Ukraine Cyber Attack on Power Grid, U.S. Warning

Ex-spy chief: Ukrainian cyberattack a warning sign for US utilities

Retired Gen. Michael Hayden, the former director of the National Security Agency and the CIA, says the US faces ‘darkening skies’ after malware linked power outages in Ukraine.

MIAMI — Former National Security Agency chief Gen. Michael Hayden warned that a recent malware attack on the Ukrainian power grid is yet another troubling sign that the US electric supply is vulnerable to hackers.

The Dec. 23 attack on utilities serving the Ivano-Frankivsk region of Ukraine appears to be the second confirmed incident of a computer-based attack to damage physical infrastructure. The attack led to blackouts throughout the region for several hours before power was restored. The Stuxnet worm that targeted the Iranian nuclear program is the only other such incident.

What happened in Ukraine is a harbinger for the kinds of cyberthreats the US faces, possibly from rival nations such as Russia and North Korea, the retired Air Force general told a crowd of critical infrastructure experts at the S4x16 security conference in Miami. General Hayden served as director of the NSA from 1999 to 2005 and served as CIA chief from 2006 to 2009.

“There a darkening sky,” he told reporters after his speech Tuesday, referring to the increasing threat of malware infections leading to physical damages. “This is another data point on an arc that we’ve long predicted,” he said, acknowledging that the Ukraine attack reinforces concerns in official circles about security of the American power grid. What’s more, he said, if early analysis of malware discovered at the Ukrainian facility that links it to Russia is accurate, the incident foreshadows a troubling uptick in the conflict between Ukraine and Russia over the disputed Crimea region.

The Department of Homeland Security has acknowledged that a version of the BlackEnergy program linked to the Ukraine attack has been discovered in US facilities. Hayden said that the link was troubling. “If they have a presence on the grid [with BlackEnergy] then they have already achieved what they need to carry out a destructive attack.”
Analysis of the malware recovered from the Ukrainian facility conducted by the security firm iSight Partners and SANS Institute revealed that a variant of BlackEnergy, dubbed “BlackEnergy3,” was present in the compromised utilities. However, security experts caution that it is premature to conclude that BlackEnergy was actually involved in the outages.

“It is possible but far too early in the technical analysis to state that,” wrote Michael Assante, who heads up industrial control system research for SANS. “Simply put, there is still evidence that has yet to be uncovered that may refute the minutia of the specific components of the malware portion of the attack.”

Hayden also remarked during his talk Friday on the general state of overall cybersecurity, calling on US lawmakers to pass legislation that will help bolster the nation’s digital defenses.

He also criticized of efforts by FBI Director James Comey, and others in the Obama administration, to weaken strong encryption on consumer devices to make it easier for law enforcement to conduct surveillance operations. “End-to-end encryption is good for America,” he said. “I know that it represents challenges for the FBI, but on balance it creates more security for Americans than the alternative – backdoors.”

Regarding the recent Office of Personnel Management hack – which US intelligence agencies and cybersecurity expert have blamed on China – Hayden said that as head of the NSA he would have absolutely stolen similar data from the Chinese government if given the opportunity. What’s more, he said, he wouldn’t have had to ask permission to carry out the operation.

“Fundamentally, the limiting factor now is a lack of legal and policy framework to do what we are capable of doing today,” Hayden said. “OPM isn’t a bad on China,” he said. “It’s a bad on us.”

What is vulnerable in the United States?

Project ‘Gridstrike’ Finds Substations To Hit For A US Power Grid Blackout

Turns out free and publicly available information can be used to determine the most critical electric substations in the US, which if attacked, could result in a nationwide blackout.

Remember that million-dollar Federal Energy Regulatory Commission (FERC) study in 2013 that found that attacks on just nine electric substations in the US could cause a blackout across the entire grid? Well, a group of researchers decided to see just what it would take for a small group of domestic terrorists to identify the US’s most critical substations — using only free and public sources of information.

While FERC relied on confidential and private information in its shocking report and spent a whopping $1 million in research, researchers at iSIGHT Partners used only so-called open-source intelligence, at a cost of just $15,000 total for 250 man-hours by their estimates. The Wall Street Journal, which obtained and first reported on the confidential FERC report, never publicly revealed the crucial substations ID’ed by FERC for obvious reasons, nor does iSIGHT plan to disclose publicly the ones it found.

Sean McBride, lead analyst for critical infrastructure at iSIGHT, says the goal of his team’s so-called “Gridstrike” project was to determine how a small local-grown terror group could sniff out the key substations to target if it were looking to cause a power blackout — either via physical means, a cyberattack, or a combination of the two. “How would an adversary go about striking at the grid?” McBride said in an interview with Dark Reading. He will speak publicly for the first time about the Gridstrike research next week at the S4x2016 ICS/SCADA conference in Miami.

The iSIGHT researchers drew from a combination of publicly available transmission substation information, maps, Google Earth, and grid congestion documentation, and drew correlations among the substations that serve the top ten cities in the US. They then were able to come up with 15 substations that serve as the backbone for much of the electric grid: knocking out those substations would result in a nationwide blackout, they say.

FERC’s report had concluded that the US could suffer a nationwide blackout if nine of the nation’s 55,000 electric transmission substations were shut down by attackers.

“We looked at maps and tried to … identify [power] generation facilities, and looked up both centers and what substations are in the middle that would make high-value targets,” for example, McBride says. “We tried to identify which substations have the highest number of transmission lines coming in and out,” as well, and weighed their significance.

The researchers shared the findings from Gridstrike with their customers as well as “organizations most interested from a defense perspective” to such attacks, says McBride, who declined to provide any further details on the specific organizations.

“We were extremely concerned about the amount of publicly available information” on the critical substations, McBride says. There were several documents available publicly that should not have been: in some cases, a sensitive document was sitting on an organization’s public website even though it specified that the report was not for public consumption.

The hope is that the findings will alert critical infrastructure and other organizations with ties to the power grid that understanding how an adversary thinks can help shore up defenses, McBride says. “They need to manage their recon exposure.”

What does all of this mean for the US power grid’s actual vulnerability to a physical or cyber-physical attack? McBride says the openly available intel is “reason for concern.” He says he worries more about the possibility of a regional, localized, grid attack targeting a city or area, than a nationwide attack.

As for the recent power blackout in the Ukraine that appears to have been due in part to a cyberattack, McBride says he’d be surprised if the attackers didn’t gather some of their reconnaissance via open source intelligence.

 

RapeFugee Operation Coordinated on Social Media

It is a game and it has a name: ‘Taharrush gamea’

German Justice Minister: Cologne attacks planned in advance

Minister of Justice Heiko Maas has said he believes the sexual assaults in Cologne were ‘coordinated and prepared’ ahead of time. He also accused xenophobic groups of using the crimes to stir up hatred.

DW: Germany’s Justice Minister Heiko Maas was the latest high-profile politician to speak out about the string of sexual assaults in Cologne on Sunday. In an interview with the popular “Bild am Sonntag” newspaper, Maas voiced his suspicions that the crimes which have the whole country reeling were not the result of an opportunistic mob mentality but a thought-out, planned attack on the city’s women.

“No one can tell me that it wasn’t coordinated and prepared,” the minister said. “My suspicion is that this specific date was picked, and a certain number of people expected. This would again add another dimension [to the crimes].”

The newspaper provided details from official police reports citing the use of social networks by some north African migrant communities to encourage their fellows to join them in the square between the Cologne train station and the cathedral, where the now hundreds of incidents of molestation and pick-pocketing took place.

Maas was careful to echo his colleagues, however, when it came to warning the public against placing blame on the country’s immigrants, saying “to assume from somebody’s origin whether or not they are delinquent is quite reckless.” The minister added that it is “complete nonsense” to take these crimes as evidence that foreigners cannot be integrated into German society.

Maas lashes out at PEGIDA, AfD

In the interview, Maas also accused the far-right populists of the Alternative for Germany (AfD) party, along with the organizers of the xenophobic PEGIDA marches, of using Cologne for propaganda purposes.

“There is the only way they can explain how shamelessly they operate their sweeping campaign against foreigners,” Maas said, referring to Saturday’s PEGIDA demonstration at the Cologne train station, which was itself met with a flashmob of counter-protesters condemning racism and sexism.

All that being said, Maas added that “cultural background justifies or excuses nothing. There is no acceptable explanation [for the assaults]. For us, men and women have equal rights in all matters. Everyone who lives here must accept that.”

In the coming days, Maas’ Social Democrats (SPD) are expected to join coalition partners, Chancellor Angela Merkel’s (CDU) in presenting new laws to the Bundestag that would expedite the deportation of asylum seekers and migrants who commit crimes . The administration has received a hefty amount of criticism for ill-preparedness when dealing with the open-door policy it has adopted towards Europe’s migrant crisis.

Istanbul Suicide Bomber Entered Country as Syrian Refugee, Officials Say

Bomber identified as Nabil Fadli was fingerprinted, but information didn’t set off security alerts

WSJ: ISTANBUL—The Islamic State suicide bomber who killed 10 German tourists in the heart of Istanbul entered the country as a Syrian refugee without setting off security alerts, Turkish officials said Wednesday, highlighting concerns that extremists are using the migrant crisis to move around and carry out terrorist attacks.

Just to our North, comes 10,000 Syrian refugees in Canada.

Canada welcomes 10,000th Syrian refugee

Ottawa (AFP) – Canada has welcomed its 10,000th Syrian refugee, the government announced Wednesday, although almost two weeks behind schedule and far fewer than it had originally planned to resettle by now.

A planeload landed in Toronto late Tuesday, putting the number of arrivals of asylum seekers at 10,121 since November when Prime Minister Justin Trudeau’s Liberals took office.

In a statement, Immigration Minister John McCallum called it a “significant milestone” on the way to meeting the Liberal’s overall pledge to take in 25,000 Syrians.

“Many people have worked day and night to bring these refugees to Canada,” he said, “and Canadians have opened their communities and their hearts to welcome them.

“Canada continues to set an international example with its response to the worst refugee crisis of our time.”

Trudeau had promised during an election campaign last year to resettle 25,000 Syrian refugees by December 31.

But after assuming power the target date was pushed to the end of February, following criticism that the government was moving too fast amid security concerns in the aftermath of deadly attacks in Paris, as well as due to logistical issues.

A new interim target of taking in 10,000 by December 31 was set, but only 6,000 Syrians travelling from camps in Jordan, Lebanon, and Turkey made it onto Canadian soil by year’s end.

The UN refugee agency estimates that more than four million Syrians have fled the civil war ravaging their country. The Britain-based Syrian Observatory for Human Rights puts the total number of dead at more than 260,000 people.

 

Secret Companies with Secret Objectives Near You

Is the nation’s largest online retailer part of a spy network? Have you given thought to the countless databases, harvesting data, human behavior, and all the interactions you have through the internet? Is Amazon now part of a larger incubation center for the federal government? You decide.

 Amazon network

Why Amazon’s Data Centers Are Hidden in US Spy Country

DefenseOne: Of all the places where Amazon operates data centers, northern Virginia is one of the most significant, in part because it’s where AWS first set up shop in 2006. It seemed appropriate that this vision quest to see The Cloud across America which began at the ostensible birthplace of the Internet should end at the place that’s often to blame when large parts of the U.S. Internet dies.

Northern Virginia is a pretty convenient place to start a cloud-services business: for reasons we’ll get into later, it’s a central region for Internet backbone. For the notoriously economical and utilitarian Amazon, this meant that it could quickly set up shop with minimal overhead in the area, leasing or buying older data centers rather than building new ones from scratch.

The ease with which AWS was able to get off the ground by leasing colocation space in northern Virginia in 2006 is the same reason that US-East is the most fragile molecule of the AWS cloud: it’s old, and it’s running on old equipment in old buildings.

Or, that’s what one might conclude from spending a day driving around looking for and at these data centers. When I contacted AWS to ask specific questions about the data-center region, how they ended up there, and the process of deciding between building data centers from scratch versus leasing existing ones, they declined to comment.

The fact that northern Virginia is home to major intelligence operations and to major nodes of network infrastructure isn’t exactly a sign of government conspiracy so much as a confluence of histories (best documented by Paul Ceruzzi in his criminally under-read history Internet Alley: High Technology In Tysons Corner, 1945-2005). To explain why a region surrounded mostly by farmland and a scattering of American Civil War monuments is a central point of Internet infrastructure, we have to go back to where a lot of significant moments in Internet history take place: the Cold War.

Postwar suburbanization and the expansion of transportation networks are occasionally overlooked, but weirdly crucial facets of the military-industrial complex. While suburbs were largely marketed to the public via barely concealed racism and the appeal of manicured “natural” landscapes, suburban sprawl’s dispersal of populations also meant increased likelihood of survival in the case of nuclear attack. Highways both facilitated suburbs and supported the movement of ground troops across the continental United States, should they need to defend it (lest we forget that the legislation that funded much of the U.S. highway system was called the National Interstate and Defense Highways Act of 1956).

Unlike Google and Facebook, AWS doesn’t aggressively brand or call attention to their data centers. They absolutely don’t give tours, and their website offers only rough approximations of the locations of their data centers, which are divided into “regions.” Within a region lies at minimum two “availability zones” and within the availability zones there are a handful of data centers.

I knew I wasn’t going to be able to find the entirety of AWS’ northern Virginia footprint, but I could probably find bits and pieces of it. My itinerary was a slightly haphazard one, based on looking for anything tied to Vadata, Inc., Amazon’s subsidiary company for all things data-center-oriented.

Facebook data-center

Google’s web crawlers don’t particularly care about AWS’ preference of staying below the radar, and searching for Vadata, Inc. sometimes pulls up addresses that probably first appeared on some deeply buried municipal paperwork and were added to Google Maps by a robot. It’s also not too hard to go straight to those original municipal documents with addresses and other cool information, like fines from utility companies and documentation of tax arrangements made specifically for AWS. (Pro tip for the rookie data-center mapper: if you’re looking for the data centers of other major companies, Foursquare check-ins are also a surprisingly rich resource). My weird hack research methods returned a handful of Vadata addresses scattered throughout the area: Ashburn, Sterling, Haymarket, Manassas, Chantilly. Much more of the report is here.

 Amazon’s Cloud center

CNBC: Palantir is notorious for its secrecy, and for good reason. Its software allows customers to make sense of massive amounts of sensitive data to enable fraud detection, data security, rapid health care delivery and catastrophe response.

Government agencies are big buyers of the technology. The FBI, CIA, Department of Defense and IRS have all been customers. Between 30 and 50 percent of Palantir’s business is tied to the public sector, according to people familiar with its finances. In-Q-Tel, the CIA’s venture arm, was an early investor.

Annual revenue topped $1.5 billion in 2015, sources say, meaning Palantir is bigger than top publicly traded cloud software companies like Workday and ServiceNow. It has about 1,800 employees and is growing headcount 30 percent annually, said the sources, who asked not to be named because the numbers are private.

Palantir serves up free meals for employees at 542 High Street, home to its cafeteria. A red sign reading “Private Company Meal” is attached to the window, and a neon blue sign on the inside says “Hobbit House.”

Other perks, according to people with knowledge of the company’s policies, include subsidized housing for employees who live in the neighborhood and help with monthly commuter Caltrain passes for those traveling down from San Francisco or up from San Jose. Employees who drive in get complimentary parking permits.

“They’re making a commitment here,” said Cannon.

“The idea is that it’s physically locked down and there’s no way you can take information out.” -Avivah Litan, Gartner analyst

For Palantir to stay, it has no choice but to spread out. Only one building in downtown Palo Alto even tops 100,000 square feet, and last year city officials limited total annual development in the commercial districts to 50,000 square feet.

There’s another benefit to having a disparate campus. In doing highly classified work for government agencies, some contracts require the use of particular types of units called Sensitive Compartmented Information Facilities, or SCIFs.

Avivah Litan, a cybersecurity analyst with Gartner, says qualities of a SCIF building include advanced biometrics for security, walls that are impenetrable by radio waves and heavily protected storage of both physical items and digital data.

“They have to make the walls so that no signals can be transmitted out of those walls,” said Litan, who is based in Washington, D.C. “The idea is that it’s physically locked down and there’s no way you can take information out.”

Having entirely separate facilities makes it easier to clear that hurdle, but even so, the vast majority of Palantir’s offices aren’t SCIFs. Read the full summary here.

FBI Expanding Clinton Investigation to Public Corruption

There are 150 FBI agents assigned to work the Clinton public corruption scandal of which the Clinton Foundation is at the core.

FBI’s Clinton probe expands to public corruption track

EXCLUSIVE: The FBI investigation into Hillary Clinton’s use of private email as secretary of state has expanded to look at whether the possible “intersection” of Clinton Foundation work and State Department business may have violated public corruption laws, three intelligence sources not authorized to speak on the record told Fox News.

This new investigative track is in addition to the focus on classified material found on Clinton’s personal server.

“The agents are investigating the possible intersection of Clinton Foundation donations, the dispensation of State Department contracts and whether regular processes were followed,” one source said.

The development follows press reports over the past year about the potential overlap of State Department and Clinton Foundation work, and questions over whether donors benefited from their contacts inside the administration.

The Clinton Foundation is a public charity, known as a 501(c)(3). It had grants and contributions in excess of $144 million in 2013, the most current available data.

Inside the FBI, pressure is growing to pursue the case.

One intelligence source told Fox News that FBI agents would be “screaming” if a prosecution is not pursued because “many previous public corruption cases have been made and successfully prosecuted with much less evidence than what is emerging in this investigation.”

The FBI is particularly on edge in the wake of how the case of former CIA Director David Petraeus was handled.

One of the three sources said some FBI agents felt Petraeus was given a slap on the wrist for sharing highly classified information with his mistress and biographer Paula Broadwell, as well as lying to FBI agents about his actions. Petraeus pleaded guilty to a misdemeanor in March 2015 after a two-plus-year federal investigation in which Attorney General Eric Holder initially declined to prosecute.

In the Petraeus case, the exposure of classified information was assessed to be limited.

By contrast, in the Clinton case, the number of classified emails has risen to at least 1,340. A 2015 appeal by the State Department to challenge the “Top Secret” classification of at least two emails failed and, as Fox News first reported, is now considered a settled matter.

It is unclear which of the two lines of inquiry was opened first by the FBI and whether they eventually will be combined and presented before a special grand jury. One intelligence source said the public corruption angle dates back to at least April 2015.  On their official website, the FBI lists “public corruption as the FBI’s top criminal priority.”

Fox News is told that about 100 special agents assigned to the investigations also were asked to sign non-disclosure agreements, with as many as 50 additional agents on “temporary duty assignment,” or TDY. The request to sign a new NDA could reflect that agents are handling the highly classified material in the emails, or serve as a reminder not to leak about the case, or both.

“The pressure on the lead agents is brutal,” a second source said. “Think of it like a military operation, you might need tanks called in along with infantry.”

Separately, a former high-ranking State Department official emphasized to Fox News that Clinton’s deliberate non-use of her government email address may be increasingly “significant.”

“It is virtually automatic when one comes on board at the State Department to be assigned an email address,” the source said.

“It would have taken an affirmative act not to have one assigned … and it would also mean it was all planned out before she took office. This certainly raises questions about the so-called legal advice she claimed to have received from inside the State Department that what she was doing was proper.”

On Sunday,  when asked about her email practices while secretary of state, Clinton insisted to CBS News’ “Face The Nation,” “there is no there, there.”

Assad and Iran’s Militia in the Middle East

Those operating in the Middle East at the behest of Iran for Iran and Syria have been identified, now what? Saudi Arabia with the cooperation of other Gulf nations has been quite assertive to end the conflicts in Syria, Yemen, Iraq and so forth yet Iran, Syria and Russia have zero interest in stopping Assad. How long into the future will this fester and will it eventually plateau only when the United States has a new president and who can lead and be effective among the candidates?

To understand the history between Shiite and Sunni, click here.

Iran won’t surrender militias that conduct Assad’s war

Not long before the Riyadh-Tehran diplomatic row that followed the execution of Saudi Shia cleric Nimr Al Nimr, a showdown between the two countries unfolded in New York. While it is difficult to draw a direct correlation between the two events, the incident can help us understand the depth of the continuing crisis.

On December 18, heated debate ensued between representatives of the two countries at a meeting in New York over the listing of armed groups operating in Syria for possible determination as terrorist organisations. The list, which Jordan was asked to develop, would name extremist groups that must be defeated as part of the UN-sponsored political process for Syria.

A month earlier in Vienna, Saudi Arabia had insisted on including in the list foreign Shia militias fighting on the side of president Bashar Al Assad. Riyadh argued that all foreign fighters must leave Syria, regardless of which side they supported. In New York, Iran, joined by Russia, strongly objected to the demand and the standoff caused a deeper rift between the two countries.

For now, the designation of terror groups in Syria has been referred to a committee comprising several European and regional countries. They first determined indicators and criteria of what constitutes a terrorist organisation, then named armed groups currently fighting in Syria. There is a preliminary list of more than 160 Sunni and Shia organisations.

Iran categorically rejects including any Shia groups in the list. For Tehran, the fate of the Assad regime it supports is critically tied to the presence of those Shia militias. It is a fact that adds to the many issues that compound the conflict in Syria – issues that the international community would seemingly rather sweep under the carpet instead of deal with head on.

The Syrian regime controls about 30 per cent of the country, though it probably controls over 50 per cent of the population. According to the defence think tank IHS Jane’s, the regime lost 16 per cent of its territory over the past year. These figures are particularly damning if one considers that foreign Shia militias were on the front line of key battles against the rebels – in the Qalamoun region, Aleppo and central and western Syria – over this period.

The growing role of these militias last year came as the Syrian army showed signs of internal weakening, something that Mr Al Assad has admitted. During his most recent speech, almost exactly a month before the Russian intervention in September, the president said that the army lacked “manpower”. Also last year, paramilitary fighters with the National Defence Forces (NDF) began to focus on their local areas rather than deploy in the front lines elsewhere – a task that foreign fighters took on.

Youssef Sadaki, a Syrian researcher who closely focuses on Shia militias, says those foreign fighters acted as the main strikers in battles outside the regime’s heartlands, while the NDF fighters defended their areas or secured and held newly-captured areas.

According to Mr Sadaki, foreign militias lead the regime’s battles in southern Aleppo, and the front lines between Idlib, Aleppo, Latakia, Homs and Hama. Hizbollah has spearheaded key battles in southern Syria near the Lebanese borders, while other militias guard the front lines in Damascus and fought in Deraa.

Phillip Smyth, a close observer of Shia militancy, says that most of the regime’s offensives over the past two years were led by foreign forces, including in areas where the regime’s elite units operate, such as in Damascus.

“When we look at Aleppo, the entire offensive there was spearheaded and planned by the Iranians, it was their Shia militia proxy forces which showcased the entire campaign,” said Mr Smyth, from the University of Maryland. “It’s quite clear that they are a – if not the main – fighting force in many areas.”

Last month on these pages, I highlighted that while Iran and Russia might in theory be willing to accept the removal of Mr Al Assad, there are practical reasons why they would not do that, because consequences are unpredictable and the result is not guaranteed.

For the rebels, no peace is possible while Mr Al Assad is in power, so his future complicates the peace talks. So does the presence of Shia militias in Syria.

Reliance on these foreign forces means that their departure will have to follow the consolidation of the government’s military control over the country. They operate in critical areas and the regime’s army or NDF do not appear to be prepared to take their place.

The presence of Shia militias is important for the regime and for its backer in Tehran. Many of these militias are also key Iranian proxies in Iraq, with recent reports suggesting that Iran has diverted them to Syria to assist in the wake of the Russian intervention in Syria. So the issue has also a regional dimension that cannot be ignored.

Iran finds itself in a situation where it seeks to save the regime in Syria through the help of religious zealots, while pushing for the designation as terrorists of Sunni extremists fighting on the side of the opposition.

In western capitals, strangely, that seems to be a reasonable position. For the opposition and regional backers such as Saudi Arabia, that is double dealing that further complicates the already-complex conflict in Syria.

Meanwhile, back to Iran and the big money. What future trouble will the monetary windfall coming for Iran play in the region?

Iran to Receive Major Economic Windfall as Nuclear Deal Begins

FreeBeacon: Expert: ‘Kerry might as well have wired the money directly into the Revolutionary Guards’ bank accounts’

Iran’s economy is set to receive a substantial boost in the next two years as a result of billions in sanctions relief from the nuclear deal, according to a new forecast, a windfall that could also secure more resources for the Iranian military and its terrorist proxies.

The World Bank said in a report that Iran’s GDP is projected to increase by 5.8 percent this year, compared to just 1.9 percent last year. Economic growth is then estimated to rise by 6.7 percent in 2017.

As part of the nuclear agreement reached between Iran and world powers last year, the Islamic regime could collect as much as $150 billion in unfrozen assets from foreign accounts after it places some restrictions on its nuclear program. Tehran will also be permitted to resume more oil exports, which could increase its sales by 0.5 to 0.7 million barrels per day this year.

The nuclear deal “opens the door for reintegration of [Iran] into the global economy and the reinvigoration of its oil, natural gas, and automotive sectors,” the World Bank said in its global economic prospects report.

“Sanctions could begin to be lifted in early 2016 if the International Atomic Energy Agency (IAEA) indicates the Iranian government has fulfilled its commitments under the pact,” the report continued. “Renewed optimism about the potential of the Iranian economy has already generated a flurry of investment interest by foreign companies.”

Michael Rubin, an expert on Iran and the Middle East at the American Enterprise Institute, said in an email that he also expects the Iranian economy to grow in the wake of the nuclear deal, though he cautioned that the World Bank can be too reliant on flawed statistics from Tehran. Rising growth in Iran would represent a stark contrast to the economic situation before the nuclear negotiations, when the country’s economy contracted under the weight of U.S.-led sanctions.

At the talks, U.S. Secretary of State John Kerry turned in “probably the worst negotiating performance any U.S. secretary of state has had in the last century,” Rubin said, because he failed to pressure Iran into eliminating all aspects of its nuclear program.

“Rather than use Iran’s precarious economic situation as leverage in U.S. negotiations, Secretary of State John Kerry effectively caved,” said Rubin, who is also a former Pentagon official in the George W. Bush administration.

“The Obama administration effectively bailed Iran out,” he added.

Analysts have raised concerns that the Islamic regime could devote billions of its sanctions relief to the Islamic Revolutionary Guard Corps (IRGC), the elite paramilitary unit that also supports terrorist groups in Lebanon, Gaza, and Yemen. The American Action Forum estimated last year that the Guard Corps’ budget could increase by about $3 billion after the nuclear deal is fully implemented.

“If Iran’s economy does grow—and that growth is not eroded from significant inflation from the hard currency influx—then the chief beneficiaries will be the Islamic Revolutionary Guard Corps who have a stranglehold over the oil industry, import-export, and construction,” Rubin said. “Kerry might as well have wired the money directly into the Revolutionary Guards’ bank accounts, because that is the net effect.”

Iran could also use the sanctions relief to bolster its ballistic missile program. Iranian forces have tested two ballistic missiles since the nuclear agreement was reached, including one in October that was capable of carrying a nuclear warhead and violated a United Nations Security Council ban. President Hassan Rouhani has said the military should allocate more resources to its missile program if the United States decides to impose sanctions for the missile tests.

Additionally, an Iranian military with more funding could further exacerbate sectarian tensions in the Middle East. Following the execution of a Shiite cleric by Saudi Arabia, a Sunni Muslim nation and Iran’s bitter regional rival, Iranian protesters stormed the Saudi embassy in Tehran, prompting the Saudis to break off diplomatic relations. Iran has now accused a Saudi-led coalition of launching airstrikes near its embassy in Yemen.

Rubin warned that Iran previously capitalized on negotiations and trade in the early 2000s to augment its nuclear program.

“Between 1999 and 2005, Europe’s trade with Iran almost tripled and the price of oil about quintupled,” he said. “Iran put about 70 percent of that hard currency windfall into its nuclear and ballistic missile programs.”

“The reason for the expansion of Iran’s illicit programs early the last decade was too much diplomacy, not too little,” he continued. “The Supreme National Security Chairman at the time directing those programs? Hassan Rouhani. Kerry is simply making the same mistake twice.”