Category Archives: DOJ, DC and inside the Beltway

Apple vs. FBI, Try the iCloud or iTunes

Posted on by

In all fairness, General Michael Hayden, former head of the NSA actually disagrees with FBI Director James Comey and sides with Apple. The reason is fascinating.

Apple’s formal statement is here.

Zetter – Wired:

The news this week that a magistrate ordered Apple to help the FBI hack an iPhone used by one of the San Bernardino shooter suspects has polarized the nation—and also generated some misinformation.

Those who support the government say Apple has cooperated in the past to unlock dozens of phones in other cases—so why can’t it help the FBI unlock this one?

But this isn’t about unlocking a phone; rather, it’s about ordering Apple to create a new software tool to eliminate specific security protections the company built into its phone software to protect customer data. Opponents of the court’s decision say this is no different than the controversial backdoor the FBI has been trying to force Apple and other companies to build into their software—except in this case, it’s an after-market backdoor to be used selectively on phones the government is investigating.

The stakes in the case are high because it draws a target on Apple and other companies embroiled in the ongoing encryption/backdoor debate that has been swirling in Silicon Valley and on Capitol Hill for the last two years. Briefly, the government wants a way to access data on gadgets, even when those devices use secure encryption to keep it private.

Apple specifically introduced security features in 2014 to ensure that it would not be able to unlock customer phones and decrypt the data on them; but it turns out it overlooked a loophole in those security features that the government is now trying to exploit. The loophole is not about Apple unlocking the phone but about making it easier for the FBI to attempt to unlock it on its own. If the controversy over the San Bernardino phone causes Apple to take further steps to close that loophole so that it can’t assist the FBI in this way in the future, it could be seen as excessive obstinance and obstruction by Capitol Hill. And that could be the thing that causes lawmakers to finally step in with federal legislation that prevents Apple and other companies from locking the government out of devices.

If the FBI is successful in forcing Apply to comply with its request, it would also set a precedent for other countries to follow and ask Apple to provide their authorities with the same software tool.

In the interest of clarifying the facts and correcting some misinformation, we’ve pulled together a summary of the issues at hand.

What Kind of Phone Are We Talking About?

The phone in question is an iPhone 5c running the iOS9 version of Apple’s software. The phone is owned by the San Bernardino Department of Public Health, which gave it to Syed Rizwan Farook, the shooter suspect, to use for work.

What Is the Issue?

Farook created a password to lock his phone, and due to security features built into the software on his device, the FBI can’t unlock the phone and access the data on it using the method it wants to use—a bruteforce password-guessing technique wherein they enter different passcodes repeatedly until they guess the right one—without running the risk that the device will lock them out permanently.

How Would It Do That?

Apple’s operating system uses two factors to secure and decrypt data on the phone–the password the user chooses and a unique 256-bit AES secret key that’s embedded in the phone when it’s manufactured. As cryptographer Matthew Green explains in a blog post, the user’s password gets “tangled” with the secret key to create a passcode key that both secures and unlocks data on the device. When the user enters the correct password, the phone performs a calculation that combines these two codes and if the result is the correct passcode, the device and data are unlocked.

To prevent someone from brute-forcing the password, the device has a user-enabled function that limits the number of guesses someone can try before the passcode key gets erased. Although the data remains on the device, it cannot be decrypted and therefore becomes permanently inaccessible. The number of password tries allowed before this happens is unclear. Apple says on its web site that the data becomes inaccessible after six failed password attempts. The government’s motion to the court (.pdf) says it happens after 10 failed guesses.

The government says it does not know for certain if Farook’s device has the auto-erase feature enabled, but notes in its motion that San Bernardino County gave the device to Farook with it enabled, and the most recent backup of data from his phone to iCloud “showed the function turned on.”

A reasonable person might ask why, if the phone was backing data up to iCloud the government can just get everything it needs from iCloud instead of breaking into the phone. The government did obtain some data backed up to iCloud from the phone, but authorities allege in their court document that he may have disabled iCloud backups at some point. They obtained data backed up to iCloud a month before the shootings, but none closer to the date of the shooting when they say he is most likely to have used the phone to coordinate the attack.

Is This Auto-Erase the Only Security Protection Apple Has in Place?

No. In addition to the auto-erase function, there’s another protection against brute force attacks: time delays. Each time a password is entered on the phone, it takes about 80 milliseconds for the system to process that password and determine if it’s correct. This helps prevent someone from quickly entering a new password to try again, because they can only guess a password every 80 milliseconds. This might not seem like a lot of time, but according to Dan Guido, CEO of Trail of Bits, a company that does extensive consulting on iOS security, it can be prohibitively long depending on the length of the password.

“In terms of cracking passwords, you usually want to crack or attempt to crack hundreds or thousands of them per second. And with 80 milliseconds, you really can only crack eight or nine per second. That’s incredibly slow,” he said in a call to reporters this week.

With a four-digit passcode, he says, there are only about 10,000 different combinations a password-cracker has to try. But with a simple six-digit passcode, there are about one million different combinations a password cracker would have to try to guess the correct one—Apple says would take more than five-and-a-half-years to try all combinations of a six-character alpha-numeric password. The iOS9 software, which appears to be the software on the San Bernardino phone, asks you to create a six-digit password by default, though you can change this requirement to four digits if you want a shorter one.

Later models of phones use a different chip than the iPhone 5c and have what’s called a “secure enclave” that adds even more time delays to the password-guessing process. Guido describes the secure enclave as a “separate computer inside the iPhone that brokers access to encryption keys” increasing the security of those keys.

With the secure enclave, after each wrong password guess, the amount of time you have to wait before trying another password grows with each try; by the ninth failed password you have to wait an hour before you can enter a tenth password. The government mentioned this in its motion to the court, as if the San Bernardino phone has this added delay. But the iPhone 5c does not have secure enclave on it, so the delay would really only be the usual 80 milliseconds in this case.

Why None of This Is an Issue With Older iPhones

With older versions of Apple’s phone operating system—that is, phones using software prior to iOS8—Apple has the ability to bypass the user’s passcode to unlock the device. It has done so in dozens of cases over the years, pursuant to a court order. But beginning with iOS8, Apple changed this so that it can no longer bypass the user’s passcode.

According to the motion filed by the government in the San Bernardino case, the phone in question is using a later version of Apple’s operating system—which appears to be iOS9. We’re basing this on a statement in the motion that reads: “While Apple has publicized that it has written the software differently with respect to iPhones such as the SUBJECT DEVICE with operating system (“iOS”)9, Apple yet retains the capacity to provide the assistance sought herein that may enable the government to access the SUBJECT DEVICE pursuant to the search warrant.”

The government is referring to the changes that Apple initially made with iOS8, that exist in iOS9 as well. Apple released iOS9 in September 2015, three months before the San Bernardino attacks occurred, so it’s very possible this is indeed the version installed on the San Bernardino phone.

After today, technology vendors need to consider that they might be the adversary they’re trying to protect their customers from.

What Does the Government Want?

A lot of people have misconstrued the government’s request and believe it asked the court to order Apple to unlock the phone, as Apple has done in many cases before. But as noted, the particular operating system installed on this phone does not allow Apple to bypass the passcode and unlock the phone. So the government wants to try bruteforcing the password without having the system auto-erase the decryption key and without additional time delays. To do this, it wants Apple to create a special version of its operating system, a crippled version of the firmware that essentially eliminates the bruteforcing protections, and install it on the San Bernardino phone. It also wants Apple to make it possible to enter password guesses electronically rather than through the touchscreen so that the FBI can run a password-cracking script that races through the password guesses automatically. It wants Apple to design this crippled software to be loaded into memory instead of on disk so that the data on the phone remains forensically sound and won’t be altered.

Note that even after Apple does all of this, the phone will still be locked, unless the government’s bruteforcing operation works to guess the password. And if Farook kept the iOS9 default requirement for a six-character password, and chose a complex alpha-numeric combination for his password, the FBI might never be able to crack it even with everything it has asked Apple to do.

Apple CEO Tim Cook described the government’s request as “asking Apple to hack our own users and undermine decades of security advancements that protect our customers—including tens of millions of American citizens—from sophisticated hackers and cybercriminals. The same engineers who built strong encryption into the iPhone to protect our users would, ironically, be ordered to weaken those protections and make our users less safe.”

What Exactly Is the Loophole You Said the Government Is Exploiting?

The loophole is the fact that Apple even has the ability to run crippled firmware on a device like this without requiring the user to approve it, the way software updates usually work. If this required user approval, Apple would not be able to do what the government is requesting.

How Doable Is All of This?

Guido says the government’s request is completely doable and reasonable.

“They have to make a couple of modifications. They have to make it so that the operating system boots inside of a RAM disk…[and] they need to delete a bunch of code—there’s a lot of code that protects the passcode that they just need to trash,” he said.

Making it possible for the government to test passwords with a script instead of typing them in would take a little more effort he says. “[T]hat would require a little bit of extra development time, but again totally possible. Apple can load a new kernel driver that allows you to plug something in over the Thunderbolt port… It wouldn’t be trivial but it wouldn’t be massive.”

Could This Same Technique Be Used to Undermine Newer, More Secure Phones?

There has been some debate online about whether Apple would be able to do this for later phones that have newer chips and the secure enclave. It’s an important question because these are the phones that most users will have in the next one or two years as they replace their old phones. Though the secure enclave has additional security features, Guido says that Apple could indeed also write crippled firmware for the secure enclave that achieves exactly what the FBI is asking for in the San Bernardino case.

“It is absolutely within the realm of possibility for Apple themselves to tamper with a lot of the functionality of the secure enclave. They can’t read the secure private keys out of it, but they can eliminate things like the passcode delay,” he said. “That means the solution that they might implement for the 5c would not port over directly to the 5s, the 6 or the 6s, but they could create a separate solution for [these] that includes basically crippled firmware for the secure enclave.”

If Apple eliminates the added time delays that the secure enclave introduces, then such phones would only have the standard 80-millisecond delay that older phones have.

“It requires more work to do so with the secure enclave. You have to develop more software; you have to test it a lot better,” he said. “There may be some other considerations that Apple has to work around. [But] as far as I can tell, if you issue a software update to the secure enclave, you can eliminate the passcode delay and you can eliminate the other device-erase [security feature]. And once both of those are gone, you can query for passcodes as fast as 80 milliseconds per request.”

What Hope Is There for Your Privacy?

You can create a strong alpha-numeric password for your device that would make bruteforcing it essentially infeasible for the FBI or anyone else. “If you have letters and numbers and it’s six, seven or eight digits long, then the potential combinations there are really too large for anyone to bruteforce,” Guido said.

And What Can Apple Do Going Forward?

Guido says Apple could and should make changes to its system so that what the FBI is asking it to do can’t be done in future models. “There are changes that Apple can make to the secure enclave to further secure their phones,” he said. “For instance, they may be able to require some kind of user confirmation, before that firmware gets updated, by entering their PIN code … or they could burn the secure enclave into the chip as read-only memory and lose the ability to update it [entirely].”

These would prevent Apple in the future from having the ability to either upload crippled firmware to the device without the phone owner’s approval or from uploading new firmware to the secure enclave at all.

“There’s a couple of different options that they have; I think all of them, though, are going to require either a new major version of iOS or new chips on the actual phones,” Guido said. “But for the moment, what you have to fall back on is that it takes 80 milliseconds to try every single password guess. And if you have a complex enough password then you’re safe.”

Is the Ability to Upload Crippled Firmware a Vulnerability Apple Should Have Foreseen?

Guido says no.

“It wasn’t until very recently that companies had to consider: What does it look like if we attack our own customers? What does it look like if we strip out and remove the security mitigations we put in specifically to protect customers?”

He adds: “Apple did all the right things to make sure the iPhone is safe from remote intruders, or people trying to break into the iPhone.… But certainly after today, technology vendors need to consider that they might be the adversary they’re trying to protect their customers from. And that’s quite a big shift.” (Great job on this Kim)

 

Beyond the Bluster, Obama Missed a Major Deadline

Posted on by

But Obama did play golf last weekend and it appears he is missing the funeral of Supreme Court Justice Antoine Scalia to play golf?

Last year, the White House held a summit on the matter, any achievements? Nah.

 

It appears that perhaps Obama and his national security team has left the matter up the Tony Blinken at the State Department and the Brookings Institute.

The United States has mobilized countries around the world to disrupt and defeat these threats to our common security—starting with Daesh and al-Qaeda and including Boko Haram, al-Shabaab, AQAP, and a number of other groups. Now, the most visible part of this effort is the battlefield and our increasingly successful effort to destroy Daesh at its core in Iraq and Syria. Working by, with, and through local partners, we have taken back 40 percent of the territory Daesh controlled a year ago in Iraq and 10 percent in Syria—killing senior leaders, destroying thousands of pieces of equipment, all the while applying simultaneous pressure against key chock points and isolating its bases in Mosul and Raqqa. In fact, we assess Daesh’s numbers are the lowest they’ve been since we began monitoring their manpower in 2014.

We have a comprehensive strategy includes training, equipping, and advising our local partners; stabilizing and rebuilding liberated areas; stopping the flow of foreign fighters into and out of Iraq and Syria; cutting off Daesh’s financing and countering its propaganda; providing life-saving humanitarians assistance; and promoting political accommodations so that our military success is sustainable.

In each of these areas, we are making real progress. These hard-fought victories undermine more than Daesh’s fighting force. They erode the narrative it has built of its own success—the perception of which remains one of Daesh’s most effective recruiting tools. For the danger from violent extremism has slipped past war’s frontlines and into the computers and onto the phones of citizens in every corner of the world. Destined to outlive Daesh, this pernicious threat is transforming our security landscape, as individuals are inspired to violent acts from Paris to San Bernardino to Jakarta.

So even as we advance our efforts to defeat Daesh on the frontlines, we know that to be fully effective, we must work to prevent the spread of violent extremism in the first place—to stop the recruitment, radicalization, and mobilization of people, especially young people, to engage in terrorist activities. Read all the comments and remarks here.

White House Misses Deadline to Deliver ISIS Strategy to Congress

Brown: (CNSNews.com) – The House Armed Services Committee noted Tuesday that the Obama administration missed their February 15 deadline to deliver a strategy to counter violent extremist groups in the Middle East, such as ISIS and al Qaeda, as required by the National Defense Authorization Act.

Rep. Mac Thornberry (R-Texas), chairman of the House Armed Services Committee, harshly criticized  President Obama’s failure to meet the deadline.

“I fear the President’s failure to deliver this report says far more about the state of his strategy to defeat terrorists than any empty reassurance he may offer from the podium,” Thornberry said in a statement.

“Unsurprisingly, the Administration cannot articulate a strategy for countering violent extremists in the Middle East. Time and again, the President has told us his strategy to defeat extremist groups like ISIS and al Qaeda is well underway,” Thornberry said, “yet, months after the legal requirement was established, his Administration cannot deliver that strategy to Congress.”

Thornberry also outlined the consequences of the administration’s failure, calling it “a lost opportunity” for Congress and the administration to come together for a common approach to respond to the threat.

“The Committee is working now to shape the FY17 National Defense Authorization Act and the Pentagon has already begun requesting authorities our troops need to defeat this enemy. Without a strategy, this amounts to leaving our troops in the wilderness with a compass, but no map,” he wrote.

“Failing to comply with the report deadline represents more than a failure of strategic vision for the White House,” Thornberry emphasized. “It is a lost opportunity for the Administration and Congress to work together on a common approach to face this threat.”

Section 1222 of the National Defense Authorization Act for FY16, signed by President Obama in November, “requires the Secretaries of State and Defense to deliver a strategy for the Middle East and countering violent extremism no later than February 15, 2016” according to Thornberry’s statement.

It also requires the Administration to “lay out a number of elements needed to defeat terrorist groups like ISIS and al Qaeda, including a description of the role the U.S. military will play in such a strategy, a description of the coalition needed to carry out the strategy, and an assessment of efforts to disrupt foreign fighters traveling to Syria and Iraq.”

House Speaker Paul Ryan (R-Wisc.) sent the White House a reminder of the deadline on February 10, citing a recent testimony by Lt. Gen. Vincent Stewart, director of the Defense Intelligence Agency, that ISIS “will probably attempt to conduct additional attacks in Europe, and attempt to direct attacks on the U.S. homeland in 2016.”

“We are aware of the report and are actively working with multiple interagency offices to complete this legal requirement per the NDAA and look forward to submitting the completed report to Congress in the near-term,” Army Lt. Col. Joe Sowers, a Department of Defense spokesman, told The Hill on Friday.

*** Just one reason why Obama being tardy is an issue:

The intercontinental nuclear missile threat arrives in America.

 

Americans have been focused on New Hampshire and Iowa, but spare a thought for Los Angeles, Denver and Chicago. Those are among the cities within range of the intercontinental ballistic missile tested Sunday by North Korea. Toledo and Pittsburgh are still slightly out of range, but at least 120 million Americans with the wrong zip codes could soon be targets of Kim Jong Un…

***

“We assess that they have the capability to reach the [U.S.] homeland with a nuclear weapon from a rocket,” U.S. Admiral Bill Gortney of the North American Aerospace Defense Command said in October, echoing warnings from the Defense Intelligence Agency and the U.S. commander in South Korea…

All of this vindicates the long campaign for missile defense. Ronald Reagan’s Strategic Defense Initiative helped win the Cold War, and North Korea is precisely the threat that continued to justify the cause after the Soviet Union’s collapse… 

You can thank the George W. Bush Administration for the defenses that exist, including long-range missile interceptors in Alaska and California, Aegis systems aboard U.S. Navy warships and a diverse network of radar and satellite sensors. The U.S. was due to place interceptors in Poland and X-Band radar in the Czech Republic, but in 2009 President Obama and Hillary Clinton scrapped those plans as a “reset” gift to Vladimir Putin.

Team Obama also cut 14 of the 44 interceptors planned for Alaska and Hawaii, ceased development of the Multiple Kill Vehicle… and defunded the two systems focused on destroying missiles in their early “boost” phase… By 2013 even Mr. Obama partially realized his error, so the Administration expanded radar and short-range interceptors in Asia and recommitted to the 14 interceptors for the U.S. West Coast. It now appears poised to install sophisticated Thaad antimissile batteries in South Korea.

Hillary has NO Defense Under the Law or Executive Order

Posted on by

Executive Order #13526  Espionage Act

WASHINGTON — Ahmed Wali Karzai, the brother of the president of Afghanistan, gets regular payments from the CIA and has for much of the past eight years, The New York Times reported Tuesday.

The newspaper said that according to current and former American officials, the CIA pays Karzai for a variety of services, including helping to recruit an Afghan paramilitary force that operates at the CIA’s direction in and around Kandahar.

The CIA’s ties to Karzai, who is a suspected player in the country’s illegal opium trade, have created deep divisions within the Obama administration, the Times said.

Allegations that Karzai is involved in the drug trade have circulated in Kabul for months. He denies them.

Critics say the ties with Karzai complicate the United States’ increasingly tense relationship with his older brother, President Hamid Karzai. The CIA’s practices also suggest that the United States is not doing everything in its power to stamp out the lucrative Afghan drug trade, a major source of revenue for the Taliban.

Clinton email chain discussed Afghan national’s CIA ties, official says

FNC: EXCLUSIVE: One of the classified email chains discovered on Hillary Clinton’s personal unsecured server discussed an Afghan national’s ties to the CIA and a report that he was on the agency’s payroll, a U.S. government official with knowledge of the document told Fox News.

The discussion of a foreign national working with the U.S. government raises security implications – an executive order signed by President Obama said unauthorized disclosures are “presumed to cause damage to the national security.”

The U.S. government official said the Clinton email exchange, which referred to a New York Times report, was among 29 classified emails recently provided to congressional committees with specific clearances to review them. In that batch were 22 “top secret” exchanges deemed too damaging to national security to release.

Confirmation that one of these exchanges concerned a reported CIA asset means the emails went beyond issues like the drone strike campaign. Democrats repeatedly have said some messages referred to this, reinforcing Clinton’s position that the documents are over-classified.

Based on the timing and other details, the email chain likely refers to either an October 2009 Times story that identified Afghan national Ahmed Wali Karzai, the half-brother of then-Afghan president Hamid Karzai, as a person who received “regular payments from the Central Intelligence Agency” — or an August 2010 Times story that identified Karzai aide Mohammed Zia Salehi as being on the CIA payroll. Ahmed Wali Karzai was murdered during a 2011 shoot-out, a killing later claimed by the Taliban.

Fox News was told the email chain included then-Secretary of State Clinton and then-special envoy to Afghanistan and Pakistan Richard Holbrooke and possibly others. The basic details of this email exchange were backed up to Fox News by a separate U.S. government source who was not authorized to speak on the record.

It’s unclear who initiated the discussion – Clinton, Holbrooke or a subordinate – or whether the CIA’s relationship with the Afghan national was confirmed, because the classified documents are not public.

Holbrooke died in December 2010, during his service as a special envoy.

A CIA spokesperson told Fox News they had no comment on the email chain.

A spokeswoman for the Office of the Intelligence Community Inspector General also had no comment.

The U.S. government official’s account of the Clinton email chain dovetails with a Feb. 3 interview on Fox News’ “America’s Newsroom,” where Republican Rep. Chris Stewart, a member of the House intelligence committee, said, “I have never read anything more sensitive than what these emails contain. They do reveal classified methods. They do reveal classified sources and they do reveal human assets.”

Stewart added, “I can’t imagine how anyone could be familiar with these emails, whether they’re sending them or receiving them, and not realize that these are highly classified.”

While the Clinton campaign claims the government classification review has gone too far, Executive Order 13526, in a section called “classification standards,” says, “the unauthorized disclosure of foreign government information is presumed to cause damage to the national security.”

Fox News was first to report that the Clinton emails contained intelligence beyond “top secret,” and some of the information was deemed “HCS-O” – a code that refers to human intelligence from ongoing operations.

National security and intelligence experts emphasized to Fox News that security clearance holders are trained to not confirm or deny details of a classified program in an unclassified setting, which would include a personal unsecured email network, even if the classified program appears in press reports.

“The rules of handling classified information dictate if something is reported in open source [news reports] you don’t confirm it because it’s still classified information,” said Dan Maguire, who spent more than four decades handling highly classified programs and specialized in human intelligence operations.

As secretary of state, Clinton signed at least two non-disclosure agreements (NDA) on Jan. 22, 2009, and received a briefing from a security officer whose identity was redacted. As part of the NDA for “sensitive compartmented information” (SCI), Clinton acknowledged any “breach” could result in “termination of my access to SCI and removal from a position of special confidence and trust requiring such access as well as the termination of my employment or any other relationships with any Department or Agency that provides me with access to SCI.”

It is remains unclear how classified materials “jumped the gap” from a classified system to her personal server.

On Feb. 12, Clinton’s national press secretary Brian Fallon emphasized that classified information would have been marked as such. “I think when this review plays itself out, at the end they’ll find that what we have said is true,” he told CNN. “Nothing was marked classified at the time it was sent.”

Fallon also attacked the State Department inspector general, Steve Linick, for what he described as “fishing expedition-style investigations” since Clinton decided to run for president. “There is no basis. It is intended to create headwinds for her campaign, but it is not going to work,” Fallon said. He leveled a similar allegation against Intelligence Community Inspector General I. Charles McCullough, III, after his office notified Congress the emails contained information beyond top secret.

Inquiries by Fox News to Clinton’s attorney David Kendall about the status of or changes to her security clearance, and access to classified information, have not been returned.

Meet ISIS’ Special Operations Unit, Katibat al-Battar

Posted on by

Tip of the Spear? Meet ISIS’ Special Operations Unit, Katibat al-Battar

Bellingcat: On a mild November night last year, nine EU citizens roamed the streets of Paris with guns and explosives, murdering and injuring hundreds of civilians. In the days and weeks afterward, France declared emergency laws, Britain voted to expand the bombing of ISIS in Syria and ISIS supporters launched their own social media response on Twitter with #PrayforRaqqah.

But many of the most important questions around Paris remain unanswered. Where did these men come from? Were they part of a group? Who instructed them to commit these acts?

The following investigation reveals that a little-known group of battle-hardened and highly capable Libyans are the common factor behind many of the major terrorist attacks in Europe and North Africa since 2014.

1

Meet Katibat Al-Battar Al-Libi

When groups of Libyans involve themselves in foreign jihads, the West normally suffers. From the jihad in 1980s Afghanistan, through to running al-Qa’ida in Pakistan in the 2000s, Libyans fighters have played a significant role in most recent jihadist conflicts. As recently as 2007, the US Naval Academy at West Point released a study of seized Islamic State personnel files, which were found in a US Army raid in Iraq. To the author’s surprise, a disproportionate number of fighters were Libyan, and specifically from the town of Dernah, in the northeast Libya. Almost 20% of the Islamic State’s fighters in Iraq were Libyan, and of that figure, over 60% of them were from Dernah. According to the study, the city and its surrounds contained ‘the greatest concentration of jihadi terrorists anywhere on the planet’.

Unsurprisingly then, in 2012 as the Arab Spring caught fire, entire brigades of fighters from Dernah were among the first foreign fighters to arrive in Syria. Rather than immersing themselves with ISIS or Jabat al-Nusra, the Libyans created their own unit, Katibat al-Battar al-Libi, with the catching slogan ‘بالذبح جئناكم’ or; ‘We came to slaughter you’. Battar is a reference to one of the Prophet’s swords – known for its impact on the neck of his enemies. The group’s inaugural 2012 video is available here. Many of the Libyan members of KBL were seasoned veterans of Iraq and Afghanistan; battle-hardened fighters.

Over time, as ISIS’ power grew in Syria, KBL sensibly pledged allegiance to ISIS leader Abu Bakr Al-Baghdadi. With its cadre of experienced fighters, KBL began fighting for the ISIS cause in Syria and Iraq. In January 2015, KBL captured and brutally killed dozens of Peshmerga. Arabic media reports in July 2015 that 350 KBL fighters supported the ISIS presence in Baiji, Iraq, where a prominent leader, Abu Dujana Al-Libi was killed.

Blogs holding ISIS content indicate that KBL was one of the first groups in Syria to participate effectively in both fighting and relief work, playing a fundamental role in ISIS’ capture of Taftanaz airport and Khan Tuman.  Various reports estimate KBL’s strength in Syria from the low hundreds to over 1400. The group began life as a semi-autonomous commando unit fighting under the overall ISIS banner, but has clearly since expanded its role to include relief work in Syria and mass training camps in Libya (see below).

The group’s role as an elite unit of ISIS would have huge consequences for the Syrian war, but also for Europe, Libya and North Africa.

2

Europeans mix with KBL

In 2013 and 2014, European fighters began travelling to Syria in larger numbers. With its sterling reputation in Syria growing, KBL became an attractive group for Francophone fighters, specifically Belgians, French and Tunisians. Although the exact reason is unknown, one explanation for Belgians joining KBL is language; many Belgian-Moroccans are from eastern Morocco, whose Maghrebi dialect is very similar to Libyan Arabic.

During 2014, KBL records indicate a considerable number of Belgians died fighting for KBL in Syria. In addition to the domestic campaign, it appears that during 2014, KBL decided to expand its operations to Europe. One of the most prominent Belgians within KBL at the time was Abdelhamid Abaaoud. In order to evade the authorities, Abaaoud faked his own death in a published list of KBL martyrs, and he appears in social media with a number of KBL individuals during 2014.

Abaaoud was at the centre of a string of terrorist plots in Europe, before the Paris attacks in November 2015. It is likely that KBL introduced the concept of ‘Inghimasi’ operations to Abaaoud, and it is possible, if not probable that KBL – via Abaaoud – assisted, sponsored or directed at least four terrorist attacks in Europe in 2014-2015;

What is clear is that a considerable number of Europeans, Tunisians and Moroccans joined Katibat al-Battar as the group’s legend in Syria grew. Many of these fighters died in Syria or Iraq, fighting for Islamic State. However, in hindsight, the mixing of EU passport holders with perhaps the most violent, ruthless and capable group of Libyans in Syria dramatically escalated the terrorist threat to Europeans, both at home and abroad.

 

From Libya to Syria, and back again

Whilst KBL’s Belgians were busy in Syria plotting internal and external attacks, dozens of experienced KBL fighters returned to Dernah in Libya, creating the first ISIS province outside of Syria and Iraq – Wilayat Barqa. Some KBL fighters reorganised themselves under the Islamic Youth Shura Council. An ISIS delegation from Raqqah, including the Yemeni Abu Bara al-Azdi and the Saudi Abu Habib Al-Jazrawi visited IYSC in September 2014 and collected allegiances from IYSC aligned fighters.

KBL’s headquarters are now believed to be in Dernah, with secondary branches in Syria and Iraq. Online videos of KBL fighters generally indicate possession of small arms, mortars and vehicle mounted anti-aircraft. A KBL affiliated Facebook group has also been identified; the group’s icon is Jihadi John.

Reports indicate that the group runs training camps in Libya focused on assassinations, mass murder, weapons training and bomb-making. KBL’s is also reported to have an operations room in Dernah for terrorist activities in Tunisia.

3

According to several sources, the activities of KB are distributed across three teams:

  • Guarding IS leaders; this is mostly made up of Tunisian nationals and elements from the dissolved Iraqi Baath regime;
  • Liquidation Teams: in charge of assassinating those who refuse to pledge allegiance to Al-Baghdadi; unverified reports point to KBL’s involvement in the killing of Ansar Al-Sharia’s former leader, Mohamed Zahawi;
  • Mass Casualty ‘Inghimasi’ Operations: Inghimasi are well-trained terrorists who carries both light arms and explosives and fights until he runs out of ammunition. Though this information cannot be entirely verified, KBL affiliated fighters are thought to have played a role in the Tunisian attacks at the Bardo Museum and in Sousse

4 5

(Source: akherkhabaronline.com)

KBL are reportedly actively working in attracting young Tunisians to take part in fighting, following an initial training phase in its Libyan training camps. Nevertheless, the group’s strategies aimed at recruiting Western/European nationals remain ambiguous, particularly following the suspension of its official social media accounts.

The Age of the “Inghimasiyun”

Since joining ISIS, KBL have fostered and grown the concept of the Inghimasi; which is the jihadi equivalent of the kamikaze or the Nazi einsatzgruppen. The concept has gripped ISIS, who now broadcast their Inghimasi as heroes. Whilst there is no smoking gun pointing to KBL’s specific role in ‘Inghimasi’ style attacks at the Brussels museum, Paris, Sousse, the Corinthia hotel or the Bardo Museum in Tunis, it is important to note a) the modus operandi is entirely consistent with KBL’s Inghimasi operations b) many of the operatives were Tunisians and Belgians and c) All of these attacks came after KBL’s arrival in Dernah, in March 2014.

 

Going forward

One of the most important questions remains unanswered; to what extent are KBL subservient to ISIS, and do they retain a degree of operational autonomy? The evidence suggests KBL, moreso than ISIS, assisted or directed many of the major terrorist attacks in the past few years. Logically, then, from a Western perspective, Katibat al-Battar are the most dangerous unit within ISIS.

Perhaps of most concern to the West is KBL’s freedom to operate in Libya, with its Wilayat Barqa ISIS enclave. Whilst fighting other militias and subject to occasional airstrikes, the group is under far less pressure in Libya than its colleagues in Syria and Iraq.  It could be argued ISIS’ Libya branch presents a greater terrorist threat to Europe than its Syrian counterpart: mass training camps, proximity to Europe and the tourist beaches of Africa, and most importantly, operational pedigree – honed during years of conflict in Syria, Iraq and Afghanistan.

GW Bush’s Nitro Zeus to Stop Iran, Obama?

Posted on by

Due to the Iran nuclear talks and eventual deal, this whole story while accurate it appears, may be an actual leak for the sake of legitimizing Iran.

 David Sanger and Mark Mazzetti report on the February 16, 2016 New York Times website that “in the early years of the Obama administration, the United States developed an elaborate plan for a cyber attack on Iran, in case the diplomatic effort to limit its nuclear program failed; and, led to a military conflict, according to a upcoming documentary film, and interviews with military and intelligence officials involved in the effort.”

 
     “The plan, code-named NITRO ZEUS, was devised to disable Iran’s air defenses, communications systems; and, crucial parts of the power grid,” the Times noted; but, was shelved when the nuclear deal with Iran was concluded.  The Times adds that “NITRO ZEUS was part of an effort to assure POTUS Obama that he had alternatives, short of a full-scale war — if Iran lashed out at the United States, or its allies in the region.  At its height, officials say, the planning for NITRO ZEUS involved thousands of American military and intelligence personnel, spending tens of millions of dollars; and, placing electronic implants in Iranian computer networks to “prepare the battlefield,” in the parlance of the Pentagon.” 
 
    FC:  The White House was no doubt hoping to dissuade Israel from conducting a pre-emptive military strike against Iran’s nuclear infrastructure, while the nuclear negotiations with Iran were nearing a conclusion.  Left unanswered in the Times article was any mention of Israel’s cooperation and/or participation in the NITRO ZEUS planning and ultimate execution.  Was Israel made aware of the plan?; but, not invited to participate?  Were they a full partner and expected to contribute to the operation if it had occurred?  Or, did the White House attempt to keep Israel out of any knowledge or participation in the effort?
     Mr. Sanger and Mr. Mazzetti note that in addition to NITRO ZEUS, “American intelligence agencies developed a separate, far more narrowly focused cyber plan to disable Iran’s Fordo nuclear enrichment site, which Iran built deep inside a mountain near the [religious] city of Qom.  The attack [on Fordo] would have been a covert operation,” which would have required POTUS approval.
 
 
   “Fordo has long been considered one of the hardest targets in Iran, buried too deep for all but the most powerful bunker-buster [bombs] in the American military arsenal,” Mr. Sanger and Mr. Mazzetti write.  “Thev proposed [covert] intelligence operation called for the insertion of a computer “worm” into the facility — with the aim of frying Fordo’s computer systems — effectively delaying, or destroying the ability of Iranian centrifuges to enrich uranium at the enrichment site.  It was intended as a follow-up to “OLYMPIC GAMES,” the code-name of a cyber attack [never acknowledged] by the United States and Israel that destroyed 1,000 Iranian nuclear centrifuges; and [at least], temporarily disrupt [nuclear fuel] production at Natanz, a far larger; but, less protected enrichment site.”  This operation involved the use of the STUXNET cyber worm; and is considered by many the first military use of a cyber weapon of mass disruption.
 
     Mr. Sanger and Mr. Mazzetti note that “the existence of NITRO ZEUS was uncovered in the course of reporting for “Zero Days,” a documentary that will be shown Wednesday [today] at the Berlin Film Festival.  Directed by Alex Gibney, who is known for other documentaries, including the Oscar-winning, “Taxi To The Dark Side,” about the [alleged] use of torture by American interrogators; and, “We Steal Secrets: The Story Of Wikileaks.”
     “Zero Days,” describes the escalating conflict between Iran and the West, in the years leading up to the agreement, and discovery of the cyber attack on the Natanz enrichment plant; and, the debates inside the Pentagon over whether the United States has [had] a workable [cyber] doctrine for the use of a new form of weaponry — whose ultimate effects are [still] only vaguely understood,” the Times noted.
    “For the seven-year old United States Cyber Command, which is still building its cyber “special forces,” and deploying them throughout the world, the Iran project [which involved infusing electronic implants at key digital ‘choke-points] was perhaps its most challenging program yet,” Mr. Sanger and Mr. Mazzetti write.  “This was enormous, and [an] enormously complex program [operation],” said one participant who requested anonymity because the program is still [highly] classified.  “Before it was developed, the U.S. had never assembled a combined cyber, kinetic attack plan on this scale,” the official added.
     “While U.S. Cyber Command would have executed NITRO ZEUS, the National Security Agency’s (NSA) Tailorerd Access Operations Unit (TAO) was responsible for penetrating the adversary’s [Iran’s] networks, which would have required piercing, and maintaining a presence in a vast number of Iranian networks, including the country’s air defenses and its transportation and command control centers,” The Times noted.
     “It is a tricky business, the war planners say, because their knowledge of how networks are connected in Iran, or any other hard target, is sketchy, and collateral damage is always hard to predict.  It is easier to turn off power grids, for example, than to start them up again.”  And, there is the critical and fundamental issue of restoring trust in the system by the people — something which is often difficult to do — just ask Target.  They have managed; but, it took a while.
     The covert operation to sabotage Fordo was challenging to say the least, since this was a clandestine Iranian nuclear enrichment facility, buried inside a mountain and no doubt heavily guarded and very difficult to breach.  Very difficult, but not impossible.  As The Times noted, some of the stolen NSA documents purloined by fugitive Edward Snowden allegedly demonstrate how computer worms and cyber viruses can be secretly inserted — remotely — into a targeted network — even if disconnected from the Internet.  I commented on article yesterday on how to steal secret keylogger data from a disconnected/stand-alone computer in another room.  Needless to say, Mr. Snowden greatly aided our adversaries and the Islamic State and al Qaeda, others with his reckless and destructive leaks.  CIA Director john Brennan admitted in a CBS 60 Minutes interview on Sunday that the Paris attackers used encrypted communications to plan, orchestrate, and launch their attack, an operational technique that allowed them to ‘remain dark’ thus prevent or undermine our ability to ferret out and hopefully prevent their operations.  In the aftermath of the Snowden leaks, these groups substantially enhanced their encryption software; as evidenced in both Paris and San Bernardino.
     For the life of me, I cannot figure out why some within the U.S. government thought disclosing this alleged operation was in our national security interests and beneficial for everyone to know.  If the report is true, it betrays extremely sensitive tactics, techniques, and procedures.  As the age old saying goes, “one cannot vanquish one’s enemies, by telegraphing one’s punches.”  Okay, nukes aside.  There are those who argue that a deterrent capability only works, if the opponent believes you can actually do what you say you can.  But, the cyber world is vastly different from the kinetic, military weaponry world, as revealing an offensive cyber capability is likely to render the digital weapon useless beyond the initial public disclosure and use.  Hackers, malcontents, others will take pleasure in being the first to reverse engineer the cyber weapon and post their findings on the open net for all to see — and, take appropriate counter-measures.  One also has to assume that North Korea, among others, is now aware of how their own networked nuclear infrastructure could be vulnerable and take pre-emptive steps to remedy their vulnerabilities. More details from the NYT’s here.