Operation Hemorrhage

It has been said often, either fight the enemy in a true war theater on the battlefield with real war tactics or fight them at home. Brussels and Paris and in the United States in Boston and San Bernardino to mention a few, the hybrid war gets real expensive. These costs are rarely measured or questioned. We are also not measuring the cost of freedoms are giving up. Add in the cost of the cyber war…..well….going back much earlier than 9-11-01 the costs cannot be calculated.

Operation Hemorrhage: The Terror Plans to Wreck the West’s Economy

DailyBeast: Every European who flies frequently knows the airport in Zaventem, has spent time in the ticketing area that was strewn with blood, limbs, broken glass, battered luggage and other wreckage.

It was another attack on aviation that pulled the United States into the conflict sometimes known as the “global war on terror” in the first place. Since then, airports and airplanes have remained a constant target for Islamic militants, with travelers being encumbered by new batches of security measures after each new attack or attempt.

After the ex-con Richard Reid managed to sneak a bomb aboard a transatlantic flight in December 2001, but failed to detonate the explosives, American passengers were forced to start removing their shoes on their way through security. After British authorities foiled a 2006 plot in which terrorists planned to bring liquid explosives hidden in sport drink bottles aboard multiple transatlantic flights, authorities strictly limited the quantity of liquids passengers were allowed to carry. When Umar Farouk Abdulmutallab snuck explosives hidden in his underwear onto a flight on Christmas Day 2009, he ushered in full-body scans and intrusive pat-downs.

Those are the misses. There have been hits, too. In August 2004, two female Chechen suicide bombers, so-called “black widows,” destroyed two domestic Russian flights. In January 2011, a suicide bomber struck Moscow’s Domodedovo airport in an attack that looked almost identical to the one that rocked the airport in Brussels: the bomber struck just outside the security cordon, where the airport is transformed from a “soft” target to a “hard” one. Just months ago, the self-proclaimed Islamic State (ISIS)—the perpetrator of the Brussels attacks—destroyed a Russian passenger jet flying out of Egypt’s Sinai, killing 224 people.

The targeting of airports and airplanes has been so frequent that in lighter times—back when the terrorists seemed so much worse at what they do—some pundits openly mocked their continuing return to airplanes and airports. In one representative discussion from early 2010, a well-known commentator described jihadists as having a “sort of schoolboy fixation” with aviation.

But the reason for this targeting, of course, is neither mysterious nor quixotic, and it’s one the jihadists have explained for themselves. Following the November Paris attacks, ISIS released an infographic boasting that its slaughter on the streets of Paris would force Belgium “to strengthen its security measures … which will cost them tens of millions of dollars.” Moreover, the group claimed, “the intensified security measures and the general state of unease will cost Europe in general and France in specific tends of billions of dollars due to the resulting decrease in tourism, delayed flights, and restrictions on freedom of movement and travel between European countries.”

And that was before the group successfully attacked the Brussels airport, despite those costly new security measures.

Even before 9/11, jihadists saw bleeding the American economy as the surest path to defeating their “far enemy.” When Osama bin Laden declared war against the “Jews and crusaders” in 1996, he emphasized that jihadist strikes should be coupled with an economic boycott by Saudi women. Otherwise, the Muslims would be sending their enemy money, “which is the foundation of wars and armies.”

Indeed, when bin Laden first had the opportunity to publicly explain what the 9/11 attacks had accomplished, in an October 2001 interview with Al Jazeera journalist Taysir Allouni, he emphasized the costs that the attacks imposed on the United States. “According to their own admissions, the share of the losses on the Wall Street market reached 16 percent,” he said. “The gross amount that is traded in that market reaches $4 trillion. So if we multiply 16 percent with $4 trillion to find out the loss that affected the stocks, it reaches $640 billion of losses.” He told Allouni that the economic effect was even greater due to building and construction losses and missed work, so that the damage inflicted was “no less than $1 trillion by the lowest estimate.”

In his October 2004 address to the American people, dramatically delivered just before that year’s elections, bin Laden noted that the 9/11 attacks cost Al Qaeda only a fraction of the damage inflicted upon the United States. “Al Qaeda spent $500,000 on the event,” he said, “while America in the incident and its aftermath lost—according to the lowest estimates—more than $500 billion, meaning that every dollar of Al Qaeda defeated a million dollars.”

Al Qaeda fit the wars the United States had become embroiled in after 9/11 into its economic schema. In that same video, bin Laden explained how his movement sought to suck the United States and its allies into draining wars in the Muslim world. The mujahedin “bled Russia for ten years, until it went bankrupt,” bin Laden said, and they would now do the same to the United States.

Just prior to 2011, there was a brief period when jihadism appeared to be in decline. Al Qaeda in Iraq, the group that later became ISIS, had all but met with defeat at the hands of the United States and local Sunni uprisings. Successful attacks were few and far between.

People gather at a memorial for victims of attacks in Brussels on Wednesday, March 23, 2016. Belgian authorities were searching Wednesday for a top suspect in the country's deadliest attacks in decades, as the European Union's capital awoke under guard and with limited public transport after scores were killed and injured in bombings on the Brussels airport and a subway station. (AP Photo/Valentin Bianchi)

Valentin Bianchi/AP

Representative of those dark times for jihadists, Al Qaeda in the Arabian Peninsula released a special issue of its online magazine Inspire celebrating a terrorist attack that claimed no victims. In October 2010, jihadists were able to sneak bombs hidden in printer cartridges onto two cargo planes. Due to strong intelligence efforts, authorities disabled both bombs before they were set to explode, but the group drew satisfaction from merely getting them aboard the planes.

“Two Nokia phones, $150 each, two HP printers, $300 each, plus shipping, transportation and other miscellaneous expenses add up to a total bill of $4,200. That is all what Operation Hemorrhage cost us,” the lead article in that special issue of Inspire boasted. “On the other hand this supposedly ‘foiled plot’, as some of our enemies would like to call [it], will without a doubt cost America and other Western countries billions of dollars in new security measures.” The magazine warned that future attacks will be “smaller, but more frequent”—an approach that “some may refer to as the strategy of a thousand cuts.”

The radical cleric Anwar Al Awlaki, writing in Inspire, explained the dilemma that he saw gripping Al Qaeda’s foes. “You either spend billions of dollars to inspect each and every package in the world,” he wrote, “or you do nothing and we keep trying again.”

Even in those days when the terrorist threat loomed so much smaller, the point was not a bad one. Security is expensive, and driving up costs is one way jihadists aim to wear down Western economies.

Unfortunately, Al Qaeda’s envisioned world of smaller but more frequent attacks proved unnecessary for the jihadists. Less than two months after the special issue of Inspire appeared that celebrated an at best half-successful attack, the revolutionary events that we then knew as the “Arab Spring” sent shockwaves through the Middle East and North Africa.

This instability would help jihadism reach the current heights to which it has ascended, where the attacks are not only more frequent but larger. Unfortunately, the United States—blinded at the time by the misguided belief that revolutions in the Arab world would devastate the jihadist movement—pursued policies that hastened the region’s instability. The damages wrought by these policies are still not fully appreciated.

The silver lining to the jihadist economic strategy is that they, too, are economically vulnerable. The damage inflicted on ISIS’s “state” by coalition bombings and other pressures forced the group to slice its fighters’ salaries at the beginning of this year. But as Al Qaeda watches its flashier jihadist rival carry out gruesome attacks on Western targets and get bombarded in return, it discerns further proof of the wisdom of its strategy of attrition.

As it watches these two sets of foes exhaust each other, Al Qaeda believes that its comparative patience will pay off. It believes that its own time will come.

 

U.S. Govt Cyber Attacks in 2015 Spike

In his annual budget request, President Barack Obama asked for $19bn for cyber security funding, $5bn more than last year.

Last year, a study from Juniper Research, ‘The Future of Cybercrime & Security: Financial and Corporate Threats and Mitigation’, estimated that by 2019 the cost of data breaches will reach $2.1 trillion – four times the total expected for 2015. The average cost of a data breach is expected to exceed $150 million by 2020 as more business infrastructure is connected.

Number of U.S. government ‘cyber incidents’ jumps in 2015

Reuters: The U.S. government was hit by more than 77,000 “cyber incidents” like data thefts or other security breaches in fiscal year 2015, a 10 percent increase over the previous year, according to a White House audit.

Part of the uptick stems from federal agencies improving their ability to identify and detect incidents, the annual performance review from the Office and Management and Budget said.

The report, released on Friday, defines cyber incidents broadly as “a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard computer security practices.” Only a small number of the incidents would be considered as significant data breaches.

National security and intelligence officials have long warned that cyber attacks are among the most serious threats facing the United States. President Barack Obama asked Congress last month for $19 billion for cyber security funding across the government in his annual budget request, an increase of $5 billion over the previous year.

The government’s Office of Personnel Management was victim of a massive hack that began in 2014 and was detected last year. Some 22 million current and former federal employees and contractors in addition to family members had their Social Security numbers, birthdays, addresses and other personal data pilfered in the breach.

That event prompted the government to launch a 30-day “cyber security sprint” to boost cyber security within each federal agency by encouraging adoption of multiple-factor authentication and addressing other vulnerabilities.

“Despite unprecedented improvements in securing federal information resources … malicious actors continue to gain unauthorized access to, and compromise, federal networks, information systems, and data,” the report said.

***** Depth of hacking illustration:

U.S. Charges 3 As It Chases Syrian Electronic Army — $100,000 Bounties On Hackers’ Heads

Firas Dardar Syrian Electronic Army FBI Most Wanted

Firas Dardar, now on the FBI’s Cyber Most Wanted list for his part in the Syrian Electronic Army. He is also accused of extorting targets.

Forbes: Syrian Electronic Army has caused all sorts of trouble since its emergence at the turn of this decade (including an attack on FORBES, amongst many other major publications). Having largely operated under the radar, the U.S. today filed official charges against three individuals it believes were key in perpetrating SEA’s attacks. Two of the three men – Ahmad Umar Agha (commonly known as Th3 Pr0) and Firas Dardar (also known as The Shadow) – have also been placed on the FBI’s Cyber Most Wanted list with $100,000 rewards on offer for anyone who helps catch them. The third suspect is German-based Peter Romar.

The three have been charged with a range of offences, from hacking, to engaging in a hoax regarding a terrorist attack, to attempting to cause a mutiny within the U.S. armed forces. Throughout the last five years, the SEA were proficient in tricking organization – often media bodies such as the BBC, the Guardian, CNN and FORBES – into handing over login details to Facebook FB +0.38% and Twitter TWTR -0.18% accounts. They would then use that access to send out messages in support of Bashar al-Assad, who remains the Syrian president, despite the chaos of civil war that has engulfed the country.

Its most effective attack came after a compromise of the Associated Press Twitter account. After a tweet that claimed a bomb had exploded at the White House and injured President Obama, $90 billion was wiped off the U.S. stock market. In other successful campaign, the hackers defaced a recruiting website for the U.S. Marine Corps, using the site to urge marines to “refuse [their] orders.”

Ahmed Al charged Syrian Electronic Army hacker

Accused Syrian Electronic Army hacker Ahmad Umar Agha.

According to one of two complaints released today, other victims included Harvard University, the Washington Post, the White House, Reuters, Human Rights Watch, NPR, CNN, The Onion, NBC Universal, USA Today, the New York Post, NASA (which assisted on the investigation), and Microsoft. FORBES was not named as one of the victims of the trio’s attacks.

All three alleged SEA operatives were using Google Gmail and Facebook to coordinate and pass around stolen data. U.S. law enforcement were able to track their activity after acquiring court orders to search their online accounts.

Nation state hackers demanding ransom

According to the Department of Justice, Dardar and Romar (also known as Pierre Romar) have also been accused of typical cybercrime, hacking into target’s machines and demanding a ransom be paid, threatening to delete data or sell personal information. Dardar was thought to be operating out of Homs, Syria, Romar from Waltershausen, Germany. The ransoms would then be handed to SEA members in Syria, a complaint read. Dardar demanded in total more than $500,000 from 14 victims, though the filings did not specify how much they actually received.

“While some of the activity sought to harm the economic and national security of the United States in the name of Syria, these detailed allegations reveal that the members also used extortion to try to line their own pockets at the expense of law-abiding people all over the world,” said Assistant Attorney General John Carlin. “The allegations in the complaint demonstrate that the line between ordinary criminal hackers and potential national security threats is increasingly blurry.”

If the complaints released by the U.S. are accurate, Dardar and Romar are two of a handful of hackers known to be working for their government and carrying out extortion. Suspicions of governments using ransomware – malware that locks users’ files by encrypting them, only decrypting when the victim hands the hackers money – have proven unfounded. But researchers from security firm FireEye told FORBES they have seen a handful of examples where nation states have perpetrated extortion campaigns like the SEA suspects. But, the researchers said, it’s unlikely they ever want funds.

“We don’t believe that their intention was to get a ransom,” said Charles Carmakal, managing director of Mandiant, a FireEye-owned firm, speaking with FORBES last week. “I can say we’ve seen it but our case load isn’t that high.”

The hack of Sony Pictures, which the U.S. accused the North Korean government of sponsoring, included such a ransom demand once hackers had broken in. Sony didn’t pay and the hackers wiped the film studio’s machines before publishing vast tranches of company emails and files for all and sundry to pick through.

 

 

Pentagon: Social Media Charting Maps on Syrian Exodus

Harvesting posts on social media platforms has become necessary to track all kinds of human conditions. There was once a time it was a scandal when Edward Snowden revealed NSA platforms but now it is widely accepted apparently.

When it comes to tracking people movement, medical and humanitarian issues and patterns, the Pentagon is working social media. If there are protests, intermittent battles or hostilities or airstrikes, social media is the go to immediate source.

It is so valuable, the United Nations is now passing out phones and or sim cards to migrants and refugees. Question is who is paying the full connectivity access and to what wireless company?

Pentagon Mapmakers Are Using Social Media to Chart Syrians’ Exodus

Officials admit the National Geospatial-Intelligence Agency’s approach has its limitations

DefenseOne: Streams of Facebook, Instagram, and other social media posts shared by smartphone-toting children and families at border crossings are providing U.S. intelligence analysts with a real-time map of the Syrian exodus. It’s not picture perfect, but it fills in gaps for the nation’s spy cartographers, a top Defense Department official says.

By searching public posts, the National Geospatial-Intelligence Agency fulfills its duty to provide decision-makers with past, present and future insights into locations during a global emergency.

Viewing Defense Department satellite imagery from “space isn’t a great way to sense human activity of that magnitude, but people talking on the ground and people tweeting about lack of food, or pictures about lines at gates at borders is really incredibly useful,” Sue Gordon, the spy map agency’s deputy director, tells Nextgov. “You will have the ability to see what’s going on from an intelligence perspective, but social media will give you that on-the-ground look to help you correlate disparate activities or to get a different view of what is real.”

Photos and vignettes that refugees and relief workers publish depict the kindnesses and bloodshed arising from a civil war that has torn an estimated 14 million people from their homes.

The images are made possible, in part, by governmental organizations. As of August, the Office of the United Nations High Commissioner for Refugees had distributed 33,000 mobile SIM cards to displaced Syrians in Jordan alone.

Geotags on posts — metadata indicating where and when messages were sent — can be searched or plotted on a map.

For example, one government vendor that specializes in the marriage of geographic data and social media pins refugee-related items from Facebook, Twitter, Instagram and other social networks on a map of the Middle East and Europe. (Here is a map of posts filtered by the keywords, “Hamah, Syria.”)

By clicking on a marker, federal analysts can see when and where the messages were sent, as well as their images and words. (Here are a few tweets, containing Instagram links, that depict a blocked Hungary-Serbia border.)

The firm, Canada-based Echosec, uses maps from geospatial software provider Esri. National Geospatial-Intelligence Agency spokeswoman Don Kerr told Nextgov the agency does not currently contract with Echosec but it does use Esri’s technology.

While declining to identify specific federal clients, Echosec marketing executive Kira Kirk said that as the Syrian conflict has escalated, the company’s tools have followed the growing numbers of displaced civilians moving into countries like Turkey, Lebanon, Greece and Hungary.

At the Za’atari Syrian Refugee Camp in Jordan, 86 percent of the young refugees owned mobile handsets and 83 percent owned SIM cards, according to a March 2015 paper presented by Pennsylvania State University scholars Carleen Maitland and Ying Xu for the 43rd Research Conference on Communication, Information and Internet.

Last month, Defense One contributor Gayle Tzemach Lemmon, reporting from the Turkish Border, said: ”Russian air strikes are among the first things you hear when spending any time among Syrians constantly monitoring what is happening to family and friends via What’sApp and Facebook. YouTube videos are played and the carnage people are witnessing is discussed.”

Unlike law enforcement authorities or covert operatives, NGA personnel do not engage social media users they follow online.

We’re not out there interacting with it and trying to influence it,” said Gordon, during an interview at Esri’s FedGIS conference in Washington. Rather, analysts subscribe to various feeds, open accounts and watch YouTube videos,

This passive approach to social media monitoring has its limitations, including spin.

Intelligence analysts can get the wrong impression from trolls, propagandists or other users with selective memories, just as Facebook stalkers sometimes feel down when bombarded with pictures of parties and achievements on their friends’ timelines.

They get depressed because they see all these people having this great life, but I think it makes the point that all this stuff that is produced by humans comes with a perspective and you may perceive it to be true but you still have to think about what it is” indicating, Gordon said. “And then you have other truths that can help out.”

To her point, Jill Walker Rettberg, a University of Bergen digital culture professor, said of a Vocativ Instagram narrative showing one Syrian man’s journey to Germany, ”The absence of women and children is striking.”

Still, localized data points can make life a little easier for an agency dealing with information overload.

It has a real lovely temporal quality to it because it’s always being captured by somebody who cares about that event and that event in time,” Gordon said. ”The Syrian migration is just a really great example, or any humanitarian crisis or migratory crisis, because we have overhead assets but the real intelligence is on the ground.”

Goggle, State Dept and Overthrowing Assad

For reference on how Hillary’s communications were vulnerable and shared.

Clinton email reveals: Google sought overthrow of Syria’s Assad

WashingtonExaminer: Google in 2012 sought to help insurgents overthrow Syrian President Bashar Assad, according to State Department emails receiving fresh scrutiny this week.

Messages between former secretary of state Hillary Clinton’s team and one of the company’s executives detailed the plan for Google to get involved in the region.

“Please keep close hold, but my team is planning to launch a tool … that will publicly track and map the defections in Syria and which parts of the government they are coming from,” Jared Cohen, the head of what was then the company’s “Google Ideas” division, wrote in a July 2012 email to several top Clinton officials.

“Our logic behind this is that while many people are tracking the atrocities, nobody is visually representing and mapping the defections, which we believe are important in encouraging more to defect and giving confidence to the opposition,” Cohen said, adding that the plan was for Google to surreptitiously give the tool to Middle Eastern media.

“Given how hard it is to get information into Syria right now, we are partnering with Al-Jazeera who will take primary ownership over the tool we have built, track the data, verify it, and broadcast it back into Syria,” he said.

“Please keep this very close hold and let me know if there is anything [else] you think we need to account for or think about before we launch. We believe this can have an important impact,” Cohen concluded.

Hillary Emails: Google tried to boost Assad defections More:

The message was addressed to deputy secretary of state Bill Burns; Alec Ross, a senior Clinton advisor; and Clinton’s deputy chief of staff, Jake Sullivan. Sullivan subsequently forwarded Cohen’s proposal to Clinton, describing it as “a pretty cool idea.”

Cohen worked as a low-level staffer at the State Department until 2010, when he was hired to lead Google Ideas, but was tied to the use of social media to incite social uprisings even before he left the department. He once reportedly asked Twitter CEO Jack Dorsey to hold off of conducting system maintenance that officials believed could have impeded a brief 2009 uprising in Iran.

https://wikileaks.org/clinton-emails/emailid/12166#efmAMoAbj

Google Is Not What It Seems, by Julian Assange (must read)

Eric Schmidt, Chairman of Google, at the “Pulse of Today’s Global Economy” panel talk at the Clinton Global Initiative annual meeting, 26 Sept. 2013 in New York. Eric Schmidt first attended the CGI annual meeting at its opening plenary in 2010. (Photo: Mark Lennihan)

The unusual involvement by Google in foreign affairs highlights the difficulty of involvement in the internal politics of foriegn states. While Cohen seemed to consider his company’s effort as helpful to American interests, the effort to overthrow Assad helped spur the rise of the Islamic State, which eventually filled a vaccuum resulting from Assad’s loss of control over of Syria.

The exchange on Syria was highlighted by Wikileaks on Saturday. Earlier in the week, the secret-leaking website posted more than 30,000 emails that Clinton sent or received during her tenure leading the State Department.

He is Missing, Bank Hack of $90 Billion

HackerNews: Tanvir Hassan Zoha, a 34-year-old security researcher, who spoke to media on the $81 Million Bangladesh Bank cyber theft, has gone missing since Wednesday night, just days after accusing Bangladesh’s central bank officials of negligence.

Zoha was investigating a recent cyber attack on Bangladesh’s central bank that let hackers stole $81 Million from the banks’ Federal Reserve bank account.
Though the hackers tried to steal $1 Billion from the bank, a simple typo prevented the full heist.
During his investigation, Zoha believed the Hackers, who are still unknown, had installed Malware on the bank’s computer systems few weeks before the heist that allowed them to obtain credentials needed for payment transfers.
With the help of those credentials, the unknown hackers transferred large sums from Bangladesh’s United States account to fraudulent accounts based in the Philippines and Sri Lanka.
However, at the same time, Zoha accused senior officials at Bangladesh central bank of gross negligence and weak security procedures that eventually facilitated the largest bank heist in the country.
The Central bank’s governor Atiur Rahman, along with two of his deputy governors, had to quit his job over the scandal, hugely embarrassing the government and raising alarm over the security of Bangladesh’s foreign exchange reserves of over US$27 Billion.
However, when the investigation was still going on, Zoha disappeared Wednesday night, while coming home with one of his friends, according to sources close to Zoha’s family.
While speaking to media in the wake of the massive cyber attack, Zoha identified himself as the ICT (Information and Communication Technology) Division’s cyber security expert who had worked with various government agencies in the past.
Soon after Zoha’s disappearance, the government officials put out a statement but did not provide more details besides the fact that they opened an investigation.

Zoha’s family members suspect that the comments Zoha made about the carelessness of bank’s officials on the Bank heist to the press on March 11 are the cause of his disappearance.
***
(Reuters) – The SWIFT messaging system plans to ask banks to make sure they are following recommended security practices following an unprecedented cyber attack on Bangladesh’s central bank that yielded $81 million, a spokeswoman for the group told Reuters on Sunday.

Brussels-based SWIFT, a cooperative owned by some 3,000 global financial institutions, will issue a written warning on Monday asking banks to review internal security, the spokeswoman said.

SWIFT staff will also begin calling banks to highlight the importance of reviewing security measures after the attack in Bangladesh, she added.

“Our priority at this time is to encourage customers to review and, where necessary, to reinforce their local operating environments,” the spokeswoman added.

Unknown hackers breached the computer systems of Bangladesh Bank and in early February attempted to steal $951 million from its account at the Federal Reserve Bank of New York, which it uses for international settlements. Some attempted transfers were blocked, but $81 million was transferred to accounts in the Philippines in one of the largest cyber heists in history.

SWIFT has so far said little about the attack, except that it was related to “an internal operational issue” at Bangladesh Bank and that there was no compromise in its core messaging system.

SWIFT prepared a summary of previously issued recommendations for implementing security measures to thwart hackers, which advises members to pay close attention to best practices, the spokeswoman added.

A confidential interim report on the investigation, which forensics experts submitted to the bank on Wednesday, said that attackers took control of the bank’s network, stole credentials for sending SWIFT messages and used “sophisticated” malicious software to attack the computers it uses to process and authorize transactions.

Investigators said in the report, which was reviewed by Reuters, that they believe the attackers have targeted other financial institutions.

The report was prepared by FireEye Inc and World Informatix, which were hired by Bangladesh’s central bank to investigate the massive theft.

The investigators did not identify other victims or name the hackers, but said that forensic evidence suggests they were also behind other recent cyber attacks on financial institutions.

“FireEye has observed these same suspected FIN threat actors within other customer networks in the financial industry, where these threat actors appear to be financially motivated, and well organized,” said an interim report sent to the bank last week.

Representatives of Bangladesh Bank and FireEye declined to comment on the confidential report and their probe into the Feb. 4 heist.

World Informatix Chief Executive Rakesh Asthana told Reuters via email that he could not discuss the investigation, but that he expected Bangladesh Bank to issue a news release on Monday.

Details from the confidential report were previously reported by Bloomberg News and a Bangladesh publication, The Daily Star.