FBI Global Hackers Sweeping Sting Arrests

So many complain the FBI is slow-walking cyber and hacking operations especially when it comes to the Russian investigations. Well, the FBI rarely announces cases and prosecutions. When it comes to the recent Russian hacking scandal into the United States election and campaign infrastructure, perhaps the Department of Justice and the FBI are building a huge file for proof.

So, try this:

NBC/McClatchy

 

U.S. sweeping up Russian hackers in a broad global dragnet

BY TIM JOHNSON/WASHINGTON

McClatchy: The arrests caught the Russian hackers totally by surprise. One was at a Finnish border crossing. Another was arriving at an airport in Spain. A third was dining at a restaurant in Prague. Still others were at luxury resorts in the Maldives and Thailand.

Many have now turned up in U.S. courts. The long arm of U.S. law enforcement is spanning the globe like never before to bring criminal hackers to justice.

And it may not be just about crime. The Justice Department cites fuzzy and overlapping boundaries between criminal hackers and Russian intelligence agencies, the same ones the U.S. accuses of coordinating the hacking and subsequent disclosure of emails from the Democratic National Committee and the Hillary Clinton presidential campaign.

President Donald Trump dismisses allegations that Russia meddled in the election as “fake news,” but the FBI and congressional committees have launched probes and the Obama administration ordered the expulsion of 35 Russian diplomats in late December.

Rubio says Russian hackers targeted his presidential campaign

During a Senate committee hearing on Thursday, Florida Senator Marco Rubio stated that his 2016 presidential campaign staff members were the targets of Russian hackers in July 2016 and March 2017, but both efforts were unsuccessful.

The U.S. campaign leaves Russian hackers with a dilemma: If they leave the safe confines of Russia, which has no extradition treaty with the United States, or Russia’s most ardent allies, they may get picked up and sent to the U.S.

“They no longer travel, the high-profile hackers. They understand the danger,” said Arkady Bukh, a criminal defense lawyer in New York City who has defended numerous accused Russian cybercriminals.

Still, some Russian and Eastern European hackers do enjoy holidays abroad – and live to regret it. Just this week, Maxim Senakh, a 41-year-old Russian, pleaded guilty in a Minneapolis courtroom to operating a massive robotic network that generated tens of millions of spam emails a day in a zombie criminal enterprise that purportedly brought in millions in profits.

Senakh didn’t come voluntarily. He’d been visiting a sister in Finland before that country put him on a U.S.-bound plane in January, answering a U.S. extradition request.

“He fought it, the Russian government fought it, and the Russian government put political pressure on its neighbor, Finland,” federal prosecutor Kevin S. Ueland said at a Feb. 19 hearing.

Another Russian, Mark Vartanyan, 29, pleaded guilty March 20 to computer fraud in an Atlanta courtroom after reaching a deal with prosecutors to offer far-reaching cooperation that would limit a prison term to five years or less.

Norway extradited Vartanyan to the U.S. in December.

David Hickton, a former U.S. attorney in Pittsburgh who made the city a hub for prosecutions of foreign hackers, said such actions are a sign of the new dimensions of crime.

IT’S NO DIFFERENT THAN IF SOMEONE PULLED A TRUCK UP TO YOUR HOUSE AND STOLE VALUABLE MATERIAL. David Hickton, former federal prosecutor

“This is 21st century burglary. It’s no different than if someone pulled a truck up to your house and stole valuable material,” said Hickton, who now directs the Institute for Cyber Law, Policy and Security at the University of Pittsburgh.

But Hickton acknowledged that carrying off successful prosecutions is a challenge.

“These cyber investigations are very, very hard. You’re talking about evaporating evidence, borderless crimes and defendants who can hide behind the borders of countries that don’t have extradition treaties with us,” he said.

It is not easy to pigeonhole the accused and convicted hackers. Some are brainy but merely cogs in larger crime groups. Others flash their wealth and opulent lifestyles.

NOT ALL OF THEM ARE RICH. 

Arkady Bukh, criminal defense attorney in New York City

“Not all of them are rich,” Bukh said. “A lot of them are involved in computer intrusion and that does not bring much money.”

Bukh recalled one client, Aleksandr Panin, who was placed by authorities on a plane in the Dominican Republic to 2013 bound for Atlanta, put on trial and convicted.

“The guy couldn’t afford a car even with (having caused) a billion dollars in losses. He’s like a mad scientist geek,” Bukh said.

Then there are those on the opposite extreme, who pose for photos with piles of cash or at luxury beach resorts. One of them, Roman Seleznev, was convicted last year in Seattle on 38 counts related to cybercrime. His father is a deputy in the Russian parliament, or Duma. Prosecutors retrieved a photo from his cell phone of him standing next to a yellow Dodge Challenger muscle car in Red Square near the Kremlin.

The magnitude of damages that prosecutors have alleged can be mind-boggling.

Vartanyan, the young Russian hacker brought to Atlanta from Norway, was part of the development team that created Citadel, a “universal spyware system” sold on underground Russian criminal hacker forums that ended up lodged on 11 million infected computers around the world.

In their complaint against him, prosecutors cited industry estimates that Citadel caused “over $500 million in losses” in a three-year period.

The investigations can be incredibly complex, leading federal investigators to call in specialized cybersecurity firms to conduct forensics. In the probe of Senakh, whose guilty plea came last month, the feds turned to ESET, a cybersecurity firm with 18 offices around the world.

ESET analyzed the malicious code Senakh used, dubbed Ebury malware, and found that it had compromised 25,000 servers around the world, researcher Marc-Etienne Leveille said in an email.

Stanislav Lisov, a computer programmer from Taganrog, a town on Russia’s Black Sea coast, had arrived at Barcelona’s international airport with his wife on Jan. 13 when Spanish Civil Guard police arrested him on an FBI warrant issued through Interpol. The charges: electronic and computer fraud.

WE WERE DETAINED AT THE AIRPORT IN BARCELONA. 

Darya Lisova, wife of accused Russian hacker Stanislav Lisov

“We were detained at the airport in Barcelona, when we came to return a rented car before flying out to Lyon, to continue our trip and visit friends. When we were getting out of the car, two police officers approached, showed us the badge, and said they were detaining my husband,” Darya Lisova told the Russian state-operated RT network.

Spain has not yet extradited Lisov, who is blamed for being the architect of a sophisticated Trojan, NeverQuest, used in stealing log-in credentials for bank accounts.

Here is a rundown of some other recent cases:

Yevgeniy Nikulin, 29, was arrested by police while dining with his girlfriend in a hotel restaurant in Prague’s Old Town Oct. 5. He has been indicted by a federal grand jury in northern California on charges of computer intrusion, identity theft and other crimes for penetrating into the systems of high-tech companies LinkedIn, Dropbox and Formspring. Since then, Washington and Moscow have been in a tug-of-war over Nikulin’s extradition.

Olga Komova, a 26-year-old Uzbek, and Dmitry Ukrainsky, a Russian, were arrested in mid-2016 at beach resorts in Thailand and accused of stealing more than $28 million as part of a mega cyber bank fraud ring. Komova has turned up in U.S. custody and faces federal charges of wire fraud and money laundering. How she was brought to the United States is unclear. Her U.S. lawyer, Michael Soroka, declined to discuss the case.

When extradition isn’t an option, U.S. authorities lure alleged hackers to jurisdictions where they can be arrested. Such tactics have been decried by Moscow as “kidnapping.”

Seleznev, the identity thief who is the son of the Duma deputy, chose to vacation at a five-star resort in the Indian Ocean archipelago nation of the Maldives in 2014 precisely because it has no extradition treaty with the United States.

U.S. officials got word and persuaded Maldives authorities to intercept Seleznev at the airport, where in a fast-paced operation he was bundled on a private plane to Guam, a U.S. territory in the western Pacific, then flown to Seattle to face federal charges.

Upon his conviction last August, prosecutors said Seleznev had stolen millions of credit card numbers, causing 3,700 banks $169 million in losses. He faces a 40-year jail term.

No matter where the hackers travel, prosecutors say they will follow.

The U.S. attorney in Atlanta, John Horn, who has also made a name for himself in prosecuting Russian hackers, offered an unapologetic defense last year of the global reach of U.S. justice.

“Cybercrime is borderless, but increasingly, so too are our law enforcement capabilities,” Horn said.

Pyotr Levashov Arrested in Barcelona, Hacker

All domestic news media has been blaming the Russians for cyber election intrusion. Conservative outlets have pushed back asking for evidence. There are investigations on The Hill regarding Russian interference and the House Intelligence Committee, chaired by Devin Nunes has seen the documents and share them with the White House. The committee co-chair Adam Schiff was angry he was not read on early enough. A big political conflict has occurred and Nunes recused himself from the specific committee investigation regarding Russia as Nunes remains chairman of the committee.

Okay so what you ask?

Well we want to blame the FBI, Comey and ODNI, Clapper for not being more forthcoming on the matter. Slow down everyone, as cyber investigations are international in scope and it takes a mobilized set of experts and agencies and international collaboration to make attribution by using exceptional tools, cyber talent and agreements. So….what does all this mean? It means the lid could soon blow off this whole operation.

You see, there was malware, phishing and countless botnet systems that were part of the U.S. election interference as we saw with the DNC hack and the John Podesta emails via WikiLeaks. There are countless moving parts and they are international. It is gratifying to know however, not only is government part of the investigation, but outside cyber corporations are doing their own due diligence and offering additional clues, evidence and assistance to the FBI. How so you ask?

From Krebs on Security: Then, on Jan. 26. 2012, I ran a story featuring a trail of evidence suggesting a possible identity of “Severa (a.k.a. “Peter Severa”), another SpamIt affiliate who is widely considered the author of the Waledac botnet (and likely the Storm Worm). In that story, I included several screen shots of Severa chatting on Spamdot.biz, an extremely secretive Russian forum dedicated to those involved in the spam business. In one of the screen shots, Severa laments the arrest of Alan Ralsky, a convicted American spam kingpin who specialized in stock spam and who — according to the U.S. Justice Department – was partnered with Severa. Anti-spam activists at Spamhaus.org maintain that Peter Severa’s real name is Peter Levashov (although the evidence I gathered also turned up another name, Viktor Sergeevich Ivashov). Read more here, it is fascinating and well done.

*** No wonder attribution takes a very long time right? Yes so read on please…..

Programmer Pyotr Levashov reportedly suspected in US election hacking arrested

Madrid: A Russian computer programmer, Pyotr Levashov, has been arrested in the Spanish city of Barcelona, a spokesman for the Russian embassy in Madrid said on Sunday.

It was unclear why Levashov was arrested. The embassy spokesman declined to give details for his arrest, and Spanish police and the interior ministry were not available for comment on Sunday.

Russian television station RT reported that Levashov was arrested under a US international arrest warrant and was suspected of being involved in hacking attacks linked to alleged interference in last year’s US election.

Peter Carr, a spokesman for the US Justice Department’s criminal division, said: “The US case remains under seal, so we have no information to provide at this time.”

The criminal division is separate from the national security division, which is responsible for investigating state-sponsored cyber crimes.

A US Department of Justice official said it was a criminal matter without an apparent national security connection.

Spanish authorities notified the Russian embassy of Levashov’s arrest on Friday, the embassy spokesman said.

In January, Spanish police arrested another Russian computer programmer, whose name was given as “Lisov” and who was wanted by the United States for leading a financial fraud network.

Russia's embassy in Madrid.Russia’s embassy in Madrid. Photo: Wikimedia/Luis García (Zaqarbal)

The US government has formally accused Russia of hacking Democratic Party emails to help the campaign of Republican President Donald Trump. The US Congress is also examining links between Russia and Trump during the election campaign.

Russian officials, including President Vladimir Putin, have repeatedly denied that Russia tried to influence the election.

Reuters

Related reading: Spain arrests Russian bank-account hacker wanted by FBI

January 2017: Spain has arrested a 32-year-old Russian computer programmer at Barcelona airport who is alleged to have designed and used software to steal bank account details from banks and individuals, Spanish police said on Friday.

Working with the U.S. Federal Bureau of Investigation (FBI), the man, named Lisov, was arrested by Spanish police on Jan. 13 as he waited to take a flight to another European country. He is suspected of leading a financial fraud network, the police said in a statement.

Lisov, wanted by the United States under an international arrest warrant, had been under observation by authorities for several days in the north-eastern region of Catalonia, police said. Police did not give the man’s first name. More here.

Related reading: Russian FSB Officers Charged in Yahoo Hack and More

Tip sheet on above:

ALEXSEY BELAN

Conspiring to Commit Computer Fraud and Abuse; Accessing a Computer Without Authorization for the Purpose of Commercial Advantage and Private Financial Gain; Damaging a Computer Through the Transmission of Code and Commands; Economic Espionage; Theft of Trade Secrets; Access Device Fraud; Aggravated Identity Theft; Wire Fraud

   Seems we need to be more patient when it comes to the FBI and associated international agencies…eh?

Obama/Rice Abuse of Surveillance Started During Iran Deal

Image result for obama surveillance israel VOA

The Guardian more than a year ago, validates the summary posted below.

US ‘spied on Binyamin Netanyahu during Iran nuclear deal talks’

Despite Barack Obama’s promise to curtail eavesdropping on allies in the wake of the Edward Snowden revelations about the scale and scope of US activities, the National Security Agency’s (NSA) surveillance included phone conversations between top Israeli officials, US congressmen and American-Jewish groups, according to the Wall Street Journal.

Further, we cannot eliminate any complicity that would include NSC advisor, Ben Rhodes.

Did the Obama Administration’s Abuse of Foreign-Intelligence Collection Start Before Trump?

One clue: The Russia story is a replay of how the former White House smeared pro-Israel activists in the lead-up to the Iran Deal

Tablet: The accusation that the Obama administration used information gleaned from classified foreign surveillance to smear and blackmail its political opponents at home has gained new traction in recent days, after reports that former National Security Adviser Susan Rice may have been rifling through classified transcripts for over a year that could have included information about Donald Trump and his associates. While using resources that are supposed to keep Americans safe from terrorism for other purposes may be a dereliction of duty, it is no more of a crime than spending all day on Twitter instead of doing your job. The crime here would be if she leaked the names of U.S. citizens to reporters. In the end, the seriousness of the accusation against Rice and other former administration officials who will be caught up in the “unmasking” scandal will rise or fall based on whether or not Donald Trump was actively engaged in a conspiracy to turn over the keys of the White House to the Kremlin. For true believers in the Trump-Kremlin conspiracy theories, the Obama “spying and lying” scandal isn’t a scandal at all; just public officials taking prudent steps to guard against an imminent threat to the republic.

But what if Donald Trump wasn’t the first or only target of an Obama White House campaign of spying and illegal leaks directed at domestic political opponents?

In a December 29, 2015 article, The Wall Street Journal described how the Obama administration had conducted surveillance by US Gov on Israeli officials to understand how Prime Minister Benjamin Netanyahu and other Israeli officials, like Ambassador Ron Dermer, intended to fight the Iran Deal. The Journal reported that the targeting “also swept up the contents of some of their private conversations with U.S. lawmakers and American-Jewish groups.”

Despite this reporting, it seemed inconceivable at the time that—given myriad legal, ethical, political, and historical concerns, as well as strict National Security Agency protocols that protect the identity of American names caught in intercepts—the Obama White House would have actually spied on American citizens. In a December 31, 2016, Tablet article on the controversy, “Why the White House Wanted Congress to Think It Was Being Spied on By the NSA,” I argued that the Obama administration had merely used the appearance of spying on American lawmakers to corner opponents of the Iran Deal. Spying on U.S. citizens would be a clear abuse of the foreign-intelligence surveillance system. It would be a felony offense to leak the names of U.S. citizens to the press.

Increasingly, I believe that my conclusion in that piece was wrong. I believe the spying was real and that it was done not in an effort to keep the country safe from threats—but in order to help the White House fight their domestic political opponents.

“At some point, the administration weaponized the NSA’s legitimate monitoring of communications of foreign officials to stay one step ahead of domestic political opponents,” says a pro-Israel political operative who was deeply involved in the day-to-day fight over the Iran Deal. “The NSA’s collections of foreigners became a means of gathering real-time intelligence on Americans engaged in perfectly legitimate political activism—activism, due to the nature of the issue, that naturally involved conversations with foreigners. We began to notice the White House was responding immediately, sometimes within 24 hours, to specific conversations we were having. At first, we thought it was a coincidence being amplified by our own paranoia. After a while, it simply became our working assumption that we were being spied on.”

This is what systematic abuse of foreign-intelligence collection for domestic political purposes looks like: Intelligence collected on Americans, lawmakers, and figures in the pro-Israel community was fed back to the Obama White House as part of its political operations. The administration got the drop on its opponents by using classified information, which it then used to draw up its own game plan to block and freeze those on the other side. And—with the help of certain journalists whose stories (and thus careers) depend on high-level access—terrorize them.

Once you understand how this may have worked, it becomes easier to comprehend why and how we keep being fed daily treats of Trump’s nefarious Russia ties. The issue this time isn’t Israel, but Russia, yet the basic contours may very well be the same.

***

Two inquiries now underway on Capitol Hill, conducted by the Senate intelligence committee and the House intelligence committee, may discover the extent to which Obama administration officials unmasked the identities of Trump team members caught in foreign-intelligence intercepts. What we know so far is that Obama administration officials unmasked the identity of one Trump team member, Michael Flynn, and leaked his name to the Washington Post’s David Ignatius.

“According to a senior U.S. government official,” Ignatius wrote in his Jan. 12 column, “Flynn phoned Russian Ambassador Sergey Kislyak several times on Dec. 29, the day the Obama administration announced the expulsion of 35 Russian officials as well as other measures in retaliation for the hacking. What did Flynn say, and did it undercut the U.S. sanctions?”

Nothing, the Times and the Post later reported. But exposing Flynn’s name in the intercept for political purposes was an abuse of the national-security apparatus, and leaking it to the press is a crime.

This is familiar territory. In spying on the representatives of the American people and members of the pro-Israel community, the Obama administration learned how far it could go in manipulating the foreign-intelligence surveillance apparatus for its own domestic political advantage. In both instances, the ostensible targets—Israel and Russia—were simply instruments used to go after the real targets at home.

In order to spy on U.S. congressmen before the Iran Deal vote, the Obama administration exploited a loophole, which is described in the original Journal article. The U.S. intelligence community is supposed to keep tabs on foreign officials, even those representing allies. Hence, everyone in Washington knows that Israeli Ambassador Ron Dermer is under surveillance. But it’s different for his American interlocutors, especially U.S. lawmakers, whose identities are, according to NSA protocol, supposed to be, at the very least, redacted. But the standard for collecting and disseminating “intercepted communications involving U.S. lawmakers” is much less strict if it is swept up through “foreign-foreign” intercepts, for instance between a foreign ambassador and his capital. Washington, i.e. the seat of the American government, is where foreign ambassadors are supposed to meet with American officials. The Obama administration turned an ancient diplomatic convention inside out—foreign ambassadors were so dangerous that meeting them signaled betrayal of your own country.

During the long and contentious lead-up to the Iran Deal the Israeli ambassador was regularly briefing senior officials in Jerusalem, including the prime minister, about the situation, including his meetings with American lawmakers and Jewish community leaders. The Obama administration would be less interested in what the Israelis were doing than in the actions of those who actually had the ability to block the deal—namely, Senate and House members. The administration then fed this information to members of the press, who were happy to relay thinly veiled anti-Semitic conceits by accusing deal opponents of dual loyalty and being in the pay of foreign interests.

It didn’t take much imagination for members of Congress to imagine their names being inserted in the Iran deal echo chamber’s boilerplate—that they were beholden to “donors” and “foreign lobbies.” What would happen if the White House leaked your phone call with the Israeli ambassador to a friendly reporter, and you were then profiled as betraying the interests of your constituents and the security of your nation to a foreign power? What if the fact of your phone call appeared under the byline of a famous columnist friendly to the Obama administration, say, in a major national publication?

To make its case for the Iran Deal, the Obama administration redefined America’s pro-Israel community as agents of Israel. They did something similar with Trump and the Russians—whereby every Russian with money was defined as an agent of the state. Where the Israeli ambassador once was poison, now the Russian ambassador is the kiss of death—a phone call with him led to Flynn’s departure from the White House and a meeting with him landed Attorney General Jeff Sessions in hot water.

Did Trump really have dealings with FSB officers? Thanks to the administration’s whisper campaigns, the facts don’t matter; that kind of contact is no longer needed to justify surveillance, whose spoils could then be weaponized and leaked. There are oligarchs who live in Trump Tower, and they all know Putin—ergo, talking to them is tantamount to dealing with the Russian state.

Yet there is one key difference between the two information operations that abused the foreign-intelligence surveillance apparatus for political purposes. The campaign to sell the Iran deal was waged while the Obama administration was in office. The campaign to tie down Trump with the false Russia narrative was put together as the Obama team was on its way out.

The intelligence gathered from Iran Deal surveillance was shared with the fewest people possible inside the administration. It was leaked to only a few top-shelf reporters, like the authors of The Wall Street Journal article, who showed how the administration exploited a loophole to spy on Congress. Congressmen and their staffs certainly noticed, as did the Jewish organizations that were being spied on. But the campaign was mostly conducted sotto voce, through whispers and leaks that made it clear what the price of opposition might be.

The reason the prior abuse of the foreign-intelligence surveillance apparatus is clear only now is because the Russia campaign has illuminated it. As The New York Times reported last month, the administration distributed the intelligence gathered on the Trump transition team widely throughout government agencies, after it had changed the rules on distributing intercepted communications. The point of distributing the information so widely was to “preserve it,” the administration and its friends in the press explained—“preserve” being a euphemism for “leak.” The Obama team seems not to have understood that in proliferating that material they have exposed themselves to risk, by creating a potential criminal trail that may expose systematic abuse of foreign-intelligence collection.

China/Russia Using the Same Cyber Operations Playbook?

As President Trump meets with Xi Jinping of China at Mar A Lago, perhaps he should point to these two conditions in earnest.

North Korean hackers seem to have managed to access a secret war masterplan by South Korea and the U.S. in a cyberattack last September, sources here said Monday.

By Lee Yong-soo: (the item posted below is copyright protected)

Chosun: One government source said Defense Ministry investigators questioned around 40 people over the hacking attack and it appears that part of the masterplan, dubbed OPLAN 5027, “leaked.” A Defense Ministry source said the hackers accessed reports containing portions of the plan, not the entire document.

Defense Minister Han Min-koo and other military officials last year downplayed the seriousness of the hacking attack, saying that only a small number of sensitive military secrets leaked out.

OPLAN 5027 was first drawn up in 1978, when the South Korea-U.S. Combined Forces Command was established, and updated every two years since 1994. It includes troop deployment plans, key North Korean targets, strategies and military control of facilities in the North.

A military official said “discussions are still taking place” whether the plan has to be overhauled now the North has seen chunks of it.

The ministry found out about the leak while investigating a new computer virus in September that attacked the vaccine server at the military cyber command.

Investigators discovered that the Defense Ministry’s Internet and Intranet servers were infected with the same malware, affecting the minister’s own computer and around 2,500 computers with Internet access and 700 connected to the Intranet.

At the time, the ministry said only that hackers accessed “some military information, including sensitive information” and that North Korea appears to be responsible.

The hackers tried to attack the main server of the Defense Integrated Data Center, which serves as the cyber nerve center of South Korea’s defense system.

 

***

China’s Information Warriors Are Growing More Disciplined, Say US Cyber Leaders

And some U.S. cyber leaders worry that the American military’s approach is too reactive and defensive.

When President Trump meets this week with his Chinese counterpart, President Xi Jinping, he’ll be engaging with a leader who commands an increasingly disciplined and persistent information-warfare force.

In December 2015, the Chinese military stood up a Strategic Support Force as part of a larger series of reforms. Essentially a Chinese version of U.S. Cyber Command, the new force focuses on war in the electromagnetic spectrum, space, and cyberspace.  “All these are the new fields that determine whether the PLA can win in the future battlefield,” Chinese officials told state media.

The new force’s key focus is building capabilities to disrupt U.S. military operations, according to Martin Libicki, who leads cybersecurity studies at the U.S. Naval Academy. In January China announced that the country will develop the world’s first exascale super computer by the end of the year.

The move follows years of steady and incremental improvements in information operations, Vice Adm. Tim White, commander of the U.S. Cyber National Mission Force, said Tuesday at the Navy League’s Sea-Air-Space conference. “They are building what I would call campaigns. They are being very thoughtful about it and being purposeful in their approach and there is some design that they are organizing themselves,” he said of adversarial nations such as China but also Russia.  “It’s not just a single mission, point of time, or place. It’s interwoven together to achieve a national purpose.”

By contrast, White worries the U.S. military is thinking too defensively. He believes the Pentagon should work toward a more disciplined, consistent response, and shift from a “broadly reactive” posture “to something we are doing something as a result of our own campaign and planning efforts.”

“They’re on the field and we are figuring out how to get on that field,” White  said. “What nations are doing in this space, it’s more coordinated. It’s more interoperable from their perspective. It’s more structured and it’s more integrated.”

Industrial espionage from China appears to have  waned since Barack Obama and Xi signed an agreement in September 2015. But attacks have not vanished entirely. Between March and May of last year, Chinese hackers deployed a backdoor into a government services company, stole important credentials, and attempted to gain access to U.S. military secrets, according to the FireEye cyber security group.

Without speaking specifically about that incident, Vice Adm. Jan Tighe, deputy chief of naval operations for information warfare and the director of naval intelligence, said that many of the attacks, pings, intrusion attempts and probe “appear to be part of deliberate campaigns” of adversarial nation-state activities against Western targets.

How to fight them off? The head of U.S. Cyber Command, Adm. Michael Rogers, has suggested giving more authority to lower-ranking service personnel. The Navy anticipates that all 40 of the Navy’s cyber mission force teams will reach full operational capability by 2018.

Navy leaders at Sea-Air-Space also said  artificial intelligence would play a bigger role in attacking and defending networks.

“I would not say we see new and exquisite DARPA-like capabilities yet,” emerging out of China in terms of artificial intelligence specifically for information warfare, according to White. “But I do think it will be inevitable because you’re not constrained by physics.”

Meanwhile, the U.S. military is exploring the use of cognitive computing and deep learning to better understand network vulnerabilities and predict attacker behavior, according to Vice Adm. Michael Gilday, who leads the Navy’s 10th Fleet  and Cyber Command, in accordance with phase II of the Command’s strategic plan to 2020, first laid out in 2015.

Marine Maj. Gen. Lori Reynolds, the commander of Marine Forces Cyber Command also maid a plea to industry. “Anything we can do to automate the intelligence cycle … that’s the right investment,”

But Military cyber leaders say that the United States and China will likely put artificial intelligence to different uses in information warfare. Automation can and probably should take over much defensive work to better keep up with the speed of attacks. But the use of offensive cyber weapons will still involve human decision making for the United States military. They could not guarantee the same of China.

AI can absolutely tighten your ability to make a decision inside your enemy’s ability to make a decision,” said Gilday.

Defense One asked Gilday and Tighe if they were seeing adversarial nations attempt to automate the use of offensive cyber weapons. They declined to respond.

Russian Spy Buryakov Deported, and that is it?

You mean there was no swap or something for this spy? How about an apology for this constant problem of our U.S. diplomats around the globe? And most of the country thinks that Russia does nothing wrong or  intercepting phone calls of foreign agents that are occurring with Americans is wrong and names should not be requested to be unmasked. How about insider threats? Okay, well read on….

Russian intelligence and security services have been waging a campaign of harassment and intimidation against U.S. diplomats, embassy staff and their families in Moscow and several other European capitals that has rattled ambassadors and prompted Secretary of State John F. Kerry to ask Vladimir Putin to put a stop to it.

At a recent meeting of U.S. ambassadors from Russia and Europe in Washington, U.S. ambassadors to several European countries complained that Russian intelligence officials were constantly perpetrating acts of harassment against their diplomatic staff that ranged from the weird to the downright scary. Some of the intimidation has been routine: following diplomats or their family members, showing up at their social events uninvited or paying reporters to write negative stories about them.

But many of the recent acts of intimidation by Russian security services have crossed the line into apparent criminality. In a series of secret memos sent back to Washington, described to me by several current and former U.S. officials who have written or read them, diplomats reported that Russian intruders had broken into their homes late at night, only to rearrange the furniture or turn on all the lights and televisions, and then leave. One diplomat reported that an intruder had defecated on his living room carpet. More here.

Russian banker convicted in U.S. spy ring deported to Moscow

A Russian banker convicted last year in the United States for involvement in a spy ring operating in New York City has been deported to Moscow, a U.S. law enforcement agency said on Wednesday.

Evgeny Buryakov, a former New York banker who was convicted in federal court of conspiring to act in the United States as an agent of the Russian Federation, is shown in this handout photo sitting on a commercial flight, escorted by deportation officers and turned over to Russian authorities, April 5, 2017.    United States Immigration and Customs Enforcement (ICE)/Handout via REUTERS

Evgeny Buryakov, a former New York banker who was convicted in federal court of conspiring to act in the United States as an agent of the Russian Federation, is shown in this handout photo sitting on a commercial flight, escorted by deportation officers and turned over to… REUTERS

Evgeny Buryakov, 42, was escorted to Russia by deportation officers aboard commercial flights and turned over to Russian authorities, the U.S. Immigration and Customs Enforcement (ICE) said in a statement.

Buryakov was arrested in January 2015 and charged with two others. U.S. prosecutors said they had worked with the Russian intelligence service and conspired to gather economic intelligence on behalf of Russia, including information about U.S. sanctions against Russia, and to recruit New York City residents as intelligence sources.

Buryakov, who worked at Russian state-owned Vnesheconombank, was sentenced in May by a U.S. district judge in Manhattan to 2-1/2 years in prison after pleading guilty to having conspired to act improperly as an agent for the Russian government.

He received credit for 16 months already spent in custody and was in line to be deported after completing his sentence.

***

Department of Justice
U.S. Attorney’s Office
Southern District of New York

FOR IMMEDIATE RELEASE
Friday, March 11, 2016

Evgeny Buryakov Pleads Guilty In Manhattan Federal Court In Connection With Conspiracy To Work For Russian Intelligence

Evgeny BURYAKOV, a/k/a “Zhenya,” Worked for Russian Intelligence Under “Non-Official Cover” as a Banker in Manhattan

            Preet Bharara, the United States Attorney for the Southern District of New York, and John P. Carlin, Assistant Attorney General for National Security, announced that EVGENY BURYAKOV, a/k/a “Zhenya,” pled guilty today to conspiring to act in the United States as an agent of the Russian Federation, without providing prior notice to the Attorney General.

U.S. Attorney Preet Bharara said:  “An unregistered intelligence agent, under cover of being a legitimate banker, gathers intelligence on the streets of New York City, trading coded messages with Russian spies who send the clandestinely collected information back to Moscow.  This sounds like a plotline for a Cold War-era movie, but in reality, Evgeny Buryakov pled guilty today to a federal crime for his role in just such a scheme.  More than two decades after the end of the Cold War, Russian spies still seek to operate in our midst under the cover of secrecy.  But in New York, thanks to the work of the FBI and the prosecutors in my office, attempts to conduct unlawful espionage will not be overlooked.  They will be investigated and prosecuted.”

Assistant Attorney General John P. Carlin said: “Evgeny Buryakov pleaded guilty to covertly working as a Russian agent in the United States without notifying the Attorney General.  Foreign nations who attempt to illegally gather economic and other intelligence information through espionage pose a direct threat to U.S. national security.  The National Security Division will continue to work with our law enforcement partners to identify and hold accountable those who illegally operate as covert agents within the United States.”

According to the Complaint, the Indictment, other court filings, and statements made during court proceedings:

Beginning in 2012, bURYAKOV worked in the United States as an agent of Russia’s foreign intelligence agency, known as the “SVR.”  BURYAKOV operated under “non-official cover,” meaning he entered and remained in the United States as a private citizen, posing as an employee in the Manhattan office of a Russian bank, Vnesheconombank, also known as “VEB.”  SVR agents operating under such non-official cover – sometimes referred to as “NOCs” – typically are subject to less scrutiny by the host government, and, in many cases, are never identified as intelligence agents by the host government.  As a result, a NOC is an extremely valuable intelligence asset for the SVR.

Federal law prohibits individuals from acting as agents of foreign governments within the United States without prior notification to the United States Attorney General.  Department of Justice records indicate that BURYAKOV never notified the United States Attorney General that he was, in fact, an agent of the Russian Federation.

BURYAKOV worked in New York with at least two other SVR agents, Igor Sporyshev and Victor Podobnyy.  From November 22, 2010, to November 21, 2014, Sporyshev officially served as a trade representative of the Russian Federation in New York.  From December 13, 2012, to September 12, 2013, Podobnyy officially served as an attaché to the Permanent Mission of the Russian Federation to the United Nations.  The investigation, however, showed that Sporyshev and Podobnyy also worked as officers of the SVR.  For their roles in the charged conspiracy, Sporyshev and Podobnyy were charged along with BURYAKOV in January 2015.  However, Sporyshev and Podbonyy no longer lived in the United States and thus were not arrested.

BURYAKOV’s Co-Conspirators Are Recorded Inside the SVR’s New York “Residentura”

During the course of the investigation, the FBI recorded Sporyshev and Podobnyy speaking inside the SVR’s offices in New York, known as the “Residentura.”

The FBI obtained the recordings after Sporyshev attempted to recruit an FBI undercover employee (“UCE-1”), who was posing as an analyst from a New York-based energy company.  In response to requests from Sporyshev, UCE-1 provided Sporyshev with binders containing purported industry analysis written by UCE-1 and supporting documentation relating to UCE-1’s reports, as well as covertly placed recording devices.  Sporyshev then took the binders to, among other places, the Residentura.

During subsequent recorded conversations, Sporyshev and Podobnyy discussed, among other things, Sporyshev’s SVR employment contract and his official cover position, their work as SVR officers, and the FBI’s July 2010 arrests of 10 SVR agents in the United States, known as the “Illegals.”

Sporyshev and Podobnyy also discussed BURYAKOV’s prior service with the SVR in South Africa.  BURYAKOV worked in South Africa between approximately 2004 and 2009, officially as a representative of VEB.  During a conversation about Sporyshev’s cover position in New York, Podobnyy related that, when BURYAKOV was working in South Africa, he had dinner with an SVR official and BURYAKOV’s supervisor at VEB and that, during the dinner, the SVR official told the VEB official that BURYAKOV was an “employee of the Service,” i.e., the SVR.

Further, Sporyshev and Podobnyy were recorded discussing, among other things, their (i) attempting to recruit New York City residents as intelligence sources for Russia; (ii) tasking BURYAKOV to gather intelligence; and (iii) transmitting intelligence reports prepared by BURYAKOV back to SVR headquarters in Moscow.

The directives from the SVR to BURYAKOV, Sporyshev, and Podobnyy, as well as to other covert SVR agents acting within the United States, included requests to gather intelligence on, among other subjects, potential United States sanctions against Russian banks and the United States’ efforts to develop alternative energy resources.

BURYAKOV’s Intelligence Taskings

Sporyshev was responsible for relaying intelligence assignments from the SVR to BURYAKOV.

BURYAKOV Drafts a Proposal for the SVR’s “Active Measures Directorate”

In May 2013, Sporyshev and Podbonyy were recorded discussing a proposal that BURYAKOV had drafted about a planned deal in which Bombardier Aircraft Company (“Bombadier”) in Canada would manufacture certain airplanes in Russia.  Sporyshev noted that Canadian “unions were resisting” and that BURYAKOV’s “proposal [was] for MS” – the SVR’s Active Measures Directorate – to “pressur[e] the unions and secur[e] from the company a solution that is beneficial to us.”  Other evidence developed during the investigation showed that, around the time of this conversation, BURYAKOV had conducted Internet searches relating to Bombardier and labor unions and, earlier, had obtained news articles regarding the planned deal and also attended a conference in Canada that Bombardier personnel also attended.

BURYAKOV Assists Sporyshev in Attempting to Obtain Sensitive Information About the New York Stock Exchange

Also, on May 21, 2013, Sporyshev called BURYAKOV, greeted him, and then described a tasking from “top sources” relating to three questions that ITAR-TASS, a Russian news agency, could put to the New York Stock Exchange.  Sporyshev called the defendant back approximately 20 minutes later.  During the call, BURYAKOV proposed questions regarding (i) exchange traded funds (ETFs), including the “mechanisms of their use to destabilize the market;” (ii) “curbing of trading robot activities;” and (iii) “technical parameters” and “other regulations directly related to the exchange.”  On July 8, 2013, a purported “bureau chief” for ITAR-TASS sent an email to an employee of the New York Stock Exchange that parroted the questions that BURYAKOV proposed to Sporyshev.

BURYAKOV Assists Sporyshev in Analyzing the Effect of Sanctions

Another example of an intelligence tasking occurred in late March 2014.  Specifically, on March 28, 2014, Sporyshev was recorded telling BURYAKOV that Sporyshev needed help researching the “effects of economic sanctions on our country,” among other things.  A few days later, on April 2, 2014, Sporyshev called BURYAKOV and stated, in an intercepted conversation, that he had not seen BURYAKOV in a while, and asked to meet BURYAKOV outside VEB’s office in Manhattan in 20 minutes.  A court-authorized search of BURYAKOV’s computer at VEB revealed that, at around the time of this telephone call, BURYAKOV conducted the following internet searches: “sanctions Russia consiquences” [sic] and “sanctions Russia impact.”

Two days later, on April 4, 2014, BURYAKOV called Sporyshev and, in an intercepted conversation, stated that he (BURYAKOV) “wrote you an order list,” and suggested that they meet.  Approximately 20 minutes later, Sporyshev met BURYAKOV in the driveway of BURYAKOV’s home.  Their encounter, which was captured by a video surveillance camera located near BURYAKOV’s residence, lasted approximately two minutes.  On the video footage, the defendants appeared to exchange a small object.

Clandestine Meetings and Communications

During the course of their work as covert SVR agents in the United States, BURYAKOV, Sporyshev, and Podobnyy regularly met and communicated using clandestine methods and coded messages, in order to exchange intelligence-related information while shielding their associations with one another as SVR agents.  These efforts were designed, among other things, to preserve their respective covers as an employee of VEB (BURYAKOV), a trade representative of the Russian Federation in New York (Sporyshev), and an attaché to the Permanent Mission of the Russian Federation to the United Nations (Podobnyy).

During the investigation, the FBI intercepted numerous calls between BURYAKOV and Sporyshev in which one of the men told the other that he needed to meet for some purpose, such as to transfer an item (such as a “ticket,” “book,” or “list,”) or for a purported social purpose.  In fact, BURYAKOV and Sporyshev used this coded language to signal that they needed to exchange intelligence information.

FBI surveillance revealed that, at some of these meetings between BURYAKOV and Sporyshev, they exchanged documents or other small items.  Notably, despite discussing on approximately a dozen occasions the need to meet to transfer “tickets,” BURYAKOV and Sporyshev were – other than one occasion where they discussed going to a movie – never observed attending, or discussing in any detail, events that would typically require tickets, such as a sporting event or concert.

BURYAKOV’s Receipt of Purported Official United States Government Documents

In the summer of 2014, BURYAKOV met multiple times with a confidential source working for the FBI (“CS-1”) and an FBI undercover employee (“UCE-2”).  Both CS-1 and UCE-2 purported to be working on a casino development project in Russia.

During a conversation recorded on July 22, 2014, Sporyshev warned BURYAKOV that meeting with UCE-2 might be a “trap” but authorized BURYAKOV to go ahead so he could make a better assessment.

During the course of the subsequent meetings, and consistent with his interests as a Russian intelligence agent, BURYAKOV demonstrated his strong desire to obtain information about subjects far outside the scope of his work as a bank employee.  During these meetings, BURYAKOV also accepted documents that were purportedly obtained from a U.S. government agency and which purportedly contained information potentially useful to Russia, including information about United States sanctions against Russia.

*                *                *

            BURYAKOV, 41, pled guilty to one count of conspiring to act in the United States as an agent of the Russian Federation without providing notice to the Attorney General, which carries a maximum sentence of five years.  This statutory maximum sentence is prescribed by Congress and is provided here for informational purposes only, as any sentence imposed on the defendant will be determined by the judge.

BURYAKOV will be sentenced on May 25, 2016, at 11:00 a.m.

U.S. Attorney Bharara praised the investigative work of the FBI’s Counterintelligence Division.

The prosecution is being handled by Assistant U.S. Attorneys Emil J. Bove III, Brendan F. Quigley, and Stephen J. Ritchin of the Terrorism and International Narcotics Unit of the U.S. Attorney’s Office for the Southern District of New York, with assistance provided by Senior Trial Attorney Heather Schmidt of the National Security Division’s Counterintelligence and Export Control Section.