Smith, WeeklyStandard: Early last Wednesday, Iran released the ten American sailors it had detained to coincide with President Obama’s State of the Union address Tuesday night. The administration understood clearly that the Iranians were both trying to ruin Obama’s victory lap and sending a message—on the eve of implementing the Joint Comprehensive Plan of Action—that Tehran will be calling the shots. So Obama made no mention of Iran’s capturing 10 Americans during his speech: No way were the Iranians going to get a rise out of him on his day.
The administration would prefer to forget the incident entirely—along with a series of other hostile acts by Iran since the nuclear deal was signed in July. In addition to its customary “Death to America” rallies, in the last few months the Islamic Republic has sentenced, in secret, Washington Post journalist Jason Rezaian; imprisoned U.S. citizen Siamak Namazi; tested ballistic missiles, in violation of U.N. Security Council resolutions; fired rockets near a U.S. aircraft carrier in the Straits of Hormuz; and attacked two diplomatic missions belonging to longtime American ally Saudi Arabia. Detaining American sailors comports perfectly with this pattern.
Some American lawmakers aren’t willing to let it slide. Representative Mike Pompeo (R-Kan.) released a statement saying “we now must fully investigate Iran for possible violations of the Geneva Convention and ensure these sailors were treated properly.”
Pompeo is on solid ground. When the Iranians detained British sailors in 2007 and paraded them on television, Prime Minister Tony Blair rightly described it as a breach of the Geneva Conventions. Article 13 stipulates that “prisoners of war must at all times be protected, particularly against acts of violence or intimidation and against insults and public curiosity.” The first piece of evidence that the Iranians violated Geneva are the photographs and videos of the American sailors, especially those of them kneeling with their hands behind their heads, which were shown repeatedly in the Iranian media; further evidence is the coerced apology from the commanding officer.
It’s worth noting that Iran’s latest hostile action has given us a clearer picture of how the regime actually functions. As the event unfolded, CNN and other American media spoke of the “two Irans,” meaning the hardliners and the moderates. This has been the administration’s working theory, which holds that the former comprises the Islamic Revolutionary Guard Corps and Supreme Leader Ali Khamenei. The “moderates” in this view are figures like President Hassan Rouhani and Foreign Minister Mohammad Javad Zarif. In this scenario, it was the “hardliners” who were responsible for detaining the 10 Americans, and it was thanks to the diplomatic channel that John Kerry opened with Zarif while negotiating the nuclear deal that the sailors were freed without much delay. This theory posits that the hardliners kidnapped the Americans in an effort to embarrass the moderates, who want warmer relations with the White House. Therefore, the fact that the moderates prevailed signals a great victory for moderation and American diplomacy—for “principled diplomacy,” to use Obama’s phrase.
This scenario may be possible, but it isn’t likely. If there really is a split in the regime, why would the hardliners put themselves in a position to lose an intra-regime battle against the moderates? It would show the world that they’re not only weaker than the moderates, they’re also weaker than the moderates’ new partners, John Kerry and Barack Obama. Indeed, if it was the moderates who liberated the sailors from the grip of the extremists, it means the supreme leader himself required them to free the Great Satan’s seamen. Which would mean that the supreme leader has sided with the moderates and the Americans against the extremists.
That’s a stretch, to say the least. What is far more likely is that there is no such split between moderates and hardliners. The two camps—if there are indeed two camps—work in tandem. The hardliners take prisoners and the moderates negotiate the price of their release. Iran’s moderates are a ministry of bagmen sent out to collect on behalf of the hard men.
In short, the regime with which the White House has negotiated the future of American national security is still a regime that takes Americans hostage. Unless you believe that hijacking a U.S. Navy boat, humiliating its crew, photographing them with their hands above their heads, and broadcasting their apologies on state television is a demonstration of peaceful, moderate intentions.
Category Archives: Cyber War
Ukraine Cyber Attack on Power Grid, U.S. Warning
Ex-spy chief: Ukrainian cyberattack a warning sign for US utilities
MIAMI — Former National Security Agency chief Gen. Michael Hayden warned that a recent malware attack on the Ukrainian power grid is yet another troubling sign that the US electric supply is vulnerable to hackers.
The Dec. 23 attack on utilities serving the Ivano-Frankivsk region of Ukraine appears to be the second confirmed incident of a computer-based attack to damage physical infrastructure. The attack led to blackouts throughout the region for several hours before power was restored. The Stuxnet worm that targeted the Iranian nuclear program is the only other such incident.
What happened in Ukraine is a harbinger for the kinds of cyberthreats the US faces, possibly from rival nations such as Russia and North Korea, the retired Air Force general told a crowd of critical infrastructure experts at the S4x16 security conference in Miami. General Hayden served as director of the NSA from 1999 to 2005 and served as CIA chief from 2006 to 2009.
“There a darkening sky,” he told reporters after his speech Tuesday, referring to the increasing threat of malware infections leading to physical damages. “This is another data point on an arc that we’ve long predicted,” he said, acknowledging that the Ukraine attack reinforces concerns in official circles about security of the American power grid. What’s more, he said, if early analysis of malware discovered at the Ukrainian facility that links it to Russia is accurate, the incident foreshadows a troubling uptick in the conflict between Ukraine and Russia over the disputed Crimea region.
The Department of Homeland Security has acknowledged that a version of the BlackEnergy program linked to the Ukraine attack has been discovered in US facilities. Hayden said that the link was troubling. “If they have a presence on the grid [with BlackEnergy] then they have already achieved what they need to carry out a destructive attack.”
Analysis of the malware recovered from the Ukrainian facility conducted by the security firm iSight Partners and SANS Institute revealed that a variant of BlackEnergy, dubbed “BlackEnergy3,” was present in the compromised utilities. However, security experts caution that it is premature to conclude that BlackEnergy was actually involved in the outages.
“It is possible but far too early in the technical analysis to state that,” wrote Michael Assante, who heads up industrial control system research for SANS. “Simply put, there is still evidence that has yet to be uncovered that may refute the minutia of the specific components of the malware portion of the attack.”
Hayden also remarked during his talk Friday on the general state of overall cybersecurity, calling on US lawmakers to pass legislation that will help bolster the nation’s digital defenses.
He also criticized of efforts by FBI Director James Comey, and others in the Obama administration, to weaken strong encryption on consumer devices to make it easier for law enforcement to conduct surveillance operations. “End-to-end encryption is good for America,” he said. “I know that it represents challenges for the FBI, but on balance it creates more security for Americans than the alternative – backdoors.”
Regarding the recent Office of Personnel Management hack – which US intelligence agencies and cybersecurity expert have blamed on China – Hayden said that as head of the NSA he would have absolutely stolen similar data from the Chinese government if given the opportunity. What’s more, he said, he wouldn’t have had to ask permission to carry out the operation.
“Fundamentally, the limiting factor now is a lack of legal and policy framework to do what we are capable of doing today,” Hayden said. “OPM isn’t a bad on China,” he said. “It’s a bad on us.”
What is vulnerable in the United States?
Project ‘Gridstrike’ Finds Substations To Hit For A US Power Grid Blackout
Turns out free and publicly available information can be used to determine the most critical electric substations in the US, which if attacked, could result in a nationwide blackout.
Remember that million-dollar Federal Energy Regulatory Commission (FERC) study in 2013 that found that attacks on just nine electric substations in the US could cause a blackout across the entire grid? Well, a group of researchers decided to see just what it would take for a small group of domestic terrorists to identify the US’s most critical substations — using only free and public sources of information.
While FERC relied on confidential and private information in its shocking report and spent a whopping $1 million in research, researchers at iSIGHT Partners used only so-called open-source intelligence, at a cost of just $15,000 total for 250 man-hours by their estimates. The Wall Street Journal, which obtained and first reported on the confidential FERC report, never publicly revealed the crucial substations ID’ed by FERC for obvious reasons, nor does iSIGHT plan to disclose publicly the ones it found.
Sean McBride, lead analyst for critical infrastructure at iSIGHT, says the goal of his team’s so-called “Gridstrike” project was to determine how a small local-grown terror group could sniff out the key substations to target if it were looking to cause a power blackout — either via physical means, a cyberattack, or a combination of the two. “How would an adversary go about striking at the grid?” McBride said in an interview with Dark Reading. He will speak publicly for the first time about the Gridstrike research next week at the S4x2016 ICS/SCADA conference in Miami.
The iSIGHT researchers drew from a combination of publicly available transmission substation information, maps, Google Earth, and grid congestion documentation, and drew correlations among the substations that serve the top ten cities in the US. They then were able to come up with 15 substations that serve as the backbone for much of the electric grid: knocking out those substations would result in a nationwide blackout, they say.
FERC’s report had concluded that the US could suffer a nationwide blackout if nine of the nation’s 55,000 electric transmission substations were shut down by attackers.
“We looked at maps and tried to … identify [power] generation facilities, and looked up both centers and what substations are in the middle that would make high-value targets,” for example, McBride says. “We tried to identify which substations have the highest number of transmission lines coming in and out,” as well, and weighed their significance.
The researchers shared the findings from Gridstrike with their customers as well as “organizations most interested from a defense perspective” to such attacks, says McBride, who declined to provide any further details on the specific organizations.
“We were extremely concerned about the amount of publicly available information” on the critical substations, McBride says. There were several documents available publicly that should not have been: in some cases, a sensitive document was sitting on an organization’s public website even though it specified that the report was not for public consumption.
The hope is that the findings will alert critical infrastructure and other organizations with ties to the power grid that understanding how an adversary thinks can help shore up defenses, McBride says. “They need to manage their recon exposure.”
What does all of this mean for the US power grid’s actual vulnerability to a physical or cyber-physical attack? McBride says the openly available intel is “reason for concern.” He says he worries more about the possibility of a regional, localized, grid attack targeting a city or area, than a nationwide attack.
As for the recent power blackout in the Ukraine that appears to have been due in part to a cyberattack, McBride says he’d be surprised if the attackers didn’t gather some of their reconnaissance via open source intelligence.
EW, Jamming GPS by IRGC vs. U.S. Navy
EW = Electronic warfare is any military action involving the use of the EM spectrum to include directed energy (DE) to control the EM spectrum or to attack an enemy. This is not limited to radio or radar frequencies but includes IR, visible, ultraviolet, and other less used portions of the EM spectrum. This includes self-protection, standoff, and escort jamming, and anti-radiation attacks. EW is a specialized tool that enhances many air and space functions at multiple levels of conflict.
| Tuesday, October 4, 2011 |
| Iran Develops GPS jammer |
| Iran Unveils Major Achievements in Electronic Warfare
TEHRAN (FNA)- Iran on Tuesday displayed three of its latest and most The country’s achievements were unveiled in a ceremony attended by The hi-tech products which went on display included Shahed Electronic Electronic warfare is amongst the most crucial elements in air defense and |
Farsi island is an exclusive IRGC base likely with very sophisticated and advanced systems to gain access to communications regardless of platform in the region, all of the Persian Gulf and land based infrastructure. (Just keep in mind, when Iran got their hands on a U.S. drone, where they likely reversed engineered our systems)
On 4 December 2011, an American Lockheed Martin RQ-170 Sentinel unmanned aerial vehicle (UAV) was captured by Iranian forces near the city of Kashmar in northeastern Iran. The Iranian government announced that the UAV was brought down by its cyberwarfare unit which commandeered the aircraft and safely landed it, after initial reports from Western news sources inaccurately claimed that it had been “shot down”. The United States government initially denied the claims but later President Obama acknowledged that the downed aircraft was a US drone and requested that Iran return it.[2][3]
General Dynamics will deliver Block 1B3 system upgrades over the next five years. The upgrades will be integrated into new and existing Navy ships providing significantly improved situational awareness of the tactical environment surrounding the ship, the company said in a statement Monday.
General Dynamics has been involved with the SEWIP Block 1 program since 2003 and received a low-rate initial production contracts for the SEWIP Block 1B3 in 2014. Work on the contract will take place in Pittsfield, Massachusetts.
SEWIP is comprised of capability improvements divided into production blocks. This contract is part of Block 1, which provides enhanced electronic warfare capabilities to Navy ship combat systems improving anti-ship missile defense, counter targeting and surveillance. The block 1B3 system is the final upgrade for Block 1, providing high-gain/high-sensitivity electronic capability.
Electronic warfare system provides greater detection and identification of threats to Navy combat ships.
Military Jamming GPS document is here.
Broken Navigation System Led U.S. Navy Boats Into Iranian Waters
Published 13 January 2016
RFE: The top naval commander for Iran’s Revolutionary Guard, Rear Admiral Ali Fadavi, has told the Tasnim news agency that an internal investigation found a broken navigation system was to blame for leading two U.S. Navy patrol boats into Iranian waters. The vessels and 10 sailors were seized by Iran on January 12. The U.S. Department of Defense has released file video showing the type of Navy boats that were seized. (U.S. Department of Defense file, Reuters)
The Pentagon Is Worried About Hacked GPS
GPS is a two-edged sword. The Global Positioning System has been the foundation of a revolution in warfare that enables highly accurate smart bombs and navigation systems. With all the furor over civilian casualties caused by smart bombs, imagine what the toll would be without GPS weapons.
On the other hand, GPS is the device that allows civilian drivers to follow its directions while driving off a cliff. Which raises the question: what happens when GPS isn’t available?
It’s a question the U.S. military is taking very seriously. The advent of cheap GPS jammers allows terrorists as well as hostile nations to block navigation signals. Hackers can disrupt the system, while the GPS satellites themselves—even at 12,500 miles high—are potentially vulnerable to anti-satellite weapons. And that’s assuming that America doesn’t wreck its own GPS system; the U.S. Air Force’s plan to develop the next generation of GPS ground control stations has been described by the Pentagon as a “disaster.”
So it is no surprise that the U.S. military is pursuing several backup technologies for GPS. The Air Force and Navy are asking the defense industry to come up with alternatives for when GPS isn’t available.
The Navy, for example, wants a Positioning, Navigation and Timing (PNT) system that allows users to navigate from radio signals when GPS is down. Ironically, one alternative the Navy is proposing is LORAN-C, the radio navigation system that the United States shut down in 2010 because GPS supposedly rendered it obsolete. “Since then, the government has realized that GPS represents a single point of failure which can be denied through unintentional and intentional interference,” explains the Navy, which also notes that the technology can be used by civilian airliners when their GPS navigation has been disrupted.
The Air Force is also looking for a PNT system. Their approach is focusing on pseudo-satellites (pseudolites), ground or airborne transmitters that perform the same function as GPS satellites, but can overpower jamming because they are a lot closer to the user’s location than an orbital GPS station.
Not to be outdone are the people who get themselves into situations where accurately knowing your location is more than a luxury. Special Operations Command (SOCOM), which oversees America’s commandos, wants a GPS alternative for its aircraft.
SOCOM does not paint an optimistic picture of current GPS technology. “Some of the issues with the current GPS include blind spots as well as spoofing and jamming of the GPS signal,” states the research proposal. “Additionally, many GPS satellites are outside of their designed lifetime and are likely to become less reliable in the future. Finally, it is uncertain whether current budget cuts will allow the funding needed to launch new GPS satellites.”
No doubt the Pentagon will find alternative technologies, perhaps something that will replace GPS. But the larger question is technological dependence. If the U.S. military, not to mention civilian airliners and ships, are that helpless when GPS is down, then perhaps the problem is with the user as well as the technology.
This should answer some questions when it comes to the IRGC activities on Farsi Island and why 2 riverine boats came into the possession of the IRGC along with 10 sailors. Is it any wonder why Defense Secretary Ash Carter asked Iran to be merciful to our sailors and John Kerry begged forgiveness?
ODNI Chief Clapper, Hacked Again
Teen Who Hacked CIA Email Is Back to Prank US Spy Chief
Motherboard: One of the “teenage hackers” who broke into the CIA director’s AOL email account last year hasn’t given up targeting government intelligence officials. His latest victim is the Director of National Intelligence James Clapper, Motherboard has learned.
A group of hackers calling themselves “Crackas With Attitude” or CWA made headlines in October, hacking into CIA Director John Brennan’s email account and apparently getting access to several online tools and portals used by US law enforcement agencies.The hackers’ exploits prompted the FBI to issue an alert warning government officials of their attacks.
One of the group’s hackers, who’s known as “Cracka,” contacted me on Monday, claiming to have broken into a series of accounts connected to Clapper, including his home telephone and internet, his personal email, and his wife’s Yahoo email. While in control of Clapper’s Verizon FiOS account, Cracka claimed to have changed the settings so that every call to his house number would get forwarded to the Free Palestine Movement. When they gained notoriety last year, Cracka and CWA claimed their actions were all in support of the Palestine cause.
“I’m pretty sure they don’t even know they’ve been hacked,” Cracka told me in an online chat.
But Brian Hale, a spokesperson for the Office of the Director of National Intelligence, confirmed the hack to Motherboard on Tuesday.
“We’re aware of the matter and we reported it to the appropriate authorities,” Hale said, declining to answer any other questions on the record. (The FBI declined to comment.)
Cracka, or whoever is pretending to be him, taunted authorities on Twitter (the hacker used a new Twitter account, not the same one he used at the time of the Brennan hack. But the hacker also is in control of a chat app account who’s been using to communicate with me since last October).
Cracka provided me with what he claimed to be Clapper’s home number. When I called it on Monday evening, I got an answer from Paul Larudee, the co-founder of the Free Palestine Movement. Larudee told me that he had been getting calls for Clapper for the last hour, after an anonymous caller told him that he had set Clapper’s number to forward calls to him. Larudee said that one of the callers said he was sitting in Clapper’s house next to his wife.According to public records, the phone number does belong to James Clapper’s household. Cracka also provided another number, a cellphone, which he said belonged to either Clapper or Clapper’s wife, Susan. When I called, a woman picked up and I asked if this was Susan Clapper. The woman responded that Susan wasn’t there, but that she’d tell her to call me back. But nobody ever did.
Cracka also claimed to have gotten into Susan’s Yahoo email account, as well as Clapper’s email account. He provided a series of screenshots to prove he had control of their Verizon FiOS account, as well as Susan’s Yahoo account. Motherboard couldn’t independently verify the authenticity of the screenshots.
The hacker also sent me a list of call logs to Clapper’s home number. In the log, there was a number listed as belonging to Vonna Heaton, an executive at Ball Aerospace and a former senior executive at the National Geospatial-Intelligence Agency. When I called that number, the woman who picked up identified as Vonna Heaton. When I told her who I was, she declined to answer any questions.
“A journalist? Oh my gosh” she said, laughing uncomfortably. “I have somebody on the line, I’m sorry, I have no insight into that. But that’s really unfortunate, have a great day.”
“I just wanted the gov to know people aren’t fucking around, people know what they’re doing and people don’t agree #FreePalestine.”
Michael Adams, an information security expert who served more than two decades in the US Special Operations Command, said that this looks “more of a social engineering hack than a real hack,” but also added that “every serious hack starts with social engineering.”Adams also said that it’s “insane” that Clapper doesn’t do more to hide his home address and phone number (both can be found with a Google search).
“If I’m the Director of National Intelligence of the United States of America nobody is going to know where the fuck I live, nobody is going to have my goddamn phone number or address,” Adams told me in a phone interview.
On Tuesday, Cracka asked me not to name him in the article, saying he “doesn’t like the attention.”
“You Asked why I did it,” he added. “I just wanted the gov to know people aren’t fucking around, people know what they’re doing and people don’t agree #FreePalestine.”
Saudi Arabia Reveals Iran Spy Ring and JPOA
ABU DHABI [MENL] — Saudi Arabia, amid a propaganda war, has reported an Iranian espionage presence in the Gulf Cooperation Council kingdom.
Officials said authorities have launched prosecution of four Iranians on charges of espionage. They said at least one of the defendants was accused of working for Iranian intelligence and recruited Saudi nationals.
This marked the second alleged Iranian spy cell dismantled in Saudi Arabia over the last year. Officials said a fifth Iranian was also accused of being part of the cell and linked to attacks in the Gulf Cooperation Council kingdom since 2003.
Officials said the fifth Iranian, sentenced to 13 years, was convicted of recruiting Saudis in Iran and sending them to fight in Afghanistan. The Iranian, who was not identified, was also charged with relaying funds for recruitment.
The Iranian espionage cell, reported in the Saudi-controlled media, was disclosed amid the crisis with Teheran fueled by Riyad’s execution of a leading Shi’ite cleric. The Saudi leadership has responded to Iranian condemnations by releasing information on Teheran’s executions of hundreds of dissidents over the last two years.
The Saudi media said the latest Iranian espionage cell stemmed from the arrival of an Iranian intelligence officer to the annual pilgrimage in the Saudi city of Mecca. The media said the cell, detected as early as 2014, also planned attacks but did not elaborate.
Riyad was said to have dismantled a previous Iranian cell in 2013. The Saudi media said the cell consisted of at least 27 alleged members, 24 of them Saudis and the rest nationals from Iran, Lebanon and Turkey.
Officials said Iran has sought to infiltrate Saudi Arabia from both the northern and southern border. On Jan. 8, the Saudi military battled hundreds of Iranian-backed Houthi fighters from neighboring Yemen, 35 of them were killed in the Raboua region.
“We are looking at additional measures to be taken if it [Iran] continues with its current policies,” Saudi Foreign Minister Adel Al Jubeir said on Jan. 9.
Meanwhile, there is little in the news about the JOPA, the P5+1 Iranian nuclear deal and there are good reasons…..lifting sanctions.
The Implications of Sanctions Relief Under the Iran Agreement
Congressional testimony by Mark Dubowitz
(1) The Joint Comprehensive Plan of Action’s (JCPOA) major design flaws, which provide Iran with patient paths to nuclear weapons and greater ballistic missile, heavy weaponry, and economic capabilities;
(2) The interplay between the P5+1 economic sanctions “snapback” and Iran’s “nuclear snapback” in limiting the ability of the United States to impose sanctions (a) to address Iranian non-compliance with the JCPOA and, (b) to punish Iranian illicit conduct in a range of non-nuclear activities such as support for terrorism; and,
(3) How sanctions relief under the JCPOA benefits the most hardline elements in Iran including the Islamic Revolutionary Guard Corps (IRGC) and Iran’s Supreme Leader Ali Khamenei.
First, on so-called “Implementation Day,” Iran will receive substantial sanctions relief with which it can defend its economy against future sanctions pressure. Iran may also use sanctions relief to increase its support for terrorism and other rogue regimes and to expand its conventional military power. The JCPOA front-loads sanctions relief, providing Iran with access to around $100 billion in restricted oil revenues and reconnecting Iranian banks, including the Central Bank of Iran, back into the global financial system. Sanctions on Iran’s crude oil export transactions will be lifted, as will sanctions on key sectors of the Iranian economy including upstream energy investment and energy-related technology transfers, the auto industry, petrochemicals, and shipping, as well as the precious metals trade. This sanctions relief will enable Iran to build greater economic resilience against future pressure—both sanctions aimed at isolating other illicit financial conduct and so-called “snapback” sanctions in the event of Iranian nuclear non-compliance.
Then, after five years, or earlier if the International Atomic Energy Agency (IAEA) reaches a broader conclusion that Iran’s nuclear program is only for peaceful purposes, the international arms embargo will be lifted, meaning that Iran can also expand its conventional military capabilities and those of its proxies. Former Under Secretary of State for Political Affairs Nicholas Burns, one of the other witnesses at this hearing, noted one week before the announcement of the JCPOA that lifting the arms embargo “would be a great mistake. Iran is selling arms, giving arms, fueling civil wars in Yemen, in Lebanon, in Syria and Iraq, and so those arms prohibitions on Iran are very important.”1 He also has explained that the arms embargo was put in place “for very good reason.” He continued that it is not in the interest of the United States “to see these arms embargos lifted from Iran. It is an issue that should not be part of these negotiations. … I think we ought to maintain these U.N. embargos.”2 In five years, however, they will disappear, giving Iran access to combat aircraft, attack helicopters, battle tanks, among other advanced weapons systems. Read the full testimony here.