploiting their logical and technical vulnerabilities who they then ex-filtrated to HK and to Russia as a smoke screen for their own operational cover
- Snowden was handled by
KGBFSB for years while coming up the ranks as an UN-credentialed cleared individual clearly taking advantage of the US’ lax clearance and oversight process post 9/11
- Snowden was in contact with Russia from the start and is a consummate operator perhaps even a cleverly created cutout sleeper agent
- Once gathering all the data Snowden then passed it to Russia for them to digest and then leak to the world to cover their own operations and shame the US
- Snowden is now a hero of the state in Russia and will get a hero’s treatment with access to all that Russia can offer in the post Soviet Oligarchy (inclusive Anna Chapman visits)
Hmmm is it just me or does the razor only really cut one way?
My take on the whole affair is that Snowden was not a paid/cultivated/handled asset of the
KGB FSB nor do I think that he was aided in any way by Russia in carrying out this leak/exploit. What I do think is that he is naive but also that what he was seeing, what we are all now seeing today in the news made him feel that the accumulation of power in a central secret body was anathema to freedom and the American ethos. As we have seen in the news there have been many things that the government has allowed, even shall we say promulgated, that are clearly violations of the US Constitution no matter the inveigling that might occur by those in power as to it’s legality. So I for one can see why someone like Snowden might do what they did outside of their own propensities for spy novels and a sense of right and wrong.
The realities are that no matter the attestations by those running the programs and their need to use them, there is always a chance of their abuse and subsequent burial of the facts through classifications and National Security letters as we have seen these last years. Were egregious abuses happening and are they still today? I am sure there are some, after all this is nothing new and all you need do to confirm that is Google “Quis custodiet ipsos custodes?” or look just to recent history with the Plame Affair to see how abuses can and have happened. So is it really outside the pale for someone with a conscience and perhaps an overactive imagination to think that great wrongs are being committed in all our names? I think that while there may have been no abuses “may” I also think that the capacity for abuse and the infrastructure to hide them is easily seen within the current architecture of the IC apparatus of the NSA and their programs. After all, if you want to ask about the idea that if you have nothing to hide you have nothing to fear, I ask you to tell me just exactly how you feel every time you go through a TSA checkpoint at the airport today.
Finally, I would also like to touch on the idea that the governments own hubris and now embarrassment is firing the boilers on this whole blame game that Snowden is in fact a handled asset of the Russians. I think that the NSA/USGOV and IC community feel the sting of their inadequacies as they have been laid bare for all to see. You see, Snowden did not carry out some 3l33t hacking here to gather the data. He used common techniques and vulnerabilities within the NSA and other government IC bodies to steal data and put them all on a USB stick and then walk out with them. It’s a simple trick and the top of that list is actually just socially engineering people for their passwords within the confines of the most secretive and secret IC shops in the world. Now that has to sting a bit wouldn’t you agree? So there is shame all around here on the part of the government and it puts them all in a weak position tactically. The reactions of all those at play seems to be more along the lines of dialogue from a playground spat rather than state or spycraft and it’s sad really. As the immortal words of GW Bush can attest;
“There’s an old saying in Tennessee – I know it’s in Texas, probably in Tennessee – that says, fool me once, shame on – shame on you. Fool me – you can’t get fooled again.”
To me, it seems that Snowden just did what he did because of a myriad reasons that also include a certain amount of self aggrandizement. However, I can point to things in our own history and to popular media that may explain why someone might do something like this on the grounds that they think it’s illegal, immoral, and against the tenets of the USA. While POTUS is right about how important these types of programs can be in the war on terror and the every day intelligence gathering that every country needs to survive, it should also be possible to have some level of oversight to disallow for abuses of power to happen and happen with great frequency due to over classification. These are fundamental changes that should occur but the reality is that the very nature of the work being done and the culture within it’s halls will stoip any real progress being made. In the end nothing will change and the NSA will continue to collect all the data it can like a giant hoover-matic for later sorting and use.
Having grown up in the era of Nixon though, and other revelations like Iran Contra, I for one not only know that these things will continue to happen but that they have in the past and should be in our collective consciousness. Unfortunately many do not remember and the only entree into such ideas may in fact be cinema… I leave you with this scene from “Three Day’s Of The Condor”
Not everything in cinema is just fantasy…
“scr hrw lgihr kzpzz cwl nci pjwt”
VQX HWMVCUSE JQJFASSNTG QV! X HQ JD ISIAVVE!
Face it.. We are all PWND six ways to Sunday
Every frigging day we hear more and more about how the NSA has been emptying our lives of privacy and subverting the laws of this land and others with their machinations. It’s true, and I have been saying as much since the day Mr. Klein came out of his telco closet and talked about how the NARUS system had been plugged into the MAE West back in the day. We are all well and truly fucked if we want any kind of privacy today kids and we all need to just sit back and think about that.
*ponder ponder ponder*
Ok, I have thought about it and I have tried to think of any way to protect myself from the encroachment of the NSA and all the big and little sisters out there. I am absolutely flummoxed to come up with any cogent means to really and truly protect my communications. Short of having access to the NSA supercloud and some cryptographers I don’t think that we will not truly have any privacy anymore. If you place it on the net, or in the air. We have reached in my opinion the very real possibility of the N-Dystopia I have talked about before in the Great Cyber Game post.
As the pundits like Schneier and others groan on and on about how the NSA is doing all of this to us all I have increasingly felt the 5 stages of grief. I had the disbelief (ok not completely as you all know but the scope was incredible at each revelation) Then the anger came and washed over me, waves and waves of it as I saw the breadth and scope of the abuse. Soon though that anger went away and I was then feeling the bargaining phase begin. I started to bargain in my head with ideas that I could in fact create my own privacy with crypto and other OPSEC means. I thought I could just deny the government the data. I soon though began to understand that no matter what I did with the tools out there that it was likely they had already been back door’d. This came to be more than the case once the stories came out around how the NSA had been pressuring all kinds of tech companies to weaken standards or even build full back doors into their products under the guise of “National Security”
Over time the revelations have all lead to the inescapable truth that there is nothing really anyone can do to stop the nation state from mining our communications on a technological level. Once that had fully set in my mind the depression kicked in. Of late I have been more quiet online and more depressed about our current state as well as our future state with regard to surveillance and the cyberwarz. I came to the conclusion that no matter the railing and screaming I might do it would mean nothing to the rapidly approaching cyberpocalypse of our own creation arriving. ….In short, we can’t stop it and thus the last of the five stages for me has set in. I accept that there is nothing I can do, nay, nothing “we” can do to stop this short of a bloody coup on the government at large.
I now luxuriate in my apathy and were I to really care any more I would lose my fucking mind.
OPSEC! OPSEC! OPSEC!
Speaking of losing one’s mind.. Lately people all have been yelling that OPSEC is the only way! One (the gruqq) has been touting this and all kinds of counterintelligence as the panacea for the masses on these issues. Well, why? Why should we all have to be spies to just have a little privacy in our lives huh? I mean it’s one thing to be a shithead and just share every fucking stupid idea you have on FriendFace and Tweeter but really, if you can’t shut yourself up that is your problem right? No, I speak of the every day email to your mom telling her about your health status or maybe your decision to come out etc. Why should the government have the eminent domain digitally to look at all that shit now or later?
If you take measures to protect these transactions and those measures are already compromised by the government why then should you even attempt to protect them with overburdened measures such as OPSEC huh? I mean, really if you are that worried about that shit then go talk to someone personally huh? I know, quite the defeatist attitude I have there huh? The reality is that even though I claim not to be caring about it (re: apathy above) I actually do but I realize that we no longer have privacy even if we try to create it for ourselves with technical means. If the gov wants to see your shit they will make a way to do so without your knowing about it. I fully expect someday that they will just claim eminent domain over the internet completely.
Fuck OPSEC.. I want my government to do the right thing and not try to hide all their skirting of the law by making it classified and sending me an NSL that threatens to put me in jail for breaking the law.
Fuck this shit.
Then we have the CYBERWARZ!! Oh yeah, the gubment, the military, and the private sector all have the CYBERWARZ fever. I cannot tell you how sick of that bullshit I am really. I am tired of all the hype and misdirection. Let me clear this up for you all right here and right now. THERE IS NO CYBERWAR! There is only snake oil and espionage. UNTIL such time as there is a full out kinetic war going on where systems have been destroyed or compromised just before tanks roll in or nukes hit us there is no cyberwar to speak of. There is only TALK OF cyber war.. Well more like masturbatory fantasies by the likes of Beitlich et al in reality. So back the fuck off of this shit mmkay? We do not live in the world of William Gibson and NO you are not Johnny Mnemonic ok!
Sick. And. Tired.
I really feel like that Shatner skit where he tells the Trekkies to get a life…
Awaiting the DERPOCALYPSE
All that is left for us all now is the DERPOCALYPSE. This is the end state of INFOSEC to me. We are all going to be co-opted into the cyberwarz and the privacy wars and none of us have a snowball’s chance in hell of doing anything productive with our lives. Some of us are breaking things because we love it. Others are trying to protect “ALL THE THINGS” from the breakers and the people who take their ideas and technologies and begin breaking all those things. It’s a vicious cycle of derp that really has no end. It’s an ouroboros of fail.
RAGE! RAGE! AGAINST THE DYING OF THE PRIVACY! is a nice sentiment but in reality we have no way to completely stop the juggernaut of the NSA and the government kids. We are all just pawns in a larger geopolitical game and we have to accept this. If we choose not to, and many have, then I suggest you gird your loins for the inevitable kick in the balls that you will receive from the government eventually. The same applies for all those companies out there aiding the government in their quest for the panopticon or the cyberwarz. Money talks and there is so much of it in this industry now that there is little to stop it’s abuse as well.
We are well and truly fucked.
So, if you too are feeling burned out by all of this take heart gentle reader. All you need do is just not care anymore. Come, join me in the pool of acceptance. Would you care for a lotus blossom perhaps? It’s all good once you have accepted the truth that there is nothing you can do and that if you do things that might secure you then you are now more of a target. So, do nothing…
rode bb iqdnpmbia fpn’k ybi lr qektrf?
par·a·noi·anoun1.Psychiatry. a mental disorder characterized by systematized delusions and the projection of personalconflicts, which are ascribed to the supposed hostility of others, sometimes progressing todisturbances of consciousness and aggressive acts believed to be performed in self-defense or as a mission.2.baseless or excessive suspicion of the motives of others.Also, par·a·noe·a [par-uh-nee-uh] Show IPA .Origin:
1805–15; < Neo-Latin < Greek paránoia madness. See para-, nous, -ia
Paranoia , the Anonymous intelligence division (self described) published a dump of data ostensibly taken from Bank of America and TEK Systems last week. The information presented seems to show that BofA had contracted with TEK to create an ad hoc “Threat Intelligence” unit around the time of the LulzSec debacle. Of course since the compromise of HB Gary Federal and the revelations that BofA had been pitched by them to do some contract work in the disinformation business it only makes sense that BofA would set up a threat intel unit. The information from the HB Gary dumps seemed to allude to the fact that BofA was actively looking to carry out such plans against those they perceived as threats. Anons out there took great umbrage and thus BofA was concerned.
This blog post is being put together to analyze the data dumped by Anonymous and to give some perspective on what BofA may have been up to and to set some things straight on the meanings of the data presented by Paranoia. First off though I would like to just say that I think that generally BofA was being handed lackluster threat intel by a group of people with intelligence background. (for those names located in the dumps their LinkedIN pages showed former mil intel work) This of course is an opinion formed solely from the content that was available online. There may have been much more context in formal reports that may have been generated by the analysts elsewhere that was not open for the taking where Anon found this dump. The daily and monthly reports found in the database showed some analysis but generally gave rough OSINT reports from online chat logs, news reports, and pastebin postings. There seemed to be a general lack of product here and as such I have to wonder if there ever was or if perhaps those reports never made it to the internet accessible server that anonymous downloaded them from.
B of A’s THREAT INTELLIGENCE TEAM
Since the leak of their threat intelligence BofA has been recruiting for a real team it seems. A Google of the parameters show that they have a bunch of openings all over the place for “Threat Assessment” It makes sense since the TEK Systems team may in fact be mostly defunct but also that they likely would want an in house group and not have to pay overhead on consultants to do the work for them. TEK’s crew as well may have been the problem that caused the leak in the first place by placing the data in an accessible area of a web-server or having passed the data to someone who did not take care of it. Either way it looks as though BofA is seeking to create their own intelligence apparatus much as many other corporate entities are today. The big difference though is what exactly is their directive as a group is to be.
One of the problems I have with the Paranoia analysis is that they take it to the conspiratorial level and make it out to be some pseudo CIA like entity. The reality though is that from what has been shown in the documents provided, that this group really was only tasked with OSINT and threat intelligence by passive listening. This is a key difference from disinformation operations and active participation or recruiting of assets. I will cover this in more detail further on in this post so suffice to say that what BofA was doing here was not only mediocre but also not Machiavellian in nature. The argument can be made though that we don’t know the whole picture and I am sure Paranoia and Anonymous are leaning that way. I cannot with what I have seen so far. What I see is an ad hoc group of contractors trying to create an intelligence wing as a defensive maneuver to try and stay ahead of incidents if not deal with them more effectively should they not be able to stop them.
Nothing more.. Nothing less.
Threat Intelligence vs. Analysis and Product
All of this talk though should be based on a good understanding of what intelligence gathering really is. There are many variations on intelligence tasks and in this case what is clearly seen in the emails and documents is that this group was designated as a “Threat Intelligence” collection group. I have written in the past about “Threat Intelligence” and the misnomer many have on the idea that it is some arcane CIA like pursuit. One of the bigger problems overall is perception and reporting where intelligence gathering is concerned. Basically in today’s parlance much of the threat intelligence out there in INFOSEC is more around malware variants, their C&C’s and perhaps who are running them. With the advent of APT actors as well as criminal activity and entities like Anonymous the paradigm of threat intelligence has come full circle back to the old school idea of what it is from the military sphere of operations.
Today’s threat intelligence is not only technical but also human action driven and this makes it even more important to carry out the collection and analysis properly in order to provide your client with the information to make their decisions with. Unfortunately in the case of the data from BofA we see only sketchy outlines of what is being pasted online, what may be being said in IRC sessions, and what is in the news. Nothing overly direct came from any of the data that I saw and as “product” I would not be able to make much of any decisions from what was presented by TEK Systems people. What is really missing within the dump from Paranoia was any kind of finished analysis product tying together the information in a cogent way for the executives at BofA. Did TEK actually carry this type of activity out? Were there actual reports that the execs were reading that would help in understanding the contents of the raw intelligence that was being passed on in emails daily and monthly? I cannot say for sure. What I did see in the reporting (daily threat reports as well as monthly) were some ancillary comments by a few of the analysts but nothing overly structured or productive. I really would like to know if they had more of an apparatus going on here as well as if they plan on creating one again with all of the advertised positions in that Google search above.
Threat Intelligence vs. HUMINT
This brings me to the whole issue of Threat Intel vs. HUMINT. It would seem that Paranoia thinks that there is much more than meets the eye within the dump that makes them intone that there is a HUMINT (Human Intelligence) portion to the BofA program. While there may well be some of that going on it was not evident from any of the documents I looked at within the dump files. HUMINT would imply that there are active participants of the program out there interacting with the targets trying to recruit them or elicit information from them. With that kind of activity comes all of the things one might conjure up in their heads when they think on NOC (Non Operational Cover) officers in the CIA trying to harvest intelligence from sources (assets) in the field. From everything seen that was posted by Paranoia this is not the case.This operation was completely passive and just collecting data that was in public view aka OSINT. (Open Source Intelligence) Could BofA be seeking to interact more with Anon’s and generate more personal data other than that which the Anon’s posted about each other (DOX’ing) sure but there is no evidence of that. Given the revelations with HB Gary though I can see why the Anon’s might be thinking that they are likely taking more robust non passive actions in the background elsewhere though. Overall I just want everyone to understand that it’s not all cloak and dagger here and seems that Paranoia has a flair for the dramatic as a means to get their point across. Or, perhaps they are just living up to their name.
My assessment in a nutshell here of the Paranoia BofA Drop is as follows:
- Paranoia found some interesting documentation but no smoking gun
- TEK systems did a mediocre job at Threat Intelligence with the caveat that I am only working with the documents in plain view today
- BofA like any other company today has the right to carry out this type of activity but they need to make sure that it’s done well and that it isn’t leaked like this
- If more documents come out showing a more in depth look at the OSINT being collected then perhaps we can change the above findings
- BofA needs to classify their data and protect it better on this front
- Paranoia needs to not let its name get the best of itself
All the drama aside this was a ho hum really. It was funny seeing all the analysts taking down their LinkedIN pages (really, how sekret squirrel is it to have a LI page saying who you work for doing this kind of work anyway? SECOPS anyone?) I consider those players quite burned and assume they are no longer working on this contract because of it. All you analysts out there named, you are now targets and you are probably learning SECOPS the hard way huh? I guess in the end this will all just be another short chapter in Encyclopedia Dramatica and an object lesson for BofA and maybe TEK Systems.
For everyone else.. It’s just LULZ.
//B zrxr wwmpxjnp vf ygwyr jh kur gig vvbxv nf o “yinwf zcnt”. Ilmf xp vv lbi vwwpe grxr mhct sxh ubpifmpxt qzgu o izkruyi nar t tcqjhrgrf. Mpgwf xrlf hawwki, CU’f uoom oehhvgvq lbtmqm, ybywzzcqt, ueq vbyzcvfx nngsk ucvlm. Pbh bxmf e qlf.\\
Threat Intelligence, Counterintelligence, and Corporate | Nation State Espionage
“Threat Intelligence”, a term that is just behind the oft used “Cyber” and God forbid, “Cyber” is all too often put in front of it as well to add more oomph for sales people to sell their brand of security snake oil… “But wait there’s more!” We also have other spook terms being kluged into the INFOSEC world now because, well, it’s cool to those cyber warriors out there. I know, I sound jaded and angry, which, yes, yes, I am, but… Well, it’s just gone completely off the rails out there. I hear people talking about these topics as if they know what they are talking about even with the exceedingly limited scope of digital security matters (i.e. hacking/forensics/defense)
I would like to clear the air here a bit on these terms and how they do really apply to the world of INFOSEC that we in this business now find ourselves in, one littered with military and spook terms that you may not be really familiar with. First off, lets look at the terms that have been thrown around here:
Threat Intelligence: In the spook world, this is the gathering of intelligence (HUMINT/MASINT/SIGINT etc) to determine who has it in for you and perhaps how they plan on getting at you.
Counterintelligence: Spies who hunt other spies (Mole Hunts etc)
Espionage (Nation State and Other) The umbrella under which this whole rubric exists. Nation state and other have the component of “Industrial” as well (i.e. IP theft)
Ok, so, where once we used to only have people in three letter agencies worried about “ThreatIntel” we now have the INFOSEC community looking at “threats” to their environments and calling it “Threat Intelligence” now. While it’s a cool name, does it really apply? What was it before the whole APT thing broke as well as the cyberwar-palooza we have today? For the most part, I can see only half of the term applying to any non state entity or three letter agency and that is of what “threats” are out there today. This means what exploits and pieces of malware are out there that your environment would be susceptible to.
That is unless you suddenly have a company that has decided to launch its own “Intelligence arm” and yes, this has happened, but usually only in larger companies with defense contracts in my experience. Others though, have set them up, like Law firms, who then hire out ex spooks to do the work of counterintelligence as well as intelligence gathering to have an edge over everyone else. Perhaps this is bleeding out into other areas as well in corporate America huh? The point here for me is that unless you have an intelligence arm (not just INFOSEC) you should not be using the term “Threat Intelligence” as an encompassing statement of “there’s malware out there and this is what it is” Point blank here, IF YOU AREN’T DETERMINING WHO YOUR ADVERSARY IS AND WHAT THEIR PLAN IS… IT”S NOT THREAT INTELLIGENCE.
Looking at IP’s on an SIEM and reacting to a triggered event is not threat intelligence. It’s INCIDENT RESPONSE. It’s AFTER THE GOD DAMN FACT OK?
So, stop trying to make it sound cooler than it really is people. To further this idea though, we still have “Counterintelligence” which FOR FUCKS SAKE I have personally seen in a title of a complete MORON at a large company. This fucker sits around all day looking at his stock quotes though, see, it’s just a cool title. It has no meaning. UNLESS you really have an operational INTELLIGENCE UNIT in your company.
*Look around you.. Do you? If not then STFU*
If you do have a real intelligence wing in your org that carries out not only COUNTERINTEL/INTEL/HUMINT/THREATINTEL then more power to you. If not, you’re deluding yourselves with militaristic terms and cyberdouchery… Just sayin.
However, the way things are going with regard to the world, I should think that you might see more of these kinds of intelligence arms springing up in some of the larger corporations of the world. It’s a rough world and the fact that everything is networked and global has primed the pump for these kinds of activities to be a daily operations tool. It’s now the blurring of the lines between what nation states solely had the control and aegis over to now its becoming privatized and incorporated.
William Gibson saw it.. Phramacombinats and all.
False Flags and Disinformation Campaigns
Which brings me to the next level of affairs here. When I was on the DEFCON “Fighting Monsters” panel, I made some statements that seem to have come to pass. I spoke about how Anonymous would have to worry about “False Flags” against their name as well as expand upon the idea that Pandora’s box had been opened. Nothing on the internet would really be the same because we all had moved into the “spook world” by the actions of Anonymous as well as things like Stuxnet. The lines had been blurred and all of us net denizens need to be aware that we are all pawns in a series of greater games being played by corporations and governments.
Since then, we have seen many disinformation campaigns (think sock puppets on social media, fake news stories, rumours, etc) as well as false flag actions where Anonymous may have been blamed or named for actions that the core did not carry out. So many times since then we have seen Anonymous attempt to set the record straight, but, like I said before, who’s gonna believe them because they are “anonymous” and disparate right? Could be anyone… Could be them… And with previous actions, are they to be trusted when they say they did not do it? See, the banner thing (hive mind) has a tremendous proclivity for severe blowback as they have learned.
What’s sauce for the goose though, is also good for the corporate, political, private gander right? How many Acorn operations do you need to see happening in the election cycle to realize that this has been going on for some time and that, now, with the internet, its easier to perform these kinds of operations with a very small group with minimal effort as well? Pandora’s box was not only opened, it was then smashed on the floor and what was once contained inside has been forever unleashed upon us all.
Now, going back to you INFOSEC people, can you then foresee how your companies reputation or security could be damaged by false flag operations and disinformation? A recent example may in fact be the attack purported to be on against Josh Corman of Akamai because he said some things that “some” anonymous players did not like. Were they really out to get him? Were they doing this out of outrage or was there another goal here? What you have to ask yourselves is, what is my company and it’s employees susceptible to in this area? Just as well, this also applies to actual attacks (DDoS etc) they could be signal to noise attacks. While the big attack is going on, another team could be using the fog of war to sneak into the back door silently and un-noticed.
See where I am going there?
In the case of Josh, do they want to D0X him or do they want to force Akamai to maybe flinch and let him go because of bad press, and potential attacks on their infrastructure and management?
Ponder that…There are many aspects to this and you have to have a war mentality to grasp it at times. Not all attacks frontally are the real attack today. Nor are all attacks on players what they may seem to be in reality, the adversaries may in fact have a longer game in mind.
Network Defense and Network OFFENSE
Ok, so back to reality today with many orgs and their INFOSEC programs. You are looking to defend your network and frankly you need not have “cool” names for your program or its players. What you need is to be mindful of your environment and pay attention to the latest attacks available that would affect it. Given today’s pace though, this makes just about everything suspect. You can get yourself an IDS/IPS, an SIEM, Malware protection, and all kinds of things, but, unless you know where shit is and what it is, you lose the big game. So, really, threat intelligence is just a cool name for an SIEM jockey today.
Like I said, unless you are doing some real adversary profiling and deep inspection of attacks, players, motivations etc, you are not doing THREATINTEL. You are minding the store and performing network defense… i.e. your job.
Now, on the other end of the spectrum lately, there have been certain douchenozzles out there saying that they can sell you services to protect your org with “OFFENSE”
Offense you say? Is this some new form of new SPECWAR we aren’t aware of? Firms like the more and more vaporware company “Crowdstrike” seem to be offering these kinds of services, basically mercenaries for hire, to stop those who would do you harm. What means are they going to employ here? Obviously performing what they see as intelligence gathering, but then what? Once you have attribution will there then be “retribution” now like so many Yakuza centric stories in Gibson novels? I’m sorry, but I just don’t see this as viable nor really any kind of a good idea whatsoever… Leave it to the three letter agencies.
Alas though, I fear that these companies and actions are already at work. You can see some of that in the link above to the book I reviewed on private intelligence and corporate espionage. Will your data be a part of a greater corporate or government conspiracy? Some black ops mumbo jumbo over your personal information perhaps? Part of some retribution for some attack perceived to have happened to company A by company B?
Welcome to the shadows and fog of espionage kids.
Going “Off The Reservation”
Overall, I guess I just wanted to lay some things out there and get people’s heads around the amount of douchery going on today. We collectively have gone off the reservation post 9/11 with PII, Privacy (lack thereof) and hacking. That entities like Anonymous came to be and now see the governments and corporations of the world as dark entities isn’t so hard to see when you look at the crap going on out there. What we saw in Team Themis was just one small spec in a larger “Cyber Beltway Banditry” going on today. Look to the other side where you have Fusion centers with private INTEL gathering capacities tossing out absolute crap yet spending BILLIONS of dollars and, well, there you have it.
Monkeys with digital guns.
We are off the reservation already and it’s every man (or woman) for him or herself.
In the end though… If you have a title that says something like “CHIEF INTELLIGENCE OFFICER” on it, you’d best be at a three letter agency.. If not, then you are deluding yourself with EPIC DOUCHERY.
Flame, DuQU, STUXNET, and now GAUSS:
Well, it was bound to happen and it finally did, a third variant of malware that is ostensibly connected to the story that Mikko Hypponen posted about after an email he got from a nuclear scientist in Iran has come to pass as true. The email claimed that a new piece of malware was playing AC/DC “Thunderstruck” at late hours on systems it had infected within the labs in Iran. I took this with a grain of salt and had some discussions with Mikko about it offline, he confirmed that the email came ostensibly from a known quantity in the AEOI and we left it at that, its unsubstantiated. Low and behold a week or two later and here we are with Eugene tweeting to the world that “GAUSS” is out there and has been since about 2011.
Gauss it seems had many functions and some of them are still unknown because there is an encryption around the payload that has yet to be cracked by anyone. Eugene has asked for a crowd sourced solution to that and I am sure that eventually someone will come out with the key and we will once again peer into the mind of these coders with a penchant for science and celestial mechanics. It seems from the data provided thus far from the reverse R&D that it is indeed the same folks doing the work with the same framework and foibles, and thus, it is again easily tied back to the US and Israel (allegedly per the mouthiness of Joe F-Bomb Veep) and that it is once again a weapon against the whole of the middle east with a decided targeting of Lebanon this time around. Which is an interesting target all the more since there has been some interesting financial news of late concerning banks and terror funding, but I digress…
I am sure many of you out there are already familiar with the technology of the malware so I am leaving all of that out here for perhaps another day. No, what I want to talk about is the larger paradigm here concerning the sandbox, espionage, warfare, and the infamous if not poorly named “CyberWar” going on as it becomes more and more apparent in scope. All of which seems to be centered on using massive malware schemes to hoover data as well as pull the trigger when necessary on periodic digital attacks on infrastructure. Something that truly has not been seen before Stuxnet and seems to only have geometrically progressed since Langer et al let the cat out of the bag on it.
Generally, in the information security sector, when I explain the prevalence of malware today I often go back to the beginning of the Morris worm. I explain the nature of early virus’ and how they were rather playful. I also explain that once the digital crime area became profitable and firewalls became a standard appliance in the network environment, the bad actors had to pivot to generally tunnel their data from the inside out home through such things as a firewall. This always seems to make sense to those I explain it to and today it is the norm. Malware, and the use of zero day as well as SE exploits to get the user to install software is the the way to go. It’s a form of digital judo really, using the opponents strength against them by finding their fulcrum weakness.
And so, it was only natural that the espionage groups of the world would turn to malware as the main means of gaining access to information that usually would take a human asset and a lot of time. By leveraging human nature and software flaws it has been a big win for some time now. I was actually amused that Henry Crumpton in the “Art of Intelligence” talks about how the CIA became a very early adopter of the network centric style of warfare. I imagine that some of the early malware out there used by spooks to steal from unprotected networks was CIA in origin and in fact that today’s Gauss probably has some relatives out there we have yet to see by people who have been doing this for some time now and we, the general public had no idea.
Times change though, and it seems that Eugene’s infrastructure for collecting data is creating a very wide dragnet for his people to find these infections and then reverse them. As we move forward expect to see more of these pop up, and surely soon, these will not just be US/UK/IL based attempts. Soon I think we will see the outsourced and insourced products of the likes of Iran and other nation states.. Perhaps we already have seen them, well, people like Mikko and Eugene may have at least. Who knows, maybe someday I will find something rooting about my network huh? Suffice to say, that this is just the beginning folks so get used to it.. And get used to seeing Eugene’s face and name popping up all over the place as well.. Superior showman that he is.
An Interesting Week of News About Lebanon and Bankers:
Meanwhile, I think it very telling and interesting as we see the scope of these malware attacks opening up, that not only one or two countries were targeted, but pretty much the whole of the Middle East as well. Seems its an equal opportunity thing, of course the malware never can quite be trusted to stay within the network or systems that it was meant for can we? There will always be spillage and potential for leaks that might tip off the opposition that its there. In the case of Gauss, it seems to have been targeted more at Lebanon, but, it may have been just one state out of a few it was really meant for. In the case of Lebanon though, and the fact that this piece of malware was also set to steal banking data from that area, one has to look on in wonder about the recent events surrounding HSBC.
Obviously this module was meant to be used either to just collect intelligence on banking going on as well as possibly a means to leverage those accounts in ways as yet undetermined by the rest of us. Only the makers and operators really know what the intent was there, but, one can extrapolate a bit. As terror finances go, the Middle East is the hotbed, so any intelligence on movement of money could be used in that light just as well as other ways to track the finances of criminal, geopolitical, and economic decisions being made there. Whether it be corporations or governmental bodies, this kind of intelligence would be highly prized and I can see why they would install that feature on Gauss.
All of this though, so close to the revelations of HSBC has me thinking about what else we might see coming down the pike soon on this front as well. Cur off the funding activities, and you make it much harder to conduct terrorism huh? Keep your eyes open.. You may see some interesting things happening soon, especially given that the Gauss is out of the bag now too. Operations will likely have to roll up a bit quicker.
Espionage vs. Sabotage vs. Overt Warfare of Cyber-Warfare:
Recently I have been working on some presentation stuff with someone on the whole cyberwar paradigm and this week just blew the lid off the whole debate again for me. The question as well as the rancor I have over the term “Cyberwar” has been going on some time now and in this instance as well as Stuxnet and Flame and DuQu, can we term it as cyberwar? Is this instead solely espionage? What about the elements of sabotage we saw in Stuxnet that caused actual kinetic reactions? Is that cyberwar? If there is no real war declared what do you term it other than sabotage within the confines of espionage and statecraft?
Then there is the whole issue of the use of “Cold War” to describe the whole effect of these operations. Now we have a possible cold war between those states like Iran who are now coding their own malware to attack our systems and to sabotage things to make our lives harder. Is that a war? A type of war? All of these questions are being bandied about all the while we are obviously prosecuting said war in theater as I write this. I personally am at a loss to say exactly what it is or what to term it really. Neither does the DoD at this point as they are still working on doctrine to put out there for the warriors to follow. Is there a need for prosecuting this war? It would seem that the US and others working with them seem to think so. I for one can understand the desire to and the hubris to actually do it.
Hubris though, has a funny way of coming back on you in spectacular blowback. This is my greatest fear and seemingly others, however, we still have a country and a government that is flailing about *cough the Senate cough* unable to do anything constructive to protect our own infrastructure even at a low level. So, i would think twice about the scenarios of actually leaking statements of “we did it” so quickly even if you perceive that the opposition has no current ability to strike back.. Cuz soon enough they will. It certainly won’t be a grand scale attack on our grid or telco when it does happen, but, we will likely see pockets of trouble and Iran or others will pop up with a smile, waving, and saying “HA HA!” when it does occur.
The Sandbox and The Wars We Are Prosecuting There by Malware Proxy:
Back to the Middle East though… We have been entrenched in there for so so long. Growing up I regularly watched the news reports about Lebanon and Israel, Iran and the hostages, Iraq, Saddam, Russian Proxy wars via terrorism, Ghadaffi and his ambitions as well as terror plots (which also hit close to home with the Lockerbee bombing) You kids today might think this is all new, but let me tell you, this has been going on for a long long time. One might even say thousands of years (Mecca anyone? Crusades?) So, it’s little wonder then that this would all be focused on the Med.
We are conducting proxy wars not only because of 9/11 but also economic and energy reasons as well. You want a good taste of that? Take a look at “Three Days of the Condor” a movie about a fictional “reader” for the CIA who stumbles on to a plan to disrupt governments in the Middle East to affect oil prices and access. For every person that said the Iraq war and Afghanistan wasn’t about oil, I say to them look at the bigger picture. There are echoes there of control and access that you cannot ignore. Frankly, if there wasn’t oil and money in the region, I think we would have quite a different story to look on as regards our implementing our forces there.
So, with that in mind, and with terrorism and nuclear ambitions (Iran) look at the malware targeting going on. Look at all of the nascent “Arab Springs” going on (albeit really, these are not springs, these are uprisings) we have peoples who want not to live under oppressive regimes not just because they aren’t free to buy an iPhone or surf porn, but they are also oppressed tribes or sects that no longer wish to be abused. All of this though, all of the fighting and insurgency upsets the very delicate balance that is the Middle East. Something that we in the US for our part, have been trying to cultivate (stability) even if that stability came from another strongman that we really don’t care for, but, who will work with us in trade and positional relevance to other states.
In goes the malware.. Not only to see what’s going on, but also to stop things from happening. These areas can be notoriously hard to have HUMINT in and its just easier to send in malware and rely on human nature to have a larger boon in intelligence than to try and recruit people to spy. It’s as simple as that. Hear that sucking sound? That’s all their data going to a server in Virginia. In the eyes of the services and the government, this is clearly the rights means to the ends they desire.
We Have Many Tigers by The Tail and I Expect Blowback:
Like I said before though, blowback has a nasty habit of boomeranging and here we have multiple states to deal with. Sure, not all of them has the ability to strike back at us in kind, but, as you have seen in Bulgaria, the Iranians just decided to go with their usual Hezbollah proxy war of terrorism. Others may do the same, or, they may bide their time and start hiring coders on the internet. Maybe they will hire out of Russia, or China perhaps. Hell, it’s all for sale now in the net right? The problem overall is that since we claimed the Iran attack at Natanz, we now are not only the big boy on the block, we are now the go to to be blamed for anything. Even if we say we didn’t do it, who’s gonna really believe us?
The cyber-genie is out of the cyber-bottle.
Then, this week we saw something new occur. A PSYOP, albeit a bad one, was perpetrated by the Assad regime it seems. Reuters was hacked and stories tweeted/placed on the net about how the rebel forces in Aleppo had cut and run. It was an interesting idea, but, it was ineffective for a number of reasons. The crux though is that Reuters saw it and immediately said it was false. So, no one really believed the stories. However, a more subtle approach at PSYOPS or DISINFO campaigns is likely in the offing for the near future I’d think. Surely we have been doing this for a while against them, whether it be in the news cycles or more subtle sock puppets online in social media sites like Twitter or Facebook. The US has been doing this for a long time and is well practiced. Syria though, not so much.
I have mentioned the other events above, but here are some links to stories for you to read up on it…
- PSYOPS Operations by the nascent Syrian cyber warfare units on Reuters
- Hezbollah’s attack in Bulgaria (bus bombing) in response to STUXNET and other machinations
- Ostensible output of INTEL from Gauss that may have gotten HSBC in trouble and others to come (Terrorism funding and money laundering)
All in all though, I’d have to say that once the players become more sophisticated, we may in fact see some attacks against us that might work. Albeit those attacks will not be the “Cyber Pearl Harbor” that Dr. Cyberlove would like you to be afraid of. Politically too, there will be blowback from the Middle East now. I am sure that even after Wikileaks cables dump, the governments of the Med thought at least they could foresee what the US was up to and have a modicum of statecraft occur. Now though, I think we have pissed in the pool a bit too much and only have ourselves to blame with the shit hits the fan and we don’t have that many friends any more to rely on.
It’s a delicate balance.. #shutupeugene
Pandora’s Box Has Been Opened:
In the end, we have opened Pandora’s box and there is no way to get that which has escaped back into it. We have given the weapon framework away due to the nature of the carrier. Even if Gauss is encrypted, it will be broken and then what? Unlike traditional weapons that destroy themselves, the malware we have sent can be easily reverse engineered. It will give ideas to those wishing to create better versions and they will be turned on us in targeted and wide fashions to wreak as much digital havoc as possible. Unfortunately, you and I my friends are the collateral damage here, as we all depend on the systems that these types of malware insert themselves into and manipulate.
It is certainly evident as I stated above, our government here in the US is unable to come up with reasonable means to protect our systems. Systems that they do not own, Hell, the internet itself is not a government run or owned entity either, and yet they want to have an executive ability to shut it down? This alone shows you the problem of their thinking processes. They then decide to open the box and release the malware genie anyway… It’s all kind of scary when you think about it. If this is hard to concieve, lets put it in terms of biological weapons.. Weapons systems that have been banned since Nixon was in office.
The allusion should be quite easy to understand. Especially since malware was originally termed “Virus” There is a direct analogy there. Anyway, here’s the crux of it all. Just like bioweapons, digital “bioware” for lack of a better term, also cannot be controlled once let into the environment. Things mutate, whether at the hand of people or systems, things will not be contained within the intended victims. They will escape (as did all the malware we have seen) and will tend to have unforeseen consequences. God forbid we start really working on polymorphics again huh? If the circumstances are right, then, we could have a problem.
Will we eventually have to have another treaty ban on malware of this kind?
Time will tell.. Until then, we all will just be along for the cyberwar ride I guess. We seem to be steadily marching toward the “cyberwar” everyone is talking about… determined really to prosecute it… But will it get us anywhere?
I came to Defcon this year as it turned 20 and after much had changed on the world stage regarding our business (INFOSEC/Pentesting/Dev/SECOPS) much remained the same. What has really changed though, and could be seen at this anniversary year was just how much our antics and interests were now the new “hotness” to the government and the military. Never before had the NSA had a booth at our conference but this year, they were there with recruiting in mind and that is a big change.
However, you may be saying to yourself right about now “Uhh, but, this has been going on a while, not just now” Well, yes, it has, but, what I have noticed this last con was that it’s not all about the tech, this year, it was also recruitment of human assets who would give “intelligence” to the players like NSA. No more are they just looking for programs and programmers, but also seeking out to make connections with people who have connections. You see, as Shawn Henry said as well as General Alexnder, “we need you to keep an eye out and tell us if you see something” What I heard was the equivalent of “if you see something say something” that the TSA has plastered at airports.
This is an important paradigm that we all need to be aware of. With the advent of Anonymous and Stuxnet as well as the nascent idea of the internet becoming a “digital nation state” we all have to be mindful that while the technologies out there are a commodity, so too are we in the great game of cold war intelligence and cyber war. We are the commodity that makes the new exploit as well as being the HUMINT asset that intelligence agencies need to “collect” with.
Now, while you are pondering that, consider the fact that the “opposition” is also trying to curry favor and recruit us as well…
Yup, that’s right. That party you might be attending might in fact have operators from other countries clandestine services too. In fact, that party could even be funded by said agencies and players to get you to chat and perhaps leak meaningful information. Think about it, how many of you out there reading this post work for fortune 500 companies as security technicians? What kind of data is in your head that might be of use to a foreign operative?
Ponder that as you sip that free drink late in the day. Say, did you know that the Chinese most preferable means to gaining intel with visiting professors and the like, is to have them over tired and tipsy? It’s true, it’s low level but its been used on many an occasion. You see, once you start talking, then you open the door for more rapport building, and then it’s pretty much over. One wonders how many Los Alamos folks had the same treatment on trips to China. Now think about the average Defcon party and the amount of alcohol and sleep deprivation we have going on there.
So, look at it from that perspective. Now the NSA has come to the con just as the FBI and other agencies and security bodies so too will the “other guys” I don’t know how many of you out there come from military or “other” backgrounds where you will have a DSS or counterintelligence training,but, I am assuming that a vast majority of the folks attending the cons today do not have that background, especially the younger ones who’s only been in the security arena a short time. Pentesters who know SE should be able to easily detect some of the techniques used to recruit an asset, and tease out information.. Others, maybe not so much.
So here we are today, APT (Yes China being one purveyor of APT attacks) are not only using malware to get into systems but also recruiting sources to help them in their goals. Used to be a time that it really only was the nuclear scientists getting the attention… Today though, everything is game, you might make widgets, but that doesn’t mean that someone doesn’t want to know what you know.
Pssst… It’s still espionage kids… And now YOU are part of it because you hold interesting information.
How’s that for some “Threat Intelligence” huh?
Which brings me to the second line of thinking or topic that came up this year. The government is asking us to consider more “threat intelligence” and to bring them in on the loop. See, right there, they are asking you to be an asset.. Did that occur to you? Of course I know for the most part you all thought, as I did too, that the idea was a bit silly.
Because who really has that kind of threat intel program going on today? Hell, we are all pretty much trying to just keep our shit together right? On average, unless you work for a major company,you may not even have an SIEM or even snort instance right? How are you going to convince your employer that you need that stuff and then more so, to pass that intel to the government? The only groups I have known to do this are the DIB partners, and they do it because they don’t want to lose contracts for the military.
So now, we would all be assets? All corporations out there, whether they are being attacked by APT or Anonymous, would be reporting their incursions or attempts at them to the government? That’s kinda spooky really. This also circles back nicely to the idea that we all now, all of us in the INFOSEC community are now collection nodes for SIGINT/HUMINT/MASINT/ELINT and not many of us have had the training to be analysts.
You see, when you use the words “Threat Intelligence” this has some context that some may not get right away. It’s not just what IP is hitting us and with what attacks anymore.. It’s about the context around all of that and the attribution that is needed for cyber warfare, or more likely, cyber intelligence operations. I expect to see a lot more of this lobbying going on at all of the cons as well as more people sidling up to the attendee’s and asking “so, what’s going on out there?”
For those of you not acquainted with HUMINT and it’s techniques, I suggest you read “The Art Of Intelligence” By Henry Crump and learn… Why? Because that guy you’re talking to at the cool party might just be a PRC case officer…
The Paradigm Pivot:
Soon after the attacks on 9/11 the US and other countries began a “War On Terror” that attempted to disrupt and destroy the Al Qaeda networks. The military and intelligence wars on AQ have been very successful in that they have splintered the group, cut its main lines of C&C, and forced them to scatter into the hills of Waziristan and other places. The intelligence war began with stepped up surveillance technically as well as, after much spin up, getting physical assets on the ground and inserted into the intelligence gathering apparatus. Once the networks were set up, and the AQ infrastructure fractured, it became apparent to the leaders of AQ that they needed to proselytize in a different way to get more “recruits” for the global jihad that they wanted.
Once the realization set in, the AQ leadership began to move online to communicate, radicalize, and recruit new jihadi’s to the cause. As time went by and more of the networks were broken, the ranks of jihad began to thin out. This became a real problem for Al Qaeda and it realized that it needed a new paradigm to reach the “Western” ummah that they could try to sway to jihad. With the creation of GIMF, and AQAP later on, the footprint of jihadi propaganda and radicalization took shape online. Since 2001, we have seen AQ and affiliates grapple with how to get their message across as well as create channels for those who are not in the 2 lands, to radicalize, and then come to jihad.
This post is about not only the means that AQ, AQAP, and others have come up with as a response to the problem, but also a profile of the GEN2 jihadi’s online that are being radicalized and who have acted in the past as well as those who may in the future.
Online Jihad: 10 Years of Internet Jihad
A plethora of sites on the internet have been set up over the years by AQ and its affiliates to propagandize and communicate. many of these sites at first were just simple file upload areas and small bulletin boards. Today we have many mass media style sites including videos, tutorials, online chat areas, and private messaging. The PHP bulletin boards set up on domain named sites or on servers (stealth) that have been hacked, have been the most popular of all. With these sites, the jihad radicalization goes on with postings within pass-worded group sites like Shamukh (AQ) or Ansar.com.
For the most part, these sites have only been partially successful in being a command and control mechanism for AQ. They have failed to gather the swelling support that they would have liked on the part of the Western ummah and it is this lack of fervor that has them vexed. I have personally seen this vexation in AQAP’s “Inspire Magazine” as they have been trying to become more “Hip and Western” to get a new audience. All of their efforts though, have had lackluster returns. This lack of response on the part of the young westernized groups that they are targeting is likely to a few factors;
- The radicalization process is not in person
- The western mindset of the targets is more secular in nature and separate from the core AQ groups experiences
- These youths are not living in lands where war is ongoing
The Psychology of Radicalization:
Radicalization: The process in which an individual changes from passiveness or activism to become more revolutionary, militant or extremist. Radicalization is often associated with youth, adversity, alienation, social exclusion, poverty, or the perception of injustice to self or others.
Much of the classic radicalizing that happens within movements such as Al Qaeda happens when the like minded get together under the penumbra of a stronger personality that leads them. In the case of Islamic Jihad, there have been many Imam’s and leaders who preach this type of thought within their right wing versions of Islam. This is the core of the idea behind raising the ummah army to fight a jihad, the radicalization of the parishioners through direct proselytizing. Since 9/11 though, much of the Muslim community has come under scrutiny from intelligence gathering groups seeking to find the next cell of terrorists being exhorted to jihad by an imam or another leader.
In other cases secular leaders may arise, this may take shape in the form of someone like Mohammad Atta, or the like who are within a circle of like minded people (What Dr. Marc Sageman calls “a group of guys” theory) who “self radicalize” and either make contact with core AQ, or, they decide to act on their own, using the internet as their guide to jihad techniques and ideals. This may happen with two or more individuals seeking like minded people, or, a leader may inculcate them into their particular brand of thought.
A third and seemingly rising type of radicalization seems to be the Lone Wolf or Loner. This is a person either seeking to belong to something greater than they are, or, someone mentally unbalanced and moving along the lines of their own particular mental illness. The Lone Wolves and the Loner’s are dangerous in that they are now one of the primary targets of AQ and their propaganda/radicalization drive other than the “group of guys” The reason for this is that all of these groups can “self radicalize” without having to step into a mosque by reading online and digitally relating with other like minded jihadi’s online. The major difference being that there is no direct contact and, for most, this method of contact and radicalizing lacks the added social element of being in person as a part of a group.
This is a key feature of radicalization that needs to be understood. Since we are social animals, we need to feel that kinship and the only real way to do this primarily is to be within a social dynamic structure that includes physically being there. Online it seems, just does not cut it for most. However, there are others, the mentally ill, and those who are so socially awkward, that online seems to be the only way that they can relate, that have become the next generation of jihobbyists. This in tandem with the fact that now it is rather hard to make contact with, and access the core AQ group physically (i.e. going to a training camp in Waziristan) has made the online radicalization process the pre-eminent way for the jihadi process to carry on.
Jihad GEN 2.0: Lone Wolves, Wolf Packs, & Loners
- Lone Wolves: Single actors who radicalize either by self or online groups but act alone
- Wolf Packs: “The Group of Guys” Who radicalize together as a unit and attempt jihad
- Loners: The single player who radicalizes online and may have contacts with some but is not a team player
Lone Wolves, or the “Lone Wolf” The most likely candidate for the lone wolf is a second generation immigrant who feels some sort of synergy with their parents homeland. There have been a spate of cases where Al Shebaab had converts sneak off from the US to Somalia to train with them. The majority of these lone wolves in this case, were kids in their teens or early twenties that took off to join the jihad there. The premise though, is that these are people who are not necessarily part of any one group but seek out the jihad on their own. They often connect with the core jihadi groups in some way (Malik Hassan and Anwar Al Awlaki) and then act on their own in a more constructed and supported way from the core AQ groups.
Wolf Packs are groups of like minded individuals who have either come together and then radicalized, or, have formed due to a strong leader. These are the most dangerous of the groups because they tend to be groomed by core AQ and, as a group, not only self radicalize, but they re-enforce their belief and action as a social dynamic. Wolf packs have been seen as the more organized and thus more dangerous element in this behavior model. An example of the wolf pack would be the Lackawana 6 or others who banded together and eventually went to an AQ training camp. Though, in the case of the Lackawanna 6, it seems as though they came back from the trip decidedly lacking the motivation to carry out a mission. This is likely because of their Westernized mind set. They did however provide material support to the jihad, and were convicted of this.
Loners are the last type of jihadi that the AQ core are seeking to incite. The loner tends to be an individual who is socially inept to the degree that some have actually been diagnosed with Aspergers Syndrome. Still others have proven to be mentally ill individuals who latch onto the jihad for whatever reasons are driving their psyche. On average, the loner can be seen as the spree killer of the group that feeds the need of the jihad in that they sow fear and confusion while potentially taking out numbers of people. An example of a loner would be Nidal Malik Hassan (Ft. Hood Shooter) who clearly was mentally unstable and went on a shooting rampage injuring 30 and killing 13.
Loners tend to be more the spree killers with guns than they are bomb makers. Another loner type would be Faisal Shahzad, who attempted to make a propane bomb alone. His training was incomplete or he was inept, because the device failed to go off. In the case of Shahzad, he also spent time in Pakistan (from where he emigrated to the US) with the Pakistani Taliban. His radicalization went on unseen by others around him and his actions became more erratic as time went on. I have not seen a psych evaluation of him, but from all that I have seen, it may well be that he too is mentally unstable.
Another couple of reasons to worry more about the “loner” type of jihadi are these:
- They are loners, thus unless someone in the family see’s whats going on, it will likely go unseen until its too late
- They are often here in the US and with guns easily available, make their spree killing scenarios most likely to work
Online Radicalization: Propaganda, Congregation, Synergy & The Online Shadow War
As mentioned above, the radicalization process online has mainly consisted of websites that cater to the newbie to the jihad up to the hard core members. Primarily though, these sites have been a means to gain new recruits for the holy war. These sites had been for a long time, rather blatantly operating online because the governments had not caught up with the technology. Recently though, there has been a change going on within the online jihad. Due to many factors including actions on the part of the hacker community, the propaganda machine that has been the jihadi bulletin board system online has begun to go underground as well as redouble its propaganda efforts.
AQAP’s “Inspire Magazine” releases also have been slowed down and the core’s processes for distribution tightened because of tampering with the files in the past and the worries that they have been compromised as a network online. Spooks and hackers have been infiltrating their networks and websites for a while now and they have caught on. Of course in some ways, the assumption should always have been so. However, attacks on the AQ propaganda sites have increased over the last couple of years to include complete take downs of certain sites through DD0S as well as compromise and destruction of their back ends. Since these occurrences, the smarter of the group have decided that it was time to create a new propaganda jihad.
Abu Hafs al-Sunni al-Sunni, is an exemplar of this mindset. He espouses that the propaganda jihad needs to be more layered and secret. His proposal is to hide the online jihad in plain sight, by making pages that have stealth links (gateway sites) that will lead the knowing, to the real sites where content can be obtained and ideas shared. His ideas were a bit ahead of the curve for most on the boards, but now, post 2011, the administrators and the core AQ I think, are taking a closer look at this model. As online sites that are non secret become more and more targeted, it is only natural that they jihad would eventually have to go underground to continue and flourish from a command and control as well as radicalization standpoint. By locking down the content with gateways to it, those who are serious could congregate behind the digital curtain and carry on, while the digital bill boards call to all those thinking about joining the fray.
As the online jihad progresses technically, so too will their followers and this is a concern. With technologies such as TOR (The Onion Router) and their “Hidden Services” one can now easily hide all content behind a network that cannot be tracked or traced. Online chats can be had in total anonymity as well as files can be left within the confines of such networks for only those who have the right address to get them (net/net meet the new digital anonymous dead drops) and it is here that once again the pivot happens within the dynamic of online jihad. Once the technological skills of the jihadi’s come online, so too will the types of attacks online that could be carried out by them as well as the success rates of kinetic attacks because they are using solid methods to transmit and connect with each other to plan operations.
Already we have seen this movement happening on the forums and it really is only a matter of time until some of these guys read the man page on how to configure their own TOR node with hidden services turned on. It is clear that the technologies are making it easier for them to hide in plain site as well as behind the technical curtain, so, it is my proposition that the next iteration of the GWOT have a component of psychological operations more involved. Just as I have said about the Anonymous situation ongoing, the greater successes are likely to come about because we better understand the players motivations and psyche’s.
Countering The Threat:
In conclusion, I see a two pronged method of attack to fight the online jihad:
- Psyops: The idea that psychological operations has always been a part of the counter insurgency effort. However, in the digital world this has been more the spooks territory than the digital warfighter. Of course the digital war is new as is the online jihad so it is a natural progression to see this type of warfare as well as detective process being implemented.
- Technical Counter-Insurgency Operations: As the technological adroitness grows on the part of the jihadi’s so should the capabilities on the counter insurgency online. It is understood that the US has quite a bit of technical know how online so it is an easier supposition to make that we will be able to step up quickly. However, it is the melding of the two (psyops/pscyhology and technical ops) that must happen to wage this battle well.
APPENDIX A:US Cases of Terrorism since 9/11
• José Padilla. José Padilla (32), a native U.S. citizen, convert to Islam, and al Qaeda
operative, was arrested upon his return from the Middle East to the United States.
Although there is no question of his al Qaeda connection, his mission remains unclear.
He was convicted for providing material support to al Qaeda and sentenced in 2008.
A co-defendant, Kifah Wael Jayyousi (40), a naturalized U.S. citizen from Jordan, was
• The Lackawanna Six. Six Yemeni-Americans—Sahim Alwar (26), Yahya Goba (25),
Yasein Taher (24), Faysal Galab (25), Shafal Mosed (23), all born in the United States,
and Muktar al-Bakri (21), a naturalized citizen—were arrested for training at an
al Qaeda camp in Afghanistan.
• The Portland Seven. Seven individuals—Patrice Lumumba Ford (31), Jeffrey Leon
Battle (31), October Martinique Laris (25), Muhammad Ibrahim Bilal (22), Ahmed
Ibrahim Bilal (24), all native U.S. citizens; Habis Abdulla al Saoub (37), a U.S. perma-
nent resident from Jordan; and Maher Hawash (38), a naturalized U.S. citizen from
Jordan—were arrested for attempting to join al Qaeda and the Taliban.
• Earnest James Ujaama. Earnest James Ujaama (36), a native U.S. citizen, was arrested
for providing support to the Taliban.
• Imran Mandhai. Imran Mandhai (20), a U.S. permanent resident from Pakistan, told
an FBI informant that he wanted to wage war against the United States. He planned
to assemble an al Qaeda cell and attack various targets in Florida, including electrical
substations, Jewish businesses, a National Guard armory, and also, improbably, Mount
Rushmore. Under surveillance for a long time, Mandhai was arrested and subsequently
convicted of conspiracy to destroy property.
• Anwar al-Awlaki. Anwar al-Awlaki (31), a U.S. citizen born in New Mexico, studied
engineering in college and motivation in graduate school, then became an increasingly
radical imam. After being questioned by the FBI several times, he left the United States
in 2002 and went to Yemen, where he is now a leading spokesperson for al Qaeda.
• Adnan Gulshair el Shukrijumah. A provisional arrest warrant was issued for Adnan
Gulshair el Shukrijumah (27), a Saudi national and legal permanent resident, who grew
up and worked in the United States. Shukrijumah was suspected of involvement in a
number of terrorist plots. In 2010, he was indicted for his involvement in the 2009 Zazi
plot to blow up New York subways.
• Iyman Faris. Iyman Faris (34), a naturalized U.S. citizen from Pakistan, was arrested
for reconnoitering the Brooklyn Bridge for a possible al Qaeda attack.
• The Northern Virginia Cluster. Eleven men were arrested in June 2003 for training
at a jihadist training camp abroad, intending to join Lashkar-e-Toiba, and planning
terrorist attacks: Caliph Basha Ibn Abdur Raheem (28), a native U.S. citizen; Sabri
Benkhala (27), a native U.S. citizen; Randoll Todd Royer (39), a native U.S. citizen;
Ibrahim al-Hamdi (25), a Yemeni national; Khwaja Mahmood Hasan (27), a natural-
ized U.S. citizen from Pakistan; Muhammed Aatique (30), a legal permanent resident
from Pakistan; Donald T. Surratt (30), a native U.S. citizen; Masoud Ahmad Khan
(33), a naturalized U.S. citizen from Pakistan; Seifullah Chapman (31), a native U.S.
citizen; Hammad Abdur-Raheem (34), a U.S.-born citizen and Army veteran of the
first Gulf War; and Yong Ki Kwon (27), a naturalized U.S. citizen from Korea. Two
other individuals were also arrested in connection with the group: Ali al-Timimi (40), a
U.S.-born citizen, and Ali Asad Chandia (26), a citizen of Pakistan. Six of the accused
pleaded guilty, and another three were convicted. Benkhala was acquitted but was later
charged and convicted of making false statements to the FBI. Al-Timimi was convicted
in 2005. The case against Caliph Basha Ibn Abdur Raheem was dismissed.
• Uzair Paracha. Uzair Paracha (23), a legal permanent resident from Pakistan, was
indicted for attempting to help an al Qaeda operative enter the United States in order
to attack gas stations. He was convicted in 2005.
• Abdurahman Alamoudi. Abdurahman Alamoudi (51), a naturalized U.S. citizen from
Eritrea, was indicted in the United States for plotting to assassinate Saudi Arabia’s
• Ahmed Omar Abu Ali. Ahmed Omar Abu Ali (22), a native U.S. citizen, was arrested
by Saudi authorities and later extradited to the United States for providing support to
a terrorist organization and plotting to assassinate the president of the United States.
• Mohammed Abdullah Warsame. Mohammed Abdullah Warsame (31), a legal perma-
nent resident from Somalia, was arrested for conspiring to support al Qaeda. He was
found guilty and sentenced in 2009.
Chronology of the Cases
• Ilyas Ali. Ilyas Ali (55), a naturalized U.S. citizen from India, pleaded guilty to provid-
ing material support to the Taliban and al Qaeda. He attempted to sell hashish and
heroin in return for Stinger missiles, which he then planned to sell to the Taliban. Two
other defendants, Muhammed Abid Afridi and Syed Mustajab Shah, both Pakistani
nationals, were also convicted in the case.
• Amir Abdul Rashid. Ryan Gibson Anderson (26)—a native U.S. citizen and convert to
Islam who called himself Amir Abdul Rashid—was a soldier in the U.S. Army at Fort
Lewis, Washington, when he was arrested in February 2004 for contacting Islamic
websites related to al Qaeda and offering information about the U.S. Army.
• Mark Robert Walker. A Wyoming Technical Institute student, Mark Robert Walker
(19), a native U.S. citizen who, according to reports, became obsessed with jihad, was
charged with attempting to assist the Somali-based group, Al-Ittihad al Islami. He
planned to provide the group with night-vision devices and bulletproof vests.
• Mohammed Junaid Babar. Mohammed Junaid Babar (31), a naturalized U.S. citizen
from Pakistan, was arrested in New York for providing material support to al Qaeda.
• The Herald Square Plotters. Shahawar Martin Siraj (22), a Pakistani national, and
James Elshafy (19), a U.S.-born citizen, were arrested for plotting to carry out a terrorist
attack on New York City’s Herald Square subway station.
• The Albany Plotters. Yassin Aref (34), an Iraqi refugee in the United States, and
Mohammad Hossain (49), a naturalized U.S. citizen from Bangladesh, two leaders of a
mosque in Albany, New York, were arrested for attempting to acquire weapons in order
to assassinate a Pakistani diplomat.
• Adam Yahiye Gadahn. Adam Yahiye Gadahn (26), a native U.S. citizen and convert to
Islam, moved to Pakistan in 1998. By 2004, he was identified as a member of al Qaeda
planning terrorist attacks in the United States, and he subsequently became one of
al Qaeda’s principal spokesmen. He was formally indicted in 2006.
• The Abdi Case. Nuradin Abdi (32), a Somali national granted asylum in the United
States, was indicted in June 2004 for plotting with Iyman Faris to blow up a Colum-
bus, Ohio, shopping mall. (He was arrested in November 2003.)
• Gale Nettles. Gale Nettles (66), a native U.S. citizen and ex-convict, was arrested in
August in an FBI sting for plotting to bomb the Dirksen Federal Building in Chi-
cago and for attempting to provide al Qaeda with explosive material. His motive was
revenge for his conviction as a counterfeiter, but he wanted to connect with al Qaeda,
which he figured would pay him for his excess explosive materials. He was convicted
on the terrorist charge in 2005.
• Carpenter and Ransom. Two New Orleans men, Cedric Carpenter (31), a convicted
felon, and Lamont Ransom (31), both native U.S. citizens, intended to sell fraudulent
identity documents to the Philippine jihadist terrorist group Abu Sayyaf in return for
cash and heroin. Ransom, who had previously served in the U.S. Navy, was familiar
with the group. Both were convicted and sentenced in 2005.
• The New York Defendants. Three defendants—Mahmud Faruq Brent (32), a U.S.-
born citizen who had attended a training camp in Pakistan run by Lashkar-e-Toiba;
Rafiq Abdus Sabir (50), a U.S.-born citizen and medical doctor who volunteered to pro-
vide medical treatment to al Qaeda terrorists; and Abdulrahman Farhane (52), a natu-
ralized U.S. citizen from Morocco who agreed to assist in fundraising for the purchase
of weapons for insurgents in Chechnya and Afghanistan—were linked to defendant-
turned-informant Tarik Shah (42), a U.S.-born citizen who was arrested in May 2005
for offering to provide training to insurgents in Iraq. Shah identified his co-defendants,
and all four were convicted.
• The Lodi Case. Hamid Hayat (22), a native-born U.S. citizen, and his father, Umar
Hayat, a naturalized U.S. citizen from Pakistan, were arrested in June 2005 for secretly
attending a terrorist training camp in Pakistan. Umar Hayat ultimately pleaded guilty
of lying to federal authorities.
• The Torrance Plotters. Kevin James (29), Levar Washington (21), and Gregory
Patterson (25), all native U.S. citizens and converts to Islam, and Hammad Riaz Samana
(21), a permanent resident from Pakistan, were charged in August 2005 with planning
to carry out terrorist attacks on National Guard armories, a U.S. military recruiting
center, the Israeli consulate, and Los Angeles International airport. (This case is some-
times referred to as the Sacramento Plot.)
• Michael Reynolds. Michael Reynolds (47), a native U.S. citizen, acquired explosives
and offered them to an informant whom he believed was an al Qaeda official to blow
up the Alaska Pipeline in return for $40,000.
• Ronald Grecula. Ronald Grecula (70), a native U.S. citizen, was arrested in Texas in
May 2005 for offering to build an explosive device for informants he believed to be
al Qaeda agents. He pleaded guilty to the charge in 2006.
• The Liberty City Seven. Seven men—Narseal Batiste (32), a native U.S. citizen;
Patrick Abraham (39), a Haitian national illegally in the United States after over-
staying his visa; Stanley Grunt Phanor (31), a naturalized U.S. citizen; Naudimar
Herrera (22), a native U.S. citizen; Burson Augustin (21), a native U.S. citizen; Rothschild
Augustin (26), a native U.S. citizen; and Lyglenson Lemorin (31), a legal permanent resi-
dent from Haiti—were charged in June 2006 with plotting to blow up the FBI build-
ing in Miami and the Sears Tower in Chicago. Herrera and Lemorin were acquitted.
Chronology of the Cases
• Syed Hashmi. Syed “Fahad” Hashmi (30), a Pakistani-born U.S. citizen, was arrested
in London on charges of providing material support to al Qaeda.
• Derrick Shareef. Derrick Shareef (22), a native U.S. citizen and convert to Islam, was
arrested for planning a suicide attack on an Illinois shopping mall. He intended to
place hand grenades in garbage cans, but the plot also involved handguns.
• The Fort Dix Plotters. Six men—Mohammad Ibrahim Shnewer (22), a naturalized
U.S. citizen from Jordan; Serdar Tatar (23), a legal permanent resident from Turkey;
Agron Abdullahu (24), a U.S. permanent resident from Kosovo; and Dritan Duka (28),
Shain Duka (26), and Elljvir Duka (23), three brothers from Albania living in the
United States illegally—were charged with plotting to carry out an armed attack on
soldiers at Fort Dix, New Jersey.
• The Toledo Cluster. Mohammad Zaki Amawi (26) and Marwan El-Hindi (43), both
naturalized U.S. citizens from Jordan, and Wassim Mazloum (25), a legal permanent
resident from Lebanon, were arrested in Toledo, Ohio, for plotting to build bombs to
use against American forces in Iraq. Two additional persons were also charged in this
case: Zubair Ahmed (26), a U.S.-born citizen, and his cousin Khaleel Ahmed (25), a
naturalized U.S. citizen from India.
• The Georgia Plotters. Syed Harris Ahmed (21), a naturalized U.S. citizen, and Ehsanul
Islam Sadequee (20), a U.S.-born citizen from Atlanta, Georgia, were arrested in April
2006 for discussing potential targets with terrorist organizations and receiving instruc-
tion in reconnaissance.
• Daniel Maldonado. Daniel Maldonado (27), a native U.S. citizen and convert to
Islam, was arrested for joining a jihadist training camp in Somalia. He was captured
by the Kenyan armed forces and returned to the United States.
• Williams and Mirza. Federal authorities charged two students at Houston Commu-
nity College—Kobie Diallo Williams (33), a native U.S. citizen and convert to Islam,
and Adnan Babar Mirza (29), a Pakistani national who had overstayed his student
visa—with aiding the Taliban. According to the indictment, the two planned to join
and train with the Taliban in order to fight U.S. forces in the Middle East.
• Ruben Shumpert. Ruben Shumpert (26), also known as Amir Abdul Muhaimin, a
native U.S. citizen who had been convicted for drug trafficking, converted to Islam
shortly after his release from prison. When the FBI came looking for him in 2006, he
fled to Somalia and joined al-Shabaab. He was reportedly killed in Somalia in Decem-
• Hassan Abujihaad. Hassan Abujihaad (31), formerly known as Paul R. Hall, a native
U.S. citizen and convert to Islam who had served in the U.S. Navy, was arrested in
April 2007 for giving the locations of U.S. naval vessels to an organization accused of
• The JFK Airport Plotters. Russell Defreitas (63), a naturalized U.S. citizen from
Guyana; Abdul Kadir (55) a Guyanese citizen; Kareem Ibrahim (56), a Trinidadian;
and Abdal Nur (57), another Guyanese citizen, were charged in June 2007 with plot-
ting to blow up aviation fuel tanks at John F. Kennedy Airport in New York. Defreitas
was arrested in Brooklyn. The other three plotters were arrested in Trinidad and extra-
dited to the United States.
• Ahmed Abdellatif Sherif Mohamed. Ahmed Abdellatif Sherif Mohamed (26), a U.S.
permanent resident from Egypt, was arrested for providing material support to terror-
ists by disseminating bomb-making instructions on YouTube. He pleaded guilty to the
• Omar Hammami. Now known as Abu Mansour al-Amriki, Omar Hammami
(23), a native-born U.S. citizen, left Alabama some time not later than 2007 to join
al-Shabaab in Somalia. He later appeared in the group’s recruiting videos. Hammami
was indicted in 2010 for providing support to al-Shabaab.
• Jaber Elbaneh. Jaber Elbaneh (41), a naturalized U.S. citizen from Yemen, was con-
victed in absentia by a Yemeni court for plotting to attack oil and gas installations in
Yemen. He had previously been charged in the United States with conspiring with the
Lackawanna Six. He was one of a number of al Qaeda suspects who escaped from a
Yemeni prison in 2006. He subsequently turned himself in to Yemeni authorities.
• The Hamza Case. Federal authorities charged the owner and several officials of Hamza,
Inc., a financial institution, for money laundering and secretly providing money to
al Qaeda. Those charged included Saifullah Anjum Ranjha (43), a legal permanent U.S.
resident from Pakistan; Imdad Ullah Ranjha (32), also a legal permanent resident from
Pakistan; and Muhammed Riaz Saqi, a Pakistani national living in Washington, D.C.
Also charged in the case were three Pakistani nationals living in Canada and Spain.
• Christopher Paul. Christopher “Kenyatta” Paul (43), a native U.S. citizen and convert
to Islam living overseas, was arrested upon his return to the United States in April 2008
for having plotted terrorist attacks on various U.S. targets. He later pleaded guilty.
• Bryant Vinas. Bryant Vinas (26), a native U.S. citizen and convert to Islam, was
arrested in Pakistan and extradited to the United States for having joined al Qaeda in
Pakistan. He also provided al Qaeda with information to help plan a bombing attack
on the Long Island Rail Road.
• Somali Recruiting Case I. As many as a dozen Somalis may have been recruited in
the Minneapolis, Minnesota, area by Shirwa Ahmed (26), a naturalized U.S. citizen
Chronology of the Cases from Somalia, to fight in Somalia. Ahmed subsequently was
killed in a suicide bomb- ing in Somalia.
• Sharif Mobley. Sharif Mobley (26), a native U.S. citizen of Somali descent, moved
to Yemen in 2008, ostensibly to study Arabic and religion, but in reality, authorities
believe, to join a terrorist organization. He was later arrested by Yemeni authorities in
a roundup of al Qaeda and al-Shabaab militants. In March 2010, he killed one guard
and wounded another in an attempt to escape.
• The Riverdale Synagogue Plot. Native U.S. citizens James Cromite (55), David
Williams (28), Onta Williams (32), and Laguerre Payen (27), a Haitian national, all con-
verts to Islam, were arrested in an FBI sting in New York in May 2009 for planning to
blow up synagogues.
• Abdulhakim Mujahid Muhammad. In June 2009, Abdulhakim Mujahid
Muhammad (23), also known as Carlos Bledsoe, a native U.S. citizen and Muslim con-
vert, killed one soldier and wounded another at an Army recruiting station in Arkansas.
• The North Carolina Cluster. Daniel Boyd (39), a native U.S. citizen and convert to
Islam who fought against the Soviets in Afghanistan in the late 1980s, was arrested
in July 2009 along with his two sons, Zakarlya Boyd (20) and Dylan Boyd (22), also
converts to Islam, and four others, including three U.S. citizens—Anes Subasic (33), a
naturalized U.S. citizen from Bosnia; Mohammad Omar Aly Hassan (22), a U.S.-born
citizen; and Ziyad Yaghi (21), a naturalized U.S. citizen—and Hysen Sherifi (24), a
legal U.S. resident from Kosovo, for plotting terrorist attacks in the United States and
abroad. Jude Kenan Mohammad (20), a U.S.-born citizen, was also a member of the
group. He was arrested by Pakistani authorities in 2008. Boyd reportedly reconnoi-
tered the Marine Corps base at Quantico, Virginia.
• Betim Kaziu. Betim Kaziu (21), a native U.S. citizen, was arrested in September
2009 for traveling overseas to join al-Shabaab or to attend a terrorist training camp in
• Ali Saleh Kahlah al-Marri. Ali Saleh Kahlah al-Marri (38), a U.S. permanent resi-
dent and dual national of Qatar and Saudi Arabia, was charged with attending an
al Qaeda training camp in Pakistan. He pleaded guilty to providing material support
to a terrorist group.
• Michael Finton. Michael Finton (29), a native U.S. citizen and convert to Islam, was
arrested in September 2009 in an FBI sting for planning to blow up a federal court-
house in Springfield, Illinois.
• Hosam Maher Smadi. Hosam Maher Smadi (19), a Jordanian citizen living in the
United States, was arrested in September 2009 in an FBI sting for planning to blow up
an office building in Dallas, Texas.
• Najibullah Zazi. Najibullah Zazi (25), a permanent U.S. resident from Afghanistan,
was arrested in September 2009 for receiving training in explosives at a terrorist train-
ing camp in Pakistan and buying ingredients for explosives in preparation for a ter-
rorist attack in the United States. Indicted with Zazi were his father, Mohammed Zazi
(53), a naturalized U.S. citizen from Afghanistan, and Ahmad Afzali (38), a U.S. per-
manent resident from Afghanistan, both for making false statements to federal inves-
tigators; neither was involved in the terrorist plot. In January 2010, authorities arrested
Adis Medunjanin (24), a naturalized U.S. citizen from Bosnia, and Zarein Ahmedzay
(25), a naturalized U.S. citizen from Afghanistan, and charged them with participat-
ing in the plot.
• Tarek Mehana. In October 2009, federal authorities in Massachusetts arrested Tarek
Mehana (27), a dual citizen of the United States and Egypt, for conspiring over a seven-
year period to kill U.S. politicians, attack American troops in Iraq, and target shopping
malls in the United States. Two other individuals, including Ahmad Abousamra (27), a
U.S. citizen, were allegedly part of the conspiracy. Abousamra remains at large.
• David Headley. In an increasingly complicated case, David Headley (49), a U.S.-born
citizen of Pakistani descent and resident of Chicago, was arrested in October 2009
along with Tahawar Rana (48), a native of Pakistan and a Canadian citizen, for plan-
ning terrorist attacks abroad. Headley was subsequently discovered to have partici-
pated in the reconnaissance of Mumbai prior to the November 2008 attack by the ter-
rorist group Lashkar-e-Toiba. He pleaded guilty in March 2010.
• Colleen Renee LaRose. Calling herself “Jihad Jane” on the Internet, Colleen Renee
LaRose (46), a native U.S. citizen and convert to Islam, was arrested in October 2009
for plotting to kill a Swedish artist whose drawings of Muhammad had enraged Mus-
lims and for attempting to recruit others to terrorism. Her arrest was concealed until
March 2010. LaRose pleaded guilty to the charges.
• Nidal Hasan. In November 2009, Nidal Hasan (38), a native U.S. citizen and Army
major, opened fire on fellow soldiers at Fort Hood, Texas, killing 13 and wounding 31.
• The Pakistan Five. In November 2009, five Muslim Americans from Virginia—
Umar Farooq (25), a naturalized U.S. citizen from Pakistan; Ramy Zamzam (22), who
was born in Egypt, immigrated to the United States at the age of two, and became a
citizen by virtue of his parents becoming citizens; Waqar Hassan Khan (22), a natu-
ralized U.S. citizen from Pakistan; Ahmad Abdullah Mimi (20), a naturalized U.S.
citizen from Eritrea; and Aman Hassan Yemer (18), a naturalized U.S. citizen from
Ethiopia—were arrested in Pakistan for attempting to obtain training as jihadist guer-
rillas. Khalid Farooq, Umar Farooq’s father, was also taken into custody but was later
released. The five were charged by Pakistani authorities with planning terrorist attacks.
• Somali Recruiting Case II. In November 2009, federal authorities indicted eight
men for recruiting at least 20 young men in Minnesota for jihad in Somalia and rais-
ing funds on behalf of al-Shabaab. By the end of 2009, a total of 14 indictments had
been handed down as a result of the ongoing investigation. Those indicted, all but
one of whom are Somalis, were Abdow Munye Abdow, a naturalized U.S. citizen from
Somalia; Khalid Abshir; Salah Osman Ahmad; Adarus Abdulle Ali; Cabdulaahi Ahmed
Faarax; Kamal Hassan; Mohamed Hassan; Abdifatah Yusef Isse; Abdiweli Yassin Isse;
Zakaria Maruf; Omer Abdi Mohamed, a legal permanent resident from Somalia; Ahmed
Ali Omar; Mahanud Said Omar; and Mustafa Salat. No age information is available.
• Abdul Tawala Ibn Ali Alishtari. Abdul Tawala Ibn Ali Alishtari (53), also known as
Michael Mixon, a native U.S. citizen, was indicted and pleaded guilty to attempting to
provide financing for terrorist training in Afghanistan.
• Raja Lahrasib Khan. Raja Lahrasib Khan (57), a naturalized U.S. citizen from Paki-
stan, was charged with sending money to Ilyas Kashmiri, an al Qaeda operative in
Pakistan, and for discussing blowing up an unidentified stadium in the United States.
• Times Square Bomber. Faisal Shazad (30), a naturalized U.S. citizen from Pakistan,
had studied and worked in the United States since 1999. In 2009, he traveled to Paki-
stan and contacted the TTP (Pakistan Taliban), who gave him instruction in bomb-
building. Upon his return to the United States, he built a large incendiary device
in a sport utility vehicle (SUV) and attempted unsuccessfully to detonate it in New
York City’s Times Square. He was arrested in May 2010. Three other individuals were
arrested in the investigation but were never charged with criminal involvement in the
• Jamie Paulin-Ramirez. The arrest of Colleen R. LaRose (“Jihad Jane”) in 2009 led to
further investigations and the indictment of Jamie Paulin-Ramirez (31), also known as
“Jihad Jamie.” Paulin-Ramirez, a native-born U.S. citizen and convert to Islam, alleg-
edly accepted an invitation from LaRose to join her in Europe in order to attend a
training camp there. According to the indictment, she flew to Europe with “the intent
to live and train with jihadists.” She was detained in Ireland and subsequently returned
to the United States, where she was arraigned in April 2010.
Wesam el-Hanafi and Sabirhan Hasanoff. Wesam el-Hanafi (33), also known
as “Khaled,” a native-born U.S. citizen, and Sabirhan Hasanoff (34), also known as
“Tareq,” a dual U.S.-Australian citizen, were indicted for allegedly providing material
In September 2010, Sami Samir Hassoun (22), was arrested in an FBI sting in Chicago
for attempting to carry out a ter-rorist bombing. Hassoun expressed anger at Chicago
Mayor Richard Daley. It is not clear that the case is jihadist-related.
In December 2010, Awais Younis (26), a naturalized U.S. citizen from Afghanistan, was
arrested for threatening to bomb the Washington, D.C., Metro system. He made the threat on
Facebook, and it was reported to the authorities. Neither of these cases is included in the chronology.
support to a terrorist group. The two men, one of whom traveled to Yemen in 2008,
provided al Qaeda with computer advice and assistance, along with other forms of aid.
• Khalid Ouazzani. Khalid Ouazzani (32) pleaded guilty in May to providing material
support to a terrorist group. Ouazzani, a Moroccan-born U.S. citizen, admitted to rais-
ing money for al Qaeda through fraudulent loans, as well as performing other tasks at
the request of the terrorist organization between 2007 and 2008.
• Mohamed Mahmood Alessa and Carlos Eduardo Almonte. Two New Jersey men,
Mohamed Mahmood Alessa (20), a native U.S. citizen, and Carlos Eduardo Almonte
(24), a naturalized citizen from the Dominican Republic and convert to Islam, were
arrested in June at New York’s JFK Airport for conspiring to kill persons outside the
United States. The two were on their way to join al-Shabaab in Somalia.
• Barry Walter Bujol, Jr. Barry Walter Bujol, Jr. (29), a native U.S. citizen and convert
to Islam, was arrested as he attempted to leave the United States to join al Qaeda in
Yemen. He had been under investigation for two years and was in contact with an
undercover agent he believed to be an al Qaeda operative.
• Samir Khan. In June 2010, the Yemen-based affiliate of al Qaeda began publishing
Inspire, a slick, English-language online magazine devoted to recruiting Western youth
to violent jihad. The man behind the new publication was Samir Khan (24), a Saudi-
born naturalized U.S. citizen who moved to the United States with his parents when
he was seven years old. He began his own journey to violent jihad when he was 15. He
reportedly left the United States in late 2009, resurfacing in Yemen in 2010.
• Rockwood’s Hitlist. Paul Rockwood (35), a U.S. citizen who served in the U.S. Navy
and converted to Islam while living in Alaska, was convicted in July 2010 for lying
to federal authorities about drawing up a list of 15 targets for assassination; they were
targeted because, in his view, they offended Islam. He was also accused of research-
ing how to build the explosive devices that would be used in the killings. His wife,
Nadia Rockwood (36), who has dual UK-U.S. citizenship, was convicted of lying to
• Zachary Chesser. Zachary Chesser (20), a native U.S. citizen and convert to Islam, was
arrested for supporting a terrorist group in July as he attempted to board an airplane to
fly to Somalia and join al-Shabaab. Chesser had earlier threatened the creators of the
television show South Park for insulting Islam in one of its episodes.
• Shaker Masri. A U.S. citizen by birth, Shaker Masri (26) was arrested in August 2010,
allegedly just before he planned to depart for Afghanistan to join al Qaeda or Somalia
to join al-Shabaab.
• Somali Recruiting Case III. As part of a continuing investigation of recruiting and
funding for al Qaeda ally al-Shabaab, the U.S. Department of Justice announced four
indictments charging 14 persons with providing money, personnel, and services to the
terrorist organization. In Minnesota, 10 men were charged with terrorism offenses for
leaving the United States to join al-Shabaab: Ahmed Ali Omar (27), a legal permanent
resident; Khalid Mohamud Abshir (27); Zakaria Maruf (31), a legal permanent resident;
Mohamed Abdullahi Hassan (22), a legal permanent resident; Mustafa Ali Salat (20), a
legal permanent resident; Cabdulaahi Ahmed Faarax (33), a U.S. citizen; and Abdiweli
Yassin Isse (26). Three were new on the list and had been the subject of previous indict-
ments: Abdikadir Ali Abdi (19), a U.S. citizen; Abdisalan Hussein Ali (21), a U.S. citi-
zen; and Farah Mohamed Beledi (26). A separate indictment named Amina Farah Ali
(33) and Hawo Mohamed Hassan (63), both naturalized U.S. citizens, for fundraising
on behalf of al-Shabaab. A fourth indictment charged Omar Shafik Hammami (26),
a U.S. citizen from Alabama, and Jehad Sherwan Mostafa (28) of San Diego, Califor-
nia, with providing material support to al-Shabaab. (Hammami’s involvement is listed
in this chronology under the year 2007, when he first left the United States to join
al-Shabaab; Mostafa is listed separately in the next entry.)
• Jehad Serwan Mostafa. In August 2010, Jehad Serwan Mostafa (28), a native U.S.
citizen, was indicted for allegedly joining al-Shabaab in Somalia. He reportedly left
the United States in December 2005 and was with al-Shabaab between March 2008
and June 2009.
• Abdel Hameed Shehadeh. Abdel Hameed Shehadeh (21), a U.S.-born citizen of Pal-
estinian origin, was arrested in October for traveling to Pakistan to join the Taliban
or another group to wage jihad against U.S. forces. Denied entry to Pakistan, then
Jordan, Shehadeh returned to the United States and subsequently attempted to join
the U.S. Army. He allegedly hoped to deploy to Iraq, where he planned to desert and
join the insurgents. When that did not work out, he tried again to leave the country
to join the Taliban.
• Farooque Ahmed. Farooque Ahmed (34), a naturalized U.S. citizen from Pakistan, was
arrested in October for allegedly plotting to bomb Metro stations in Washington, D.C.
FBI undercover agents learned of Ahmed’s intentions by posing as al Qaeda operatives.
• Shabaab Support Network in San Diego. Saeed Moalin (33), a naturalized U.S. cit-
izen from Somalia, Mohamed Mohamed Mohamud (38), born in Somalia, and Issa
Doreh (54), a naturalized U.S. citizen from Somalia, all residents of San Diego, were
arrested for allegedly providing material support to al-Shabaab. The investigation of
this network is continuing, and a fourth man from Southern California, Ahmed Nasir
Taalil Mohamud (35), was subsequently indicted.
• Al-Shabaab Fundraising II. In November, federal authorities arrested Mohamud
Abdi Yusuf (24), a St. Louis resident, and Abdi Mahdi Hussein (35) of Minneapolis,
both immigrants from Somalia. The two are accused of sending money to al-Shabaab
in Somalia. A third person, Duane Mohamed Diriye, believed to be in Africa, was also
• Nima Ali Yusuf. Nima Ali Yusuf (24), a legal permanent resident originally from Soma-
lia, was arrested in November for allegedly providing material support to a terrorist
group. She was accused of attempting to recruit fighters and raise funds for al-Shabaab.
• Mohamed Osman Mohamud. Mohamed Osman Mohamud (19), a naturalized U.S.
citizen originally from Somalia, was arrested in December for attempting to detonate
what he believed to be a truck bomb at an outdoor Christmas-tree-lighting ceremony
in Portland, Oregon. He reportedly had wanted to carry out some act of violent jihad
since the age of 15. His bomb was, in fact, an inert device given to him by the FBI,
which set up the sting after it became aware of his extremism through a tip and subse-
quent monitoring of his correspondence on the Internet.
• Antonio Martinez. Antonio Martinez (21), also known as Muhaamed Hussain, a nat-
uralized U.S. citizen and convert to Islam, was arrested in December for allegedly plot-
ting to blow up the Armed Forces Career Center in Catonsville, Maryland. The car
bomb he used to carry out the attack was a fake device provided to him by the FBI,
which had been communicating with him for two months.