Year in review: The biggest spy-related stories of 2018, part II

End of Year ReviewSince 2008, when we launched intelNews, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2019 may bring in this highly unpredictable field, we present you with our selection of the top spy stories of 2018. They are listed below in reverse order of significance. This is part two in a three-part series; part one is available here. Part three is here.

07. Russia accused of using ISIS hacker group as cover to launch cyber attacks. The group calling itself Cyber Caliphate first appeared in early 2014, purporting to operate as the online wing of the Islamic State of Iraq and Syria (ISIS), which later renamed itself Islamic State. Today the Cyber Caliphate boasts a virtual army of hackers from dozens of countries, who are ostensibly operating as the online arm of the Islamic State. Their known activities include a strong and often concentrated social-media presence, as well as computer hacking, primarily in the form of cyber-espionage and cyber-sabotage. But a report issued in October by Britain’s National Cyber Security Centre described the Cyber Caliphate and other similar hacker groups as “flags of convenience” for the Kremlin. The report echoed the conclusion of a German government report that was leaked to the media in June of 2016, which argued that the Cyber Caliphate is a fictitious front group created by Russia.

06. Outgoing CIA director said US killed ‘couple of hundred’ Russians in Syria. Sources from the US Pentagon, said that the armed confrontation took place on February 7, 2018, when a 500-strong Syrian government force, which allegedly included hundreds of contracted Russian soldiers crossed the Euphrates River and entered Kurdish-controlled territory in Syria’s northeastern Deir al-Zour region. US-supported Kurdish forces in the area, which include embedded American troops, responded with artillery fire, while US military aircraft also launched strikes on the Syrian government forces. The latter withdrew across the Euphrates after suffering heavy losses. The US side is said to have estimated at the time that over 100 attackers had been left dead, with another 200-300 injured. The toll later rose to nearly 400 dead. At a press conference held soon after the armed clash, US Secretary of Defense James Mattis refused to discuss the matter. But on April 12, the outgoing director of the CIA, Mike Pompeo, appeared to acknowledge that US troops killed hundreds of Russians in Deir al-Zour. He was speaking before a committee of the US Senate during a hearing pertaining to his nomination to serve as the next US secretary of state. Pompeo said that: “in Syria, now, a handful of weeks ago the Russians met their match. A couple of hundred Russians were killed”.

05. Iran tried to bomb conference in France with over 30 senior US officials present. On June 30, members of Belgium’s Special Forces Group arrested a married Belgian couple of Iranian descent in Brussels. The couple were found to be carrying explosives and a detonator. On the following day, German police arrested an Iranian diplomat stationed in Iran’s embassy in Vienna, Austria. And on the same day, a fourth person was arrested by authorities in France, reportedly in connection with the three other arrests. All four individuals appear to have been charged with a foiled plot to bomb the annual conference of the National Council of Resistance of Iran (NCRI) that took place on June 30 in Paris. The NCRI is led by Mujahedin-e Khalq, a militant group that was designated as a terrorist group by the European Union and the United States until 2009 and 2012 respectively. But it has since been reinstated in both Brussels and Washington, reportedly because it provides the West with a vehicle to subvert the Iranian government. NCRI conference participants included over 30 senior US officials, including US President Donald Trump’s personal lawyer, Rudy Giuliani, who addressed the meeting. Stephen Harper, Canada’s former prime minister, also spoke at the conference.

This is part two in a three-part series; part one is available here. Part three is here.

Authors: Joseph Fitsanakis and Ian Allen | Date: 28 December 2018 | Permalink

Year in review: The biggest spy-related stories of 2018, part I

End of Year ReviewSince 2008, when we launched intelNews, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2019 may bring in this highly unpredictable field, we present you with our selection of the top spy stories of 2018. They are listed below in reverse order of significance. This is part one in a three-part series; Part two is available here. Part three is here.

10. Taiwan admits that Chinese general Liu Liankun was one of its spies. In April, the government of Taiwan acknowledged publicly for the first time that Liu Liankun, a Chinese major general who was executed by Beijing in 1999 for espionage, was indeed one of its spies. Liu, who headed the Department of General Logistics of the Chinese People’s Liberation Army, was accused by the Chinese government of having spied for Taiwan for five years, in exchange for nearly $2 million in bribes. He was eventually executed by lethal injection in a Beijing prison. He was 58. At the time of his conviction, Liu was the most senior Chinese military officer to have ever been convicted of spying for Taiwan. The island nation denied that Liu spied on its behalf and refused to acknowledge that it had any role in his espionage activities. But in April Taiwan’s Military Information Bureau unveiled its renovated memorial at its headquarters in Taipei City. Among the plaques, visitors to the memorial saw one dedicated to Liu for the first time.

09. Israel charges former cabinet minister with spying for Iran. In 1992, when he was 35, Gonen Segev, was elected as one of the Knesset’s youngest members, representing the conservative Tzomet party. Initially an opposition Knesset member, Segev eventually left Tzomet and joined a governing coalition with the Labor Party, in which he served as Minister of Energy and Infrastructure. In 2004, after exiting politics, Segev was arrested on a flight from Holland while reportedly trying to smuggle several thousand ecstasy pills into Israel. He was jailed for five years but was released from prison in 2007, after a commendation for good conduct. Shortly after his release, Segev moved to the Nigerian city of Abuja, where he practiced medicine. It was there, the Shin Bet claims, that he was recruited by Iranian intelligence. He was reportedly detained in May of this year during a trip to Equatorial Guinea, following a request by Israeli officials. He was then extradited to Israel and arrested as soon as he arrived in Tel Aviv. Israel’s Shin Bet security service said that Segev admitted being in regular contact with Iranian intelligence agents in Nigeria, where he lived after 2007, and other countries around the world. He also said that he was given a fake passport by his handlers, which he used to visit Iran on two separate occasions in order to hold secret meetings with Iranian intelligence officers.

08. European Union agrees to establish joint intelligence training school. In November, 25 members of the European Union agreed to establish a joint intelligence training academy, a move interpreted by some as a concrete effort to deepen inter-European security cooperation following Brexit. The announcement came just hours after leading EU heads of state spoke in favor of establishing a joint EU defense force. Calls for tighter cooperation between EU members in the areas of defense and security have been issued for decades. But the upcoming departure of Britain from the EU —popularly known as Brexit— appears to have prompted Germany and France to propose deeper integration as a response to the rise of anti-EU sentiment across the continent. The new intelligence academy initiative will be led by Greece —an EU member since 1981— and will be headquartered in Cyprus, which joined the EU in 2004. It will work in cooperation with the individual intelligence agencies of the 25 co-signatory states, along with NATO and with other regional security bodies.

This is part one in a three-part series; Part two is available here. Part three is here.

Authors: Joseph Fitsanakis and Ian Allen | Date: 27 December 2018 | Permalink

Barcelona on high alert after US State Department terrorism warning

Las Ramblas BarcelonaPolice in Barcelona have intensified security checks in some of the Spanish city’s most recognizable landmarks, following a security warning from the United States Department of State. The surprise warning came in the form of a post on the popular social networking site Twitter on Sunday, December 23. In the tweet, the Department of State advised travelers to “exercise heightened caution around areas of vehicle movement, including buses”. It added that terrorists could “attack with little or no warning, targeting tourist locations, transportation hubs, and other public areas”. It is rare for the Department of State to issue warnings for specific locations, unless the US government is in possession of critical intelligence pointing to the possibility of a terrorist attack.

Hours after the Department of State’s warning, Miquel Buch, Minister of the Interior for Spain’s Catalonia region, told a radio station in Barcelona that local authorities were “engaged in assessing the warning” by the US authorities. Local media reported that increased police presence was visible around bus, minibus, train and metro stations throughout the Catalonian capital. Heavily armed police presence was also notable in Barcelona’s most popular tourist landmarks, including the Sagrada Familia Cathedral, the Gothic Quarter, and the mile-long Las Ramblas pedestrian Boulevard at the city’s center. There was no information about the precise nature of the US warning, but there were reports in Catalonian media on Tuesday that the alert notice involved the possibility of a vehicular attack by Islamists during the Christmas holiday season.

In August of 2017, Younes Abouyaaqoub, a 22-year-old Moroccan-born Islamist drove a van into large crowds of tourists at Las Ramblas, killing 14 and injuring nearly 150 people. Abouyaaqoub’s attack was followed by another assault by five men in Cambrils, a small seaside town south of Barcelona, who drove a car into a crowd of pedestrians, killing one and injuring six more. All six men were members of the Islamic State. They were shot and killed by police and security forces.

Author: Ian Allen | Date: 26 December 2018 | Permalink

China seeks clarification over alleged spy equipment ordered by US embassies

US embassy Berlin GermanyThe Chinese government says it is seeking explanations from Washington after a leaked procurement database showed that American embassies purchased data forensics software and various tactical spy equipment. The purported database was published on December 21 by the international anti-secrecy website WikiLeaks, founded by Julian Assange, who is accused by some in the United States of having violated its espionage laws. WikiLeaks has dubbed the database the “US Embassy Shopping List” and says that it contains over 16,000 procurement requests from officials at American embassies located all over the world.

Most procurement requests included in the WikiLeaks database appear to be for commonplace items or services, such as passenger transportation, heating oil, outdoor freezers, or garage gates maintenance and repair. But there are some requests for so-called “tactical spy equipment”, such as those ordered by the US embassies in Colombia and El Salvador. These appear to be for miniature surveillance cameras hidden into everyday objects, such as buttons, baseball caps, watches and ties. Nearly 100 such items were requested for procurement by the US embassy in San Salvador. Several embassies ordered hardware and software for forensic examination of mobile phones. For example, the US embassy in Yerevan, Armenia, ordered a “Cell Phone Analyzer”, which allows users to access data from cell phones while bypassing security measures such as passwords. Similar devices were ordered by the US embassies in Berlin (pictured), and Kiev, capital of Ukraine, where fears were expressed on Monday about a possible military action by Russian troops during the holidays.

On Monday, China’s Ministry of Foreign Affairs said it was seeking “clarifications” from Washington about the documents made public by WikiLeaks. Speaking to reporters in Beijing, Ministry spokesman Hua Chunying said that the US owed “the rest of the world an explanation […] for what has recently been revealed by WikiLeaks”. Chunying also spoke about prior WikiLeaks revelations, including the so-called “PRISM-gate” in 2013, which revealed extensive intelligence-collection activities by the US on numerous countries, including some if its allies, such as Germany and France. She went on to ask, “why do American embassies buy so much secret surveillance equipment?”. Authorities in Washington had made no comment on the WikiLeaks revelation as of Tuesday morning.

Author: Ian Allen | Date: 25 December 2018 | Permalink

Islamic State issues drone bomb warning following London airport chaos

Islamic State dronesOn the heels of chaotic scenes at Britain’s Gatwick Airport, which remained closed for three days due to reported sightings of drones, the Islamic State has released images on social media showing drones carrying packages to large Western cities. The images, which appear to be PhotoShopped, have reignited concerns that the group may be close to launching attacks on civilian targets around the world using drones. Known formally as unmanned aerial vehicles (UAVs), drones have become increasingly accessible to private consumers in recent years. They range from miniature toy models that can be controlled via smartphone applications to highly sophisticated models that can carry significant loads to high altitudes.

In recent years, it has been reported that several militant groups, such as Hezbollah in Lebanon and al-Qaeda-affiliated groups in Pakistan, have made use of drone technology for surveillance and combat purposes. But observers believe that the Islamic State may have the most advanced drone arsenal of any non-state group in the world. The militant Sunni-Muslim organization launched an experimental armed drone campaign in Iraq in 2016. A year earlier, Islamic State fighters had been seen making use of commercially purchased drones for surveillance purposes in the battlefields of Iraq and Syria. In 2016, the Islamic State built several workshops to modify commercially purchased drones, and eventually to build its own models. In January 2017, the group announced the establishment of a new unit called “Unmanned Aircraft of the Mujahideen”, which operated a sizeable fleet of modified combat drones. The following month, the Islamic State claimed to have killed with the use of drones nearly 40 Iraqi soldiers in a single week. The militant group said it did so by using drones to drop three-pound mortar shells on Iraqi troop positions.

Counterterrorism specialists are concerned about what they see as the Islamic State’s “growing ambition” to use drones in the battlefield. But they doubt that the use of drones can by itself affect the outcome of battles. A much larger concern is the possibility that the Islamic State could transfer its drone knowledge outside the battlefield. It has long been confirmed that Islamic State militants have systematically discussed the possibility of deploying drones in civilian areas to drop explosives or even weaponized chemical substances. In October of this year, Federal Bureau of Investigation director Christopher Wray told the United States Congress that the threat of the use of drones by a group like the Islamic State against American tarets was “steadily escalating”. Wray said that the FBI assessed drones “will be used to facilitate an attack in the United States against a vulnerable target, such as a mass gathering”. He added that his assessment was based on several factors, such as the retail availability of the devices, the “lack of verified identification requirement to procure” drones, their ease of use, as well as the experience in the use of drones that militant groups have been amassing abroad.

Author: Joseph Fitsanakis | Date: 24 December 2018 | Permalink

Saudi royal suspected of ordering Khashoggi murder leads spy reform body

King Salman with Crown Prince MohammedThe Saudi royal who is suspected by the international community of having ordered the state-sponsored murder of journalist Jamal Khashoggi is now leading a committee to reform the Kingdom’s spy services. Khashoggi, 59, was a Saudi government adviser who became critical of the Kingdom’s style of governance. He moved to the United States and began to criticize Saudi Arabia from the pages of The Washington Post. He was killed on October 2 by a 15-member Saudi hit-squad while visiting the Saudi consulate in Istanbul, Turkey, in order to be issued a document certifying his divorce from his former wife in Saudi Arabia. After several weeks of vehemently denying any role in Khashoggi’s killing, the Saudi government eventually admitted that he was killed while inside the Saudi consulate in Istanbul.

After conceding that Khashoggi was murdered inside its consulate in Istanbul, the Saudi monarchy pledged to punish those responsible and reform the Kingdom’s intelligence services. But reports in the international press have disclosed that nearly every major Western intelligence agency believes that Khashoggi’s murder was authorized by none other than Muhammad Bin Salman, Saudi Arabia’s Crown Prince and heir-presumptive to the Saudi throne. In late October it was disclosed that Britain’s intelligence services had prior knowledge of a plot to target Khashoggi at the highest echelons of the Saudi government, and allegedly warned Riyadh not to proceed with the plan. And earlier this month it was reported by The Wall Street Journal that, according to the United States Central Intelligence Agency, bin Salman had exchanged text messages with the head of the 15-member hit-team in the hours prior to and following Khashoggi’s brutal murder in Istanbul.

However, not only has the Kingdom’s ruler, King Salman, rejected reports about the crown prince’s alleged involvement in Khashoggi’s murder, but he has also appointed the controversial royal as the head of a ministerial committee to “restructure the General Intelligence Presidency”. The term refers to the primary intelligence agency of Saudi Arabia, which is also known as the General Intelligence Directorate (GID). The ministerial committee has reportedly met several times since October 19, when it was established by royal decree “in pursuit of achieving best international practices” in intelligence operations. On Thursday, Saudi media announced that the ministerial committee had drafted a document recommending “short-, medium-, and long-term development solutions” for restructuring the GID. Several measures were presented by the media as “urgent”. They center on creating a “department for strategy and development” whose task will be to ensure that intelligence operations are in line with the GID’s strategy and the Kingdom’s national security strategy. Another proposed measure involves creating a “general department for legal affairs” that will assess the compatibility of proposed intelligence operations with “international laws and charters and with human rights”. The committee also proposed the creation of a “general department for performance evaluation and internal review” to verify that intelligence operations have been carried out in a legal fashion.

Saudi media reports on Thursday made no mention of the controversy surrounding bin Salman’s presidency of the ministerial committee. For the past two months, the Kingdom has dismissed reports of the crown prince’s involvement in Khashoggi’s murder as “fake news” promoted by its rival Qatar. It has also warned that any social media posts that promote “fake news” about the Saudi government’s involvement in the murder will result in up to five years’ imprisonment. Last month, Prince Turki al-Faisal, the former director of the GID, rejected calls for an international inquiry into Khashoggi’s murder and said that Saudi Arabia would never agree to an international investigation into the case.

Author: Joseph Fitsanakis | Date: 21 December 2018 | Permalink

Cyber spies accessed thousands of European Union diplomatic cables

European Commission buildingA group of hackers, allegedly working for the Chinese military, accessed thousands of classified diplomatic cables from the European Union during a protracted cyber-espionage operation, a report has revealed. Over 100 organizations are believed to have been targeted in the multi-year cyber-espionage campaign, including the United Nations, international labor groups, as well as government ministries from dozens of countries. The operation was revealed on Tuesday by Area 1, a cyber-security company founded by former officials of the United States National Security Agency, and reported by The New York Times.

The compromised cables come primarily from the European Union’s COREU communication network, a Telex-based network that uses teleprinters to exchange text-based messages. The European Union uses the COREU network to transmit information that is classified “limited” or “restricted” between officials representing the executive governments of the European Union’s member states, members of the European Commission, foreign-ministry officials, and other approved parties. Top-secret information (“tres secret” in European Union parlance) is typically not shared on the COREU network. Consequently, the hacked cables contain mostly low-level information. That does not mean, however, that their access by at least one adversary power does not represent a serious security breach. Area 1 said that its forensic examination of the method used by the hackers reveals a set of cyber-espionage techniques that are closely associated with the Chinese People’s Liberation Army (PLA). These clues, in association with the PLA’s long history of attacking Western diplomatic targets, point to Beijing as a very likely culprit behind the attacks, according to Area 1.

The American cyber-security firm said it was able to access the compromised European Union cables and made over 1,100 of them available to The New York Times. The paper reported on Tuesday that the cables reflect increasing tension between Brussels and Washington, as European Union diplomats attempt to get a handle on the unpredictability of United States President Donald Trump. A series of diplomatic cables discusses the whether the European Union should bypass the White House and work directly with the Republican-controlled US Congress, which is viewed as more reliable and responsible. Another set of diplomatic exchanges describes the frustration of the Beijing’s leadership with Trump, which Chinese President Xi Jinping is said to have described to European Union officials as “a bully [engaged in a] no-rules freestyle boxing match”.

The Times said that it notified the European Union of the breach of its diplomatic cables and was told that officials were “aware of allegations regarding a potential leak of sensitive information and [were] actively investigating the issue”. The paper also contacted the White House National Security Council but did not get a response.

Author: Ian Allen | Date: 20 December 2018 | Permalink

Details of Albania’s clandestine operatives posted online due to admin error

Albanian State Intelligence Service Sensitive information about the identities and activities of Albania’s intelligence operatives appeared online, apparently due to an administrative blunder. The incident has reportedly alarmed officials at the North Atlantic Treaty Organization (NATO), of which Albania has been a member since 2009. British newspaper The Independent, which reported the incident earlier this month, described it as “a dangerous breach that could have international consequences”. The paper quoted a former officer in the United States Central Intelligence Agency who described the breach as “the type of bureaucratic catastrophe that could put lives at risk”.

Until the end of the Cold War, Albania was a communist state aligned with China. Since 1991, however, the former communist country has tried to align itself with the West. As part of this strategy, successive Albanian administrations have tried to combat widespread nepotism and government corruption. A significant aspect of this ongoing anti-corruption campaign involves the daily publication of the financial activities of Albanian government agencies. This information is available in searchable spreadsheets on the website of Albania’s Ministry of Finance and Economy. Recently, however, Vincent Triest, a researcher with British-based investigative website Bellingcat, noticed that the publicly available spreadsheets contained information about the State Intelligence Service, Albania’s spy agency, known as SHISH. In reading through the spreadsheets, Triest was able to find the names, official job titles, salaries and monthly expenses of at least eight senior members of SHISH. Most of them, said Triest, serve under official (diplomatic) cover at Albanian embassies and consulates in Greece, Italy, Belgium, Serbia, and elsewhere in Europe.

In a follow-up article posted yesterday on Bellingcat’s website, Triest said that the spreadsheets on the website of the Albanian Finance Ministry contain names and national identification records of SHISH officers, the agency field offices where they are serving, and even the make and model of the vehicles they drive along with their license plate numbers. A separate spreadsheet lists the construction contractors, plumbers and electricians used by various SHISH field offices, as well as the mechanics that are contracted to service the agency’s vehicles. Remarkably, at least two of the exposed SHISH officers are serving in “sensitive posts at NATO headquarters in Brussels”, writes Triest. This has raised alarms at NATO, as Albanian intelligence officers with access to NATO’s secrets could now become susceptible to possible recruitment by adversary spy agencies, said The Independent. The paper added that it notified the Albanian government of the security breach, and was told that the sensitive data would be promptly removed from government websites.

Author: Joseph Fitsanakis | Date: 19 December 2018 | Permalink

Analysis: Iraq’s revenge campaign against Sunnis fuels new pro-ISIS wave

Iraq security forcesA campaign of revenge by Iraq’s Shiite-dominated government against Sunni Arabs in regions once controlled by the Islamic State is aiding Islamists and fueling another rebellion in the country, according to a new report. In 2014, the meteoric rise of the Islamic State of Iraq and Syria —ISIS, later renamed to Islamic State— was largely aided by the strong belief among Iraqi Sunnis that they were second-class citizens in a Shiite-dominated Iraq. In addition to its Sunni credentials, the Islamic State was also able to appeal to Iraqi Sunnis by portraying itself as pious, efficient and trustworthy. This image was in a sharp contrast to the widespread provincial view of politicians in Baghdad as corrupt, indifferent and ineffectual. Popular support for the Islamic State among Iraq’s Sunni Arab minority took the Iraqi government by surprise and almost enabled the militant group to conquer Baghdad in 2015.

Today, after the destruction of the Islamic State’s self-declared caliphate, Iraq’s Shiite-dominated security and intelligence services have returned to Sunni-majority regions that were once ruled by ISIS. But their systematic campaign of human-rights violations against Sunnis, whom they see as ISIS collaborators, is playing into Islamist propaganda and fueling a new wave of rebellion against Baghdad, according to a new report by the Washington-based Pulitzer Center on Crisis Reporting. The report, authored by The New Yorker staff writer Ben Taub, warns that the Iraqi government has no strategy on how to reach out to Iraq’s disaffected Sunni Arabs. Even worse, a state-sanctioned campaign of revenge and intimidation is taking place throughout western Iraq, in which “hundreds of thousands of civilians are suffering at the hands of their liberators”, says Taub.

In areas that until a few months ago were ruled by ISIS, anyone —regardless of age or sex— perceived as having previously supported ISIS is outright killed or sent to concentration camps. For Iraqi security forces, says Taub, civilians who did not flee ISIS are seen as inherently suspicious. Bearded men are often viewed as displaying evidence of ISIS support, even though the militant group had a policy of punishing any man who did not grow a beard in accordance with Quranic directives. Most of these people, says Taub, are fired from their jobs, sent to prison, or worse are executed by the dozens and even hundreds. A handful are tried in a court of law each month, but these are usually show trials with a conviction rate of 98 percent, he adds. Family members of the accused rarely show up in court, fearing immediate arrest and imprisonment, which appears to be a regular occurrence. It is “not uncommon for relatives [of accused ISIS supporters] to be rounded up by the security forces and sent to remote desert camps, where they are denied food, medical services, and access to documents”, reports Taub.

These arbitrary arrests are happening alongside an untold number of battlefield executions —many captured on video by jubilant Shiite soldiers and militia members— and killings of prisoners in detention centers. Taub quotes an anonymous senior official in the Iraqi intelligence services who says that “this is not just revenge on ISIS. It is revenge on Sunnis”. The widespread criminality and brutality of the Iraqi security and intelligence forces “plays directly into the jihadis’ narrative”, says Taub, by convincing Sunni Arabs that they “cannot live safely under a government dominated by Shiites”. Ultimately, what is at stake is “whether the Iraqi government can win over the segment of the population for whom ISIS seemed a viable alternative”, concludes Taub, and warns of the possibility of another armed rebellion against Baghdad by what is left of Iraq’s Sunni minority.

Author: Joseph Fitsanakis | Date: 18 December 2018 | Permalink

French security services investigate Russian role in yellow vests movement

yellow vests movementIntelligence and security services in France are investigating whether Russian involvement on social media and other platforms is playing a role in amplifying the so-called ‘yellow vests’ movement. Known in French as le mouvement des gilets jaunes, the campaign began online in May of this year as a popular protest against rising fuel prices and the high cost of living in France. In mid-November, the movement made its first public appearance with large demonstrations that have continued every weekend since then. Yellow vest protestors claim that tax increases are disproportionally affecting working- and middle-class people and that everyday life is becoming economically unsustainable in France. Some of the demonstrations have turned violent, and so far at least eight people have died as a result. The ensuing crisis has become the most significant threat to the government of Emmanuel Macron, as the protests are increasingly evolving into an anti-Macron rallies.

So far, the yellow vests campaign has been largely bipartisan, bringing together protestors from the entirety of the French political spectrum. Additionally, there are no identified leaders or coordinators of the movement. However, some suspect that Russian government operatives may be further-inflaming an already incensed protest movement. On Friday, The Wall Street Journal said that French security agencies were investigating potential involvement by the Kremlin in the yellow vests campaign. The paper quoted an unnamed French government cybersecurity official as saying that “there has been some suspect activity [and] we are in the process of looking at its impact”. The official was referring to the online activity of some leading social-media accounts involved with the yellow vests, which appear to also be “promoting Russian-backed coverage” of French politics. The Journal also cites Ryan Fox, a cybersecurity expert for the Texas-based firm New Knowledge, who claims that “several hundred accounts on Twitter and Facebook” that are involved in the yellow vests movement “are very likely controlled by Moscow”.

However, there is disagreement among cybersecurity experts about the extent of the Kremlin’s involvement in the yellow vests. Paris has previously accused Moscow of trying to influence the direction of French politics. In February of 2017, France’s Directorate-General for External Security warned that Russia had launched a secret operation to try to influence the outcome of that year’s French presidential election in favor of the far right. However, if such an effort existed, it failed to stop the rise to power of Emmanuel Macron. Since assuming the country’s presidency, Macron has been a leading international critic of Russia’s domestic and foreign policies. The Kremlin, therefore, has strong reasons to want to see a premature end to Macron’s presidency.

This does not necessarily mean that Moscow has been able to anticipate —let alone influence— the yellow vests movement, whose energy has surprised even the most experienced French political observers. The Journal notes that many leading Western cybersecurity bodies, including the Atlantic Council’s Digital Forensic Research Lab, have “not seen significant evidence of state-sponsored interference” in the yellow vests movement, whether by Russia or any other government. Facebook also said that its monitors have not uncovered any evidence of an organized campaign by Moscow to coax the yellow vests protests. The paper also cited Dimitri Peskov, a spokesman for the Kremlin, who categorically denied allegations that Russia was in any way involved in directing yellow vests activists.

Author: Joseph Fitsanakis | Date: 17 December 2018 | Permalink

Wave of bomb threats prompts hundreds of evacuations in four countries

Toronto subway evacuationAn unprecedented “flood of bomb threats” prompted hundreds of evacuations and closures of private buildings, transport hubs and offices in four countries on Thursday, causing confusion and in some cases panic. The threats —which numbered in the hundreds— were issued throughout the day Thursday against businesses, schools, hospitals and media companies in the United States, Canada, New Zealand and the United Kingdom. It is the first time in history that such a large wave of bomb threats was issued against so many targets internationally.

Police agencies in the United States and Canada said that most of the threats were emailed, but some were phoned in by unknown individuals. They warned that devices containing explosive compounds such as tetryl or trinitrotoluene would be detonated unless funds were deposited into an international account using the virtual currency bitcoin. The messages also warned that the alleged devices would be detonated if “any police activity or unusual behavior” were detected. A deadline of one business day was given to deposit the funds. Throughout the day, police agencies across three continents issued notices cautioning people to remain aware of their surroundings and report suspicious messages or behavior. It was eventually determined that virtually all bomb threats were not credible.

However, it was the sheer number and geographical extent of the threats that shocked law enforcement agencies across four countries. In the United States, threats were reported in cities such as Boston, Philadelphia, San Francisco and Oklahoma City, where over dozens of specific addresses were targeted. Nearly 30 schools were placed on lockout in the state of Colorado, while numerous buildings were evacuated in Los Angeles, Chicago, Washington, Cincinnati and Seattle. Smaller cities were also affected, including South Bend, Indiana, Grand Rapids, Iowa, Charlotte, North Carolina, Norfolk, Virginia, and Park City, Utah. In Canada dozens of bomb threats were issued in Montreal, Ottawa, Winnipeg, Calgary, and Toronto, where five of the city’s subway stations were shut down for several hours. Media reports late on Thursday said it was unclear how many —if any— of those targeted paid the bitcoin ransoms demanded by the hoaxers.

Author: Ian Allen | Date: 14 December 2018 | Permalink

Analysis: Strasbourg attack raises serious security concerns in Europe

StrasbourgThe terrorist attack in the French city of Strasbourg on December 11 raises important security concerns for Europe’s ability to defend itself against a rapidly evolving Islamist insurgency. The attack lasted 10 minutes, from 7:50 to 8:00 p.m. on Tuesday evening, and targeted shoppers in Christkindelsmärik, a large Christmas market held annually in Strasbourg. The lone shooter, who has since been identified as Chérif Chekatt, a French citizen, was reportedly heard shouting “Allahu Akbar” (God is great) repeatedly as he opened fire on the unsuspecting shoppers. He also tried to stab some of them using a knife. Chekatt eventually exchanged fire with French soldiers and officers of the National Police before fleeing the scene of the attack in a taxi cab. Three people were declared dead at the scene, while 12 others were urgently transported to nearby hospitals. Six of them remain in critical condition. Chekatt remained at large until Thursday evening, when he was shot dead by police in Strasbourg.

It is important to stress that the choice of Strasbourg as the site of the terrorist strike was not accidental, nor was the attack spontaneous. A city and of nearly 500,000 inhabitants in its greater district, Strasbourg is one of the European Union’s de facto capitals. It hosts several European institutions, including the building of the European Parliament. Its geographical location on the French-German border epitomizes the crossroads of Franco-German cultural traditions. Its distinct character symbolizes the coexistence of Europe’s two leading powers, which forms the cornerstone of the European Union project. The majority of Strasbourg’s residents are bilingual and communicate in Alsacien, a peculiar mixture of French and German. The city also exemplifies a distinctive brand of 21st-century Christian unity through the balanced coexistence of Catholic and Protestant religious cultures. The Christkindelsmärik —the venue that was attacked on Tuesday— is Europe’s largest Christmas market and symbolizes precisely that coexistence. Providing that Tuesday’s attack was sanctioned and/or planned by the Islamic State or one of its affiliate organizations, its strong symbolism is apparent.

As Washington Examiner commentator Tom Rogan noted on Wednesday, it appears that the perpetrator of the attack was able to acquire a semi-automatic weapon, as well as grenades. Unlike the United States, accessing these types of weapons in Western Europe is exceedingly difficult. This is so especially in France, a country that has remained in a perpetual state of heightened security since the Paris attacks of November 2015. It is even more perplexing that Chekatt was able to acquire this type of weaponry, given that his name featured on the terrorism watch lists of France’s security and intelligence services. Additionally, says Rogan, one of the operational trademarks of the Islamic State centers on adhering to a sharp division between its arms procurement networks and the individuals who carry out terrorist attacks. This means that a wider Islamist network in France, Switzerland or Germany, was able to armed and possibly trained Chekatt in Europe, since the attacker is not believed to have visited the Middle East or North Africa.

Rogan also points out that Chekatt —a French-born 29-year-old petty criminal— was radicalized while serving time in prison. This raises important questions about Salafist-Jihadi radicalization networks inside Western European prison systems. The security implications of this realization inevitably widens the security considerations of Europe’s counterterrorism agencies. The latter have so far focused primarily on the danger posed by the return of European Islamic State volunteers from the Middle East. The problem, however, appears to be more complicated.

Ultimately, the Strasbourg attack demonstrates that, despite several years of concerted efforts, the ability of European counterterrorism agencies to prevent strikes by Islamist groups on European soil is limited. Meanwhile, European streets are busy during the Christmas season, with indoor and outdoor markets and festivals, concerts, as well as a host of religious observances taking place in thousands of different locations across the continent. Should Tuesday’s attack in Strasbourg mark the beginning of a sustained terrorism campaign by the Islamic State, December could prove to be a deadly month in Europe.

Author: Joseph Fitsanakis | Date: 13 December 2018 | Permalink

Russian spies ‘launched major cyber attack on Ukraine’ prior to naval incident

Strait of KerchRussia “paved the way” for last November’s seizure of Ukrainian Navy ships by launching a major cyber attack and disinformation campaign aimed at Ukraine, according to a cyber security firm and the European Union. In what has become known as the Kerch Strait incident of November 25, border service coast guard vessels belonging to the Russian Federal Security Service (FSB) opened fire on three Ukrainian Navy ships that were attempting to enter the Sea of Azov through the Kerch Strait. All three Ukrainian vessels, along with crews totaling 24 sailors, were captured by the Russian force and remain in detention. Ukraine condemned Russia’s action as an act of war and declared martial law in its eastern and southern provinces. But Moscow said the incident had been caused by a provocation by the Ukrainian government, in a desperate effort to increase its popularity at home. Meanwhile, the three Ukrainian ships and their crews remain in Russia.

But now a private cyber security firm has said that Moscow launched a series of cyber attacks on Ukrainian government servers, which were aimed at gathering intelligence that could be used for the ships’ capture. In a separate development, the European Union’s security commissioner has alleged that the Kremlin launched an elaborate “disinformation campaign” aiming to “soften up public opinion” before seizing the Ukrainian ships.

The American-based cyber security firm Stealthcare said this week that the cyber attacks were carried out by Carbanak and the Gamaredon Group, two hacker entities that are believed to be sponsored by the Russian intelligence services. The first wave of attacks, which occurred in October of this year, centered on a phishing campaign that targeted government agencies in Ukraine and other Eastern European countries. Victims of these attacks had “important functions” of their computers taken over by remote actors who stole and exfiltrated data, according to Stealthcare. Another attack installed back doors on computer servers belonging to Ukrainian government agencies in November, just days prior to the Kerch Strait crisis. The two attacks, said the company, provided the hackers with “information that would have been very […] relevant in planning” the November 25 naval crisis, said Stealthcare. The company added that there was “no doubt that this was a Kremlin-led reconnaissance effort to prepare for the Kerch Strait crisis”.

Meanwhile on Monday Julian King, a British diplomat who is currently the European Commissioner for the Security Union, said that Russia “paved the way for the Kerch Strait crisis” through a systematic fake news campaign that “lasted for more than a year”. The campaign, said King, included the use of social media to spread false rumors, such as claims that the Ukrainian government had infected the Black Sea with bacteria that cause cholera. Another report by Russian media allegedly claimed that Kiev had tried to secretly transport a nuclear device to Russian-annexed Crimea through the Kerch Strait. The EU security commissioner added that social media platforms and online search engines like Google had a responsibility “to identify and close down fake accounts that were spreading disinformation”.

Author: Joseph Fitsanakis | Date: 12 December 2018 | Research credit: D.V. | Permalink

CIA names first woman to lead Directorate of Operations

CIAIn a surprising departure from established practice, the United States Central Intelligence Agency has publicized the name of its incoming head of operations. Beth Kimber, a 34-year veteran of the Agency, will become the first woman in the CIA’s 70-year history to lead the Directorate of Operations. Officers in the Directorate of Operations, formerly known as the National Clandestine Service, spend their careers recruiting foreign agents to spy for the United States, while also carrying out covert operations around the world. This is also the first time that the CIA has chosen to publicly identify its Deputy Director for Operations —Kimber’s official title, abbreviated as DDO. Previous DDO have been undercover officers whose namse have remained undisclosed. Kimber’s promotion was announced on December 7 by Brittany Bramell, the CIA’s Director of Public Affairs.

Little is known about Kimber, who spent much of her career as a case officer before joining the CIA’s senior intelligence staff. She is a graduate of Hamilton College, a private, liberal arts college situated in upstate New York, and spent much of her early career with the CIA as a case officer in Western Europe. She is also believed to have led the “Russia Group”, a network of intelligence planners in the CIA’s Directorate of Operations that manage a broad spectrum of espionage operations targeting the Russian spy services. She has also served as deputy director of the National Clandestine Service, before it was renamed to Directorate of Operations. Newsweek intelligence correspondent Jeff Stein wrote about Kimber in 2014, but did not name her, as she was still serving in an undercover capacity.

For a few months this year, Kimber served as the CIA’s acting deputy director while Congress considered President Donald Trump’s nomination of Gina Haspel’s for the Agency’s director position. Kimber’s most recent prior post in the CIA was head of the Agency’s Europe and Eurasia Mission Center. Kimber is the third woman to assume a central role in the CIA in the past six months. In May of this year, Gina Haspel, a 33-year veteran of the CIA, became the Agency’s first female director. In August, Haspel picked Sonya Holt, a 34-year CIA veteran, to serve as the Agency’s chief diversity and inclusion officer. On Friday, the American news network CBS cited “people familiar with the shift”, who said that the outgoing DDO “will take another role within the agency” and is expected to remain undercover.

Author: Joseph Fitsanakis | Date: 11 December 2018 | Permalink

Jailed Russian who spied for CIA writes letter to Trump, asking to be freed

Russian Ministry of Internal AffairsA Russian former police officer, who is serving a prison sentence in Russia for having spied for the United States Central Intelligence Agency, has written an open letter to President Donald Trump, asking to be freed. Yevgeny A. Chistov was arrested by the Russian Federal Security Service (FSB) in 2014 on charges of spying for Washington. During his trial, he admitted having been recruited by the CIA when he worked as an officer in the police, Russia’s federal law-enforcement agency, which operates under the Ministry of Internal Affairs. Russian state prosecutors accused him of having established contact with the CIA in 2011. In 2015, he was sentenced to 13 years in prison, which he is currently serving at a labor camp in the Nizhny Novgorod town of Bor, located in central European Russia.

On Saturday, British newspaper The Guardian published a letter that was allegedly written by Chistov. In the letter, the jailed spy admits that he passed Russian state secrets to the CIA for three years, after deciding “to help the US as a friend”. He claims that he did it out of love for his country, and in order to help “overthrow […] the regime” of Russian President Vladimir Putin. Chistov goes on to accuse “Putin and his cronies” of having plundered Russia and of oppressing its people through “corruption and extortion”. He blames the Kremlin for Russia’s current economic state: “we have a resource-rich country yet our people are poor”, he says. The jailed spy adds that he told the CIA about the “secret plans” of the Ministry of Internal Affairs, that he provided “names of some people from the FSB”, and that he “revealed some objectives of Russia’s Ministry of Defense”. He does not provide details. He then claims that, even though he was paid by the CIA for his services, he did not act out of self-interest.

Chistov says that the conditions of his imprisonment are inhumane and that he and his family “are in great danger in Russia”. He also claims that his wife visited the US embassy in Ukraine in an attempt to secure a travel visa, but that her application was rejected and she was forced to return to Russia. The jailed spy adds that he “wrote two letters to the CIA asking them to help and received no response”. He then pleads with President Trump to help him, in two ways. First, by granting asylum in the US to his wife and mother. Second, by swapping him with someone “who worked for Russia” and is serving time in a US prison. “I want to appeal to the president to conduct the exchange”, he concludes.

The United States has participated in very few spy swaps in the post-Cold War era. In 2010, Washington and Moscow conducted one of history’s largest spy exchanges, as ten deep-cover Russian agents captured in the US earlier that year were swapped for four Russian citizens imprisoned by Moscow for spying for the US and Britain. Four years later, a Cuban intelligence officer who spied for the CIA was released as part of a wider exchange between Washington and Havana of persons held in each other’s prisons on espionage charges. The White House has not commented on Chistov’s letter.

Author: Joseph Fitsanakis | Date: 10 December 2018 | Permalink