Epic Chinese Hacking is Forecasted

 

In 2015: Washington (CNN) A highly trained group of Chinese hackers is targeting defense, commercial and political organizations worldwide, pulling off sophisticated heists of sensitive information, according to new research out Wednesday.

Though Chinese cyberespionage has been well-documented, researchers from Dell SecureWorks Counter Threat Unit — a division of Dell tech company — say this group, nicknamed Emissary Panda by another research firm, has pulled off cyberattacks at a level of sophistication and specialization rarely seen before among Chinese hackers. More here.

Security Firm Warns of
New Chinese Cyber Attacks

FreeBeacon: China’s cyber attacks against U.S. government and private sector databases are part of a major intelligence-gathering operation and are likely to continue, according to a new report by a cyber security firm.

Chinese hackers stole health care data pertaining to some 80 million Americans last year, and the Office of Personnel Management cyber attacks netted sensitive records on 22 million federal workers, according to an annual threat report made public Wednesday by CrowdStrike, a cyber security and intelligence company. The company is widely consulted by both government and private sector organizations.

The gathering of personal data by the Chinese represents a new trend in Beijing’s aggressive cyber attacks.

“This targeting underscores that intrusion operations associated with nation-states pose a significant risk to all data, no matter how uninteresting it may seem,” the report said.

The 49-page “2015 Global Threat Report” also states that the U.S.-China agreement not to conduct commercial cyber theft has had little impact on Beijing’s cyber operations.

“Beneath the surface, however, China has not appeared to change its intentions where cyber is concerned,” the report said.

Any reduction in Chinese cyber attacks this year likely will be temporary, and an apparent reduction may result from the use of more clandestine methods for conducting attacks following a major military reorganization.

The military changes “will likely increase [China’s] reliance on its civilian intelligence agencies and associated contractors, all of which generally employ better tradecraft,” the report said.

“If observed campaigns in late 2015 were any indication, it is unlikely China will completely cease its cyber operations, and 2016 will show the new direction it is headed,” the report said.

More cyber attacks seeking personal data could take place in the future, and organizations that hold such data “should remain alert to the possibility of similar activity going into 2016,” the report said.

China’s cyber spies usually use cyber intrusions to steal strategic information, such as intellectual property, business operations data, and sensitive government documents.

Stolen personal data, on the other hand, “is typically used to facilitate identity theft or other types of financially motivated crimes,” the report said.

However, the compromised personal information from health insurance companies Anthem, Premera, and CareFirst last year could be used by the government or state-run companies.

The large data theft also appears to be part of Chinese efforts to “build out profiles on individuals to support future operations.”

The federal government data breaches were more damaging and included sensitive background investigation information on federal employees, the report said.

“Without doubt, access to this degree of [personally identifiable information] for both successful and unsuccessful applicants represents a treasure trove of information that may be exploited for counterintelligence purposes,” the report said.

The Chinese can now exploit millions of stolen records for intelligence operations.

“Knowledge acquired during these operations could be used to create more individualized, and therefore more effective, spear phishing campaigns, or also in more traditional, real-world espionage activity,” the report said, noting that the background investigation data “would be particularly useful to traditional [human intelligence] operations as it contains details of a very personal nature about current and former government employees, as well as private sector employees working on government contracts.”

The Chinese government, through the Ministry of Public Security, has launched a major domestic campaign to crack down on online dissent. The Ministry is conducting cyber operations against people and websites that post information opposed by communist authorities, including use of an offensive cyber security force called the “Great Cannon,” a supplement to the Great Firewall designed to block online users from accessing unapproved content.

In Russia, hackers linked to the government used malicious software for intelligence-gathering and for political coercion, such as against Ukraine. Moscow hackers also have conducted cyber reconnaissance—preparation of the cyber battlefield—in Europe and elsewhere.

“In February, widespread spear phishing … was detected and analyzed,” the report said. “These attacks targeted numerous entities in government, defense, and non-governmental organizations (NGOs) in the U.S., Europe, Asia, and South America.”

Russian hackers used stolen emails from a hack against the U.S. strategic consulting firm Stratfor, the report said, a tactic not typical of Russian hacking in the past.

International pressure on Moscow over its military activities, such as the annexation of Ukraine’s Crimea “portend increased intelligence collection by Russia-based adversaries particularly against regional targets and global energy companies,” the report said.

A Russian cyber intelligence operation, dubbed Berserk Bear, targeted oil and gas companies in the Middle East. Another operation, called Fancy Bear, targeted Chinese defense firms.

One Russian hacker group called CyberBerkut operating in Ukraine appears linked to Russian intelligence services.

North Korean cyber activities last year principally involved intelligence-gathering operations directed against South Korea.

Pressure from China could prompt Pyongyang to take a more aggressive cyber posture. And North Korean cyber activities also could expand into criminal activities to raise money for the regime, the report said.

Iran is expected to step up cyber attacks against Saudi Arabia. Regional tensions “increase the likelihood that Iran would use its proven cyber capabilities in 2016, targeting Saudi Arabia and regional governments that are becoming involved in the two countries’ dispute by choosing to align with Saudi Arabia.”

The report names more than 70 cyber adversaries and divides them into three types of attackers: Target intruders, such as nation states, cyber criminals, and “hacktivists.”

For cyber crime, attacks on banks and the use of ransom schemes increased during 2015.

“Phishing emails continued to dominate crimeware distribution throughout the year as the primary mechanism used for the aforementioned banking Trojans and ransomware threats,” the report said.

So-called hacktivist activities including politically motivated cyber attacks by groups like the Syrian Electronic Army and pro-ISIS hackers.

Several pro-Iranian hacker groups also were active last year, including Parastoo, Remember EMAD, and SOBH Cyber Jihad.

The group Remember EMAD—named after the Hezbollah terrorist Imad Mughniyah who was killed in a Damascus car bomb in 2009—claimed to have penetrated Pentagon networks and then threatened to release stolen data. No data was ever released.

ISIS hacking was very active last year and included campaigns of web defacement, the release of personal data—known as “doxing”—and the hijacking of social media accounts.

Russia’s Beachhead Syria, Serbia and Baltics?

New Russian beachhead in Syria

WashingtonTimes: U.S. intelligence agencies are closely watching what appears to be a buildup of Russian military forces in northeastern Syria, very close to the Turkish border.

The buildup has been underway for the past several weeks, and defense officials say there are concerns Moscow is creating a new military air base and outpost similar to the current base near Latakia, on Syria’s Mediterranean coast.

Defense officials said there are indications the Russians are planning to deploy their most advanced air defense weapons, the S-400, at Qamishli, located very close to the Turkish border. Russian-Turkish relations soured in November after Turkish forces shot down a Russian Su-24 jet that strayed into Turkish airspace.

The London Times reported last month that some 200 Russians were fortifying a runway at the Qamishli air base.

The report prompted the Russian Defense Ministry to deny Moscow planned to deploy air forces at the base.

“There are no ‘new’ air bases or additional pre-strike staging ports for Russian warplanes in the territory of [the] Syrian Arab Republic, and there are no plans to create them,” Russian Defense Ministry spokesman Igor Konashenkov told the Interfax news agency.

The Russian activity at Qamishli has set off alarms in Turkey, a NATO ally, with fears the Russians are preparing to conduct threatening operations against Turkey in retaliation for the downing of the Su-24, which led to the death of one of the two crew members and a member of the Russian team sent to rescue the downed crew.

Russia denied the jet violated Turkish airspace and said it would retaliate against the Turks for the incident.

Turkey then announced Jan. 30 that another Russian jet violated Turkish airspace, prompting another denial from Moscow.

An Israeli think tank, The Fisher Institute for Air and Space Strategic Studies, this week published photos of the Russian military buildup at Latakia. The photos reveal deployments of over 30 warplanes, including 11 of the supersonic Su-24 bombers. Additionally, the photos show 10 Su-25s and seven advanced Su-35s.

Defense officials say the Russian airstrikes in Syria are aimed primarily at anti-regime rebels with only limited strikes against the Islamic State terrorist group.

The S-400 batteries also are visible in the photos along with Pantsir SA-22 missiles.

***

Serbia and Russia

Moscow confirms: Serbia wants Russian missiles and warplanes

Serbia is interested in buying Russian air defense systems Tor, Pantsir, and Buk, as well as MiG-29 warplanes, Sputnik is reporting.

Belgrade showed interest in this after Croatia announced it planned to buy American weapons, a representative of the Russian Federal Service for Military Technical Cooperation said.

“We are considering the issue of delivering air defense systems and MiG-29s to Serbia. That country is our strategic partner in Europe in many spheres, including military-technical cooperation,” the source said.

It was stated on January 15 that in the wake of Croatia’s announced plans to buy MGM-140 ATACMS missiles, Serbia became interested in Russian air defense systems and jets.

If Russia Started a War in the Baltics, NATO Would Lose — Quickly

FP: If Russian tanks and troops rolled into the Baltics tomorrow, outgunned and outnumbered NATO forces would be overrun in under three days. That’s the sobering conclusion of war games carried out by a think tank with American military officers and civilian officials.

“The games’ findings are unambiguous: As currently postured, NATO cannot successfully defend the territory of its most exposed members,” said a report by the RAND Corp., which led the war gaming research.

In numerous tabletop war games played over several months between 2014-2015, Russian forces were knocking on the doors of the Estonian capital of Tallinn or the Latvian capital of Riga within 36 to 60 hours. U.S. and Baltic troops — and American airpower — proved unable to halt the advance of mechanized Russian units and suffered heavy casualties, the report said.

The study argues that NATO has been caught napping by a resurgent and unpredictable Russia, which has begun to boost defense spending after having seized the Crimean peninsula in Ukraine and intervened in support of pro-Moscow separatists in eastern Ukraine. In the event of a potential Russian incursion in the Baltics, the United States and its allies lack sufficient troop numbers, or tanks and armored vehicles, to slow the advance of Russian armor, said the report by RAND’s David Shlapak and Michael Johnson.

“Such a rapid defeat would leave NATO with a limited number of options, all bad,” it said.

The United States and its NATO allies could try to mount a bloody counter-attack that could trigger a dramatic escalation by Russia, as Moscow would possibly see the allied action as a direct strategic threat to its homeland.  A second option would be to take a page out of the old Cold War playbook, and threaten massive retaliation, including the use of nuclear weapons. A third option would be to concede at least a temporary defeat, rendering NATO toothless, and embark on a new Cold War with Moscow, the report said.

However, the war games also illustrated there are preemptive steps the United States and its European allies could take to avoid a catastrophic defeat and shore up NATO’s eastern defenses, while making clear to Moscow that there would no easy victory.

A force of about seven brigades in the area, including three heavy armored brigades, and backed up by airpower and artillery, would be enough “to prevent the rapid overrun of the Baltic states,” it said. The additional forces would cost an estimated $2.7 billion a year to maintain.

The report was released Tuesday, the same day Defense Secretary Ash Carter unveiled plans to add more heavy weapons and armored vehicles to prepositioned stocks in Eastern Europe to give the Pentagon two brigade sets worth of heavy equipment on NATO’s eastern frontier.  As it stands now, there are two U.S. Army infantry brigades stationed in Europe — one in Italy and the other in Germany — but they have been stretched thin by the constant demands of training rotations with allies across the continent. The new $3.4 billion plan outlined by Carter and the White House would add another brigade to the mix, but it would be made up of soldiers from the United States, rotating in for months at a time.

Late last month, Gen. Philip Breedlove, commander of U.S. European Command, released a new strategy anticipating — and pushing back against — the call for more rotational forces. Flying troops in and out of the region “complements” the units who call Europe home, he wrote, but they’re no “substitute for an enduring forward deployed presence that is tangible and real. Virtual presence means actual absence.”

David Ochmanek from the RAND Corp., a former senior Pentagon official who has studied the challenge posed by Russia’s military, called the administration’s budget proposal for European forces an important step and an “encouraging sign.”

“Heavy armored equipment, pre-positioned forward, is the sine qua non of a viable deterrent and defense posture on the alliance’s eastern flank,” Ochmanek told Foreign Policy. But he said much more needed to be done to strengthen NATO’s defenses.

The findings from the war games will be warmly welcomed by senior officers in the U.S. Army, who have struggled to justify the cost of maintaining a large ground force amid budget pressures in recent years and a preference for lighter footprints. And the report will reinforce warnings from top military leaders, including the chairman of the Joint Chiefs of Staff, Gen. Joseph Dunford, that Russia may represent the number one threat to U.S. interests.

In early 2012, the Obama administration announced the withdrawal of two heavy brigades and their equipment from Germany, cutting deeply into the U.S. Army’s traditional, large footprint on the continent. Since then, the service has been slowly trying to move some hardware back into Germany for use in training exercises with NATO partners. Last year, U.S. Marines also began to roll a small number of Abrams tanks into Romania for a series of exercises with local forces.

Since Russia’s intervention in Ukraine sparked alarm in Eastern Europe, the United States has repeatedly vowed to defend Estonia, Latvia, and Lithuania in the event of an attack, citing its mutual defense obligations under the NATO alliance. In a September 2014 speech in Tallinn, President Barack Obama made an explicit promise to protect the Baltic countries.

“We’ll be here for Estonia.  We will be here for Latvia.  We will be here for Lithuania.  You lost your independence once before. With NATO, you will never lose it again,” Obama said.

But the RAND report said “neither the United States nor its NATO allies are currently prepared to back up the president’s forceful words.”

The borders that the three Baltic countries — all former Soviet republics — share with Russia and Belarus are about the same length as the one that separated West Germany from the Warsaw Pact during the Cold War. But in that era, NATO stationed a massive ground force along the frontier with more than 20 divisions bristling with tanks and artillery.

Tanks are few and far between now in NATO countries, the report said. Germany’s arsenal of about 2,200 main battle tanks in the Cold War has declined to roughly 250. Britain, meanwhile, is planning on pulling out its last brigade headquarters left on the continent.

With only light infantry units at the ready in the Baltics, U.S. and NATO planners are also worried about the continued Russian arms buildup in the exclave of Kaliningrad on the Baltic coast between Poland and Lithuania, and Moscow’s intention to build a new air force base in Belarus, just south of the Polish-Lithuanian border.

The war games run by RAND underscored how U.S. and NATO forces lack the vehicles and firepower to take on their Russian adversaries, which have maintained more mechanized and tank units. NATO ground troops also lacked anti-aircraft artillery to fend off Russian warplanes in the Baltic scenario.

“By and large, NATO’s infantry found themselves unable even to retreat successfully and were destroyed in place,” the report said.

In the war games, although U.S. and allied aircraft could inflict damage on the invading Russian forces, they also were forced to devote attention to suppressing Russia’s dense air defenses and defending against Russian air attacks on rear areas.

Although it was unclear if deploying more troops and armor would be enough to discourage Russia from gambling on an attack in the Baltics, NATO’s current weak position clearly did not pose a persuasive deterrent, the report said.

By undertaking “due diligence” and bolstering NATO’s defenses, the alliance would send “a message to Moscow of serious commitment and one of reassurance to all NATO members and to all U.S. allies and partners worldwide,” it said.

 

 

Libya, to Be or Not to Be, Mercenaries

ISIS Recruits Poor Africans as Fighters for Libya with Cash Bonus

Rendition for Edward Snowden?

Edward Snowden did perform a duty and that was to expose the NSA programs and the associated intrusions. However, stealing documents and sharing them with roque nations and adversarial countries is best described as high crimes and misdemeanors. Would planning a rendition operation be altogether misguided?

Secret US flight flew over Scottish airspace ‘to capture Snowden’

TheNational: THE UK GOVERNMENT is facing demands to reveal the details of a secret flight through Scottish airspace which was at the centre of a plot to capture whistleblower Edward Snowden.

The plane, which passed above the Outer Hebrides, the Highlands and Aberdeenshire, was dispatched from the American east coast on June 24 2013, the day after Snowden left Hong Kong for Moscow. The craft was used in controversial US ‘rendition’ missions.

Reports by Scottish journalist Duncan Campbell claim the flight, travelling well above the standard aviation height at 45,000 feet and without a filed flight plan, was part of a mission to capture Snowden following his release of documents revealing mass surveillance by US and UK secret services.

That the flight passed over Scotland, airspace regulated by the UK, has raised questions over UK complicity in a covert mission to arrest Snowden and whether any police, aviation or political authorities in Scotland were made aware of the flight path.

Alex Salmond, the SNP foreign affairs spokesman and Scotland’s First Minister when the flight took place, has called for full transparency from the UK Government over the case.

He said: “As a matter of course and courtesy, any country, particularly an ally, should be open about the purposes of a flight and the use of foreign airspace or indeed airports.”

“What we need to know now is, was this information given to the UK Government at the time. If so, then why did they give permission? If not, then why not? As a minimum requirement, the UK authorities should not allow any activity in breach of international law in either its airspace or its airports.

“That is what an independent Scotland should insist on. Of course, since no rendition actually took place in this instance, it is a moot point as to whether intention can constitute a breach of human rights. However, we are entitled to ask what the UK Government knew and when did they know it.”

The flight took place after US federal prosecutors filed a criminal complaint against Snowden on June 14. Regular meetings with the FBI and CIA, convened by US Homeland Security adviser Lisa Monaco, then planned Snowden’s arrest for alleged breaches of the Espionage Act, according to The Washington Post.

New documents, revealed by Danish media group Denfri, confirm that the N977GA plane was held at a Copenhagen airport for “state purposes of a non-commercial nature”. Two days later Danish authorities received an “urgent notification” from the US Department of Justice to cooperate in arresting Snowden.

N977GA was previously identified by Dave Willis in Air Force Monthly as an aircraft used for CIA rendition flights of US prisoners. This included the extradition of cleric Abu Hamza from the UK. Snowden accused the Danish Government of conspiring in his arrest. In response to flight reports, he said: “Remember when the Prime Minister Rasmussen said Denmark shouldn’t respect asylum law in my case? Turns out he had a secret.”

Snowden was behind the largest leak of classified information in history, revealing spying activities that were later deemed illegal on both sides of the Atlantic. He was elected rector at the University of Glasgow in February 2014, yet is unable to fully carry out his duties.

Patrick Harvie, co-convener of the Scottish Green Party, echoed calls for an inquiry into the flight: “It will certainly raise suspicions that an aircraft previously identified as involved in rendition flew through UK airspace at that time. We have a right to know what UK and Scottish authorities knew about this flight given it is implicated in the US response to whistleblowing about global surveillance.”

ATTEMPTS to arrest Snowden have failed as Russian authorities refused to comply. However, pressure from US authorities made it dangerous for Snowden to travel from Russia to Latin America, where Ecuador, Nicaragua, Bolivia, and Venezuela have all offered him asylum.

The presidential plane of Bolivian leader Evo Morales was forced to ground in Vienna, after four EU nations refused airspace access on the mistaken belief that Snowden was hidden on board.

In 2013 Police Scotland launched an investigation into whether other US rendition flights – where prisoners were taken to blacklist torture sites – used Scottish airports or airspace.

In 2006 aviation expert Chris Yates said it was likely that a US rendition flight had passed through Scottish airspace to Syria, in a case where the prisoner, Maher Arar, said he was tortured.

In 2008 then foreign secretary David Miliband admitted that UK airports had been used for US rendition flights and apologised for previous government denials.

American politics lecturer John MacDonald, director of foreign policy group the Scottish Global Forum, said: “Given the constitutional arrangements, there are a number of areas in which the Scottish Government may well have interests or concerns but will be excluded because security arrangements with the US are deemed ‘out of bounds’ for Scotland.

“However, if you take serious the supposition that all responsible governments have a moral and legal obligation to raise questions about flights which may be involved in dubious security and intelligence activities, then the Scottish Government may well have an interest in – or even be obliged to –raise questions.

“Questions have already been raised about the nature of military and intelligence air traffic through Scotland and if this activity is raising concerns within Scottish civil society – and it seems to be – then it is surely incumbent upon the Scottish Government to raise the issue with London.”

National Air Traffic Control Systems (Nats), who control flight access to UK airspace, said rendition flights are an issue for the UK Government. In response to questions, the UK Government refused to provide details on attempts to arrest Snowden or on the passage of the N977GA flight.

The Scottish Government also avoided a direct statement on the case on legal grounds. A spokesman said: “There is already an ongoing Police Scotland investigation, directed by the Lord Advocate. This investigation will seek to gather all available evidence of rendition flights using Scottish airports. As this is a live investigation it would be inappropriate to comment further.”

During his two and a half years in Moscow, Snowden has caused diplomatic ruptures and a worldwide debate on privacy and state security. In October 2015 the European Parliament voted narrowly, in a non-binding motion, to drop charges against him in recognition of “his status as [a] whistle-blower and international human rights defender”.

Argentina, U.S. Treasury, a Bombing and a Murder

Exclusive: Documents Confirm Leak of Unexplained Deposits to Nisman’s US Bank Account

by Michael LaSusa

Documents obtained exclusively by LobeLog confirm that Argentine officials violated an agreement with the US Treasury Department by leaking sensitive financial information regarding deceased prosecutor Alberto Nisman. These leaks could complicate further US-Argentine cooperation in the controversial investigations surrounding Nisman’s death.

The leaks exposed a number of suspicious financial transactions involving a New York bank account maintained by Nisman since March 2002. Argentine authorities are currently investigating the possibility that the account was used for money laundering, while a separate inquiry attempts to determine the cause of Nisman’s death.

Argentine investigators have previously hypothesized that some of the deposits in Nisman’s New York account could be linked to a group of US investors, including some prominent funders of conservative political causes, who have been locked in a years-long legal battle with Argentina over the country’s debt.

And media reports have recently surfaced that appear to confirm that Nisman received questionable payments through a separate bank account in Uruguay from a company owned by US billionaire Sheldon Adelson, one of the most influential fund-raisers on the American conservative political scene.

Neither the money laundering investigation nor the inquiry into Nisman’s death has yet reached an official conclusion. But the information contained in the documents obtained by LobeLog, combined with a months-long investigation, sheds new light on a case that Argentine journalist Uki Goni wrote has “enough twists and turns to satisfy the most avid conspiracy theorist.”

Suicide or Murder?

When Nisman was found dead in his apartment on January 18, 2015, the news made headlines around the world. For more than a decade, the prosecutor had led the investigation into the 1994 bombing of the headquarters of the Argentine Jewish Mutual Association—AMIA, by its Spanish acronym—the deadliest anti-Semitic attack in Latin American history.

In 2006, Nisman formally charged several high-level Iranian officials with masterminding the bombing. Just days before he died, he had accused the administration of former Argentine President Cristina Kirchner of making a pact with the Iranians in 2013 to set aside their alleged involvement in the AMIA attack in exchange for closer economic ties between the two countries.

The day before Nisman was scheduled to testify about his allegations in an emergency session of congress, he was found dead in his bathroom with a single gunshot wound to his head.

Many observers have speculated that Nisman’s death relates in one way or another to his involvement in the AMIA case, especially given the nature and timing of the accusations he lodged against the Kirchner government. Kirchner herself has suggested that rogue elements of the country’s now-disbanded and reconstituted intelligence service murdered Nisman in order to destabilize her government.

On the other hand, Argentine journalist Facundo Pastor recently published a book suggesting that Nisman killed himself after realizing the weakness of the evidence for his allegations. “He spent two years confronting the government,” Pastor told The Independent, “but the day comes to present his case and Nisman realises that he has nothing.”

An Argentine federal judge dismissed Nisman’s charges against the Kirchner administration soon after the prosecutor’s death. The country’s recently inaugurated president Mauricio Macri has promised not to appeal a separate ruling by an Argentine court that declared the 2013 agreement with Iran unconstitutional.

Argentine government investigators still have not determined whether Nisman’s death was a suicide or a murder, but members of Nisman’s family have questioned several aspects of the government’s inquiry so far. And adding yet another twist to an already convoluted story, the late prosecutor’s ex-wife, Sandra Arroyo Salgado, who serves as a federal judge in Argentina, has maintained that Nisman was assassinated for “economic motives.”

Money Laundering

Arroyo Salgado revealed the existence of Nisman’s New York bank account to Argentine authorities in March 2015. Nisman’s mother, Sara Garfunkel, and his sister, Sandra Nisman, were listed as signatories on the account, as was Diego Lagomarsino—the technology expert who worked in Nisman’s office and admitted to giving the late prosecutor the gun that apparently killed him.

Shortly after Arroyo Salgado’s revelation, the Financial Information Unit (UIF) of the Argentine Justice and Human Rights Ministry asked for money laundering charges to be brought against Lagomarsino, who had reportedly sent half his monthly salary to the New York account. Soon after Lagomarsino was charged, Garfunkel and Sandra Nisman were also indicted for their alleged involvement in laundering funds through the account.

In April, the federal judge then in charge of the case, Rodolfo Canicoba Corral, requested information on the alleged money laundering from US authorities. According to the documents obtained by LobeLog, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) “shared sensitive financial information with the UIF on Argentinian [sic] subjects associated with the deceased prosecutor and their joint investment account at Merrill Lynch in New York, and other accounts in Uruguay and other countries.”

“Since the [Argentine] courts’ requests for information from the US Department of Justice (DOJ) were taking too long,” the document continues, the head of the UIF, Jose Alberto Sbatella, “was asked by Argentine Federal Judge Canicoba Corral to ask for FinCEN’s permission to incorporate FinCEN’s relevant report in the case file so that it could be used as evidence in court.”

On July 7, Argentine news outlet Infobae reported that it had gained exclusive access to documents related to the money laundering case. A few days later, on July 16, Infobae reported that Sbatella had turned over the FinCEN report to Canicoba Corral, and that the judge was seeking to incorporate it as evidence in the proceedings. (This request was granted in September.)

Then, on July 27, the Buenos Aires-based news outlet Pagina/12 published an article titled “Nisman and his incredible financial relations,” which revealed previously unknown details about suspicious transactions involving Nisman’s New York account.

Several other media reports followed that contained information apparently provided by FinCEN to the UIF, which had in turn handed it over to Canicoba Corral, who was removed from the case in November after making prejudicial statements to various media outlets about the defendants’ alleged guilt.

Anatomy of a Leak

A US State Department employee sent an email with an English translation of the Pagina/12 article to colleagues at the Treasury Department on August 6, captioning it with the message, “It now appears indisputable that Argentine authorities, in violation of their agreement with Treasury, have leaked information about Alberto Nisman.”

Argentine news outlet Perfil subsequently published a front-page report on August 23 titled, “Nimsan received almost $600,000 in the US from nine suspicious depositors.” The English-language Buenos Aires Herald followed up the story the next day with a piece headlined, “Suspicious transfers raise more questions on Nisman.”

On August 24, a State Department employee sent another email to colleagues at the Treasury Department with links to both above-mentioned articles.

“[I] wanted to make sure you or you successor at Treasury saw that the story below made the front page of Perfil this weekend and was picked up by the [Buenos Aires] Herald today,” the message reads in part. The author then asks, “Is this just rehashing of an old story or something new?”

The documents—obtained by LobeLog from the Treasury Department via a freedom of information request—are almost entirely redacted, making it impossible to tell what, if any, response Treasury employees provided to the State Department emails.

The Treasury Department and the State Department declined to comment for this story, as did the US Department of Justice. The latter claimed through a spokesperson that the “investigation is a matter of Argentine jurisdiction and, therefore, any inquiries should be directed to Argentine authorities.” LobeLog sought comment from the Argentine Ministry of Justice and Human Rights, but did not receive a response.

Unexplained Transactions

The August 23 article from Perfil, based on information reportedly provided by US financial investigators to their Argentine counterparts, detailed nearly $600,000 in suspicious deposits made to Nisman’s New York bank account between 2012 and 2014.

Officials from the UIF had previously speculated that some of that deposits could have originated from the “holdouts,” a group of investors who have refused Argentina’s debt restructuring offers, and who stand to make billions of dollars if they prevail in the related legal dispute that is currently playing out in U.S. courts. One of the most prominent “holdouts” is NML Capital, owned by billionaire hedge fund manager and Republican Party power broker Paul Singer.

Since Nisman’s death, lobbying groups with ties to the “holdouts” have funded efforts to promote his work on the AMIA case. While the prosecutor was alive, these organizations spent millions of dollars on a campaign to “do whatever we can to get our government and media’s attention focused on what a bad actor Argentina is,” in the words of one group’s executive director.

An independent investigation by LobeLog did not reveal any definite links between the “holdouts” and the depositors identified by various news reports. However, the timing of some of the transactions does appear to coincide with important developments related to the debt dispute.

One example is that of “Joseph Gestetner,” who deposited $10,000 in Nisman’s account on September 13, 2012. Perfil reported that his name “does not appear in official records.” When contacted for comment, New York-based public relations professional and Orthodox Jewish community activist Yossi Gestetner—sometimes known as Joseph—denied that the documents obtained by Perfil referred to him.

Public records searches similarly turned up little information about “Daniel Benayon,” who transferred $15,000 to Nisman’s account on the same day as the transfer from Gestetner. A Facebook profile indicates that a man named Daniel Benayon lived in Argentina and worked for a Buenos Aires-based Orthodox Jewish organization, but messages seeking comment from this individual did not receive a response.

One of the largest single deposits revealed by Perfil came from “RODFA Limited,” which transferred $134,975 to Nisman’s New York account on September 14, 2012—the day after the deposits from Gestetner and Benayon.

Public records research uncovered that the company was incorporated in March 2012 in Hong Kong, listing “Rodrigo Martin Ferreiros” and “Facundo Pla” as signatories on the incorporation documents. (The name RODFA appears to derive from the first several letters of the two individuals’ names.)

A document filed with the Hong Kong Companies Registry notes that Pla ceased to act as director of RODFA on September 1, 2012—roughly two weeks before the deposit to Nisman’s account. A separate document indicates that Ferreiros assumed the position of director in March 2013. According to RODFA’s most recent annual filing, Ferreiros, who listed a Buenos Aires address in the document, continued to serve as director of RODFA as of March 2015.

Infobae reporter Andres Ballesteros revealed that the Argentine Senate briefly employed an individual named Rodrigo Martin Ferreiros from September to December 2013. However, efforts to uncover more detailed information about Ferreiros and Pla, as well as attempts to contact them for comment, were unsuccessful.

The series of deposits from September 13 and 14, 2012—totaling roughly $160,000—occurred at the same time that an important discussion of the Argentine debt situation was unfolding at a meeting of the “Paris Club,” an informal group of financial officials from various countries tasked with helping resolve disputes between creditors and debtor nations. The deposits also coincided with mass anti-government protests in Argentina against the administration of then-president Cristina Kirchner.

More Mysterious Deposits

In addition to the transfers described above, Perfil also revealed a $50,000 deposit to Nisman’s account from “Guillermo N. Salemi” [sic] on August 21, 2014, as well as another deposit of $50,000 made the same day from a firm called “Las Tierras USA.” An individual named Guillermo N. Salimei [sic] is listed as the registered agent of three active companies incorporated in the Miami area in 2013, including Las Tierras USA.

When contacted for comment, the registered president of Las Tierras, Agustin Misson, confirmed that he was a “friend” of Salimei, but claimed that he did not know how to get in touch with him. Misson also said he knew nothing about the bank transfers. Further attempts to reach Salimei for comment were not successful.

On August 21, 2014, the same day as the transfers from Salimi and Las Tierras, a $10,000 deposit was made to Nisman’s account by an entity referred to as “Iungelson (from Israel).” Perfil reported that “Iungelson” may refer to a member of Nisman’s extended family, but LobeLog was unable to determine whether the name refers to an individual or an organization.

On August 22, 2014—the day after the Salimei, Las Tierras and Iungelson transfers—Nisman’s account received a $50,000 deposit from “Vivaterra SA,” whose name matches that of a South American travel agency based in Brazil. LobeLog made initial contact with a representative of the firm’s Argentina office, but repeated requests for comment went unanswered.

This series of deposits—also totaling $160,000—were made less than two weeks after the Kirchner administration announced that it would sue the United States in the International Court of Justice over a ruling by US judge Thomas Griesa that ordered US banks not to process any of Argentina’s payments to its debt-holders until the country also agreed to pay the “holdouts.” The bulk of these payments came on August 21—the same day that Griesa ruled against a proposal by the Argentine government intended as a workaround to his previous decision.

Further Twists and Turns

The name of yet another mysterious figure has also surfaced in connection with Nisman’s New York account: Claudio Picon, the owner of the Argentine packaging business Palermopack. Picon’s brother and business partner Fabian Picon is the son-in-law of Hugo Anzorreguy, the former head of Argentina’s intelligence service who is now on trial for his alleged role in facilitating a bribe to a key witness in the AMIA case.

Perfil reported last June that Claudio Picon deposited $200,000 in Nisman’s account in July 2012, around the time of crucial hearings in the US court system related to the debt dispute between Argentina and the holdouts.

In the August 23 expose, Perfil also documented transfers by Picon to Nisman’s New York account totaling $72,000 between January 2013 and March 2014—a time period during which the controversy over the debt dispute and the agreement between Argentina and Iran regarding the AMIA case reached a peak.

In addition, the Picon brothers’ company owned an Audi Q5 sport utility vehicle commonly driven by Nisman, which Claudio Picon has said he lent to the late prosecutor for free on account of their close friendship. Representatives for the Picons could not be reached for comment.

One of the most enigmatic figures mentioned in the documents obtained by Perfil is Damian Stefanini, an Argentine businessman who deposited $150,000 in Nisman’s account on October 23, 2012—less than a week before Griesa issued another ruling against Argentina in the debt dispute.

Perfil journalist Emilia Delfino reported that according to “judicial sources” Stefanini and Claudio Picon had traveled together to Sao Paulo around the time of that deposit, and that they had also traveled together to other countries, including Paraguay, Uruguay, the United States and China.

On October 17, 2014—just three months before Nisman’s death—Stefanini vanished. His car was later found abandoned near his accountant’s office in Buenos Aires, blocks away from the address listed by Ferreiros as director of RODFA.

Argentine authorities are investigating Stefanini’s disappearance as a kidnapping, but they have not yet identified any suspects. The international law enforcement organization Interpol has issued the equivalent of a worldwide missing person notice for Stefanini.

Arroyo Salgado, Nisman’s ex-wife, had been in charge of the investigation into Stefanini’s disappearance until she was recused from the case in October due to her potential for bias following the revelation of the financial link between the missing entrepreneur and her late ex-husband. Arroyo Salgado has indicated that she will appeal that decision.

Murky Outlook

The leak of information provided in confidence by US authorities to their Argentine counterparts could complicate further cooperation between the United States and Argentina regarding the investigations into Nisman’s death and the money laundering that allegedly occurred using his New York bank account.

At the same time, the recent election of Mauricio Macri as Argentina’s president could help improve the country’s often-strained relations with the United States. Following Macri’s victory, US congressional Representatives Ed Royce (R-CA) and Eliot Engel (D-NY) called for the US to “prioritize” its relationship with Argentina, saying the two nations “should be natural partners.”

When Macri announced his intention not to appeal the decision voiding the 2013 Argentine-Iranian agreement, the Twitter account of the foreign affairs committee of the House of Representatives posted a message signed by Royce that read, “Glad to see #Argentina has scrapped this disturbing pact w/ #Iran.”

It remains to be seen, however, whether an improvement in overall US-Argentine relations would also include a deepening of cooperation on the Nisman case, especially given the previous breach of trust.

In fact, the US Department of Justice recently declined a request to turn over Nisman’s electronic communication records to Argentine prosecutor Viviana Fein, who was leading the investigation into the late prosecutor’s death. Judge Fabiana Palmaghini has since replaced Fein as head of the investigation, and has made it clear that she intends to closely examine the possibility that Nisman may have been murdered.

As several observers and commentators have previously noted, Nisman is only the latest in a long line of high-profile Argentine figures who died suddenly under mysterious circumstances. Controversy continues to surround many of these previous cases years after the investigations ended. And even the AMIA case itself remains unsolved, despite the passage of more than two decades since the attack.

This history suggests that a full accounting of Nisman’s death—whether it was tied to his work on the bombing or to the suspicious deposits, or whether those two threads of the story relate to one another—will not be forthcoming any time soon.