Cyberwar, Deeper Truth on China’s Unit 61398

The NSA has been hacking China for years, so it is a cyberwar. What the United States cyber experts have known at least since 2009 spells out that there has been no strategy to combat cyber intrusions much less a declaration that these hacks are an act of war.

The NSA Has A Secret Group Called ‘TAO’ That’s Been Hacking China For 15 Years

China hacking charges: the Chinese army’s Unit 61398
Operating out of a tower block in Shanghai, Unit 61398 allegedly hacks Western companies in support of the Chinese government’s political and economic aims.

From DarkReading:

According to the DOJ indictment, Huang Zhenyu was hired between 2006 and 2009 or later to do programming work for one of the companies (referred to as “SOE-2” in the indictment). Huang was allegedly tasked with constructing a “secret” database to store intelligence about the iron and steel industry, as well as information about US companies.

“Chinese firms hired the same PLA Unit where the defendants worked to provide information technology services,” according to the indictment, which the US Department of Justice unsealed Monday. “For example, one SOE involved in trade litigation against some of the American victims herein hired the Unit, and one of the co-conspirators charged herein, to hold a ‘secret’ database to hold corporate ‘intelligence.'”

The for-hire database project sheds some light on the operations of China’s most prolific hacking unit, Unit 61398 of the Third Department of China’s People’s Liberation Army (also known as APT1), where the alleged hackers work. US Attorney General Eric Holder announced an unprecedented move Monday: The Justice Department had indicted the five men with the military unit for allegedly hacking and stealing trade secrets of major American steel, solar energy, and other manufacturing companies, including Alcoa, Allegheny Technologies Inc., SolarWorld AG, Westinghouse Electric, and US Steel, as well as the United Steel Workers Union.

It has never been a secret, it has only been a topic debated with no resolutions behind closed doors. China has a database on Americans and is filling it with higher details, growing their intelligence on everything America.

China has launched a strategic plan when one examines the order of hacks of American companies, the timing and the data. A full report was published on Unit 61398.

New York Times report

Hacked in the U.S.A.: China’s Not-So-Hidden Infiltration Op

From Bloomberg: The vast cyber-attack in Washington began with, of all things, travel reservations.

More than two years ago, troves of personal data were stolen from U.S. travel companies. Hackers subsequently made off with health records at big insurance companies and infiltrated federal computers where they stole personnel records on 21.5 million people — in what apparently is the largest such theft of U.S. government records in history.

Those individual attacks, once believed to be unconnected, now appear to be part of a coordinated campaign by Chinese hackers to collect sensitive details on key people that went on far longer — and burrowed far deeper — than initially thought.

 

But time and again, U.S. authorities missed clues connecting one incident to the next. Interviews with federal investigators and cybersecurity experts paint a troubling portrait of what many are calling a serious failure of U.S. intelligence agencies to spot the pattern or warn potential victims. Moreover, the problems in Washington add new urgency to calls for vigilance in the private sector.

In revealing the scope of stolen government data on Thursday, Obama administration officials declined to identify a perpetrator. Investigators say the Chinese government was almost certainly behind the effort, an allegation China has vehemently denied.

‘Facebook of Intelligence’

Some investigators suspect the attacks were part of a sweeping campaign to create a database on Americans that could be used to obtain commercial and government secrets.

“China is building the Facebook of human intelligence capabilities,” said Adam Meyers, vice president of intelligence for cybersecurity company CrowdStrike Inc. “This appears to be a real maturity in the way they are using cyber to enable broader intelligence goals.”

The most serious breach of records occurred at the U.S. Office of Personnel Management, where records for every person given a government background check for the past 15 years may have been compromised. The head of the government personnel office, Katherine Archuleta, resigned Friday as lawmakers demanded to know what went wrong.

The campaign began in early 2013 with the travel records, said Laura Galante, manager of threat intelligence for FireEye Inc., a private security company that has been investigating the cyber-attacks.

Stockpiling Records

By mid-2014, it became clear that the hackers were stockpiling health records, Social Security numbers and other personal information on Americans -– a departure from the country’s traditional espionage operations focusing on the theft of military and civilian technology.

“There was a clear and apparent shift,” said Jordan Berry, an analyst at FireEye.

Recognition came too late for many of the victims. Vendors of security devices say health-care companies are spending tens of millions of dollars this year to upgrade their computer systems but much of the data is already gone.

U.S. intelligence agencies were collecting information on the theft of personal data but failed to understand the scope and potential damage from the aggressive Chinese operation, according to one person familiar with the government assessment of what went wrong.

In the last two years, much of the attention of U.S. national security agencies was focused on defending against cyber-attacks aimed at disrupting critical infrastructure like power grids.

 

Iran Deal, Deviled Details and $300 Billion

Both sides are saying the others are throwing sand in the gears to publishing a final document of the Joint Plan of Action with Iran and the P5+1.

In part from FarsNews: “We have reached a stage now that the other side should decide if it is seeking an agreement or pressure; we have said many times that agreement and pressure cannot come together and one of them should be chosen,” Zarif told reporters in Vienna.

He reiterated that if the other side shows political will and inclination for a balanced and good deal it will be achievable.

Zarif, however, said that unfortunately the other side is showing change in stances and raising excessive demands which make the conditions difficult, adding, “We are doing our best as Supreme Leader (of the Islamic Revolution Ayatollah Seyed Ali Khamenei) and other Iranian officials have said many times we are looking for a good deal and we will continue the negotiations; we have never left the negotiations and we will not in future.”

The Geneva interim deal envisaged the removal of all the UN and unilateral US and EU sanctions against Iran under a final comprehensive deal.

Also, in a framework agreement approved by the six powers and Iran in April known as the Lausanne Statement, the seven nations agreed that a final deal would include removal of all sanctions as well as a UN Security Council resolution which would call all the five UNSC sanctions resolutions imposed against Iran’s nuclear activities as “null and void”.

The first two UNSC resolutions boycotted export of military, specially missile, hardware and software to Iran, a sanction that – along with all the other embargoes imposed against Iran under the five UNSC resolutions – would be automatically removed under the new UNSC resolution that, according to the Lausanne framework agreement, should be issued on the same day that the final deal is endorsed.

Hence, the debate over the removal of the UN Security Council arms embargoes against Iran means US defiance of both agreements.

From the WSJ: If no deal is reached by Monday night, the two sides must again agree to extend the terms of their November 2013 interim nuclear deal or risk seeing two years of high-stakes diplomacy unravel. That accord offered modest sanctions relief for Iran in exchange for Tehran freezing parts of its nuclear program.

Among the final issues to be resolved are disagreements about the timing and sequencing of sanctions relief for Iran and the continuation of a ban on sales of arms and ballistic-missile parts to Iran. Officials have also been toiling over the text of a new U.N. Security Council resolution that would keep some restrictions on Iran and outline steps the country would take to detail its past nuclear activities.

One European official said Sunday there was “no way” negotiations could continue beyond Monday.

“Everything can fail still, but we are really near the end,” said a German official late Sunday. “With the willingness of Tehran to take the final steps, it could now go quickly. We are ready to negotiate all night.”

The matter of lifting sanctions, suspending other over 15 years funds future terrorism by infusing Iran with $300 billion.

From Foreign Policy Magazine: Barack Obama’s administration and the other parties to the interim nuclear deal with Iran now seem to be saying they are willing to release to Iran between a third and a half a trillion dollars over the next 15 years in order for Iran not to give up the program, but to freeze it. In other words, we are not restoring Iran’s assets and income sources in exchange for permanently and irreversibly accepting international standards; we are just renting the country’s restraint, offering it access to hundreds of billions of dollars to make any future nuclear program development the problem of the next U.S. president — or the one after that.

The problem is compounded by the fact that Iran’s nuclear program is not viewed by its neighbors as the main threat the country poses. A systematic, 35-year campaign of regional meddling, destabilization, and extension of Iranian influence is seen as a much bigger issue. And restoring cash flows and assets to Iran, as well as giving the country greater international standing, clearly exacerbates that threat. It gives Tehran the wherewithal to continue to underwrite terrorists like Hezbollah and Hamas, prop up dictators like Syria’s Bashar al-Assad, and buy ever greater influence in places like Iraq and Yemen.

The consequences of Iran’s regional strategy were on display this week in Washington when Iraqi Prime Minister Haider al-Abadi essentially read from Iranian talking points when addressing the conflict in Yemen. He took a stance against Saudi intervention to stop Iranian-backed Houthis, suggested Iran’s role in Yemen was overstated, and even went so far as to suggest Obama had told him that he was not supportive of the Saudis. The White House immediately denied the last accusation but can’t have been too happy with the rest of the statement that came from the leader of a country the United States had spent hundreds of billions to “liberate.”

 

JPOA, Iran Deal Reached, Announcement is a Formality

Fundamentally: JPOA: Comprehensive nuclear deal would “produce the comprehensive lifting of all UN Security Council sanctions.” That includes arms embargo. As the deal is being broadcasted in coming hours, Tehran has a flag burning. So has the signing bonus been delivered?

Update: 5:45 PM, EST

Associated Press is reporting that putting items on paper with correct language is being worked now and the celebrations are in preparation. Details are here.

Update: 5:00 PM, EST

Terms of the JPOA Iran Deal from FarsNews Agency:

TEHRAN (FNA)- A source privy to the talks between Iran and the six world powers said in case Iran and the six world powers agree on a final deal, the text of the agreement will include the following points.

“In case the opposite side shows political will and the final agreement is signed, the text of the agreement will include the following points,” the source said.

“According to the Joint Comprehensive Plan of Action, all sanctions against Iran are terminated and Iran will no more be recognized as a sanctioned nation,” the source said, and added, “The JCPA only envisages a set of temporary restrictions that will be removed after a limited and logical period of time, as stated earlier by the Iranian Supreme Leader.”

“All economic, financial and banking sanctions against Iran will be terminated for good on day one after the endorsement of the deal, again as the Iranian Supreme Leader has demanded.”

“Iran will no more be under any arms embargo, and according to a UN Security Council resolution that will be issued on the day when the deal is signed by the seven states, all arms embargos against Iran will be terminated, while its annex keeps some temporary restrictions on Iran for a limited period,” the source disclosed.

He said the JCPA is, in fact, a collection of multiple agreements that all fall within the redlines specified by the Iranian Supreme Leader Ayatollah Seyed Ali Khamenei, and includes a set of temporary and limited measures that will remain valid for different periods of time.

“The upcoming UN Security Council resolution – that will call all the previous five resolutions against Iran null and void – will be the last resolution to be issued on Iran’s nuclear program and withdraws Iran’s nuclear dossier from under Chapter 7 of the UN Charter. This last resolution will remain valid and will be implemented for a specifically limited period of time and will then automatically end at the end of this period,” the source added.

“This is the first time that a nation subject to Chapter 7 of the UN Charter has managed to end its case and stop being subject to this chapter through active diplomacy,” he concluded.

Media preview

View originalFlag media

Iran, powers near to historic deal; U.S. says tough issues remain

By Parisa Hafezi and Arshad Mohammed

VIENNA (Reuters) – After more than two weeks of marathon negotiations, Iran and six world powers were close to nailing down an historic nuclear deal that would bring sanctions relief in exchange for curbs on Tehran’s atomic program, diplomats said on Sunday.

But Iranian and Western officials said it was unlikely they would be able to finalize an agreement on Sunday, saying the earliest an agreement could be ready was more likely Monday.

“We are working hard, but a deal tonight is simply logistically impossible,” Alireza Miryousefi, a spokesman for the Iranian delegation, said on Twitter. “This is a 100-page document, after all.”

A Western official said Tehran and Washington would need time to consult their capitals once an agreement was reached.

U.S. Secretary of State John Kerry cautioned that some difficult issues remained on the 16th day of ministerial negotiations between Iran, the United States, Britain, France, Germany, Russia and China.

“I think we’re getting to some real decisions,” Kerry told reporters in the Austrian capital. “So I will say, because we have a few tough things to do, I remain hopeful. Hopeful.”

Several diplomats said an agreement that would end more than a year and a half of negotiations was so close that it could come as early as on Sunday. In a sign that something might be in the works, both Russian Foreign Minister Sergei Lavrov and Chinese Foreign Minister Wang Yi were also due to join the talks on Sunday.

However, a senior U.S. official played down speculation that an agreement was in the works on Sunday, and reiterated Kerry’s point that “major issues remain to be resolved in these talks.”

French Foreign Minister Laurent said he hoped the high-stakes negotiations were finally drawing to a close.

“I hope, I hope, that we are finally entering the final phase of this marathon negotiation,” Laurent Fabius told reporters.

“I believe it,” he added. “France’s position has been one of constructive firmness and I hope it will allow is to reach the end now, quickly, for a satisfying result.”

A senior Iranian official also said an agreement was close.

“Some 99 percent of the issues have been resolved and the agreement is ready,” said an Iranian diplomat. “With political will, we can finish the work late tonight and announce it tomorrow. But still there are at least two issues to be resolved.”

IRAN LEADER SETS NO NEW ‘RED LINES’

Iran and the six powers involved in the talks have given themselves until Monday to reach a deal, their third extension in two weeks, as the Iranian delegation accused the West of throwing up new stumbling blocks to an accord.

Among the biggest sticking points this week has been Iran’s insistence that a United Nations Security Council arms embargo and ban on its ballistic missile program dating from 2006 be lifted immediately if an agreement is reached.

Russia, which sells weapons to Iran, has publicly supported Tehran on the issue.

However, a senior Western diplomat said earlier in the week the six powers remained united, despite Moscow’s and Beijing’s well-known dislike of the embargos.

Western powers have long suspected Iran of aiming to build nuclear bombs and using its civilian atomic energy program to cloak its intention – an accusation Iran strongly denies.

The goal of the deal is to increase the time it would take for Iran to produce enough enriched uranium fuel for a single weapon to at least one year from current estimates of 2-3 months – the “breakout” time.

If there is a deal, the limits on Iran’s enrichment program are expected to be in place for at least a decade.

Other problematic issues in the talks are access for inspectors to military sites in Iran, answers from Tehran over past activity and the overall speed of sanctions relief.

Kerry and Zarif have met nearly every day since Kerry arrived in Vienna more than two weeks ago for what was intended to be the final phase in a negotiation process that began with an interim nuclear deal clinched in November 2013.

Experts and senior officials from Iran, the United States and the other powers have been meeting non-stop for months, often working into the early hours of the morning, to finalize an accord that will include five technical annexes.

An agreement would be the biggest step toward rapprochement between Iran and the West since the 1979 Islamic Revolution, although both sides are likely to remain wary of each other even if a deal is concluded.

Iranian Supreme Leader Ali Khamenei said Tehran would continue its fight against “global arrogance” – referring to the United States. But Khamenei did not set any new “red lines” for his negotiators as he did in a tough speech two weeks ago.

In Washington, the top Republican in the U.S. Senate cast doubt on whether President Barack Obama will be able to win approval in Congress for any deal.

“I think it’s going to be a very hard sell, if it’s completed, in Congress,” Senate Majority Leader Mitch McConnell said on the “Fox News Sunday” broadcast. “We already know it’s going to leave Iran as a threshold nuclear state.”

WH Visitor Logs Shows the Pro-Iran U.S. Posture

In 2013, NAIC, National Iranian American Council was ordered to pay almost $200,000 due to failure to disclose and comply with lobby rules.

Trita Parsi, the founder of NAIC has frequent access to the White House and exploits that access for the mission to lift sanctions on Iran of which has been most effective during the talks of the P5+1.

Parsi has been at it a very long time and he drafted this fancy document on the sanctions and in full defense of Iran. “Never Give In, Never Give Up”

Parsi also has an interesting

In part from FreeBeacon:

“Trita Parsi, founder of the National Iranian American Council (NIAC), which has been accused of lobbying on the regime’s behalf, has met a handful of times with the White House between 2013 and 2014, according to visitor logs.

Parsi and NIAC have been key advocates for the administration’s diplomacy with Iran and have been present during various rounds of negotiations.

Joseph Cirincione, president of the Ploughshares Fund—a group that has been at the center of attempts to try to sell a deal with Iran—is also listed on White House visitor logs.

Cirincione’s organization has been a key funder of organizations such as NIAC and J Street as they seek to promote a final nuclear deal with Iran and the administration’s efforts.

Ploughshares has been identified in reports as working on a “behind the scenes strategy” with senior White House officials such as Ben Rhodes to help promote the deal.

Plougshares has spent more than $7 million funding organizations and experts that have publicly defended the administration’s concessions to Iran in talks, according to the Wall Street Journal.

“The Ploughshares coalition includes a former Iranian government spokesman, the liberal Jewish organization J Street, and a group of former American diplomats who have held private talks with Iranian government officials,” the Journal reported in March.

In the case of Sfard, a White House NSC official declined to provide further details about his meeting or comment when contacted by the Free Beacon. In addition to the PLO, Sfard also has worked with Breaking the Silence, a far-left group that seeks to launch war crimes charges against Israelis and those in the Israel Defense Forces (IDF), according to a dossier published by NGO Monitor, which tracks anti-Israel groups and actors.”

The lobby work begins on lawmakers on the missiles

Pro-Tehran Lobby Demands Iran Be Given Ballistic Missiles

FreeBeacon:

A pro-Tehran advocacy group long accused of concealing illicit ties to the Iranian regime is lobbying Congress in support of a demand that America repeal a United Nations arms embargo limiting the Islamic Republic’s ability to stockpile arms, including ballistic missiles, which could be used to carry nuclear payloads, according to a copy of an email sent by the group to various lawmakers.

The National American Iranian Council (NIAC), which has long been suspected of acting as Tehran’s lobbying shop in Washington, D.C., sent lawmakers an email on Friday asserting that “the Iranian arms embargo will need to be disposed of as part of a final agreement on Iran’s nuclear program.”

The email comes roughly a week after Iranian diplomats issued a similar demand during ongoing talks in Vienna between world powers and Iran. The new condition has been blamed for grinding negotiations to a halt, as diplomats blew through a third self-imposed deadline this weekend.

The NIAC email on ballistic missiles is in step with Iran’s potentially deal-breaking demands.

“The UN embargo imposed on Iran’s trade in certain conventional arms was specifically imposed by the Security Council to deal with the nuclear dispute,” wrote Tyler Cullis, who is identified in the email as a legal fellow at the council.

Cullis writes: “Starting with [United Nations Security Council resolution] UNSCR 1747 in 2007, the Security Council imposed a ban on Iranian arms exports. The Council followed up this export ban with more comprehensive restrictions on the sale to or from Iran of certain heavy-weapons, including battle tanks, combat aircraft, attack helicopters, warships, and the like in 2010 via UNSCR 1929.”

NIAC maintains that such restrictions should be lifted as part of a nuclear agreement, even though they are not specific restrictions on Iran’s nuclear program.

A range of sources who spoke to the Washington Free Beacon—including analysts, former intelligence officials, as well as current and former congressional staffers—challenged both the legal analysis and motivation of NIAC’s letter to lawmakers.

Critics remain concerned that such a move could legally allow Iran to funnel arms to terror groups such as Hezbollah and militias in Yemen.

One former congressional staffer involved in the crafting of sanctions legislation over the years dismissed NIAC’s claims as unfounded and flatly misleading.

“NIAC is the same group that lobbies Congress to defund human rights and democracy promotion programs in Iran for fear of undermining the mullahs,” said one former senior Senate aide with intimate knowledge of Iran sanctions. “What the Iran lobby doesn’t want you to know is that UN Security Council sanctions are directly tied to the dismantlement of Iran’s ballistic missile program—a key element being excused from the P5+1 agreement.”

One senior congressional aide familiar with efforts to sanction Iran said NIAC is widely viewed as Tehran’s in-house lobbying shop.

NIAC has absolutely no credibility on Capitol Hill, where that organization is viewed as a de facto lobbyist for the Iranian regime,” said the senior congressional staffer.

“To cite the latest example, for many months NIAC has opposed the inclusion of ballistic missile limitations or anything else non-nuclear in the negotiations with Iran, yet today NIAC sent an email to congressional staff that actually backs up the Iranian regime’s ridiculous, last-second demand that the United Nations drop its non-nuclear arms embargo on Iran,” the source said.

Elliott Abrams, a deputy national security adviser for George W. Bush, said the Iranian arms embargo will become even more critical in future years.

“The arms embargo on Iran is even more critical today than when it was imposed in 2007 in UN Security Council Resolution 1747,” Abrams explained. “Since then Iran has helped kill or maim thousands of Americans in Iraq, has sent more and more arms to Hezbollah and the Assad regime in Syria, has intervened in Yemen, and now has an expeditionary force of Revolutionary Guard troops fighting in Iraq and Syria.”

“To end the arms embargo now would be throwing gasoline in a fire: the flames would spread. It is dangerous and absolutely against U.S. national security interests to lift the arms embargo on Iran,” Abrams said.

One Western source present in Vienna and apprised of the talks cast doubt on NIAC’s legal analysis concluding that the arms embargo was only aimed at Iran’s nuclear program.

“The Security Council had moved beyond Iran’s nuclear work before the first arms embargo was even imposed,” said the Western source. “UNSCR 1737 sought ‘to constrain Iran’s development of sensitive technologies in support of its nuclear and missile programs.”

“Subsequent resolutions reaffirmed that language, and ultimately UNSCR 1929 demanded an arms embargo ‘until such time as the Security Council determines that the objectives of these resolutions have been met,” the source explained.

NIAC has long been viewed as a pro-Tehran lobbying outfit that tows the regime’s line in the halls of Congress.

In 2012, NIAC was ordered to pay reparations to an Iranian dissident who sued the organization for allegedly concealing its ties to the Iranian regime. NIAC was ordered to pay thousands to the defendant and was upbraided by a federal judge for hindering the discovery process in the case.

In recent years, NIAC has spearheaded lobbying efforts on the Hill to threaten lawmakers into supporting a deal with Iran that fully removes economic sanctions and permits the Islamic Republic to retain key aspects of its nuclear infrastructure.

Meanwhile, Secretary of State John Kerry announced late Friday that talks will continue through next week.

“We have a couple of different lines of discussion that are going on right now, but I think it’s safe to say that we have made progress today,” Kerry said in a statement to reporters. “The atmosphere is very constructive.”

 

General Dunford Said Russia is #1 Threat, Here is Why

Anyone read the book ‘Disinformation’ by Ronald Rychlak and LtG. Ion Pacepa?

General Joseph Dunford is next in line to replace General Dempsey as the Chairman of the Joint Chiefs of Staff. His assessment today about who represented the topic threat to America’s National Security shocked the lawmakers when his response was Russia.

Peeling back some layers, we will come to understand why the General’s alarming conclusions are exactly right. Russia is operating a stealth KGB operation and it has been effective.

Wikileaks Release Indicates Hacking Team Sold To FSB, Russia’s Secret Police

Hacking Team Galileo console

From Forbes:

Now that Wikileaks has released the emails included in the 415GB leaked by the hackers who breached Italian “lawful intercept” provider Hacking Team TISI NaN%, the world has easy access to a trove of information blowing open the inner workings of the private surveillance industry. Amongst the files seen by FORBES so far, emails detailing Hacking Team’s sales to Russia’s secret police, the FSB.

Previous analysis of the leaks had sold its Galileo Remote Control System (RCS) to KVANT, a Russian state-owned military technology company. This inspired questions from  Dutch politician and European Member of Parliament Marietje Shaake about the potential breach of European Union sanctions about the sale of such goods to Russia, which has been put on blacklists for its operations in war-torn Ukraine. Selling to the FSB would likely concern onlookers more, given the agency’s widespread access to communications in Russia. Many more details here.

Going beyond the next layer

Cyber Caliphate Hackers Not Linked to Islamic State

State Department warns IS online threat ‘unmatched’

The hacker group Cyber Caliphate that was thought to be an online arm of the Islamic State has no ties to the terror group despite its cyber attacks in support of the ultra-violent al-Qaeda offshoot, according to a State Department security report.

“Although Cyber Caliphate declares to support ISIL, there are no indications—technical or otherwise—that the groups are tied,” the two-page report from the Overseas Security Advisory Council states. The Islamic State (IS) is also known by the acronyms ISIL or ISIS.

Instead, Russian hackers now appear to be linked to the Cyber Caliphate, a fact discovered by French government authorities after a cyber attack on TV5Monde television in France last April.

In addition to the announcing the lack of a connection between IS and the Cyber Caliphate, the State Department warned that the terrorist group nevertheless continues to have unprecedented online recruitment and propaganda capabilities.

“ISIL’s online presence for propaganda and recruitment purposes continues to be unmatched by other terrorist organizations,” the report said.

The Islamic State uses Internet sites and social media strategies to disseminate and control its Islamist message.

“ISIL’s use of Twitter has been deemed particularly effective; a Brookings study reported at least 46,000 Twitter accounts in use by ISIL supporters during the timeframe of September through December 2014,” the report said.

IS also deftly exploits modern technology and has mastered online propaganda in appealing to young and computer-savvy foreigners, including known hackers who support its ends.

“Although ISIL continues to demonstrate success in using online tools for propaganda, recruitment, and fundraising purposes, the suspected link of Russian hackers to the TV5Monde attack reinforces the assessment that ISIL still lacks the ability to carry out a technically sophisticated cyberattack,” the report concludes.

President Obama on Monday defended the administration strategy against ISIL—despite the group’s expansion from Iraq and Syria to other parts of the world.

Obama said ISIL is “particularly effective” in recruiting foreigners, including Americans, and is using online methods to spread its ideology.

The president said that to defeat ISIL and al Qaeda, “it is going to also require us to discredit their ideology.”

However, the president and his administration continue to play down the Islamist nature of the threat, preferring the non-religious term “violent extremism.”

“Ideologies are not defeated with guns. They’re defeated by better ideas, [a] more attractive and more compelling vision,” Obama said.

“So the United States will continue to do our part by working with partners to counter ISIL’s hateful propaganda, especially online.”

The State Department report, “Who Is Cyber Caliphate? Re-examining the Online ISIL Threat,” was produced by a unit of the Department’s Office of Diplomatic Security, which supports American businesses overseas. It describes Cyber Caliphate as a relatively unsophisticated group that has conducted cyber attacks against perceived enemies of the Islamic State.

“This included targeting various media outlets, issuing threats against U.S. military spouses, and the highly publicized hacking of U.S. Central Command’s Twitter account and YouTube channel,” the report said.

Most of the group’s technical activities involved website defacements and hacking of Twitter accounts. The cyber vandalism seems to have beeen intended to spread IS propaganda and to build notoriety for the group.

However, the TV5Monde cyber attack that disrupted live broadcasts, staff email accounts, and the station’s web page for some 20 hours demonstrated new capabilities, the report said.

“The methodology employed in the attack was atypical of previous Cyber Caliphate activity, and further investigation by French authorities and U.S. private cyber security companies instead pointed to nation-state actors,” the report said.

Among the information said to have been compromised during the TV5Monde attack were personal information about relatives of French soldiers fighting IS. France is among the coalition of nations engaged in military operations against IS.

According to the report, IP addresses traced to the TV5Monde attack were traced to the Russian hacker group known as APT28.

“The [APT28] hacking group was formerly observed targeting the North Atlantic Treaty Organization, entities in Eastern Europe, security companies, and journalists,” the report said.

“APT28 is assessed to conduct operations to benefit the Russian government, and was not previously seen using hacktivists or terrorist organizations as cover.”

The origin of Cyber Caliphate and its members remains unclear. Initially, it was believed by security authorities that the group started by a British hacker, 20-year-old Junaid Hussain, who was linked to a hack against former British Prime Minister Tony Blair.

Hussain then was said to have moved from Britain to Syria where he sought to recruit hackers.

The Cyber Caliphate has not been officially endorsed by IS but it has gained from the free publicity its hacker attacks have generated.

The group’s attack on TV5Monde was described in the report as an anomaly for the hackers. Several theories are under consideration by experts regarding the nature of the group’s actions.

Some analysts believe the group was testing its cyber capabilities in preparation for expanded strikes on new targets.

Other analysts said the television station cyber attack was retaliation based on strained ties between Moscow and Paris.

Russia was angered by France’s recent decision to cancel a $1.3 billion deal for two Mistral-class helicopter carriers for the Russian Navy after Russia’s military aggression against Ukraine.

According to the report, the cyber security firm iSight Partners has assessed the Cyber Caliphate as a “false front for anti-western Russian actors.”

Another theory is that Cyber Caliphate is part of a Russian disinformation operation used by Moscow’s hackers as cover for their cyber attacks. The report noted “Russia’s long history of disinformation campaigns.”