French security services investigate Russian role in yellow vests movement

yellow vests movementIntelligence and security services in France are investigating whether Russian involvement on social media and other platforms is playing a role in amplifying the so-called ‘yellow vests’ movement. Known in French as le mouvement des gilets jaunes, the campaign began online in May of this year as a popular protest against rising fuel prices and the high cost of living in France. In mid-November, the movement made its first public appearance with large demonstrations that have continued every weekend since then. Yellow vest protestors claim that tax increases are disproportionally affecting working- and middle-class people and that everyday life is becoming economically unsustainable in France. Some of the demonstrations have turned violent, and so far at least eight people have died as a result. The ensuing crisis has become the most significant threat to the government of Emmanuel Macron, as the protests are increasingly evolving into an anti-Macron rallies.

So far, the yellow vests campaign has been largely bipartisan, bringing together protestors from the entirety of the French political spectrum. Additionally, there are no identified leaders or coordinators of the movement. However, some suspect that Russian government operatives may be further-inflaming an already incensed protest movement. On Friday, The Wall Street Journal said that French security agencies were investigating potential involvement by the Kremlin in the yellow vests campaign. The paper quoted an unnamed French government cybersecurity official as saying that “there has been some suspect activity [and] we are in the process of looking at its impact”. The official was referring to the online activity of some leading social-media accounts involved with the yellow vests, which appear to also be “promoting Russian-backed coverage” of French politics. The Journal also cites Ryan Fox, a cybersecurity expert for the Texas-based firm New Knowledge, who claims that “several hundred accounts on Twitter and Facebook” that are involved in the yellow vests movement “are very likely controlled by Moscow”.

However, there is disagreement among cybersecurity experts about the extent of the Kremlin’s involvement in the yellow vests. Paris has previously accused Moscow of trying to influence the direction of French politics. In February of 2017, France’s Directorate-General for External Security warned that Russia had launched a secret operation to try to influence the outcome of that year’s French presidential election in favor of the far right. However, if such an effort existed, it failed to stop the rise to power of Emmanuel Macron. Since assuming the country’s presidency, Macron has been a leading international critic of Russia’s domestic and foreign policies. The Kremlin, therefore, has strong reasons to want to see a premature end to Macron’s presidency.

This does not necessarily mean that Moscow has been able to anticipate —let alone influence— the yellow vests movement, whose energy has surprised even the most experienced French political observers. The Journal notes that many leading Western cybersecurity bodies, including the Atlantic Council’s Digital Forensic Research Lab, have “not seen significant evidence of state-sponsored interference” in the yellow vests movement, whether by Russia or any other government. Facebook also said that its monitors have not uncovered any evidence of an organized campaign by Moscow to coax the yellow vests protests. The paper also cited Dimitri Peskov, a spokesman for the Kremlin, who categorically denied allegations that Russia was in any way involved in directing yellow vests activists.

Author: Joseph Fitsanakis | Date: 17 December 2018 | Permalink

Advertisements

Russian spies ‘launched major cyber attack on Ukraine’ prior to naval incident

Strait of KerchRussia “paved the way” for last November’s seizure of Ukrainian Navy ships by launching a major cyber attack and disinformation campaign aimed at Ukraine, according to a cyber security firm and the European Union. In what has become known as the Kerch Strait incident of November 25, border service coast guard vessels belonging to the Russian Federal Security Service (FSB) opened fire on three Ukrainian Navy ships that were attempting to enter the Sea of Azov through the Kerch Strait. All three Ukrainian vessels, along with crews totaling 24 sailors, were captured by the Russian force and remain in detention. Ukraine condemned Russia’s action as an act of war and declared martial law in its eastern and southern provinces. But Moscow said the incident had been caused by a provocation by the Ukrainian government, in a desperate effort to increase its popularity at home. Meanwhile, the three Ukrainian ships and their crews remain in Russia.

But now a private cyber security firm has said that Moscow launched a series of cyber attacks on Ukrainian government servers, which were aimed at gathering intelligence that could be used for the ships’ capture. In a separate development, the European Union’s security commissioner has alleged that the Kremlin launched an elaborate “disinformation campaign” aiming to “soften up public opinion” before seizing the Ukrainian ships.

The American-based cyber security firm Stealthcare said this week that the cyber attacks were carried out by Carbanak and the Gamaredon Group, two hacker entities that are believed to be sponsored by the Russian intelligence services. The first wave of attacks, which occurred in October of this year, centered on a phishing campaign that targeted government agencies in Ukraine and other Eastern European countries. Victims of these attacks had “important functions” of their computers taken over by remote actors who stole and exfiltrated data, according to Stealthcare. Another attack installed back doors on computer servers belonging to Ukrainian government agencies in November, just days prior to the Kerch Strait crisis. The two attacks, said the company, provided the hackers with “information that would have been very […] relevant in planning” the November 25 naval crisis, said Stealthcare. The company added that there was “no doubt that this was a Kremlin-led reconnaissance effort to prepare for the Kerch Strait crisis”.

Meanwhile on Monday Julian King, a British diplomat who is currently the European Commissioner for the Security Union, said that Russia “paved the way for the Kerch Strait crisis” through a systematic fake news campaign that “lasted for more than a year”. The campaign, said King, included the use of social media to spread false rumors, such as claims that the Ukrainian government had infected the Black Sea with bacteria that cause cholera. Another report by Russian media allegedly claimed that Kiev had tried to secretly transport a nuclear device to Russian-annexed Crimea through the Kerch Strait. The EU security commissioner added that social media platforms and online search engines like Google had a responsibility “to identify and close down fake accounts that were spreading disinformation”.

Author: Joseph Fitsanakis | Date: 12 December 2018 | Research credit: D.V. | Permalink

Facebook says efforts to subvert upcoming US elections resemble ‘new arms race’

FacebookFacebook has said it is involved in an “arms race” against “bad actors” as it announced on Tuesday the removal of accounts that allegedly tried to subvert the upcoming mid-term elections in the United States. The social-media giant said its security division had identified 32 profiles and pages that were set up for the sole purpose of disrupting, subverting or otherwise influencing the American political process. At least seven more accounts were shut down on the Instagram platform –which is also owned by Facebook– for the same reasons. In the past 14 months, the suspect accounts generated nearly 10,000 posts and were liked or followed by over 290,000 users, said Facebook.

In addition to producing memes that aimed to stir existing racial, political and religious tensions in American society, the suspect accounts are also believed to have generated approximately 150 paid advertisements, spending around $11,000 for that purpose. Moreover, close to 30 public events were organized, advertised and hosted by the suspect pages throughout the US in the past 14 months. One such event was subscribed to by 4,700 users, with another 1,400 users stating that they would attend.

In a preliminary report posted on its online newsroom, Facebook said it was too early in the investigation to identify the party or parties behind the alleged effort to influence the US mid-term elections. Its security team had detected “one instance” of a connection between this latest operation and the Russian-based Internet Research Agency (IRA), which Facebook identified as being one of the main sources behind efforts to influence the 2016 US presidential elections. But the report cautioned that the instigators of this latest attempt to influence the US political process had gone to great pains to hide their identities, affiliations and geographical coordinates. For instance, they routinely employed virtual private networks in order to disguise their internet protocol addresses. They also used third parties to purchase advertisements on Facebook and Instagram. These and many other tactics severely limited the ability of security technicians to attribute these efforts to specific countries, governments or companies, said Facebook.

Using unusually strong language to describe its ongoing probe, Facebook said that the exploitation of its platform for sinister political purposes resembled “an arms race” and that constantly changing tactics were needed to combat it. In addition to removing the suspect accounts, Facebook said it was working closer with law enforcement and leading online security firms in order to analyze and eliminate threats from what it described as “bad actors”. It added that it was “investing heavily” in more people and better technology in order to eliminate those who were trying to weaponize its communication platform for sinister goals.

Author: Joseph Fitsanakis | Date: 01 August 2018 | Permalink

Iran warns of repercussions as US intensifies campaign against Tehran

IRGC IranIranian military officials have warned of extracting “revenge from foreign intelligence services”, as Reuters reported that an aggressive campaign against Tehran has been launched by Washington. On Sunday, the Reuters news agency said that senior officials in the administration of US President Donald Trump had launched a concerted offensive “meant to foment unrest” in the Islamic Republic. Citing information from “more than half a dozen current and former officials”, Reuters said that the US offensive is directly supported by President Trump’s Secretary of State Mike Pompeo and his National Security Adviser John Bolton. Both officials are known for their aggressive stance against the Iranian government.

The campaign, said Reuters, is meant to “work in concert” with President Trump’s push to “economically throttle Iran”. The US leader announced a series of economic sanctions on the Islamic Republic and has intensified his critical statements against Tehran after May of this year, when Washington pulled out of the Iran nuclear agreement. Known as the Joint Comprehensive Plan of Action (JCPOA), the international agreement was reached in 2015 between Iran and a group of nations known as the P5+1, namely the five permanent members of the United Nations Security Council plus Germany. As part of the deal, Iran agreed to halt its nuclear weapons program in exchange for an end to economic sanctions by the West. But President Trump abandoned the agreement, saying it was a form of appeasing Tehran.

According to Reuters, Washington’s campaign involves the spreading of information that “paints Iranian leaders in a harsh light” and in some cases makes claims about Tehran that are “exaggerated”. For example, said Reuters, some social media posts by the US Department of State’s Farsi-language news service claim that Iran is close to al-Qaeda, despite the fact that Shiite Islam, which is Iran’s state religion, is viewed as a heresy by Sunni members of al-Qaeda. Other –perhaps more believable– accusations include claims that the leaders of Iran are wasting funds released by the JCPOA instead of using it for their people’s welfare, and that Tehran funds the Taliban in Afghanistan.

Meanwhile, a spokesman for the Iranian Revolutionary Guard Corps (IRGC), arguably the most powerful branch of the Iranian Armed Forces, issued a warning on Sunday against “foreign intelligence services”. The spokesman, Brigadier General Ramezan Sharif, said Iran would take revenge on foreign spy services “who try to disrupt the security of Iran’s borders”. He was referring to an armed attack that took place on Saturday in Iran’s northwestern Marivan region, near the Iran-Iraq border. The attack concentrated on an Iranian military compound in the village of Dari and culminated with the bombing of an IRGC arms depot. According to Iranian media reports, the explosion killed 11 Iranian border guards. Reuters said it contacted the White House and the Department of State about the alleged campaign against Iran, but that both declined to comment.

Author: Joseph Fitsanakis | Date: 23 July 2018 | Permalink

Latvia warns of ‘hybrid war’ as central bank corruption probe widens

Ilmars RimsevicsLatvian defense officials have hinted that Russia is trying to destabilize Latvia’s economy, as a Western-backed anti-corruption probe at the highest levels of the Baltic country’s banking sector deepens. Developments have progressed at a high speed since Monday of last week, when Latvia’s Corruption Prevention and Combating Bureau arrested Ilmars Rimsevics, the longtime Governor of the Bank of Latvia —the country’s central bank. Bureau investigators said Rimsevics’ arrest related to charges that he received bribes in order to facilitate money laundering from Russia.

Rimsevics became deputy governor of the Bank of Latvia in 1992, just months after the country seceded from the Soviet Union. In 2001 he was promoted to governor, a post that he has held onto ever since. When the small Baltic country joined the European Union, in January 2014, Rimsevics automatically became a member of the Governing Council of the European Central Bank (ECB), which directs the Eurozone’s monetary policy and monitors the performance of the euro. But last week the Latvian government rescinded Rimsevics’ security clearance and a scheduled meeting of the ECB in Frankfurt took place without him.

This dramatic development underscores the troubled state of Latvia’s banking sector, which is a notorious reputation as one of Europe’s most lucrative money-laundering hubs. Soon after it gained its independence, the small country of 2 million became an attractive conduit for Russia’s nouveau riche seeking to funnel their money westward. The country’s sizeable Russian-speaking minority allowed the local banking sector to offer highly sought-after services in the Russian language, which further-facilitated its contacts with wealthy Russian clients. This was further-enhanced by Latvia’s integration into the economic structure of the European Union in 2014. But Western countries began voicing concerns about close links between Latvia’s banking sector and Russian oligarchs in 1996. By 2011, the United States Department of the Treasury had identified numerous Latvian banks as serious violators of laws designed to prevent money laundering. In 2014, and again in 2017, the Organized Crime and Corruption Reporting Project identified Latvia as part of an extensive international money-laundering scheme dubbed “the Russian Laundromat”.

Notably, Rimsevics was arrested less than a week after Washington vowed to impose penalties on ABLV, Latvia’s third largest bank, for “institutionalizing money laundering” and violating a host of financial sanctions imposed by the United Nations, including sanctions against North Korea’s nuclear program. There is no question, therefore, that Rimsevics’ dramatic arrest was designed to combat what The Financial Times recently called “a banking scandal on the Baltic”. In the past few hours, reports from Riga indicate that ABLV may be on the brink of collapse, being unable to withstand the financial effects of the public scandal that emerged in recent days.

But things are never simple in the Baltic region. Soon after Rimsevics’ release on bail, reports in the Latvian media pointed to alleged efforts by Russia to defame him, in an effort to further-tarnish the already damaged reputation of Latvia’s banking sector. On Tuesday of last week, the Latvian Ministry of Defense said it had evidence that Rimsevics was targeted in a “disinformation operation” directed from abroad. It added that there was a “high probability that [a] massive information operation” had been launched for “foreign centers” aimed at destabilizing Latvia’s banks. No evidence or further information about the allegation was revealed. But the Defense Ministry’s allegations seemed to be supported by an analysis of the relevant news reporting by the Atlantic Council’s Digital Forensics Research Lab in Washington.

On February 23, Latvia’s Prime Minister, Maris Kucinskis, and President, Raimonds Vejonis, seemed to endorse the Defense Ministry’s allegations. Despite the fact that both politicians have urged Rimsevics to resign “for the sake of the financial system”, they also warned that Latvia was under attack in an information war. The two men did not make specific allegations, but said that the information attacks experienced by Latvia were “identical” to those seen in recent years in France, Germany, and the United States. Meanwhile, shortly after his release, Rimsevics held a press conference in Riga, where he denied all charges against him. He accused Latvia’s private banks of conspiring against him and said he was the victim of “death threats” to destabilize the country. On the same day Moscow, Kremlin spokesman Dmitry Peskov said that Russia had no comment on the situation in Latvia. “This is an internal political matter for our Latvian comrades [and] we wouldn’t want to get involved”, he said.

Author: Joseph Fitsanakis | Date: 26 February 2018 | Permalink

Britain to set up intelligence unit to combat ‘fake news’ by foreign states

Theresa MayThe British government has announced that it will form a new intelligence unit tasked with preventing the spread of so-called “fake news” by foreign states, including Russia. The decision was revealed earlier this week in London by a government spokesman, who said that the new unit will be named “National Security Communications Unit”. The spokesman added that the unit will be responsible for “combating disinformation by state actors and others”. When asked by reporters whether the effort was meant as a response to the phenomenon often described as “fake news”, the spokesman said that it was.

According to The Times newspaper, the proposal for a National Security Communications Unit was presented during a scheduled meeting of the country’s National Security Council earlier this week. It was put forward by its strongest proponent, Sir Mark Sedwill, Britain’s former ambassador to Afghanistan and current national security adviser to the government. The unit will be directly accountable to the Cabinet Office, the government department that is responsible for providing support to the Prime Minister and her Cabinet. It will be staffed with professionals from Britain’s intelligence and security agencies, but will also rely on contributions from external experts in cybersecurity, communications and public relations. The unit will also include a “rapid response unit” that will be tasked with countering “fake news” in real time, according to The Times.

The move follows a similar development in the United States. In December of 2016, the then President Barack Obama signed a new law that designated $160 million to set up a government center for “countering foreign propaganda and disinformation”. The law, entitled “Countering Foreign Propaganda and Disinformation Act”, authorized the departments of State and Defense to work with other federal agencies in establishing the new body. According to a statement by the White House, the goal of the Center would be to collect and analyze “foreign government information warfare efforts” and to “expose and counter foreign information operations” directed against “US national security interests”.

On Wednesday it was announced in London that the British Secretary of Defense, Gavin Williamson, will be providing further details about the National Security Communications Unit in a speech to the House of Commons “within the next few days”.

Author: Joseph Fitsanakis | Date: 25 January 2018 | Permalink

Intelligence chief warns of foreign interference in German coalition talks

A senior German intelligence official has warned that foreign powers, including Russia, could try to shape the outcome of talks by German parties to form a governing coalition, following last week’s national elections. The elections resulted in a major shakeup of Germany’s political landscape, as Chancellor Angela Merkel’s Christian Democratic Union lost nearly 10 percentage points compared to its 2013 election result. It is now forced to seek the participation of other conservative or centrist political parties in a broad governing alliance. Meanwhile, the far-right Alternative for Germany (AfD) won 12.6 percent, propelling it to third place and giving it 91 seats in the Bundestag. The AfD result marks the first time since 1945 that a German far-right party has managed to secure parliamentary representation.

On Thursday, senior intelligence official Burkhard Even said that, unlike France and the United States, Germany was spared major foreign interference during its recent election period. Speaking at a security conference in Berlin, Even, who is director of counterintelligence at the Federal Office for the Protection of the Constitution, said interference attempts were limited in both volume and impact. He described them as “low-level propaganda” operations conducted mainly by Russian media, which “did not have a significant impact on voters” and did not affect “the election outcome as a whole”. However, the official added that such attempts were possible in the post-election period. For instance, there could be efforts by foreign intelligence agencies to discredit certain government officials or political figures, said Even. Alternatively, methods of propaganda could be employed by a foreign power “to affect the forging of a new government”, he added, referring to the ongoing talks between German political parties to enter into a governing coalition. “The risks are enormous”, said Even, and “they are not diminishing”.

The far-right AfD campaigned in favor of ending Muslim immigration to Germany and expelling most non-Western immigrants from the country. The party has also called for a tighter relationship between Berlin and Moscow and opposes Germany’s decision to impose economic sanctions on Russia in response to its alleged intervention in Crimea. Some have suggested that the Russian intelligence services launched a secret campaign to gather voter support for the AfD in the run-up to last week’s elections.

 

Author: Joseph Fitsanakis | Date: 29 September 2017 | Permalink