2011, POTUS Stopped Syrian Refugees, Security Concerns

Posted on November 18, 2015November 18, 2015 by Denise Simon

The real humanitarian thing to do at this point is fight this war against all enemies and fight to win it. Syrians and the rest of the refugees can go home, where most do have loyalties.

The Obama Administration Stopped Processing Iraq Refugee Requests For 6 Months In 2011

November 18, 2015 By Sean Davis

Although the Obama administration currently refuses to temporarily pause its Syrian refugee resettlement program in the United States, the State Department in 2011 stopped processing Iraq refugee requests for six months after the Federal Bureau of Investigation uncovered evidence that several dozen terrorists from Iraq had infiltrated the United States via the refugee program.

After two terrorists were discovered in Bowling Green, Kentucky, in 2009, the FBI began reviewing reams of evidence taken from improvised explosive devices (IEDs) that had been used against American troops in Iraq. Federal investigators then tried to match fingerprints from those bombs to the fingerprints of individuals who had recently entered the United States as refugees:

An intelligence tip initially led the FBI to Waad Ramadan Alwan, 32, in 2009. The Iraqi had claimed to be a refugee who faced persecution back home — a story that shattered when the FBI found his fingerprints on a cordless phone base that U.S. soldiers dug up in a gravel pile south of Bayji, Iraq on Sept. 1, 2005. The phone base had been wired to unexploded bombs buried in a nearby road.

An ABC News investigation of the flawed U.S. refugee screening system, which was overhauled two years ago, showed that Alwan was mistakenly allowed into the U.S. and resettled in the leafy southern town of Bowling Green, Kentucky, a city of 60,000 which is home to Western Kentucky University and near the Army’s Fort Knox and Fort Campbell. Alwan and another Iraqi refugee, Mohanad Shareef Hammadi, 26, were resettled in Bowling Green even though both had been detained during the war by Iraqi authorities, according to federal prosecutors.

The terrorists were not taken into custody until 2011. Shortly thereafter, the U.S. State Department stopped processing refugee requests from Iraqis for six months in order to review and revamp security screening procedures:

As a result of the Kentucky case, the State Department stopped processing Iraq refugees for six months in 2011, federal officials told ABC News – even for many who had heroically helped U.S. forces as interpreters and intelligence assets. One Iraqi who had aided American troops was assassinated before his refugee application could be processed, because of the immigration delays, two U.S. officials said. In 2011, fewer than 10,000 Iraqis were resettled as refugees in the U.S., half the number from the year before, State Department statistics show.

According to a 2013 report from ABC News, at least one of the Kentucky terrorists passed background and fingerprint checks conducted by the Department of Homeland Security prior to being allowed to enter the United States. Without the fingerprint evidence taken from roadside bombs, which one federal forensic scientist referred to as “a needle in the haystack,” it is unlikely that the two terrorists would ever have been identified and apprehended.

“How did a person who we detained in Iraq — linked to an IED attack, we had his fingerprints in our government system — how did he walk into America in 2009?” asked one former Army general who previously oversaw the U.S. military’s anti-IED efforts.

President Barack Obama has thus far refused bipartisan calls to pause his administration’s Syrian refugee program, which many believe is likely to be exploited by terrorists seeking entry into the United States. The president has not explained how his administration can guarantee that no terrorists will be able to slip into the country by pretending to be refugees, as the Iraqi terrorists captured in Kentucky did in 2009. One of those terrorists, Waad Ramadan Alwan, even came into the United States by way of Syria, where his fingerprints were taken and given to U.S. military intelligence officials.

Obama has also refused to explain how his administration’s security-related pause on processing Iraq refugee requests in 2011 did not “betray our deepest values.”

*** Were we even paying attention last February when POTUS made his declaration on accepting Syrian refugees? What changed between 2011 and earlier this year? The UN? Money? Iran?

WASHINGTON — The Obama administration’s commitment to take in potentially thousands of Syrian refugees is raising national security concerns among law enforcement officials and some congressional Republicans who fear clandestine radicals could slip into the country among the displaced.
The administration has vowed to help those who fled the civil war by providing homes, furniture, English classes and job training in the United States. It says they’ll be subject to intensive screening before entering the country, and that the overwhelming majority are vulnerable women and children.
“These are people I think that if most Americans met them, their instinct would immediately be, ‘We have to help these people,'” Anne Richard, the assistant secretary of state for population, refugees and migration, said in an interview with The Associated Press.
But without reliable intelligence within Syria, some argue that it’s impossible to ensure that someone bent on violence or supporting a militant cause doesn’t come in undetected.
The issue came to the fore at a House Homeland Security Committee hearing earlier this month, when Michael Steinbach, the FBI assistant director for counterterrorism, said the information the intelligence community would normally rely on to properly vet refugees doesn’t exist in a failed country like Syria.
“You have to have information to vet, so the concern in Syria is that we don’t have systems in places on the ground to collect the information,” Steinbach testified.
More than 3.8 million Syrians are believed to have fled their country in the four years since an uprising against President Bashar Assad led to a civil war.
Most who have resettled have traveled to neighboring countries like Lebanon, Jordan and Turkey. But those avenues are strained. Lebanon announced plans last month to impose restrictions on Syrians trying to enter the country, and an international human rights group accused Jordanian authorities in the fall of deporting vulnerable refugees, including wounded men and unaccompanied children, back to Syria.
The United States last year resettled nearly 70,000 refugees from dozens of countries and accepts the majority of all referrals from U.N. refugee programs. More than 500 Syrian refugees are in the U.S., and plans call for adding a few thousand more in the next couple of years.
But aid groups say they’d like to see the U.S. move more quickly to take in more, given the humanitarian crisis in Syria.
“They need countries like the United State that have capacity to host significant numbers to really start to share that burden,” said Anna Greene, a policy and advocacy director at International Rescue Committee, a New York-based humanitarian organization.
As the Obama administration pushes to boost the numbers, three Republican members of Congress — Reps. Peter King of New York, Michael McCaul of Texas and Candice Miller of Michigan — have asked the administration to say how many Syrian refugees it plans to resettle and to provide a timeline and steps to ensure they’re not a security risk. They warned that a weak screening process could become a “backdoor for jihadists.”
When McCaul raised the issue Wednesday with Secretary of State John Kerry, Kerry assured him that the refugees would be subject to “super-vetting” and that if the FBI expressed concerns about someone, that person would not be let in. “We have amazing ways of being able to dig down and dig deep,” Kerry said at a House Foreign Affairs Committee hearing.
The security concerns echo those voiced over the past decade, when large number of Iraqis sought U.S. refuge from that country’s war.
Two Iraqi refugees who entered the United States in 2009 were charged in Kentucky two years later with plotting to send weapons and money to al-Qaida operatives in Iraq. The case raised particular alarm within the intelligence community because one of the men was able to enter the country even though his fingerprints years several earlier had been left on an unexploded bomb in Iraq. In 2011, then-FBI Director Robert Mueller said the FBI was scrutinizing Iraqi refugees already in the U.S. for possible links to al-Qaida’s affiliate in Iraq.
U.S. officials say they’ve since tightened the controls.
The FBI’s Steinbach told Congress that unlike Iraq, where Americans personnel on the ground were able to gather intelligence, there’s no comparable “footprint on the ground in Syria.”
“All of the data sets, the police, the intel services that normally you would go and seek that information, don’t exist,” he said.
State Department officials say refugees are screened more carefully than all other visitors to the United States, checked against all databases maintained by U.S. law enforcement and intelligence agencies and undergo extensive medical checks and fingerprinting. Specially trained officers from the Homeland Security Department conduct overseas, in-person interviews with those seeking refuge. Refugees are far more likely to be victims of violence than criminals themselves.
“I think if we talk about just this faceless mob of people from conflict-ridden lands, it seems very scary,” the State Department’s Richard said. “But if you meet individuals and individual families, you start to understand the very, very human nature of what it means to be a refugee.”

Last May, DHS Warned on Belgium ISIS Cell

Posted on November 18, 2015November 18, 2015 by Denise Simon

UNC L A S S I F I E D / / F O R O F F I C I A L US E O NL Y

(U//FOUO) Future ISIL Operations in the
West Could Resemble Disrupted Belg Plot

13 May 2015

Office of Intelligence and Analysis

IA-0 -15
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

13 May 2015
(U//FOUO) Future ISIL Operations in West Could Resemble Disrupted Belgian Plot

(U//FOUO) Prepared by the Office of Intelligence and Analysis (I&A). Coordinated with NPPD, the FBI, and NCTC.

(U) Key Judgments
(U//FOUO) I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West. We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little

to no warning.
(U//FOUO) I&A assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.
(U//FOUO) I&A assesses that items recovered by Belgian authorities suggest the group’s plotting may
have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR). (See Appendix A for details on the importance of SAR reporting.)

(U//FOUO)  I&A assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.
(U//FOUO)  I&A assesses that facilitation efforts by
the group were likely aided by members’ criminal
background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.
(U//FOUO)  Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.

(U//FOUO) Belgian Plot Signals ISIL’s Interest
in Complex Plots Against the West
(U//FOUO) The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated

(U) Scope
(U//FOUO) This Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL). This Assessment is intended to support the DHS activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.

(U) Background
(U) On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect. The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operatives—some of whom were returning foreign fighters—possibly targeting police or the public. The group may have been acting under the direction of a member(s) of ISIL. There is no publically available information as to whether a specific target was selected. Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities. The investigation into this plot remains ongoing.1,2

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 2 of 8

operations in the West. I&A judges that the threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europe—where several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacks—than in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s
geographic proximity to the conflicts in Syria and Iraq.3,4 While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland. I&A notes that small-scale attacks using comparatively less sophisticated tactics—such as the 3 May attempted attack against a
“Draw the Prophet” event in Garland, Texas by
individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social media—could proceed with little to no warning.
(U//FOUO) Dispersed Activities and Remote Leadership Possibly Intended to Conceal

Activities
(U//FOUO) The group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing information about emerging and ongoing threats. Even though the group likely planned to attack targets in Belgium, the
investigation into the group’s activities spans several
European countries, including France, Greece, Spain, and the Netherlands, as well countries where there is limited- to-no counterterrorism cooperation with the United States,

such as Syria.
» (U) The purported leader of the group, Abdelhamid Abaaoud, directed the operation from a safe house in Athens, Greece using a cell phone, while other group members operated in several other European countries, according to European media reporting citing a senior Belgian counterterrorism official.5,6
» (U) In addition to the 13 arrests made throughout Belgium, two operatives were arrested in France and police apprehended a cell member in Greece after tracing links to a second safe house in Athens, according to a Belgian news conference and Greek media reporting citing senior police officers.7,8,9
» (U) Multiple members of the cell appear to have been able to communicate and travel unimpeded across borders to facilitate attack planning. In addition to directing operatives from the safe house in Athens, Abaaoud boasted he was able to return to

Syria after the Verviers raid despite having international warrants for his arrest, according to an interview featured in the February release of ISIL’s

Dabiq magazine.10
» (U) The passport of an identified Dutch national—
possibly associated with the group—who likely traveled to Syria in late 2014 was found at the Verviers safe house, according to Dutch media reporting.11 Dutch officials conducted a search of his parents’ home and confiscated laptops and other media. As of early April, he was reportedly killed while fighting in Syria, according to unconfirmed Dutch media reporting.12

(U//FOUO) Material Acquisition Suggests Attacker’s Potential Tactics and Targets
(U//FOUO) Items recovered during searches of
residences affiliated with the cell suggest the group’s
plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers. There is no publicly available information about the acquisition of these items, but the amounts and types of materials acquired by the group highlights the role of the public and private sector in alerting law enforcement through SARs of attempts to acquire or store a large cache of equipment or chemicals needed to support larger operations.
» (U) Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash during the raid in Verviers, according to statements made by Belgian government officials.14,15,16 At the time

UNCLASSIFIED

(U) A picture, from ISIL’s Dabiq magazine, of Abdelhmaid Abaaoud (far right) with the two alleged cell members killed during the January 2015 raid in

Verviers, Belgium.13

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 3 of 8

of the raid, the members of this cell were also searching for an ice machine to cool and transport the TATP, according to European press reporting.17
» (U) Belgian officials were reportedly concerned that the acquisition of police uniforms and discussion by group members of a Molenbeek police station—where members of the group had reportedly spent time—
suggests that they may have intended to target a police station or to impersonate officers to potentially gain access to a sensitive site. 18,19,20 While there is no confirmation the group was actually going to target police, such an attack would have been consistent with media reports about recent ISIL-linked plots in the West directed at law enforcement and ongoing messaging by ISIL since September 2014.21

(U//FOUO) Alleged Operational Security Measures Suggest Knowledge of Law Enforcement Methods
(U//FOUO) The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications. The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to

deflect scrutiny.
(U//FOUO) Communications Security. The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
» (U) A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for

microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police

officials.23
» (U) According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.24
» (U) Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious
communications, according to Belgian media reporting.25
(U//FOUO) Physical Security.  The group attempted to obscure their operational travel and material acquisition from Belgian officials.
» (U//FOUO) According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria. However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.26
» (U//FOUO) Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports. 27,28,29 Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning. 30
» (U//FOUO) The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s
procurement activities and to conceal purchasing patterns.31  Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.

UNCLASSIFIED

(U) Belgium investigators at scene following the raid in Verviers, Belgium on 15 January 2015.22

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 4 of 8

UNCLASSIFIED

(U) Figure 1. Map of Group Activities

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 5 of 8

(U//FOUO) Member’s Criminal Background Likely Aided Planning and Facilitation
(U//FOUO) Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts. The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious

intentions.
» (U) At least one alleged cell member, Souhaib el Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.32 The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.33
» (U) The Belgian police uniforms, large cache of illegal weapons—including Kalashnikov rifles, handguns, ammunition, and materials to make explosives—that were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference.34 Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.35

(U) Implications
(U//FOUO) I&A assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small
groups of individuals, raising I&A’s concern that the
involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.*
* (U//FOUO) DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.

(U//FOUO) We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts. While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 6 of 8

(U//FOUO) Appendix A: Importance of Suspicious Activity Reporting
(U//FOUO) Given the range of targets and tactics of ISIL-associated plots since last year, we encourage reporting of suspicious activity to appropriate government authorities and encourage our security, military, and law enforcement partners to remain vigilant. We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists. Pre-operational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.

(U) Indicators
(U//FOUO) DHS encourages federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities, to include suspicious acquisition of materials and construction of explosive devices. Some observed activities that may be suspicious include constitutionally protected activity. These activities should not be reported absent articulable facts and circumstances that support the source agency’s suspicion that
the observed behavior is not innocent, but rather reasonably indicative of criminal activity associated with terrorism. No single behavioral indicator should be the sole basis for law enforcement action. The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action.
» (U//FOUO) New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;
» (U//FOUO) Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
» (U//FOUO) Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
» (U//FOUO) Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
» (U//FOUO) Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of time—a possible sign of covert stockpiling;
» (U//FOUO) Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;
» (U//FOUO) Internet research for target selection, acquisition of technical capabilities, planning, or logistics; » (U//FOUO) Insisting on paying in cash or using a credit card in another person’s name; » (U//FOUO) Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in
a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
» (U//FOUO) Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
» (U//FOUO) Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
» (U//FOUO) Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 7 of 8

(U) Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8

(U) Source Summary Statement
(U//FOUO) This Assessment is based on information drawn from a body of unclassified reporting, including open source media reports, public statements of senior foreign government officials, and public accounts of foreign law enforcement investigations from multiple law enforcement agencies. We have medium confidence in the press reports used in this product, some of which have been corroborated by public statements made by senior foreign law enforcement officials.

(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide

SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 8 of 8

1 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
2 (U); OSC; EUL2015041773002595; 17 April 2015. 3 (U); OSC; EUL2015021166933318; 11 February 2015. 4 (U); OSC; EUR2015022528575929; 24 February 2015.
5 (U); OSC; EUN2015020948731295; 31 January 2015. 6 (U); OSC; EUL2015020274740312; 1 February 2015. 7 (U); OSC: EUN2015020947629159; 30 January 2015. 8 (U); OSC; EUL2015011674541100; 16 January 2015. 9 (U); OSC; EUL2015021764970267; 17 February 2015. 10 (U); DHS-OS-0316-15; 12 February 2015. 11 (U); OSC; EUL2015012065248183; 19 January 2015.

12 (U); Teen with Connection to Verviers Deceased in Syria; http://www.nieuwsblad.be/cnt/dmf20150403_01614138;

accessed 9 April 2015.
13 (U); DHS-OS-0316-15; 12 February 2015. 14 (U); OSC; EUL2015011674541100; 16 January 2015. 15 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-

belgium-isis-plot/; accessed 20 March 2015.
16 (U); “Belgium Terror Group Planned to Kill Police Officers”; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
17 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
18 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying;
http://www.rtl.be/info/belgique/societe/verviers-voici-ce-que-les-terroristes-presume; accessed 6 April 2015.

19 (U); OSC; EUL2015021764970267; 17 February 2015. 20 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
21 (U); OSC; TRR2014092201178788; 22 September 2014. 22 (U); Belgian Operation Thwarted ‘Major Terrorist Attacks,’ Kills 2 Suspects; http://www.cnn.com/2015/01/15/
world/belgium-anti-terror-operation/; accessed 13 April 2014.
23 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/societe/
verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
24 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/
societe/verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.

25 (U); OSC; EUL2015012064970018; 20 January 2015. 26 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
27 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
28 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.

29 (U); OSC; EUN201502094762159; 31 January 2015. 30 (U); Belgian Police Admit Seeking Wrong Man as Vervier Shooutout Jihadists Named; http://www.telegraph.co.uk/
news/worldnews/europe/belgium/11362093/Belgian-police-admit-seeking-wrong-man-as-Vervier-shooutout-jihadists-named.html; accessed 13 April 2015.

31 (U); OSC; EUN201502094762159; 31 January 2015. 32 (U); Terrorist Threat – Dismantled Verviers Terrorist Cell: 4 Suspects Face Council Chamber;
http://www.thebrusselstimes.com/belgium/terrorist-threat-dismantled-verviers-terrorist-cell-4-suspects-face-
council-chamber/; accessed 1 April 2015.
33 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.

34 (U); OSC; EUL2015011674541100; 16 January 2015. 35 (U); OSC; EUR2015012167949567; 21 January 2015.

ISIS Embedded in Urban Areas, Fake Passports

Posted on November 18, 2015November 18, 2015 by Denise Simon

Reuters: Honduras detains 5 Syrians heading for U.S. with stolen Greek passports-police

Honduran authorities have detained five Syrian nationals who were trying to reach the United States using stolen Greek passports, but there are no signs of any links to last week’s attacks in Paris, police said.

Check out this interactive graphic on Syrian refugee arrivals in the U.S., by the Reuters Graphics team. http://reut.rs/1OfytDd

‘420 potentially dangerous Islamists live in Germany’

Berlin, Nov 17 (IANS/EFE) Around 43,000 people are part of Islamist circles in Germany and around 420 are considered potentially dangerous, the president of the German Federal Criminal Police Office (or BKA) has said.

In an interview with Die Welt newspaper after the attacks in Paris, Holger Munch recalled that Islamist terrorism attacks European values, with Germany also in its sight.

As he noted, the coordinated work of the security forces has prevented 11 attacks in the country, but Paris has shown that the risk of international terrorism is “high” and that Germany may also be affected.

The jihadists, he explained, are younger than they were a few years ago and radicalized much faster; sometimes they spend a few months or a few weeks until a person decides to travel to Syria.

Many have criminal records behind them and often, before travelling abroad to join the jihadists, come into contact with Salafist groups in Germany.

According to data from the BKA, more than 750 Islamists have left Germany bound for Iraq and Syria and there is information about 70 people who have returned after receiving military training or combat experience.

French Prosecutor: 7 Hour Siege 5000 Rounds, Paris

Posted on November 18, 2015November 18, 2015 by Denise Simon

A dead dog too, sadly that was instrumental to the investigation and raid.

Abdelhamid Abaaoud, Top Suspect in Paris Attacks, Not Arrested in Morning Raid

NYT: The police stormed the Paris suburb of St.-Denis and arrested eight. At least two people died, including one who blew herself up.

The prosecutor said that Abdelhamid Abaaoud, suspected of organizing Friday’s attacks, and another fugitive, Salah Abdeslam, were not among those arrested.

Everything we know about the attackers is here.

Here are profiles of some of the victims.

Details for Bataclan Attack Found on Cellphone in Paris Trash Can

A cellphone that could belong to one of the attackers was found in a trash can near the Bataclan concert hall in Paris, according to the French publications Le Monde and Mediapart.

Investigators found a detailed plan of the Bataclan assault and a text message sent at 9:42 p.m. on Friday that read, “On est parti on commence.” This can be translated as “Here we go, we’re starting,” or, more literally, “We have left, we’re starting.”

The identities of the sender and the recipient of the text message remained unclear.

Investigators told Le Monde that geolocation services on the phone led them to one of the places the attackers were last seen, in the Paris suburb of Alfortville.

French authorities kill 2, detain 7 terror suspects in violent raid

Here are the latest details related to the French police raid on suspected terrorists in a Paris suburb, as well as the larger fight involving ISIS and the West:

Latest developments:

• Officials have not yet identified the two dead in Wednesday’s raids in Saint-Denis, Paris prosecutor Francois Molins said. Belgian state broadcaster RTBF reported that the woman who blew herself up during that operation is a cousin of Abdelhamid Abaaoud, the suspected ringleader in Friday’s attacks in Paris.

Abaaoud and Salah Abdeslam, who also was allegedly involved in last week’s bloodshed, are not among the seven detained in connection with that Saint-Denis operation, the prosecutor said.

• The Saint-Denis shootout began at 4:20 a.m. local time (10:20 p.m. ET Tuesday) and lasted nearly an hour, according to Molins.

• Three coordinated teams of commandos committed Friday’s Paris attacks, arriving nearly simultaneously at three locations, Molins said. Authorities have been able to identify five of the seven terrorists killed in that bloodshed.

Full story:

For the second time in a week, gunfire and explosions ripped through France on Wednesday — this time in an hours-long ordeal that ended with two terror suspects dead, seven detained, new attacks potentially thwarted and further proof, according to French President Francois Hollande, that his country is “at war” with ISIS.

Authorities zeroed in on a building in the northern Paris suburb of Saint-Denis after picking up phone conversations indicating that a relative of Abdelhamid Abaaoud, the suspected ringleader of last week’s bloody attacks, might be there, a Belgian counterterrorism official said. French police also believed Abaaoud himself was then still in the country, though they didn’t know exactly where.

By late Wednesday, the new question was whether or not he is even alive. Investigators are using DNA to analyze the body parts found in the Saint-Denis building where a female suspect first blew herself up and then French forces used powerful munitions to combat others, which led to one floor of the building collapsing.

Hollande was among those who offered congratulations to French police on the raid. Yet he also stressed that his country’s fight against terrorists, specifically those linked to ISIS, is anything but over. In fact, the violent nature of Wednesday’s raid in Saint-Denis is further proof that “we are at war,” Hollande said.

“What the terrorists were targeting was what France represents. This is what was attacked on the night of November 13th,” he said. “These barbarians targeted France’s diversity. It was the youth of France who were targeted simply because they represent life.”

Given this threat, Hollande said that Wednesday evening he would present legislation to extend France’s state of emergency for three more months — a measure that, among other things, gives authorities greater powers in conducting searches, holding people and dissolving certain groups.

The French President also said he’d appeal to world leaders — including meetings next week with U.S. President Barack Obama and Russian President Vladimir Putin, who have been at odds on what to do in the ISIS stronghold of Syria — to form a wider coalition to go after the savage Islamist extremist group.

“There is no more … divide. There are only men and women of duty,” he said. “… We must destroy this army that menaces the entire world, not just some countries.”

‘We could see the bullets’

As France learned Friday — when a series of coordinated attacks left a trail of horror, sorrow and questions, with 129 dead and hundreds more wounded — terrorists act with savagery on their own schedule.

And those in Saint-Denis were “about to move on some kind of operation” again, police sources told CNN, adding that the Wednesday raid happened “just in time.”

Some 110 police swarmed on the diverse, working-class area that is home to the Stade de France sports stadium — where three suicide bombings took place days earlier. They first went into one apartment that had been under surveillance since Tuesday, a Paris police source said. That raid led them to another apartment on the same street.

The French police met fierce resistance when they entered the building, including the female suicide bomber — who Belgian state broadcaster RTBF claimed was Abaaoud’s cousin. They answered with powerful munitions of their own, a fact that produced piles of rubble interspersed with body parts, according to the Belgian counterterrorism official.

“We could see the bullets,” a woman, who identified herself only as Sabrine, told CNN affiliate France 2 of the drama. “We could feel the building shaking.”

Interior Minister Bernard Cazeneuve said there could end up being more than the two suspected terrorist deaths. As of Wednesday afternoon, seven suspects — including three in one apartment, the person who loaned the apartment to the suspected terrorists and his friend — ended up in custody from this operation alone. Two of them are hospitalized, Interior Ministry spokesman Pierre-Henry Brandet told France Info radio.

Five French officers, meanwhile, were slightly wounded, while a police dog died in the operation, according to police.

Saadana Aymen, a 29-year-old who lives one street down, couldn’t believe what was happening in his neighborhood.

“When you think of Saint-Denis, you don’t think of terrorists,” he told CNN. “I’m shocked! Why would the terrorists pick this neighborhood?”

Phones offer clues

Yet Saint-Denis wasn’t the only place where French authorities fanned out Tuesday night into Wednesday, as part of their security clampdown.

The Interior Ministry announced in a statement that 118 searches led to the detention of at least 25 people, the confiscation of 34 weapons and the discovery of illicit drugs in 16 instances. This is on top of hundreds of similar operations conducted in recent days, which have resulted in 64 people being held and 118 put under house arrest.

Authorities have not yet laid out what connection any of these arrests have to Friday’s attacks. Yet counterterrorism and intelligence officials say that investigators have uncovered what could be a big break: cell phones believed to belong to the attackers.

According to the officials, one of the phones contained a message, sent sometime before the Friday attacks began, to the effect of: OK, we’re ready.

But cracking into their communication won’t be easy.

Investigators have found encrypted apps on the phones, which appear to have left no trace of messages or any indication of who would have been receiving them, according to officials briefed on the French investigation.

‘These are not regular people’

Seven attackers died during Friday night’s wave of violence, and an international arrest warrant is out for one suspect, Salah Abdeslam, a 26-year-old Frenchman. The identity of the possible ninth suspect, seen in a video that shows two gunmen inside a black car and perhaps a third person driving the vehicle, is unknown.

Mohamed Abdeslam has urged his younger brother Salah, who was stopped but then let go en route to the Belgian border hours after the attacks, to turn himself into authorities. He acknowledged noticing Salah and another brother — 31-year-old Ibrahim, who is among the seven terrorists killed — had been adopting more radical views, though that didn’t mean the family isn’t shocked.

“My brother who participated in this terrorist act must have been psychologically ready to commit such an act. These are not regular people,” he told CNN.

“You cannot have the slightest doubt that they have been prepared, that they must not leave any trace which would cause suspicion that they might do such things. And even if you saw them every day, their behavior was quite normal.”

Official: Belgian authorities lost track of 2 suspects

Both Salah Abdeslam and Ibrahim were known to authorities: Belgian prosecutor Eric Van Der Sypt told CNN’s Ivan Watson police questioned the Abdeslam brothers in February. The brothers were released, the federal prosecutor said, after they denied wanting to go to Syria.

And Salah Abdeslam and Abaaoud served time together in a Belgian prison in 2011, when the former spent a month for an alleged theft, a Belgian federal prosecutor said.

Belgian authorities believe Abaaoud has spent previous months in Raqqa, the Syrian city that’s now the de facto capital of the Islamic State, or ISIS, a counterrrorism official in that European nation said. There, in Syria, Abaaoud is thought to have worked with several senior French figures in ISIS — members of the so-called Artigat network including Sabri Essid and Fabien Clain, whose voice can be heard on the claim of responsibility for the Paris attacks — to plot a series of attacks in France.

Already, Essid and Clain have been traced to an April plot to attack a Paris church and the August armed assault on an Amsterdam-to-Paris train that was thwarted by three Americans.

As to those behind the latest violence, Belgian authorities didn’t even know Abaaoud was back in Europe, according to the counterterrorism official. They’d also lost track of Salah Abdeslam.

And, the senior Belgian official said, the bombmaker who made the suicide vests used in Paris is also thought to still be at large.

What’s next for ISIS?

ISIS was born in Iraq and blossomed in Syria, taking advantage of the power vacuum from that country’s chaotic, years-long civil war. In the process, the militant group employed bold, ruthless and sometimes sadistic tactics — as evidenced by the taking of women and girls as sex slaves, broadcasting the beheading of journalists and aid workers, destroying centuries-old historic artifacts and massacring those who don’t subscribe to its twisted, extreme interpretation of Islam.

The group has managed to take over vast swaths of Iraq and Syria in this campaign. But it’s not content to stop there.

Egypt, Libya, Yemen, Lebanon and other nations have all been sites of ISIS-claimed attacks in recent months. The militant group has also boasted about bloodshed inside Europe, including January’s massacre on the Paris offices of the satirical magazine Charlie Hebdo.

While some have faulted world leaders for not stepping up sooner, there has been a more concerted effort of late. The United States conducted airstrikes for months, which U.S. Army Col. Steven Warren estimated have killed at least one mid- to high-level ISIS figure every day since May. More recently, Russia has stepped into the fray, in part, to support its longtime ally Bashar al-Assad, Syria’s embattled President.

Then there’s Turkey, whose involvement has been complicated by the fact that its longtime adversaries, the Kurds, have been fighting against ISIS. On Wednesday, the semi-official Anadolu news agency reported that Turkish police had detained eight ISIS-linked suspects who’d arrived at an Istanbul airport from Casablanca. The eight Moroccans said they had booked a hotel in Turkey and were preparing to head to Germany — via Greece, Serbia and Hungary — the report added, pointing to a document — seized by police — that detailed the travel route.

France has been part of the U.S.-led coalition fighting ISIS for months. But it has enhanced its role — symbolically and in practice — in the wake of the latest Paris attacks. And Hollande says that the arrival of the aircraft carrier Charles de Gaulle within striking distance of Syria will triple France’s capacity to conduct airstrikes.

And, despite their differing stances on Syria’s future and other matters, Russia’s armed forces are ready to organize joint military operations with the French navy “to combat terrorists in Syria,” Russia’s state-run TASS news agency reported, citing army official Andrey Kartapolov.

WH Refuses Governors Information on Refugees

Posted on November 17, 2015November 17, 2015 by Denise Simon

Governors Press White House for Refugee Information

By Josh Rogin

In a call with senior Obama administration officials Tuesday evening, several governors demanded they be given access to information about Syrian refugees about to be resettled by the federal government in their states. Top White House officials refused.

Over a dozen governors from both parties joined the conference call, which was initiated by the White House after 27 governors vowed not to cooperate with further resettlement of Syrian refugees in their states. The outrage among governors came after European officials revealed that one of the Paris attackers may have entered Europe in October through the refugee process using a fake Syrian passport. (The details of the attacker’s travels are still murky.)

The administration officials on the call included White House Chief of Staff Denis McDonough, Deputy Secretary of Homeland Security Alejandro Mayorkas, State Department official Simon Henshaw, FBI official John Giacalone, and the deputy director of the National Counterterrorism Center John Mulligan.

On the call several Republican governors and two Democrats — New Hampshire’s Maggie Hassan and California’s Jerry Brown — repeatedly pressed administration officials to share more information about Syrian refugees entering the United States. The governors wanted notifications whenever refugees were resettled in their states, as well as access to classified information collected when the refugees were vetted.

“There was a real sense of frustration from all the governors that there is just a complete lack of transparency and communication coming from the federal government,” said one GOP state official who was on the call.

The administration officials, led by McDonough, assured the governors that the vetting process was thorough and that the risks of admitting Syrian refugees could be properly managed. He added that the federal government saw no reason to alter the current method of processing refugees.

Florida governor Rick Scott asked McDonough point blank if states could opt out of accepting refugees from Syria. McDonough said no, the GOP state official said.

In a readout of the call Tuesday night, the White House said that several governors “expressed their appreciation for the opportunity to better understand the process and have their issues addressed.” The White House noted that “others encouraged further communication” from the administration about the resettlement of refugees.

Hassan, one of two Democrats to challenge the administration on the call, had already come out in favor of halting the flow of Syrian refugees to the United States. She expressed anger that state officials aren’t notified when Syrian refugees are resettled in their territory.

Brown said he favored continuing to admit Syrian refugees but wanted the federal government to hand over information that would allow states to keep track of them, the GOP state official said.

McDonough responded to Brown that there was currently no process in place to give states such information and the administration saw no reason to change the status quo. The non-governmental organizations that help resettle the refugees would have such information.

Brown countered by noting that state law enforcement agencies have active investigations into suspected radicals and that information about incoming Syrian refugees could help maintain their awareness about potential radicalization. He suggested the U.S. had to adjust the way it operates in light of the Paris attacks.

McDonough reiterated his confidence in the current process. While promising to consider what Brown and other senators had said, he emphasized that the administration had no plans to increase information sharing on refugees with states as of now.

Top GOP senators echoed the concerns of governors Tuesday. Senate Majority Leader Mitch McConnell and Senate Intelligence Committee Chairman Richard Burr joined House Speaker Paul Ryan’s call for a “pause” in the flow of Syrian refugees, which is intended to include 10,000 people by 2016. McConnell said “the ability to vet people coming from that part of the world is really quite limited.”

Democratic senators are split on the issue. Senators Chuck Schumer and Dianne Feinstein said Tuesday there may be a need for a pause in accepting Syrian refugees but they both wanted to hear more from the administration about the issue. Sen. Dick Durbin said that refugees aren’t the primary source of concern. He pointed to the millions of foreign visitors who enter America each year.

“Background checks need to be redoubled in terms of refugees but if we’re talking about threats to the United States, let’s put this in perspective,” he said. “Let us not just single out the refugees as the potential source of danger in the United States.”

The White House is trying hard to engage governors and lawmakers. Top administration officials held several briefings about the issue Tuesday on Capitol Hill. But if they don’t agree to share more with state and local politicians, the opposition to accepting Syrian refugees could quickly gain ground.

*** Meanwhile Speaker Ryan asked DHS Secretary Jeh Johnson and FBI Director James Comey for a Paris briefing. It happened behind closed doors, and did not go well.

TheHill:

Partisan divisions over continuing to allow refugees fleeing the Islamic State in Iraq and Syria (ISIS) into the U.S. deepened Tuesday as Obama administration officials briefed the House on last week’s terrorist attacks in Paris.

Homeland Security Secretary Jeh Johnson and FBI Director James Comey offered House members a classified briefing following the Friday massacre in the French capital that killed more than 120. Senators are expected to be briefed Wednesday. Johnson said he reviewed the domestic security “enhancements” enacted in recent days following the attacks in Paris.

He further maintained that the U.S. should continue allowing vetted Syrian refugees into the country despite calls from Republicans to halt the program in the aftermath of the Paris attacks.

“I believe that a lot of countries in the world right now are looking to the United States for leadership,” Johnson told reporters after the briefing.

“It is a careful, time-consuming process. And we are committed to continuing that process with regard to Syrian refugees,” he said.

Intelligence and law enforcement officials have previously warned about “gaps” in the data that they can scan to screen refugees headed to the U.S.

On Tuesday, Republicans indicated that Johnson and Comey had not quelled their concerns about those blind spots.

The House plans to vote Thursday on legislation to require refugees from Syria and Iraq to undergo FBI background checks. The Department of Homeland Security and the FBI would further have to verify that the refugees do not pose security threats.

Both chambers are expected to adjourn Thursday for the Thanksgiving holiday recess, adding pressure on lawmakers to act quickly before they depart Washington.

There is “really very little information about these refugees’ past,” House Homeland Security Committee Chairman Michael McCaul (R-Texas) said after the briefing.

“You don’t know who they are and you don’t have anything about their past, in terms of intelligence or databases,” McCaul said.

Rep. Peter King (R-N.Y.) said Syrian refugees presented a risk because they “come from a terrorist country, where there’s a large amount of ISIS and al Qaeda.”

King also said he thought allowing visa waivers to Europeans who travel to the U.S. was ”definitely something that has to be looked at, because circumstances have changed.”

Rep. Matt Salmon (R-Ariz.) concluded: “I’m leaving this briefing far less comfortable than when I came in the first place.”

Democrats are largely standing by the president’s plan, arguing that the rigorous screening process ought to account for any gaps in security.

Sen. Chuck Schumer (D-N.Y.) emerged as one notable exception, but it appeared unlikely that any prominent House Democrats would join him in his concern.

Rep. Adam Smith (D-Wash.) said refugees coming into the U.S. are “very thoroughly vetted.”

“It takes two years, most times, to come through this process,” said Smith, ranking Democrat on the House Armed Services Committee.

“It’s worth noting that the evidence at this point — aside from this one mysterious passport, which hasn’t been attributed to anybody — that the people who committed the attacks in France were all born in France or Belgium,” he added.

As both sides dig in, however, the effort seems destined to be largely partisan.

“Anything constructive would be welcome,” said Rep. Adam Schiff (D-Calif.), the top Democrat on the House Intelligence Committee. “But I think there would be a lot of resistance within the Democratic caucus on an effort to close the door on mothers and children who are fleeing the violence around the world. “

Asked whether he was concerned about Republicans potentially trying to halt the refugee program through an upcoming government spending bill, Johnson noted that the agency that vets refugee applications isn’t subject to the congressional appropriations process.

U.S. Citizenship and Immigration Services (USCIS) is funded through application fees.

“It’s an organization that pays for itself,” Johnson said.