Has the WH or NSC Been Briefed at all on al Suri’s Strategy?

Posted on August 6, 2016August 6, 2016 by Denise Simon

Abu Mus‘ab al-Suri DVD Cover: Image Analysis

The image here is a DVD cover of a recording of Abu Mus‘ab al-Suri, a top jihadi strategist. He is described as “min alma‘ mufakkiri al-qa‘ida tamma rasd khamsat malayin dular min qibali al-hukuma al-amrikiyya lil-qabd ‘alayhi” (“one of al-Qa‘ida’s brightest thinkers for whom the American government has offered a sum of 5 million dollar for his capture”). The cover portrays the recording as “jalsa ma‘a shabab bilad al-haramayn; min akhtar ma qila ‘an al-wad‘ fi bilad al-haramayn wa-mustaqbal al-haraka al-jihadiyya” (“a meeting Saudi youth; one of the most interesting accounts of the situation in Saudi Arabia and the future of the jihadi movement”). CTC

Related reading: 4GW, Fourth Generation Warfare

The Strategist: How Abu Mus’ab al-Suri Inspired ISIS

TerrorismWatch: This paper takes a look into the life and work of Abu Mus’ab al-Suri, jihadist theorist, and argues that he should be considered the architect of the extant Islamic State of Iraq and Syria (ISIS). This is done by way of an examination of his own writings, as well as secondary literature on al-Suri, al-Qaeda, and ISIS. A key point that emerges out of this analysis is that ISIS is likely to continue its two-pronged strategy: of individual attacks offshore, and consolidating territory in Iraq and Syria.

1. Introduction

In 1994 a young man of Syrian origin, who had then recently acquired Spanish citizenship, moved with his wife to Neasden, a dreary suburb of London. Neasden is home to immigrants of many nationalities (it has the largest Hindu temple outside of India), so it was not too strange for this young, cash-strapped family to have decided to relocate there from Madrid. The man’s wife – a Spanish-born Moreno – explained to her family that they were relocating to London as her husband had found a job there as an editor for a small newspaper. The young family’s daily life was not that different from other immigrants’ – it was not unheard of in Neasden to be broke and in debt, with a doting wife doing her best to support her bright, ambitious husband through careful house-holding and not infrequent penny-pinching. The life of the Setmariams could have been out of a Maupassant or a Zola story; except it was not.

Fast-forward to 31 October 2005, when Pakistani security forces stormed an Islamist front in Quetta in Balochistan, and arrested the man from Neasden as he waited for iftar with a colleague. That colleague was killed in the operation. The man – Mustafa bin Abd al-Qadir Setmariam Nasar, also known as Abu Mus’ab al-Suri and 47 years old – carried a bounty of five million dollars as announced by the US government. In all likelihood, Pakistan transferred the custody of al-Suri to the US Central Intelligence Agency which, in turn, rendered him to Syria where he remains in prison till date.

Al-Suri impressed almost everyone who met him. Peter Bergen, the first western journalist to have interviewed Osama bin Laden (a meeting facilitated by al-Suri himself) described al-Suri as “intelligent, intense, and well informed and very very serious.” Bergen went on say that he came to “admire his intellect.”[1] The Norwegian counterterrorism expert Brynjar Lia – whose definitive book on al-Suri remains standard reading for counter-Islamist-terrorism analysts – described al-Suri as an autodidact intellectual in the classic mould:

An avid reader, with an encyclopaedic memory, he impressed acquaintances with his knowledge of literature, classical music, history, politics, and the sciences […][2]

Another journalist had described al-Suri as “possess(ing) of a romantic streak and surprised friends by doting on his Spanish-born spouse.”[3] Physically, wrote an AP reporter, he resembled “an Irish pub patron”.

For counterterrorism experts, al-Suri was notorious: he had been suspected of involvement in a number of terrorist attacks in Europe, including the 2004 Madrid and 2005 London bombings, though these charges were never established mostly because he was not tried for the bombings, in the first place. Whether or not he had a hand in those bombings, what had rattled the Americans and their European counterparts was his role as al-Qaeda’s leading strategist, and the extent to which his guidance had influenced that group in general, and Osama bin Laden, in particular. One gauge of his influence is the consistent reference in many academic and popular writings of him as ‘architect’. Cruickshank and Hage Ali, for example, write: “[…] no other individual has done more to conceptualize al-Qaeda’s new strategy after 9/11.”[4] Lawrence Wright, meanwhile, identifies theorists like al-Suri as tutors to a “third generation of mujahideens” – as Al-Suri himself calls them – who, after having fought in Iraq – will “add their expertise to the new cells springing up in the Middle East, Central Asia, the Philippines, Indonesia, Malaysia, and many European nations.”[5]Jason Burke writes:

If al-Awlaki was the propagandist who did most to shape today’s threat against the West, and al-Zawahiri and al-Baghdadi are currently the most influential commanders, then al-Suri is the strategist of greatest relevance.[6]

As Burke indicates, al-Suri’s reach – and the efficacy of his strategy – far exceeds al-Qaeda, and could be seen as laying the foundations of the strategy that has been adopted by the Islamic State of Iraq and Syria (ISIS). Al-Suri’s book, The Global Islamic Resistance Call – key parts of which are excerpted in Lia’s book, and is available on the SITE intelligence website[7] – shows an eerie similarity with the strategic and tactical thinking of ISIS, going beyond al-Suri’s original concept of ‘individual-terrorism jihad’. Indeed, a close reading of al-Suri as an ISIS strategist has been absent in the discourse around the group – perhaps for the simple reason that in the mental framing of many analysts, al-Suri’s name conjures al-Qaeda more than any other group. (A notable exception is a short article in the Atlanticpublished late June this year.[8])

2. Fathers of Mu’sab

The goal of the present paper is to look at al-Suri’s book itself (as a primary source) as well as academic literature on his work, with ISIS’s ideology and modus operandi in mind. To better appreciate the intellectual influence of al-Suri on ISIS, a trace must first be made of actual links between the man and the group.

The story of the evolution of ISIS is beyond the scope of this paper; there is no dearth of literature on the subject. It suffices to say that the present-day ISIS evolved out of the rubble of the 2003 US invasion of Iraq, and was largely driven by one man: Abu Mus’ab al-Zarqawi. Al-Zarqawi, a Jordanian criminal-turned-terrorist, was influenced by jihadi ideologue Abdullah Azzam’s sermons enough to travel to Afghanistan for jihad against the Soviets in the early 1980s.[9] By 2005, al-Zarqawi was at his peak, leading his al-Qaeda in the Land of Two Rivers. But by January 2006, he had amalgamated his group with other Islamist outfits to form the Mujahideen Shura Council of Iraq[10] which, after his death in a US air-strike in June 2006, morphed into the Islamic State of Iraq – the direct precursor of ISIS as the world knows the group today.

Al-Suri and al-Zarqawi’s paths first crossed in Afghanistan during the Taliban rule. Both controlled semi-independent camps there — al-Suri in Kabul and al-Zarqawi in Herat.[11] Both disdained bin Laden, and insisted on greater autonomy, something bin Laden resisted.[12] (This fissure would become full-blown much later. By October 2015, Ayman al-Zawahiri, bin Laden’s successor, was directly challenging ISIS and the legitimacy of its self-proclaimed Caliph.[13]) By 2004, the US Central Command in Dubai suspected that al-Suri had joined al-Zarqawi in Iraq, “acting as deputy and mentor”, something al-Suri himself denied.[14]Nevertheless, the links between the two lasted long after the fall of the Taliban: Ameer Azizi, a protégé of al-Suri’s, is suspected to have travelled to Iraq to work with al-Zarqawi. The ideological link between the two was cemented by Jordanian/Palestinian cleric, Abu Muhammad al-Maqdisi, al-Zarqawi’s “foremost spiritual mentor”[15] and who is considered an influence on al-Suri’s own thinking.[16] Al-Maqdisi’s student Turki al-Bin’ali, in turn, is now reputed to be a prominent authority in the Islamic state.[17] Finally, long after al-Suri was incarcerated, the first issue of ISIS’s flagship publication Dabiq indirectly acknowledged al-Suri’s influence on the organisation, by attributing al-Suri’s strategies to al-Zarqawi.[18]

Yet the affinity between the group and the man who influenced it does not end with ideology. As much as one face of al-Suri was that of a theorist, he was capable of great violence himself. Cruickshank and Hage Ali interviewed a former jihadi who knew al-Suri personally. According to this interviewee, al-Suri “personally tracked down and killed individuals” who had deserted his Kabul camp.[19] His exhortation to indiscriminate violence – “Kill wherever and don’t make a distinction between men, women and children” – and anti-Shia stance would all find resonance in later ISIS behaviour. Incidentally, as Burke notes, al-Qaeda had invested significantly in reducing fitna (discord) between Muslims and non-Muslims.[20] ISIS, al-Zarqawi, as well as al-Suri had no problems with the same – a marked departure from al-Qaeda’s stance. This had significant tactical advantages for al-Zarqawi. By opening up the sectarian Shia-Sunni divide, the group had hoped to capitalise on Sunni support. This was also buttressed by growing Shia influence in the post-war Iraq.

3. A Military Theory of ‘Jihad’

Al-Suri’s strategic thought was presented, as noted earlier, in his 1,600-page opus. Analysts who have had access to videotapes of his lectures in jihadist camps in Afghanistan have also discerned a few more themes related to that book’s overall thrust. When it comes to applicability of his thoughts to ISIS’s grand strategy, two key ideas emerge: “Individual-Terrorism Jihad”, and “Open-Front Jihad.” Al-Suri’s strategic theory also suggests a way to structure a jihadist organisation that meshes the two into one functional unit. But it is also important to situate al-Suri’s programme within the larger context of Islamist resistance.

3.1. Syed Qutb: Precursor theorist

Al-Suri started his career as an Islamist extremist under the umbrella of the Syrian Brotherhood. He would eventually have a falling-out with the Brotherhood, as he blamed it for the brutal crackdown under then-Syrian President Hafez al-Assad in 1982. Ideologically – and methodologically – the Syrian Muslim Brotherhood was extremely close to the Egyptian Muslim Brotherhood Ikhwan. In fact, al-Suri himself noted that his trainer “pledged allegiance to Sheikh Hassan al Bannah […] He accompanied Sayyid Qutb […].”[21]

Al-Banna and Qutb remain prominent ideological figures for both al-Qaeda and ISIS. Jihadi-salafism (commonly referred to as ‘jihadism’) is a mixture of two strains: the ideology of the Ikhwan, led by al-Banna (whose chief theoretician was Sayyid Qutb), and Wahhabism which promotes a version of Sunni exclusivism.[22] Initially these two strains were separate – the Brotherhood Ikhwan “not implacably hostile” towards Shi’ism[23] – but under the ideological influence of the theoretician Qutb – groups (which would serve as forerunners to al-Qaeda and ISIS) arose in the Arab Middle East that were influence by both.[24] Lia notes:

He studied the writings of Sayyid Qutb and Abdallah Azam, both of whom had significant influence on his subsequent development as a jihadi theorist. [emphasis added][25]

It is therefore important to situate al-Suri’s thinking within that of Qutb’s – a full-length work in itself. But even a cursory reading shows continuity and congruence between the two men’s thinking.

Sayyid Qutb’s formative years, 1919 to 1952, included a stay in the United States that was to prove extremely significant in his subsequent radicalisation in prison for almost a decade. The latter was for opposing Nasser and his conception of the Egyptian state – it was in 1952, the year Nasser assumed office, that Qutb developed the fundamental concept of jahilyya.[26] This concept is expansive is nature. Qutb himself defined it – in his influential work, Milestones, for which he was ultimately executed by Nasser[27] – as:

Jahilyyah […] is one man’s lordship over another, and in this respect it is against the system of the universe and brings the involuntary aspect of human life into conflict with its voluntary aspects.[28]

Jahilyyah can be understood as being in a state of ignorance about the need to surrender to God (the literal meaning of the word “Islam.”) This included the Western political-social order, as well as the pre-Islamic pagan society of which Qutb found Nasser’s Egypt to be an example.[29] Qutb and his followers saw Islam as a “complete and total system” which had no need for influence from the outside.[30]

Qutb’s call was to create a group which would “separate itself from jahili society,” and resist it from the outside.[31] This would be the central purpose of jihad. But jihad was to be, for Qutb and other Islamists after him, more that the “defence of the ‘homeland of Islam’” in a geographical sense of the term.[32] The geographical ‘homeland of Islam’ was merely a nerve-centre for the entire faith; the correct interpretation of the phrase ‘defence of the Islamic homeland’ was the “defence of the Islamic beliefs, the Islamic way of life, and the Islamic community.” Ultimately, it was jihad as resistance to obtain “the freedom of man from the servitude to other men” – one of the characteristic features of jahili societies – that was to influence later jihadi-theorists in a marked way, al-Suri included. Such servitude would, by definition, put some individuals above others. These individuals would include lawmakers and other secular authorities, according to Qutb and other theorists. The goal of the Islamist resistance project would be to oppose these individuals as disbelievers. Al-Suri writes:

There is very clear evidence, in the Qur’an and the Sunna, of the faithlessness of those who have given themselves the right to legislate laws in what is forbidden and permissible, and to change the laws, and to confront the sovereignty of God, to become worshipped gods.[33]

Like Qutb before him, al-Suri saw the fall of the Islamic Caliphate in 1924 as a watershed for political Islam – leading to the “catastrophe”[34] of a splintered Islamic state. Reversing this splintering would prove to be a major cause for him and for ISIS.

3.2. “System Not Organization”

The first, and perhaps most important, element of al-Suri’s thinking is that of jihad through Nizam la Tanzim – “System Not Organization.” In his book, al-Suri described his vision of al-Qaeda:

Al-Qaeda is not an organization, it is not a group, nor do we want it to be […] It is a call, a reference, a methodology.[35]

The etymology of the word ‘al-Qaeda’ helps us understand this statement to some extent. Al-Qaeda-al-sulbah “can also mean a precept, rule, principle, maxim, model, or pattern,”[36] other than the commonly-used meaning of “the base” (interpreted in a physical-geographical sense). To understand the strategic import of the statement is to – like al-Suri himself – appreciate that regional-secret-hierarchical tanzims did not fare well post the end of the Cold War and till right after the fall of the Twin Towers on 11 September 2001. Al-Suri writes:

Throughout the last decade of the 20th century, programs for fighting terrorism were able to disband those organizations security-wise, militarily defeat them, isolate them from their masses [of followers], damage their reputation, dry out their financial resources, make their elements homeless, and put them in a constant state of fear, starvation, and lack of funds and people.[37]

Not all of this was due to western agencies alone. One other factor was the changing geopolitics of the world following the end of the Cold War. As al-Suri explains, when the world was bipolar, one organisation that was proscribed under one pole could find shelter with another.[38] A case in point is the Afghan jihad of the 1980s which was supported by the United States. But local governments were also to be blamed for the fall of the secret-hierarchical tanzims.

For example, Al-Suri blames Hosni Mubarak’s regime in Egypt for putting “an end to all the jihadi organizations in Egypt, one after the other.”[39] Why – according to al-Suri – was this the case? In a lecture in 2000 at the Al Ghuraba training camp in Afghanistan for new al-Qaeda recruits, al-Suri drew the following diagram depicting the structure of these failed tanzims (modified by this author from a sketch in Cruickshank and Hage Ali[40]).

Figure 1: A Schematic Description of a Hierarchical Centralised Structure

In this structure – as depicted in figure 1 – if any one individual (nodes) is arrested or otherwise compromised, the whole network – which is hierarchical, top-down, and centralised – would be compromised. As al-Suri noted: “In case you are caught, they are all caught.”[41] But beyond this tradecraft consideration laid al-Suri’s deep distrust of centralisation of command – which had manifested in his not-infrequent run-ins with bin Laden. The goal of resistance through individual terrorism is not a struggle of the elite, al-Suri wrote.[42] He explained:

The Call is to convoy the idea in succinct and detailed ways in order to enable the youth, who are determined to fight a jihad, to enter this call and form their own Units independently.[43]

What al-Suri is referring to is not the same as what the press calls “lone wolves,” or “leaderless jihad.” Indeed, according to al-Suri, what connects these decentralised units responding to “the Call” to the larger System is an ideological link comprising of (1) a common aim, (2) common name, (3) common doctrinal jihadi program, and (4) a comprehensive educational program. Al-Suri requires his individual terrorists to commit to nothing “other than to believe in the idea, be absolutely certain in his intention, join the Call, and educate himself and those with him according to the Call’s program […].”[44] Tures – in a debunking of the lore of lone-wolf terrorism – writes:

These “lone wolves,” are therefore anything but “lone.” Though the media, government, and even terrorists like ISIS themselves use the term, these new terror recruits are still connected to the group, even if such people do not have face-to-face contact or fly to the Middle East or some domestic compound for training.[45]

Indeed, consider what happened in San Bernardino on 2 December 2015 where a married couple – self-radicalised (or “self-educated,” as al-Suri would have put it) killed 14 people. These were not “lone wolves”; rather, they were following a path al-Suri laid out for them. In other words, ISIS’s claim – that the couple were soldiers of the Caliphate[46] – is literally true if the organisation has taken a leaf out of al-Suri’s individual terrorism strategy. But for the de-centralised form of individual terrorism to be truly successful, al-Suri recognised the need for mass mobilisation. One way to mobilise Muslims, al-Suri suggested at the Al Ghuraba lecture, was to harangue on the “degeneracy of the Western world” with “its sins, gays and lesbians.”[47] [emphasis added] The attack on an Orlando gay nightclub in June this year – the worst mass-shooting in American history – seems to be right out of al-Suri’s Machiavellian playbook. The shooter, Omar Mateen, had pledged bay’at to ISIS.

The conception of nizam la tanzimand “individual-terrorism jihad” stands out in sharp relief to al-Qaeda. While the network structure of that organisation was known, bin Laden – according to many analysts – was seen as “promoting ‘a worldwide, religiously-inspired, professionally guided Islamist insurgency [emphasis added].”[48]Professional guidance for al-Suri for individuals responding to the ‘Resistance Call’ individually is limited in the sense of “education” being the individual’s initiative. However, al-Suri would advocate the spreading of the requisite “legal, political, military and other sciences and knowledge that the Mujahidun need in order to carry out Resistance operations,” without compromising the decentralised structure of the system.[49]Social media would prove handy for ISIS in implementing this tactic.

3.3. “Open-Front Jihad”

Al-Suri did recognise that the ultimate goal for the Islamic Resistance, as he called this putative global jihadi system, was holding physical territory. His conception of al-Qaeda had three key elements: a physical base (one meaning of Qaeda); a leadership; and a global world-view.[50] The importance of the first cannot be underestimated in al-Suri’s world-view: in fact, the “greatest loss,” from the ensuing US invasion of Afghanistan following the 9/11 attacks, “was not the destruction of the terrorist organization but the downfall of the Taliban, which meant that al-Qaeda no longer had a place to train, organize, and recruit.”[51] Al-Suri was categorical on the importance of seizing territory in the ‘Resistance Call,’ which he called the “strategic goal” of the whole enterprise.[52] (His sub-theory of decentralised jihad, in contrast, was a tactical tool.) This is also something he shared with al-Qaeda’s then ‘Number Two’ Ayman Al-Zawahiri, who wrote:

If the successful operations against Islam’s enemies and the severe damage inflicted on them do not serve the ultimate goal of establishing the Muslim nation in the heart of the Islamic world, they will be nothing more than mere nuisance, regardless of their magnitude, that could be absorbed and endured, even if after some time, and with some losses.[53]

Al-Suri imagined that this physical territory that could be controlled by the Islamic resistance system would also serve as a site for “Open-Front Jihad,” where enemies could be drawn in for asymmetric warfare. In fact, he identifies areas in the greater Middle East, Central Asia, and North Africa for such activity – preconditions related to geography, population, and political factors.[54] Geography plays a particularly important role in his analysis – the ideal site for Open-Front jihad was to be “spacious in terms of area,” “varied with long borders,” “difficult to siege,” with inhospitable topography, and yet with sufficient resources for human sustenance.[55] But his analysis was not generic in identifying most of the places in this vast area as suitable for Open-Front jihad. In fact, his analysis showed that the vast majority of the 55 states in this area were unsuitable for this kind of activity in not meeting one or more of the preconditions he listed.[56]

He then goes on to identify the “Levant and Iraq,” as an ideal site for Open-Front jihad. “It has all the preconditions for the Open Fronts,” al-Suri writes.[57] His reading of the situation in that area was striking in his analysis – written long before the so-called Arab Spring, the series of protests and uprisings that erupted in the Arab world as 2010 came to an end. He wrote:

The now emerging American occupation has declared its determination to remain on a long-term basis. They also prepare to extend their aggression to Syria in order to control the whole Levant […][58]

In al-Suri’s strategic theory, such a move by the Americans will draw them into an un-winnable conflict where the ‘defenders’ (the putative Islamic resistance) would have tactical as well as strategic advantage. This seems to also be the guiding principle of ISIS. Victory in this asymmetric conflict would lead to:

[…] victory for the Muslims, that [front] will be the centre of an Islamic Emirate, which should be ruled by God’s sharia. It will be a centre and destination for those around it emigrating to fight jihad in the cause of the country.[59]

The extent of ISIS’s intended-Islamic State was mapped in March 2016 by the Financial Times (FT).[60] That map, along with another one drawn up by the Institute for Study of War in July 2016[61] show how remarkably close ISIS’s territory-control/territory-of-influence strategy has been to al-Suri’s geographical prescriptions. At the time of writing this paper, the core ISIS control zone has a filamentary structure which would make it exceedingly difficult to attempt to seize it using ground troops. The control zone is embedded in a support zone that is vast, geographically speaking, and stretches from Fallujah to Mosul (in Iraq), from Mosul to Ayn al-Arab (in Syria), and all the way to Dera on the border of Jordan. Most of the territory controlled by ISIS is also of relatively low-altitude, which makes manoeuvres, and obtaining supplies, relatively easy.

3.4 Organising the ‘Resistance Call’

Al-Suri conceptualises how both the tactical, de-centralised structure of individual jihad and the strategic structure of open-front/territorial jihad mesh in terms of concentric circles. The innermost circle (around the centre who is the putative Caliph) is that of the “centralized unit,” tasked with “guidance, counselling, and calling to jihad,” as well as maintaining military balance in Open-Front areas.[62]Essentially, this is the leadership circle.

The circle of “centralized unit” lies inside the circle of “de-centralized units” of fighters that are permitted to operate like a traditional secret organisation – trained directly, and to be “spread across the world.”[63] Essentially, one may call these the garden-variety ISIS jihadists who travel to Syria or Iraq for training and return to their homelands to carry out attacks when called to do so.

This circle, in turn, is embedded within the final “Da’wah” circle “who participates in the Resistance without any organizational links with the Centre [i.e. Centralized Unit].”[64]This circle has been responsible for most of the recent attacks in the US and Europe. The important point here is that authority radiates outwards from the centre – the Emir or the Caliph – and is managed through the institution of bay’at – the binding allegiance to the figurehead.

Figure 2 depicts al-Suri’s organisational-structure theory. The centralised unit is circle 1, the circle of de-centralised units is 2, and the Da’wah circle is 3, in that figure. Note that the entire structure is governed by the institution of bay’at (depicted by arrow B). Note, also, that as one moves from circles 1 to 3, individuals and units become more geographically dispersed (as depicted by arrow G). While individuals and units in circles 1 and 2 are allowed to communicate with each other and to their adjacent circles (depicted through connecting arrows), such is not the case with the outer circle 3.

How does al-Suri’s organisational structure match the typologies of attackers being advanced in light of the recent terrorist attacks in Europe? Gartenstein-Ross and Barr – in way of debunking the “myth of lone wolf terrorism,” advanced one such typology.[65] In their analysis, there are four kinds of attackers and attacks. In the first kind, attackers are sent by an outfit from abroad to carry out operations. In al-Suri’s jargon, these would be attackers in circle 2. Then there are attackers – in the Gartenstein-Ross and Barr typology – who are in touch with each other virtually, for purposes of coordination. In al-Suri’s structure, these would also be attackers in circle 2 – or between circles 2 and 3. The third category of attackers are ones “who are in contact with a militant group via online communications but do not receive specific instructions about carrying out an attack.” These would be – according to al-Suri – individuals in the Daw’ahcircle 3. Finally, in the Gartenstein-Ross and Barr typology, there are true lone wolves who act completely independently of the ‘parent’ network. This, too would be, according to al-Suri’s theory, individuals in circle 3 – only if they pledge allegiance to the Caliph or the Emir (who is al-Baghdadi, in case of ISIS). The similarity between the Gartenstein-Ross and Barr typology and al-Suri’s theory is remarkable.

Figure 2: A Schematic Description of Al-Suri’s Organisational Theory

4. Al-Suri’s ISIS: The Way Forward

If ISIS indeed operates out of al-Suri’s playbook, what is in store for that organisation?

One would expect to see the frequency of individual jihadistsattack to continue and keep pace, fuelled by self-radicalisation. Al-Suri, as this paper has explained, placed a premium on this tactic. One would also expect ISIS to continue to hold territory even at significant military costs. After all, as al-Suri explains, the whole point of the enterprise of Islamic Resistance is to control territory and establish an Islamic State. Therefore analysts who expect ISIS to completely morph into a de-centralised structure would be well-advised to rethink their assumptions.

Al-Suri had displayed a great interest in weapons of mass destruction (WMDs). A US government assessment of al-Suri puts him as “an expert in the use of poison.”[66] Individual expertise aside, al-Suri is known to have worked quite closely with al-Qaeda’s leading expert on unconventional weapons Abu Khabab al-Masri.[67] Al-Suri himself is said to have written on biological weapons, and has called for the use of WMDs against the US and allies “to reach a strategic decisive outcome.”[68]ISIS has already used chemical weapons in Syria and Iraq, but the real question is whether it would do so outside its own ‘territory’.[69] It is unlikely if most of the attacks outside Syria and Iraq are carried out by individual jihadists in the Daw’ah circle. Therefore the most likely ISIS WMD-use threat lies against American and allied troops in any possible ground invasion.

The most important point with the al-Suri-and-ISIS story is polemical. Blinded by indiscriminate violence, it is easy to conclude that ISIS is a nihilistic group driven by eschatological motives. It is rather more difficult to accept instinctively that there may be a concrete strategic theory behind their actions. But to strive to understand is not the same as to extend empathy. This paper has argued that the foundation of ISIS strategy was provided by one man – Abu Mus’ab al-Suri. Indeed, in order to dissect ISIS strategy, more research is needed about ideologues and theorists like al-Suri – without empathy, for sure, but not without curiosity.

The author thanks the two individuals who served as referees for their useful remarks which helped improve the quality of this paper. He also thanks Ms. Nisha Verma, ORF Librarian, for arranging research material at short notices.

[1] Paul Cruickshank and Mohannad Hage Ali, “Abu Musab Al-Suri: Architect of the New al-Qaeda,” Studies in Conflict & Terrorism, 30 (2007), 5.

[2] Brynjar Lia, Architect of Global Jihad: The Life of al-Qaida Strategist Abu Mus’ab al-Suri(London: Hurst & Company, 2007), 2.

[3] Craig Whitlock, “Architect of New War on the West,” Washington Post, May 23, 2006.

[4] Cruickshank and Hage Ali, “Abu Musab Al-Suri,” 1.

[5] Lawrence Wright, “The Master Plan: For the New Theorists of Jihad, al-Qaeda is Just the Beginning,” New Yorker, September 11, 2006.

[6] Jason Burke, The New Threat From Islamic Militancy (London: The Bodley Head, 2015), 164.

[7] Lia, Architect of Global Jihad, 347-484; “Abu Musab al-Suri’s Military Theory of Jihad,” SITE Intelligence Group, January 15, 2014, https://news.siteintelgroup.com/Articles-Analysis/suri-a-mili.html. This Paper will use the first source as primary material unless noted otherwise.

[8] Kathy Gilsinan, “ISIS: An Organization – and an Idea,” Atlantic, June 26, 2015, http://www.theatlantic.com/international/archive/2015/06/tunisia-kuwait-france-isis/396932/.

[9] Burke, The New Threat From Islamic Militancy, 61.

[10] Burke, The New Threat From Islamic Militancy, 69.

[11] Lia, Architect of Global Jihad, 267.

[12] Lia, Architect of Global Jihad, 268.

[13] Yaseer Okbi and Maariv Hashavua, “ISIS vs. al-Qaida: Zawahiri Says Baghdadi is Not the Leader of the Muslim World,” Jerusalem Post, June 10, 2015, http://www.jpost.com/Middle-East/ISIS-Threat/ISIS-vs-al-Qaida-Zawahiri-says-Baghdadi-is-not-the-leader-of-the-Muslim-world-421090.

[14] Cruickshank and Hage Ali, “Abu Musab Al-Suri,” 2.

[15] Lia, Architect of Global Jihad, 269.

[16] Joas Wagemakers, The Quietest Jihadist: The Ideology and Influence of Abu Muhammad al-Maqdisi (New York: Cambridge University Press, 2012), 177.

[17] Bunzel, From Paper State to Caliphate: The Ideology of the Islamic State, 11.

[18] Michael W.S. Ryan, “Dabiq: What Islamic State’s New Magazine Tells Us about Their Strategic Direction, Recruitment Patterns and Guerrilla Doctrine,” The Jamestown Foundation, August 1, 2014, http://www.jamestown.org/single/?tx_ttnews%5Btt_news%5D=42702&no_cache=1#.V44aCLh97IU.

[19] Cruickshank and Hage Ali, “Abu Musab Al-Suri,” 7.

[20] Burke, The New Threat From Islamic Militancy, 17.

[21] Cruickshank and Hage Ali, “Abu Musab Al Suri,” 3.

[22] Cole Bunzel, From Paper State to Caliphate: The Ideology of the Islamic State, Brookings Project on U.S. Relations with the Islamic World Analysis Paper No. 19 (Washington DC: Brookings Institution, 2015), 7-8.

[23] Bunzel, From Paper State to Caliphate: The Ideology of the Islamic State, 7.

[24] Bunzel, From Paper State to Caliphate: The Ideology of the Islamic State, 9.

[25] Lia, Architect of Global Jihad, 85.

[26] Gilles Kepel, Jihad: The Trail of Political Islam (London: I.B. Tauris, 2002), 28.

[27] Alastair Crooke, Resistance: The Essence of the Islamist Revolution (New York: Pluto Press, 2009), 75.

[28] Sayyid Qutb, Milestones, originally published in 1964, 2005 web edition from majalla.org.

[29] Bruce Riedel, The Search for Al Qaeda: Its Leadership, Ideology and Future (Washington DC: Brookings Institution, 2008), 17.

[30] Kepel, Jihad, 27.

[31] Ibid.

[32] Ibid.

[33] Sarah E. Zabel, The Military Strategy of Global Jihad, Carlisle Papers in Security Strategy (Carlisle PA: Strategic Studies Institute, 2007), 3.

[34]al-Suri, The Military Theory of the Global Islamic Resistance, pages 1355-1404, in Lia, Architect of Global Jihad, 370.

[35] Burke, The New Threat From Islamic Militancy, 164.

[36] Jason Burke, The 9/11 Wars(London: Allen Lane, 2011), 154.

[37] al-Suri, The Military Theory of the Global Islamic Resistance, pages 1355-1404, in Lia, Architect of Global Jihad, 352.

[38]

[39]al-Suri, The Military Theory of the Global Islamic Resistance, pages 1355-1404, in Lia, Architect of Global Jihad, 357.

al-Suri, The Military Theory of the Global Islamic Resistance, pages 1355-1404, in Lia, Architect of Global Jihad, 353.

[40] Cruickshank and Hage Ali, “Abu Musab Al-Suri,” 8.

[41] Ibid.

[42] al-Suri, The Military Theory of the Global Islamic Resistance, pages 1405-1413, in Lia, Architect of Global Jihad, 353.

[43]al-Suri, The Military Theory of the Global Islamic Resistance, pages 1405-1413, in Lia, Architect of Global Jihad, 444-445.

[44] Ibid.

[45]John A. Tures, “The Myth of the Lone-Wolf Terrorist,” Huffington Post, November 14, 2015, http://www.huffingtonpost.in/entry/the-myth-of-the-lone-wolf_b_8563886.

[46] Rukmini Callimachi, “Islamic State Says ‘Soldiers of Caliphate’ Attacked in San Bernardino, New York Times, December 5, 2015, http://www.nytimes.com/2015/12/06/world/middleeast/islamic-state-san-bernardino-massacre.html?_r=0.

Source http://www.orfonline.org/research/the-strategist-how-abu-musab-al-suri-inspired-isis/

What you Need to Know About IDI and Why

Posted on August 5, 2016August 5, 2016 by Denise Simon

This Company Has Built a Profile on Every American Adult

Every move you make. Every click you take. Every game you play. Every place you stay. They’ll be watching you.

David Gauvey Herbert

Bloomberg: Forget telephoto lenses and fake mustaches: The most important tools for America’s 35,000 private investigators are database subscription services. For more than a decade, professional snoops have been able to search troves of public and nonpublic records—known addresses, DMV records, photographs of a person’s car—and condense them into comprehensive reports costing as little as $10. Now they can combine that information with the kinds of things marketers know about you, such as which politicians you donate to, what you spend on groceries, and whether it’s weird that you ate in last night, to create a portrait of your life and predict your behavior.

IDI, a year-old company in the so-called data-fusion business, is the first to centralize and weaponize all that information for its customers. The Boca Raton, Fla., company’s database service, idiCORE, combines public records with purchasing, demographic, and behavioral data. Chief Executive Officer Derek Dubner says the system isn’t waiting for requests from clients—it’s already built a profile on every American adult, including young people who wouldn’t be swept up in conventional databases, which only index transactions. “We have data on that 21-year-old who’s living at home with mom and dad,” he says.

Dubner declined to provide a demo of idiCORE or furnish the company’s report on me. But he says these personal profiles include all known addresses, phone numbers, and e-mail addresses; every piece of property ever bought or sold, plus related mortgages; past and present vehicles owned; criminal citations, from speeding tickets on up; voter registration; hunting permits; and names and phone numbers of neighbors. The reports also include photos of cars taken by private companies using automated license plate readers—billions of snapshots tagged with GPS coordinates and time stamps to help PIs surveil people or bust alibis.

IDI also runs two coupon websites, allamericansavings.com and samplesandsavings.com, that collect purchasing and behavioral data. When I signed up for the latter, I was asked for my e-mail address, birthday, and home address, information that could easily link me with my idiCORE profile. The site also asked if I suffered from arthritis, asthma, diabetes, or depression, ostensibly to help tailor its discounts.

Users and industry analysts say the addition of purchasing and behavioral data to conventional data fusion outmatches rival systems in terms of capabilities—and creepiness. “The cloud never forgets, and imperfect pictures of you composed from your data profile are carefully filled in over time,” says Roger Kay, president of Endpoint Technologies Associates, a consulting firm. “We’re like bugs in amber, completely trapped in the web of our own data.”

When logging in to IDI and similar databases, a PI must select a permissible use for a search under U.S. privacy laws. The Federal Trade Commission oversees the industry, but PI companies are largely expected to police themselves, because a midsize outfit may run thousands of searches a month.

Dubner says most Americans have little to fear. As examples, he cites idiCORE uses such as locating a missing person and nabbing a fraud or terrorism suspect.

IDI, like much of the data-fusion industry, traces its lineage to Hank Asher, a former cocaine smuggler and self-taught programmer who began fusing sets of public data from state and federal governments in the early 1990s. After Sept. 11, law enforcement’s interest in commercial databases grew, and more money and data began raining down, says Julia Angwin, a reporter who wrote about the industry in her 2014 book, Dragnet Nation.

Asher died suddenly in 2013, leaving behind his company, the Last One (TLO), which credit bureau TransUnion bought in bankruptcy for $154 million. Asher’s disciples, including Dubner, left TLO and eventually teamed up with Michael Brauser, a former business partner of Asher’s, and billionaire health-care investor Phillip Frost. In May 2015, after a flurry of purchases and mergers, the group rebranded its database venture as IDI.

Besides pitching its databases to big-name PIs (Kroll, Control Risks), law firms, debt collectors, and government agencies, IDI says it’s also targeting consumer marketers. The 200-employee company had revenue of about $40 million in its most recent quarter and says 2,800 users signed up for idiCORE in the first month after its May release. It declined to provide more recent figures. The company’s data sets are growing, too. In December, Frost helped underwrite IDI’s $100 million acquisition of marketing profiler Fluent, which says it has 120 million profiles of U.S. consumers. In June, IDI bought ad platform Q Interactive for a reported $21 million in stock.

IDI may need Frost’s deep pockets for a while. The PI industry’s three favorite databases are owned by TransUnion and media giants Reed Elsevier and Thomson Reuters. “There’s no shortage,” says Chuck McLaughlin, chairman of the board of the World Association of Detectives, which has about 1,000 members. “The longer you’re in business, the more data you have, the better results.” He uses TLO and Tracers Information Specialists.

Steve Rambam, a PI who hosts Nowhere to Hide on the Investigation Discovery channel, says marketing data remains a niche monitoring tool compared with social media, but its power can be unparalleled. “You may not know what you do on a regular basis, but I know,” Rambam says. “I know it’s Thursday, you haven’t eaten Chinese food in two weeks, and I know you’re due.”

Wait…there is another problem you don’t know about.

Comcast Lobbies To Charge Customers More To Protect Their Online Privacy

Internet providers are still hashing out issues with the FCC. In particular, Comcast is currently defend its “pay-for-privacy” model to the FCC [PDF]. Comcast has even contended that “the FCC has no authority to prohibit or limit these types of programs.”

So what exactly is the “pay-for-privacy” system? Essentially, companies like Comcast offers discounts to customers in exchange for allowing ISP’s to use their data. Comcast then floods these customers with various behaviorally-targeted ads. Customers who prefer privacy over pricing are charged a premium.

image: http://hothardware.com/ContentImages/NewsItem/38236/content/small_comcast_office.jpg

Several weeks ago a number of lawmakers urged the FCC to ban the “pay-for-privacy” system. They argued that this pricing pyramid is particularly harmful to elderly customers who do not necessarily understand how ISP’s work and low-income customers who cannot afford to pay the privacy premium. Members of Congress noted that Comcast’s policies are “counter to our nation’s core principle that all Americans have a fundamental right to privacy.”

Comcast argued that the “pay-for-privacy” model actually benefits elderly and low-income customers. They insisted that its “prohibition would harm consumers by, among other things, depriving them of lower-priced offerings.” They noted that this system is commonly used throughout the United States economy.

image: http://hothardware.com/ContentImages/NewsItem/38236/content/small_fcc.jpg

Comcast also argued that its ensures “through contractual provisions that vendors who handle customer-related data have strong measures in place to protect that customer-related data, and that the vendors are prohibited from using that data for any purposes other than as directed by Comcast.”

The company concurs that opt-in agreements should be required when dealing with sensitive information. This kind of information would include financial, health, and children’s information, Social Security numbers, and precise geo-location information. All other information, however, would be subject to opt-out or, in most instances, “implied” consent. The FCC is currently considering privacy rules that would require broadband providers to obtain consumers’ opt-in consent regardless of whether the information was sensitive or not. Hat tip to HotHardware

Edward Snowden has Gone Hollywood

Posted on August 5, 2016August 5, 2016 by Denise Simon

The U.S. v. Edward Snowden criminal complaint is under seal but the cover is here.

New Snowden Movie Depicts Traitor as Hero; Profiting from His Treason May Violate Law

JudicialWatch: The upcoming Hollywood movie about traitor Edward Snowden—criminally charged by the U.S. government under the Espionage Act—portrays the National Security Agency (NSA) subcontractor who leaked top secret information as a courageous patriot. Nothing surprising there considering the film’s Academy award-winning director, Oliver Stone, referred to Snowden as a “hero”back in 2013 when he fled to Moscow to avoid prosecution after betraying his country. Snowden’s illegal disclosures have helped terrorist groups like Al Qaeda and led to the death of innocent people. Last year Snowden began openly engaging with ISIS and Al Qaeda members and supporters via social media.

Buzzfeed

“Snowden has done incalculable damage to the NSA and, in the process, to American national security,” according to University of Virginia Law School Professor Robert F. Turner, who specializes in national security issues and served as Counsel to the President’s Intelligence Oversight Board at the White House. “Officials in position to know said good people have already lost their lives thanks to Snowden. Countless more are likely to lose theirs now that our enemies know our most closely guarded sources and methods of communications intelligence collection.” Turner adds that Snowden is hailed as a hero and “whistleblower” by those who are clueless to the devastation he’s done. “When all of the smoke clears, it may very well be proven that Snowden is the most injurious traitor in American history.”

This would make it illegal to profit from his crimes and the Department of Justice (DOJ) should confiscate all money made by the violators. Snowden is no whistleblower. In fact he violated his secrecy agreement, which means he and his conspirators can’t materially profit from his fugitive status, violation of law, aiding and abetting of a crime and providing material support to terrorism. It’s bad enough that people are profiting from Snowden’s treason, but adding salt to the wound, the Obama administration is doing nothing about it. Judicial Watch has launched an investigation and is using the Freedom of Information Act (FOIA) to obtain records. True whistleblowers and law-abiding intelligence officers such as Lt. Colonel Anthony Shaffer, FBI Special Agent Robert G. Wright and Valerie Plame got release authority in accordance with their secrecy agreement and did not seek money or flee to Russia. A federal appellate court has ruled that government employees, such as Snowden, who signed privacy agreements can’t profit from disclosing information without first obtaining agency approval. The case involved a CIA agent (Frank Snepp) who violated his agreement with the agency by publishing a book. A federal court denied Snepp royalties from his book and an appellate court upheld the ruling, reiterating that the disgraced agent breached the “constructive trust” between him and the government.

Furthermore, Snowden, Stone and the producers of a 2014 Oscar-winning Snowden film titled “Citizenfour” may be in violation of the Anti-Terrorism Act (ATA), which forbids providing material support or resources for acts of international terrorism. Many deep-pocketed institutions have been sued under the law for providing terrorist organizations or affiliates resources that assisted in the commission of terrorist acts. Just last month the families of victims killed and injured by Hamas filed a $1 billion lawsuit against Facebook under ATA for providing the terrorist group with material support by letting it use its services to help carry out attacks. A number of banks have also been sued under the law for financing terrorist activities, albeit unknowingly.

Both Stone and “Citizenfour” director Laura Poitras had clandestine meetings abroad with Snowden. Stone told a Hollywood trade publication he met Snowden in Russia and that he moved production overseas because filming in the U.S. was too risky. “We didn’t know what the NSA might do, so we ended up in Munich, which was a beautiful experience,” Stone said. Poitras actually collaborated with Snowden’s defection to China then Russia and had email communication with him before he committed his crimes so she had foreknowledge. This is all included in her documentary. On May 20, 2013 Snowden flew to Hong Kong to meet with British journalists and Poitras. He gave them thousands of classified documents and Poitras became known as the woman who helped Snowden spill his secrets, or rather commit treason. When Citizenfour won the 2015 Academy Award, Poitras was joined by Snowden’s girlfriend during her acceptance speech at the Dolby Theater in Hollywood, California. “The disclosures that Edward Snowden revealed don’t only expose a threat to our privacy but to our democracy itself,” Poitras said in her acceptance speech. “Thank you to Edward Snowden for his courage and for the many other whistleblowers.”

Snowden remains a fugitive from U.S. law protected by Russia. On June 14, 2013, federal prosecutors charged him with “theft of government Property,” “unauthorized communication of national defense information” and “willful communication of classified communications intelligence information to an unauthorized person.” Al Qaeda keeps using information leaked by Snowden to help its fighters evade surveillance technology, according to a British newspaper report. “The terrorist group has issued new video guidance based on what they have learnt about Western spying methods from the Snowden disclosures which have been made public on the internet,” the article states. “The move confirms the worst fears of British and American intelligence chiefs who warned that Snowden’s betrayal would play into the hands of the terrorists. The video even uses footage of news reports of the Snowden leak, highlighting how ‘NSA is tracking millions of phones.’”

New Color-coded Cyber Threats

Posted on August 4, 2016August 4, 2016 by Denise Simon

Remember when the Democrats and lobby groups ridiculed George W. Bush for using a color coded threat matrix? Carry on….

The White House now has a color-coded scale for cyber-security threat

TheVerge: As the Obama administration nears its final months, the White House has released a framework for handling cyberattacks. The Presidential Policy Directive on United States Cyber Incident Coordination builds on the action plan that Obama laid out earlier this year, and it’s intended to create a clear standard of when and how government agencies will handle incidents. It also comes with a new threat level scale, assigning specific colors and response levels to the danger of a hack.

The cyberattack severity scale is somewhat vague, but it’s supposed to make sure that the agencies involved in cybersecurity — the Department of Justice, Department of Homeland Security, and Office of the Director of National Intelligence — respond to threats with the same level of urgency and investment. A Level One incident is “unlikely to impact public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence,” while a red Level Four one is “likely to result in a significant impact to public health or safety, national security, economic security, foreign relations, or civil liberties.” One final designation — Level Five, or black — covers anything that “poses an imminent threat to the provision of wide-scale critical infrastructure services, national government stability, or to the lives of US persons.”

The upshot of this is that anything at Level Three or above will trigger a coordination effort to address the threat. In addition to the groups above, this effort will include the company, organization, or agency that was attacked.

Cybersecurity is a growing concern, and both Congress and the White House have spent the past several years pushing various frameworks for shoring it up. This includes a series of hotly debated bills that culminated in the Cyber Information Sharing Act, which has raised privacy questions as it’s been put into practice. At the same time, high-profile hacks have led to serious consequences for companies like Sony Pictures, Target, and Ashley Madison. Most recently, an unknown hacker or hackers — potentially linked to Russia — breached the Democratic National Committee’s servers, releasing large numbers of embarrassing documents and emails. This announcement doesn’t tell us exactly how the federal government will handle future cyberattacks, but along with everything else, it does signal that they’re becoming a more and more standard part of the security equation.

*****

From the White House FACT SHEET: Presidential Policy Directive

The PPD builds on these lessons and institutionalizes our cyber incident coordination efforts in numerous respects, including:

Establishing clear principles that will govern the Federal government’s activities in cyber incident response;

Differentiating between significant cyber incidents and steady-state incidents and applying the PPD’s guidance primarily to significant incidents;

Categorizing the government’s activities into specific lines of effort and designating a lead agency for each line of effort in the event of a significant cyber incident;

Creating mechanisms to coordinate the Federal government’s response to significant cyber incidents, including a Cyber Unified Coordination Group similar in concept to what is used for incidents with physical effects, and enhanced coordination procedures within individual agencies;

Applying these policies and procedures to incidents where a Federal department or agency is the victim; and,

Ensuring that our cyber response activities are consistent and integrated with broader national preparedness and incident response policies, such as those implemented through Presidential Policy Directive 8-National Preparedness, so that our response to a cyber incident can seamlessly integrate with actions taken to address physical consequences caused by malicious cyber activity.

We also are releasing today a cyber incident severity schema that establishes a common framework within the Federal government for evaluating and assessing the severity of cyber incidents and will help identify significant cyber incidents to which the PPD’s coordination procedures would apply.

Incident Response Principles

The PPD outlines five principles that will guide the Federal government during any cyber incident response:

Shared Responsibility – Individuals, the private sector, and government agencies have a shared vital interest and complementary roles and responsibilities in protecting the Nation from malicious cyber activity and managing cyber incidents and their consequences.

Risk-Based Response – The Federal government will determine its response actions and resource needs based on an assessment of the risks posed to an entity, national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.

Respecting Affected Entities – Federal government responders will safeguard details of the incident, as well as privacy and civil liberties, and sensitive private sector information.

Unity of Effort – Whichever Federal agency first becomes aware of a cyber incident will rapidly notify other relevant Federal agencies in order to facilitate a unified Federal response and ensure that the right combination of agencies responds to a particular incident.

Enabling Restoration and Recovery – Federal response activities will be conducted in a manner to facilitate restoration and recovery of an entity that has experienced a cyber incident, balancing investigative and national security requirements with the need to return to normal operations as quickly as possible.

Significant Cyber Incidents

While the Federal government will adhere to the five principles in responding to any cyber incident, the PPD’s policies and procedures are aimed at a particular class of cyber incident: significant cyber incidents. A significant cyber incident is one that either singularly or as part of a group of related incidents is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.

When a cyber incident occurs, determining its potential severity is critical to ensuring the incident receives the appropriate level of attention. No two incidents are the same and, particularly at the initial stages, important information, including the nature of the perpetrator, may be unknown.

Therefore, as part of the process of developing the incident response policy, the Administration also developed a common schema for describing the severity of cyber incidents, which can include credible reporting of a cyber threat, observed malicious cyber activity, or both. The schema establishes a common framework for evaluating and assessing cyber incidents to ensure that all Federal departments and agencies have a common view of the severity of a given incident, the consequent urgency of response efforts, and the need for escalation to senior levels.

The schema describes a cyber incident’s severity from a national perspective, defining six levels, zero through five, in ascending order of severity. Each level describes the incident’s potential to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence. An incident that ranks at a level 3 or above on this schema is considered “significant” and will trigger application of the PPD’s coordination mechanisms.

Lines of Effort and Lead Agencies

To establish accountability and enhance clarity, the PPD organizes Federal response activities into three lines of effort and establishes a Federal lead agency for each:

Threat response activities include the law enforcement and national security investigation of a cyber incident, including collecting evidence, linking related incidents, gathering intelligence, identifying opportunities for threat pursuit and disruption, and providing attribution.   The Department of Justice, acting through the Federal Bureau of Investigation (FBI) and the National Cyber Investigative Joint Task Force (NCIJTF), will be the Federal lead agency for threat response activities.

Asset response activities include providing technical assets and assistance to mitigate vulnerabilities and reducing the impact of the incident, identifying and assessing the risk posed to other entities and mitigating those risks, and providing guidance on how to leverage Federal resources and capabilities.   The Department of Homeland Security (DHS), acting through the National Cybersecurity and Communications Integration Center (NCCIC), will be the Federal lead agency for asset response activities. The PPD directs DHS to coordinate closely with the relevant Sector-Specific Agency, which will depend on what kind of organization is affected by the incident.

Intelligence Support and related activities include intelligence collection in support of investigative activities, and integrated analysis of threat trends and events to build situational awareness and to identify knowledge gaps, as well as the ability to degrade or mitigate adversary threat capabilities. The Office of the Director of National Intelligence, through the Cyber Threat Intelligence Integration Center, will be the Federal lead agency for intelligence support and related activities.

In addition to these lines of effort, a victim will undertake a wide variety of response activities in order to maintain business or operational continuity in the event of a cyber incident. We recognize that for the victim, these activities may well be the most important. Such efforts can include communications with customers and the workforce; engagement with stakeholders, regulators, or oversight bodies; and recovery and reconstitution efforts.   When a Federal agency is a victim of a significant cyber incident, that agency will be the lead for this fourth line of effort. In the case of a private victim, the Federal government typically will not play a role in this line of effort, but will remain cognizant of the victim’s response activities consistent with these principles and coordinate with the victim.

Coordination Architecture

In order to facilitate the more coordinated, integrated response demanded by significant cyber incidents, the PPD establishes a three-tiered coordination architecture for handling those incidents:

National Policy Level: The PPD institutionalizes the National Security Council-chaired interagency Cyber Response Group (CRG). The CRG will coordinate the development and implementation of United States Government policy and strategy with respect to significant cyber incidents affecting the United States or its interests abroad.

National Operational Level: The PPD directs agencies to take two actions at the national operational level in the event of a significant cyber incident.

Activate enhanced internal coordination procedures. The PPD instructs agencies that regularly participate in the Cyber Response Group to develop these procedures to ensure that they can surge effectively when confronted with an incident that exceeds their day-to-day operational capacity.

Create a Unified Coordination Group. In the event of a significant cyber incident, the PPD provides that the lead agencies for each line of effort, along with relevant Sector-Specific Agencies (SSAs), state, local, tribal and territorial governments, international counterparts, and private sector entities, will form a Cyber Unified Coordination Group (UCG) to coordinate response activities. The Cyber UCG shall coordinate the development, prioritization, and execution of cyber response efforts, facilitate rapid information sharing among UCG members, and coordinate communications with stakeholders, including the victim entity.

Field Level: The PPD directs the lead agencies for each line of effort to coordinate their interaction with each other and with the affected entity.

Integration with Existing Response Policy

The PPD also integrates U.S. cyber incident coordination policy with key aspects of existing Federal preparedness policy to ensure that the Nation will be ready to manage incidents that include both cyber and physical effects, such as a significant power outage resulting from malicious cyber activity. The PPD will be implemented by the Federal government consistent with existing preparedness and response efforts.

Implementation tasks

The PPD also directs several follow-on tasks in order to ensure its full implementation. In particular, it requires that the Administration develop and finalize the National Cyber Incident Response Plan – in coordination with State, Local, Territorial, and Tribal governments, the private sector, and the public – to further detail how the government will manage cyber incidents affecting critical infrastructure. It also directs DHS and DOJ to develop a concept of operations for how a Cyber UCG will operate and for the NSC to update the charter for the CRG.

Passionatepolka, TreasureMap and FLATLIQUID?

Posted on August 4, 2016August 4, 2016 by Denise Simon

I read one of his books several years ago….

The summary below is not classified material. The Intelligence Community including the NSA has declassified a lot of material such as:

Chinese Cyber Espionage in the U.S.

August 10, 2015

China Read Emails of Top U.S. Officials – NBC News

Commentary: The world’s best cyber army doesn’t belong to Russia

by: Bamford

Reuters: National attention is focused on Russian eavesdroppers’ possible targeting of U.S. presidential candidates and the Democratic Congressional Campaign Committee. Yet, leaked top-secret National Security Agency documents show that the Obama administration has long been involved in major bugging operations against the election campaigns — and the presidents — of even its closest allies.

The United States is, by far, the world’s most aggressive nation when it comes to cyberspying and cyberwarfare. The National Security Agency has been eavesdropping on foreign cities, politicians, elections and entire countries since it first turned on its receivers in 1952. Just as other countries, including Russia, attempt to do to the United States. What is new is a country leaking the intercepts back to the public of the target nation through a middleperson.

There is a strange irony in this. Russia, if it is actually involved in the hacking of the computers of the Democratic National Committee, could be attempting to influence a U.S. election by leaking to the American public the falsehoods of its leaders. This is a tactic Washington used against the Soviet Union and other countries during the Cold War.

In the 1950s, for example, President Harry S Truman created the Campaign of Truth to reveal to the Russian people the “Big Lies” of their government. Washington had often discovered these lies through eavesdropping and other espionage.

Today, the United States has morphed from a Cold War, and in some cases a hot war, into a cyberwar, with computer coding replacing bullets and bombs. Yet the American public manages to be “shocked, shocked” that a foreign country would attempt to conduct cyberespionage on the United States.

NSA operations have, for example, recently delved into elections in Mexico, targeting its last presidential campaign. According to a top-secret PowerPoint presentation leaked by former NSA contract employee Edward Snowden, the operation involved a “surge effort against one of Mexico’s leading presidential candidates, Enrique Peña Nieto, and nine of his close associates.” Peña won that election and is now Mexico’s president.

The NSA identified Peña’s cellphone and those of his associates using advanced software that can filter out specific phones from the swarm around the candidate. These lines were then targeted. The technology, one NSA analyst noted, “might find a needle in a haystack.” The analyst described it as “a repeatable and efficient” process.

The eavesdroppers also succeeded in intercepting 85,489 text messages, a Der Spiegel article noted.

Another NSA operation, begun in May 2010 and codenamed FLATLIQUID, targeted Pena’s predecessor, President Felipe Calderon. The NSA, the documents revealed, was able “to gain first-ever access to President Felipe Calderon’s public email account.”

At the same time, members of a highly secret joint NSA/CIA organization, called the Special Collection Service, are based in the U.S. embassy in Mexico City and other U.S. embassies around the world. It targets local government communications, as well as foreign embassies nearby. For Mexico, additional eavesdropping, and much of the analysis, is conducted by NSA Texas, a large listening post in San Antonio that focuses on the Caribbean, Central America and South America.

Unlike the Defense Department’s Pentagon, the headquarters of the cyberspies fills an entire secret city. Located in Fort Meade, Maryland, halfway between Washington and Baltimore, Maryland, NSA’s headquarters consists of scores of heavily guarded buildings. The site even boasts its own police force and post office.

And it is about to grow considerably bigger, now that the NSA cyberspies have merged with the cyberwarriors of U.S. Cyber Command, which controls its own Cyber Army, Cyber Navy, Cyber Air Force and Cyber Marine Corps, all armed with state-of-the-art cyberweapons. In charge of it all is a four-star admiral, Michael S. Rogers.

Now under construction inside NSA’s secret city, Cyber Command’s new $3.2- billion headquarters is to include 14 buildings, 11 parking garages and an enormous cyberbrain — a 600,000-square-foot, $896.5-million supercomputer facility that will eat up an enormous amount of power, about 60 megawatts. This is enough electricity to power a city of more than 40,000 homes.

In 2014, for a cover story in Wired and a PBS documentary, I spent three days in Moscow with Snowden, whose last NSA job was as a contract cyberwarrior. I was also granted rare access to his archive of documents. “Cyber Command itself has always been branded in a sort of misleading way from its very inception,” Snowden told me. “It’s an attack agency. … It’s all about computer-network attack and computer-network exploitation at Cyber Command.”

The idea is to turn the Internet from a worldwide web of information into a global battlefield for war. “The next major conflict will start in cyberspace,” says one of the secret NSA documents. One key phrase within Cyber Command documents is “Information Dominance.”

The Cyber Navy, for example, calls itself the Information Dominance Corps. The Cyber Army is providing frontline troops with the option of requesting “cyberfire support” from Cyber Command, in much the same way it requests air and artillery support. And the Cyber Air Force is pledged to “dominate cyberspace” just as “today we dominate air and space.”

Among the tools at their disposal is one called Passionatepolka, designed to “remotely brick network cards.” “Bricking” a computer means destroying it – turning it into a brick.

One such situation took place in war-torn Syria in 2012, according to Snowden, when the NSA attempted to remotely and secretly install an “exploit,” or bug, into the computer system of a major Internet provider. This was expected to provide access to email and other Internet traffic across much of Syria. But something went wrong. Instead, the computers were bricked. It took down the Internet across the country for a period of time.

While Cyber Command executes attacks, the National Security Agency seems more interested in tracking virtually everyone connected to the Internet, according to the documents.

One top-secret operation, code-named TreasureMap, is designed to have a “capability for building a near real-time interactive map of the global Internet. … Any device, anywhere, all the time.” Another operation, codenamed Turbine, involves secretly placing “millions of implants” — malware — in computer systems worldwide for either spying or cyberattacks.

Yet, even as the U.S. government continues building robust eavesdropping and attack systems, it looks like there has been far less focus on security at home. One benefit of the cyber-theft of the Democratic National Committee emails might be that it helps open a public dialogue about the dangerous potential of cyberwarfare. This is long overdue. The possible security problems for the U.S. presidential election in November are already being discussed.

Yet there can never be a useful discussion on the topic if the Obama administration continues to point fingers at other countries without admitting that Washington is engaged heavily in cyberspying and cyberwarfare.

In fact, the United States is the only country ever to launch an actual cyberwar — when the Obama administration used a cyberattack to destroy thousands of centrifuges, used for nuclear enrichment, in Iran. This was an illegal act of war, according to the Defense Department’s own definition.

Given the news reports that many more DNC emails are waiting to be leaked as the presidential election draws closer, there will likely be many more reminders of the need for a public dialogue on cybersecurity and cyberwarfare before November.

(James Bamford is the author of The Shadow Factory: The Ultra-Secret NSA From 9/11 to the Eavesdropping on America. He is a columnist for Foreign Policy magazine.)