Arms Race, Cyber Defenses Fail

By: Damian Paletta, Danny Yadron and Jennifer Valentino-DeVries
Countries toiled for years and spent billions of dollars to build elaborate facilities that would allow them to join the exclusive club of nations that possessed nuclear weapons.
Getting into the cyberweapon club is easier, cheaper and available to almost anyone with cash and a computer.
A series of successful computer attacks carried out by the U.S. and others has kicked off a frantic and destabilizing digital arms race, with dozens of countries amassing stockpiles of malicious code. The programs range from the most elementary, such as typo-ridden emails asking for a password, to software that takes orders from a rotating list of Twitter handles.
The proliferation of these weapons has spread so widely that the U.S. and China-longtime cyber adversaries-brokered a limited agreement last month not to conduct certain types of cyberattacks against each other, such as intrusions that steal corporate information and then pass it along to domestic companies. Cyberattacks that steal government secrets, however, remain fair game.
This comes after other countries have begun to amass cyberweaponry on an unprecedented scale. Pakistan and India, two nuclear-armed rivals, regularly hack each other’s companies and governments, security researchers said. Estonia and Belarus are racing to build defensive shields to counter Russia. Denmark and the Netherlands have begun programs to develop offensive computer weapons, as have Argentina and France.
In total, at least 29 countries have formal military or intelligence units dedicated to offensive hacking efforts, according to a Wall Street Journal compilation of government records and interviews with U.S. and foreign officials. Some 50 countries have bought off-the-shelf hacking software that can be used for domestic and international surveillance. The U.S. has among the most-advanced operations.
In the nuclear arms race, “the acronym was MAD-mutually assured destruction-which kept everything nice and tidy,” said Matthijs Veenendaal, a researcher at the NATO Cooperative Cyber Defence Centre of Excellence, a research group in Estonia. “Here you have the same acronym, but it’s ‘mutually assured doubt,’ because you can never be sure what the attack will be.”
Governments have used computer attacks to mine and steal information, erase computers, disable bank networks and-in one extreme case-destroy nuclear centrifuges.
Nation states have also looked into using cyberweapons to knock out electrical grids, disable domestic airline networks, jam Internet connectivity, erase money from bank accounts and confuse radar systems, experts believe.
Large conventional militaries and nuclear forces are ill-suited to this new kind of warfare, which evens the playing field between big and small countries. Cyberattacks are hard to stop and sometimes impossible to trace. The West, as a result, has been forced to start reconfiguring its militaries to better meet the threat.
 
Access to cyberweapons, according to U.S. and foreign officials and security researchers, is far more widespread than access to nuclear weapons was at the height of the nuclear arms race, a result of inexpensive technology and the power of distributed computing.
More than two dozen countries have accumulated advanced cyberweapons in the past decade. Some Defense Department officials compare the current moment to the lull between the World Wars when militaries realized the potential of armed planes.
“It’s not like developing an air force,” in terms of cost and expertise, said Michael Schmitt, a professor at the U.S. Naval War College and part of an international group studying how international law relates to cyberwarfare. “You don’t need to have your own cyberforce to have a very robust and very scary offensive capability.”
For example, hackers aligned with the Syrian government have spied into the computers of rebel militias, stolen tactical information and then used the stolen intelligence in the ongoing and bloody battle, according to several researchers, including FireEye Inc.
Most cyberattacks linked to the U.S. and foreign governments in recent years involve cyberspying-breaking into a computer network and stealing data. More-aggressive covert weapons go further, either erasing computer records or destroying physical property.
“With some countries, we’re comfortable with knowing what their capabilities are, but with other countries we’re still lost,” said Andre McGregor, a former cyber special agent at the Federal Bureau of Investigation and now the director of security at Tanium Inc., a Silicon Valley cybersecurity startup. “We don’t have the visibility into their toolset.”
The Military Balance, a widely read annual assessment of global military powers published by the International Institute for Strategic Studies in London, tallies tanks, battalions and aircraft carriers. When it comes to national cyberforces it says “capabilities are not assessed quantitatively.”
In the U.S., the National Security Agency, Central Intelligence Agency, FBI and others all play roles in combing through intelligence.
U.S. officials say their biggest concerns are the cyberweapons held by the Chinese, Russians, Iranians and North Koreans, countries that have deployed advanced attacks that either dug inside U.S. government networks or targeted top U.S. companies. Even Israel, a U.S. ally, was linked to hacking tools found on the computers of European hotels used for America’s diplomatic talks with Iran, according to the analysis of the spyware by a top cybersecurity firm. Israeli officials have denied spying on the U.S.
Cyberarmies tend to be integrated with a country’s military, its intelligence services, or both, as is the case in China and the U.S.
In China, hackers are famous for the relatively low-tech tactic of “phishing”-sending a flood of disguised emails to trick corporate employees and government bureaucrats to letting them into their networks.
The U.S. suspects that is how they penetrated the Office of Personnel Management, using a phishing email to breach an OPM contractor and then crack the agency’s network. The records of more than 21 million people were exposed in the 2014 and 2015 data breach, disclosed this summer. China has said it wasn’t involved.
China’s army has divisions devoted to cyberattacks, and recent evidence shows links between the country’s military and hackers who appear to be pressing the country’s interests abroad.
“They used to be snap and grab-get in and dump everything they can,” said Tommy Stiansen, co-founder and chief technology officer at Norse Corp., a California cybersecurity firm that tracks nation-state activity. “Now they trickle out the information, stay hidden in the system. We’ve even seen Chinese actors patch and repair networks once they’ve broken in.”
China opposes the militarization of cyberspace or a cyberarms race, said Zhu Haiquan, a spokesman for the Chinese Embassy in Washington, adding China “firmly opposes and combats all forms of cyberattacks in accordance with law.”
Choosy in targets
 
Russian hackers have targeted diplomatic and political data, burrowing inside unclassified networks at the Pentagon, State Department and White House, also using emails laced with malware, according to security researchers and U.S. officials.
They have stolen President Barack Obama‘s daily schedule and diplomatic correspondence sent across the State Department’s unclassified network, according to people briefed on the investigation. A Russian government spokesman in April denied Russia’s involvement.
“Russia has never waged cyberwarfare against anyone,” Andrey Akulchev, a spokesman for the Russian Embassy in Washington, said in a written statement Friday. “Russia believes that the cybersphere should be used exclusively for peaceful purposes.”
Russia’s top hackers tend to be choosier in their targets, tailoring email attacks to those they believe might unwittingly open links or attachments.
“They are sitting there trying to think through ‘how do I really want to compromise this target?’ ” said Laura Galante, director of threat intelligence at FireEye, a Silicon Valley cybersecurity company that works closely with Washington. “The Chinese just want a foothold into the target. Russian theft is very personal.”
U.S. spies and security researchers say Russia is particularly skilled at developing hacking tools. Some malicious software linked to Russia by security researchers has a feature meant to help it target computers on classified government networks usually not connected to the Internet.
The virus does this by jumping onto USB thumb drives connected to targeted computers, in the hopes that the user-such as U.S. military personnel-will then plug that USB drive into a computer on the classified network.
Russian hackers also make efforts to hide stolen data in normal network traffic. In one example, a piece of malware hides its communications in consumer Web services to fool cybersecurity defenses. The code downloads its instructions from a set of Twitter accounts. It then exports data to commercial storage services. This tactic is effective because corporate cybersecurity systems often don’t block traffic to and from these sites.
Government investigators believe Iranian hackers implanted the Shamoon virus on computers at Saudi Arabia’s Saudi Aramco, the world’s largest energy firm, in 2012. The Aramco attack erased 75% of the company’s computers and replaced screen images with burning American flags. The attack didn’t affect oil production, but it rattled the company, and security officials, as it revealed the extent of Iran’s cybercapabilities. A spokesman for Aramco didn’t respond to a request for comment.
The move was at least partly in retaliation for the alleged U.S.-Israeli attack on Iran discovered in 2010 that deployed the Stuxnet computer worm to destroy Iranian nuclear centrifuges-considered to be the most successful and advanced cyberattack ever. The U.S. and Israel haven’t confirmed or denied involvement with Stuxnet.
Director of National Intelligence James R. Clapper has said that Iran used malware to destroy computers last year at Las Vegas Sands Corp., a casino company run by Sheldon Adelson, a major critic of the Iranian government. A Sands spokesman declined to comment.
Adm. Michael Rogers, center, director of the National Security Agency and commander of the U.S. Cyber Command, confers with Deputy Defense Secretary Robert Work ahead of testifying before the Senate Armed Services Committee in September. Photo: Win McNamee/Getty Images
Defense officials have also said Iranian hackers have temporarily overwhelmed the websites of numerous U.S. banks, in an annoying but relatively pedestrian technique known as a “denial of service” attack. The attack was allegedly in response to a YouTube video depicting the Prophet Muhammad. Some U.S. officials suspected it was retaliation for sanctions and the Stuxnet attack.
In 2012, Iran’s Supreme Leader Ayatollah Ali Khamenei publicly announced the creation of the Supreme Council of Cyberspace charged to oversee the defense of Iran’s computer networks and develop “new ways of infiltrating or attacking the computer networks of its enemies.”
National Security Agency Director Adm. Michael Rogers said Iranian cyberattacks have slowed since nuclear talks intensified last year, but that Tehran appears “fully committed” to using cyberattacks as part of its national strategy.
A spokesman for the Iranian government didn’t respond to request for comment.
Sony hack
 
U.S. officials accused North Korea of destroying computer files and records at Sony Corp.’s Hollywood film unit in 2014, allegedly in retaliation for “The Interview,” a satirical movie about assassins of North Korean leader Kim Jong Un. The breach was considered one of the most successful nation-state attacks. North Korea successfully implanted malware on Sony computers, which allowed them to both steal and destroy company records, the FBI alleged.
South Korea has also accused North Korea of trying to hack a nuclear reactor, television networks and at least one bank.
“Cybercapability, especially offensive cybercapability, is a relatively inexpensive method that a country can exploit to ‘hit above its weight class,’ which North Korea is fully aware of and is attempting to leverage,” said Steve Sin, a former U.S. Army counterintelligence officer who now researches unconventional weapons and technology.
Defense contractor Northrop Grumman Corp., meanwhile, has advertised for a “cyber operations planner” to “facilitate” offensive computer attacks with the South Korean and U.S. governments, according to a job posting it listed online.
A Northrop spokesman said the customer determines the scope of work performed.
A spokesman for North Korea couldn’t be reached for comment. The country hasn’t commented publicly on cyberprograms.
Many cybersecurity experts, however, consider the U.S. government to have the most advanced operations. When Kaspersky Lab ZAO, a Russian cybersecurity company, this year released a report on a group it called the Equation Group-which U.S. officials confirmed was a thinly veiled reference to the NSA-it referred to the operatives as the “crown creator of cyberespionage.”
Former National Security Agency contractor Edward Snowden leaked documents that showed the NSA had implanted malware on tens of thousands of foreign computers. That allowed the U.S. government secret access to data and, potentially, the industrial control systems behind power plants and pipelines. The Pentagon’s U.S. Cyber Command didn’t respond to a request for comment.
In some instances, Kaspersky found, the NSA was able to burrow so deeply into computers that it infected the code that controls how a hard drive spins. So-called firmware isn’t scanned by computer defenses.
“We, too, practice cyberespionage, and, in a public forum, I’m not going to say how successful we are, but we’re not bad,” Mr. Clapper, the Director of National Intelligence, told a Senate panel in September.
U.S. Cyber Command now has nine “National Mission Teams” with plans to build four more. These each comprise 60 military personnel that will “conduct full-spectrum cyberspace operations to provide cyber options to senior policy makers in response to attacks against our nation,” a Pentagon spokesperson said.
The Navy, Army, and Air Force will each build four teams, with the Marines building a single unit. Each will have a “separate mission with a specific focus area,” though these have so far remained secret.
Air Force Chief of Staff Gen. Mark A. Welsh III told a group of reporters in April that he wanted to see the military develop “blunt force trauma” powers with their cyberweapons. He gave examples of computer codes that could “make an enemy air defense system go completely blank” or have an enemy’s “radar show a thousand false targets that all look real.” He didn’t say the military had finished designing such powers.
Defense Secretary Ash Carter has made the development of new cyberweapons a priority, although the policy seems in flux after questions were raised by the Pentagon’s inspector general.
This activity has prompted other countries to join the digital buildup.
In 2014, the Netherlands announced it would begin training its own Internet troops through a domestic cybersecurity company, called Fox-IT. The head of the Dutch armed forces, Major Gen. Tom Middendorp, said in a symposium the group should be prepared to carry out attacks, not just block them, according to a Dutch media report. The Netherlands’ military strategy, laid out in various documents, refers to hacking as a “force multiplier.” A Dutch military spokesman confirmed the efforts but declined to make Gen. Middendorp available for an interview.
In 2013, Denmark’s Defense Ministry began allocating about $10 million a year for “computer network operations,” which include “defensive and offensive military operations,” according to government budget documents. That amount is just 0.24% of the Danish defense budget, reflecting the tiny barrier of entry.
Countries unable to develop their own weapons can buy off-the-shelf systems from private parties. Earlier this year, an attack and document leak on the Italian firm Hacking Team revealed the company had sold its surveillance tools to dozens of countries, including Sudan, Egypt, Ethiopia and Azerbaijan.
Hacking Team touted its product as “the hacking suite for governmental interception,” and computer security researchers who studied its program said it took advantage of holes in popular software to get onto opponents’ computers and mobile devices. The FBI is among the groups listed as clients of Hacking Team. An FBI spokesman said it didn’t comment on specific tools or techniques.
Most of these countries use surveillance software on domestic enemies or insurgent groups, according to officials with numerous countries and researchers.
States aren’t the only players. About 30 Arabic-fluent hackers in the Palestinian territories, Egypt and Turkey are building their own tools to hit targets in Egypt, Israel and the U.S., according to researchers at Kaspersky Lab.
And in August, the U.S. used a drone to kill Islamic State hacker Junaid Hussain in Raqqa, Syria, showing the extent to which digital warfare has upset the balance of power on the modern battlefield.
The British citizen had used inexpensive tools to hack more than 1,000 U.S. military personnel and published personal and financial details online for others to exploit. He helped sharpen the terror group’s defense against Western surveillance and built hacking tools to penetrate computer systems, according to people familiar with the matter.
National-security and cyberweapon experts are watching the growing digital arms stockpile nervously, worried that one-off attacks could eventually turn messier, particularly given how little is known about what each country is capable of doing.
“What we can do, we can expect done back to us,” said Howard Schmidt, who was the White House’s cybersecurity coordinator until 2012. The U.S. is thinking, “Yeah, I don’t want to pull that trigger because it’s going to be more than a single shot that goes off.”

Obama Sells Syrian Peace Talks that Will Never Come

As noted in the Steve Kroft, 60 Minutes interview with Barack Obama, when challenged on leadership, Obama said he leads on climate change.

The White House has falsely created a bucket-load of people to blame for any intelligence failures, including declaring CENTCOM had modified intelligence reports to make al Qaeda appear as though the terror group was decimated, which is hardly a fact of today.

It should also be noted, the U.S. intelligence agencies collaborate several times daily with allied foreign intelligence services and the United Nations has their own intelligence pathways. In fact, the UN has been approached to seek urgent agreements of peace, no-fly zones, cease fires or a discussion on a coalition government for Syria.

WASHINGTON —CIA-backed rebels in Syria, who had begun to put serious pressure on President Bashar Assad’s forces, are now under Russian bombardment with little prospect of rescue by their American patrons, U.S. officials say.

Over the past week, Russia has directed parts of its air campaign against U.S.-funded groups and other moderate opposition in a concerted effort to weaken them, the officials say. The Obama administration has few options to defend those it had secretly armed and trained.

The Russians “know their targets, and they have a sophisticated capacity to understand the battlefield situation,” said Rep. Mike Pompeo, R-Kan., who serves on the House Intelligence Committee and was careful not to confirm a classified program. “They are bombing in locations that are not connected to the Islamic State” group. More here.

So, within DC, there are arguments at every corner about what to do with regard to Russia, Syria, Iran, Iraq, Yemen and Afghanistan. It is not a matter of failed intelligence. Saudi Arabia is especially concerned about Syria and has been equipping anti-Assad forces. The Saudis met with the Russians over the weekend.

DailyBeast;

Politicians in Washington are pointing their fingers at spies for making them look silly on Russia and Syria. Did our spies mess up again?
As Russia continues airstrikes in Syria, a fight is brewing between members of Congress and U.S. intelligence agencies over what lawmakers were told about the Russian military operations, and when.The House Intelligence Committee, which oversees the CIA and other spy agencies responsible for tracking the Russian military buildup in Syria, is “looking at possible problems in the timely provision of information to Congress,” a congressional staff member told The Daily Beast. Three other officials confirmed that the inquiry—which is not a formal investigation—is underway and that lawmakers have been talking to intelligence officials about whether their reports to Congress accurately predicted when the Russian air strikes would begin and that they would target rebel groups fighting the regime of Bashar al-Assad.

U.S. intelligence officials fired back that they had provided lawmakers with warnings about Russia’s intentions to begin military operations in Syria, including in the weeks before airstrikes began in late September.

“Any suggestion that the intelligence community was surprised by Russia’s military support to the Assad regime is misleading,” a senior intelligence official told The Daily Beast. Members of Congress had access to intelligence reports on the movements of Russian aircraft into Syria as well as the buildup of ground troops and could read them anytime they chose, another official said.

Russia has long been a subject of close scrutiny for the CIA and other intelligence agencies. But since the end of the Cold War and a post-9/11 shift to focusing on terrorist organizations and the rise of extremist groups, some lawmakers have questioned whether the agencies are paying enough attention to old foes in Moscow.

“For several years, the Intelligence Community has provided regular assessments of Russia’s military, political, and financial support to the [Assad] regime,” Brian Hale, a spokesperson for the Director of National Intelligence, said in a statement. “In recent months, the Intelligence Community tracked and reported Moscow’s determination to play a more direct role in propping up Assad’s grip on power, including its deployment of offensive military assets to Syria. While these events unfolded quickly, the IC carried out its responsibilities with equal agility.”

The pushback from officials underscored how sensitive the agencies are to allegations of “intelligence failures” and in particular being behind the curve about Russia’s international ambitions and the rise of extremists groups in the Middle East. The Defense Department is also investigating allegations that senior intelligence officials at the military’s Central Command manipulated intelligence reports to paint a rosy picture about the U.S.-led air campaign against the so-called Islamic State, widely known as ISIS, in Iraq and Syria.

The congressional inquiry also highlights how politicized the Obama administration’s strategy in Syria has become in the wake of a total breakdown in the U.S. military’s training of rebel groups and a 13-month-old U.S.-led air campaign that has failed to destroy ISIS forces in Syria or Iraq.

The White House defended the quality of the intelligence reporting on Syria and noted that journalists had also been tracking the deployment of military aircraft and ground troops into the country.

“I don’t think there was anybody that had the expectation in the administration that Russia wasn’t prepared to use that equipment to advance what they view as their interests inside of Syria,” White House press secretary Josh Earnest said on Thursday, adding that officials had already assessed Russia and wanted to prop up the embattled Assad regime before the airstrikes began.

“I don’t think that’s a surprise,” Earnest said. “The president, before Russia commenced their military activities, said that a decision by Russia to double down on Assad militarily would be a losing bet. That’s something that the President said before we saw this Russian military activity and we continue to believe that that’s true.”

Reuters first reported that lawmakers were examinig possible intelligence lapses over Russia’s intervention and were concerned that intelligence agencies were slow to grasp Putin’s intentions.

That’s a charge that lawmakers have made in the past.

After Russian forces invaded the Crimean peninsula in Ukraine in 2014, lawmakers blasted the Pentagon and intelligence community for failing to anticipate Putin’s plans.

“It was not predicted by our intelligence. That is well known, which is another massive failure because of our total misreading of the intentions of Vladimir Putin,” Sen. John McCain told then-Defense Secretary Chuck Hagel during a hearing. That prompted James Clapper, the director of national intelligence, to defend his analysts’ work.

“I have lived through some genuine intelligence failures in my career, and this was not a failure by any stretch,” Clapper said in an interview with Washington news radio station WTOP in March 2014.

“We tracked [the situation in Ukraine] pretty carefully and portrayed what the possibilities were and certainly portrayed the difficulties we’d have, because of the movements of Russian troops and provided anticipatory warning of their incursion into Crimea,” Clapper said.

Three months later, when ISIS forces rolled into the Iraqi city of Mosul and established a major foothold inside the country, the agencies again found themselves on the defensive, recounting all the times they’d said they warned lawmakers about the rising strength of ISIS in the region and how it could threaten security. Critics said, however, that the intelligence agencies hadn’t predicted ISIS would take over whole cities, and that the reporting wasn’t specific enough to develop a counterattack.

The debate over intelligence assessments on Russia’s recent airstrikes has a similar theme. Lawmakers are zeroing in on specific reporting about military movements and potential targets, as well assessments about Putin’s intentions and his strategy, to get at the question of how the U.S. response to Russia’s operation might have been different with other kinds of information.

Rep. Adam Schiff, the senior Democrat on the House Intelligence Committee said in a statement on Thursday that it was “certainly true that few would have predicted that Putin would react to the weakening position of the Assad regime by sending in combat aircraft and augmenting its naval presence. An increase in Russia’s material support for the Assad regime seemed much more probable.”

That suggested that some lawmakers viewed the intelligence assessments as not declarative or precise enough for Congress to understand how the events would unfold.

But, Schiff added, “As Putin’s intention to deploy more military power to Syria became clearer in recent weeks, the Intelligence Community kept the Committee apprised of those developments. Although we will continue to look into the timeliness and accuracy of intelligence assessments, I do not think we should rush to find fault with the Intelligence Community in its ability to discern exactly what is in Putin’s head.”

Military and intelligence officials did warn that Russia was likely to begin military operations in Syria in the days before air strikes began.

Nine days before Russia’s first bombing runs on Syrian rebel groups, including those that the CIA had given weapons and training, three U.S. officials told The Daily Beast that airstrikes would begin “soon.” They noted that Russian drone flights to scout potential targets were underway—those same flights were also reported on social media by eyewitnesses in Syria.

The officials’ assessment on the imminence of Russian airstrikes marked a shift from previous statements, when officials had said they weren’t sure whether Russia intended to use force in Syria and enter into the country’s long and brutal civil war. That shifting analysis reflected the rapid increase in the number of Russian jets in the region, as well as reports by eyewitnesses that Russian military forces were working with Assad’s army. Videos supporting those claims could be found on YouTube.

And yet, those aggressive, visible moves were met with hardly a shrug in some circles in Washington.

“There are not discussions happening here about what this means for U.S. influence on the war against ISIS,” one defense official told The Daily Beast at the time.

In light of the administration’s response, it’s questionable whether more precise assessments of Russia’s movements would have led to any attempts to head off its intervention.

Schiff, the top Democrat on the House Intelligence Committee, said that reading the Russian leader’s mind was all but impossible.

“Putin notoriously keeps a tight counsel and employs a deliberate strategy of improvisation and unpredictability,” Schiff said. “That said, we need to make sure that we appropriately prioritize so-called hard targets like Russia.”

Bowe Bergdahl, Time Served

Remember, Obama approved the ransom payment to Haqqani for Bergdahl, or was it? Perhaps it was to finish the prisoner swap details with both networks, the Taliban and Haqqani.

An Army officer is recommending that Sgt. Bowe Bergdahl face a lower-level court martial and be spared the possibility of jail time for leaving his post in Afghanistan, his lawyer said Saturday.
Defense attorney Eugene Fidell said Lt. Col. Mark Visger has decided Bergdahl’s case should go to a military system similar to civilian courts that handle misdemeanor charges. It limits the maximum punishment to reduction of rank, a bad conduct discharge and a short jail term, though that isn’t being sought, Fidell said. Military prosecutors charged Bergdahl in March with desertion and misbehavior before the enemy, a charge that could carry a maximum penalty of life imprisonment.

By The Associated Press – Associated Press – Saturday, October 10, 2015

Sgt. Bowe Bergdahl was handed over to U.S. special forces in May 2014 after nearly five years in captivity in Afghanistan. Here is a look at some of the key events from his capture until Saturday, when an Army officer recommended Bergdahl’s case should go to a military system that’s similar to civilian courts that handle misdemeanors:

June 30, 2009 – Bergdahl, who is serving with an Alaska-based infantry regiment, vanishes from a base in Afghanistan’s Paktika province near the border of Pakistan.

July 2, 2009 – Two U.S. officials tell The Associated Press on condition of anonymity that Bergdahl had “just walked off” his base with three Afghans after his shift.

July 18, 2009 – Taliban posts video online showing Bergdahl saying he was “scared I won’t be able to go home.” Bergdahl also says he was lagging behind a patrol when he was captured.

July 19, 2009 – Pentagon confirms missing U.S. solider in Afghanistan is Pfc. Bowe R. Bergdahl, 23, of Ketchum, Idaho.

July 22, 2009 – More than 500 people attend a vigil in Hailey, Idaho, to show support for Bergdahl and his family.

Dec. 25, 2009 – The Taliban releases a video showing Bergdahl apparently healthy and making a lengthy statement criticizing the U.S. military operation.

June 16, 2011 – The Army announces that Bergdahl has been promoted from specialist to sergeant.

June 30, 2011 – Bergdahl’s parents mark the second anniversary of their son’s capture at hometown event.

Aug. 29, 2011 – US officials tell the AP that direct U.S. talks with the Taliban had evolved to a substantive negotiation before they were scuttled by Afghan officials who feared the talks would undercut President Hamid Karzai.

May 9, 2012 – Bergdahl’s parents say they are hopeful that negotiations or a prisoner swap could bring their son home. Bob Bergdahl tells hometown newspaper that he’s concerned the U.S. government hasn’t done enough to secure his son’s release. The AP agreed in 2010 – at the request of the Pentagon and the White House – not to report on the proposed prisoner swap and ongoing negotiations, on the grounds that public discussion would endanger Bergdahl’s life. When Bergdahl’s parents began to discuss the deal publicly, the AP and other news organizations reported the proposed swap – a plan that would allow the transfer of five Taliban prisoners held at the U.S. military prison at Guantanamo Bay, Cuba.

Weekend of May 27, 2012 – President Barack Obama calls Bergdahl’s parents to assure them that he and the U.S. Department of Defense were doing everything in their power to free Bergdahl.

June 29, 2012 – Bergdahl’s family and hometown marks the third anniversary of his capture. Parents release a statement saying they hope he’s released this year and can return home.

June 20, 2013 – The Taliban proposes a deal in which they would free Bergdahl in exchange for five of their most senior operatives at Guantanamo Bay.

July 9, 2013 – The Taliban close the office in Qatar that was serving as the site for negotiations with the U.S.

Jan. 15, 2014 – U.S. officials say they received a new video of Bergdahl that they believe was taken in the last month, showing Bergdahl is alive.

Feb. 18, 2014 – Bergdahl’s family says they are cautiously optimistic about reported renewed efforts by the Obama’s administration to win his freedom.

May 31, 2014 – Obama administration officials announce that Bergdahl was handed over to U.S. special forces by the Taliban in exchange for the release of five Guantanamo detainees. Bergdahl’s parents say they’re “joyful and relieved.” But debate quickly erupts over whether Bergdahl is a hero or a deserter.

June 2, 2014 – Afghanistan’s Foreign Ministry criticizes the U.S. for swapping Taliban prisoners at Guantanamo Bay to secure Bergdahl’s release. American officials tell The Associated Press that the Pentagon concluded in 2012 that Bergdahl walked away from his unit, something members of his unit had said put soldiers in danger.

June 4, 2014 – Bergdahl’s Idaho hometown cancels plans to celebrate his return, citing security concerns.

June 13, 2014 – Bergdahl arrives at Brooke Army Medical Center at Fort Sam Houston in San Antonio.

June 16, 2014 – The Army says it is investigating the facts and circumstances around Bergdahl’s disappearance.

Aug. 6, 2014 – The Army begins questioning Bergdahl, who by now has returned to regular duty, about his disappearance.

Aug. 21, 2014 – The nonpartisan Government Accountability Office says the Pentagon broke the law when it swapped Bergdahl for five Taliban leaders because it didn’t notify relevant congressional committees at least 30 days in advance and used money from a wartime account to make the transfer.

Dec. 19, 2014 – The Army says it has finished its investigation.

March 25, 2015 – Bergdahl is charged with desertion and misbehavior before the enemy.

March 26, 2015 – Bergdahl’s lawyer releases a note in which Bergdahl says he was repeatedly tortured by the Taliban.

Sept. 17, 2015 – An Article 32 hearing begins to determine whether Bergdahl should face a military trial for leaving his post.

Sept. 18, 2015 – The hearing ends, and the presiding officer will forward his recommendations to the leader of the U.S. Army Forces Command, who will decide whether it should be referred to a court-martial or be resolved in another manner.

Oct. 9, 2015 – Bergdahl’s attorney says an Army officer recommends that Bergdahl face a lesser court-martial, meaning it should go to a military system that’s similar to civilian courts that handle misdemeanor, as well as not spend time in jail.

They Are Coming

Per the FBI website: Good afternoon Chairman Johnson, Ranking Member Carper, and members of the committee. Thank you for the opportunity to appear before you today to discuss the current threats to the homeland and our efforts to address new challenges, including terrorists’ use of technology to communicate—both to inspire and recruit. The widespread use of technology propagates the persistent terrorist message to attack U.S. interests whether in the homeland or abroad. As the threat to harm Western interests evolves, we must adapt and confront the challenges, relying heavily on the strength of our federal, state, local, and international partnerships. Our successes depend on interagency cooperation. We work closely with our partners within the Department of Homeland Security and the National Counterterrorism Center to address current and emerging threats.

Counterterrorism

Counterterrorism remains the FBI’s top priority, however, the threat has changed in two significant ways. First, the core al Qaeda tumor has been reduced, but the cancer has metastasized. The progeny of al Qaeda—including AQAP, al Qaeda in the Islamic Maghreb, and the Islamic State of Iraq and the Levant (ISIL)—have become our focus.

Secondly, we are confronting the explosion of terrorist propaganda and training on the Internet. It is no longer necessary to get a terrorist operative into the United States to recruit. Terrorists, in ungoverned spaces, disseminate poisonous propaganda and training materials to attract troubled souls around the world to their cause. They encourage these individuals to travel, but if they can’t travel, they motivate them to act at home. This is a significant change from a decade ago.

We continue to identify individuals who seek to join the ranks of foreign fighters traveling in support of ISIL, and also homegrown violent extremists who may aspire to attack the United States from within. These threats remain among the highest priorities for the FBI and the Intelligence Community as a whole.

Conflicts in Syria and Iraq continue to serve as the most attractive overseas theaters for Western-based extremists who want to engage in violence. We estimate approximately 250 Americans have traveled or attempted to travel to Syria to participate in the conflict. While this number is lower in comparison to many of our international partners, we closely analyze and assess the influence groups like ISIL have on individuals located in the United States who are inspired to commit acts of violence. Whether or not the individuals are affiliated with a foreign terrorist organization and are willing to travel abroad to fight or are inspired by the call to arms to act in their communities, they potentially pose a significant threat to the safety of the United States and U.S. persons.

ISIL has proven relentless in its violent campaign to rule and has aggressively promoted its hateful message, attracting like-minded extremists to include Westerners. To an even greater degree than al Qaeda or other foreign terrorist organizations, ISIL has persistently used the Internet to communicate. From a homeland perspective, it is ISIL’s widespread reach through the Internet and social media which is most concerning as ISIL has aggressively employed this technology for its nefarious strategy. ISIL blends traditional media platforms, glossy photos, in-depth articles, and social media campaigns that can go viral in a matter of seconds. No matter the format, the message of radicalization spreads faster than we imagined just a few years ago.

Unlike other groups, ISIL has constructed a narrative that touches on all facets of life—from career opportunities to family life to a sense of community. The message isn’t tailored solely to those who are overtly expressing symptoms of radicalization. It is seen by many who click through the Internet every day, receive social media push notifications, and participate in social networks. Ultimately, many of these individuals are seeking a sense of belonging.

As a communication medium, social media is a critical tool for terror groups to exploit. One recent example occurred when an individual was arrested for providing material support to ISIL by facilitating an associate’s travel to Syria to join ISIL. The arrested individual had multiple connections, via a social media networking site, with other like-minded individuals.

There is no set profile for the susceptible consumer of this propaganda. However, one trend continues to rise—the inspired youth. We’ve seen certain children and young adults drawing deeper into the ISIL narrative. These individuals are often comfortable with virtual communication platforms, specifically social media networks.

ISIL continues to disseminate their terrorist message to all social media users—regardless of age. Following other groups, ISIL has advocated for lone offender attacks. In recent months ISIL released a video, via social media, reiterating the group’s encouragement of lone offender attacks in Western countries, specifically advocating for attacks against soldiers and law enforcement, intelligence community members, and government personnel. Several incidents have occurred in the United States and Europe over the last few months that indicate this “call to arms” has resonated among ISIL supporters and sympathizers.

In one case, a New York-based male was arrested in September after he systematically attempted to travel to the Middle East to join ISIL. The individual, who was inspired by ISIL propaganda, expressed his support for ISIL online and took steps to carry out acts encouraged in the ISIL call to arms.

The targeting of U.S. military personnel is also evident with the release of names of individuals serving in the U.S. military by ISIL supporters. The names continue to be posted to the Internet and quickly spread through social media, depicting ISIL’s capability to produce viral messaging. Threats to U.S. military and coalition forces continue today.

Social media has allowed groups, such as ISIL, to use the Internet to spot and assess potential recruits. With the widespread horizontal distribution of social media, terrorists can identify vulnerable individuals of all ages in the United States—spot, assess, recruit, and radicalize—either to travel or to conduct a homeland attack. The foreign terrorist now has direct access into the United States like never before.

In other examples of arrests, a group of individuals was contacted by a known ISIL supporter who had already successfully traveled to Syria and encouraged them to do the same. Some of these conversations occur in publicly accessed social networking sites, but others take place via private messaging platforms. As a result, it is imperative the FBI and all law enforcement organizations understand the latest communication tools and are positioned to identify and prevent terror attacks in the homeland.

We live in a technologically driven society and just as private industry has adapted to modern forms of communication so too have terrorists. Unfortunately, changing forms of Internet communication and the use of encryption are posing real challenges to the FBI’s ability to fulfill its public safety and national security missions. This real and growing gap, to which the FBI refers as “Going Dark,” is an area of continuing focus for the FBI; we believe it must be addressed given the resulting risks are grave both in both traditional criminal matters as well as in national security matters. The United States government is actively engaged with private companies to ensure they understand the public safety and national security risks that result from malicious actors’ use of their encrypted products and services. However, the administration is not seeking legislation at this time.

The FBI is utilizing all lawful investigative techniques and methods to combat the threat these individuals may pose to the United States. In conjunction with our domestic and foreign partners, we are rigorously collecting and analyzing intelligence information as it pertains to the ongoing threat posed by foreign terrorist organizations and homegrown violent extremists. We continue to encourage robust information sharing; in partnership with our many federal, state, and local agencies assigned to Joint Terrorism Task Forces around the country, we remain vigilant to ensure the safety of the American public. Be assured, the FBI continues to pursue increased efficiencies and information sharing processes as well as pursue technological and other methods to help stay ahead of threats to the homeland.

Intelligence

Integrating intelligence and operations is part of the broader intelligence transformation the FBI has undertaken in the last decade. We are making progress, but have more work to do. We have taken two steps to improve this integration. First, we have established an Intelligence Branch within the FBI headed by an executive assistant director (EAD). The EAD looks across the entire enterprise and drives integration. Second, we now have special agents and new intelligence analysts at the FBI Academy engaged in practical training exercises and taking core courses together. As a result, they are better prepared to work well together in the field. Our goal every day is to get better at using, collecting and sharing intelligence to better understand and defeat our adversaries.

The FBI cannot be content to just work what is directly in front of us. We must also be able to understand the threats we face at home and abroad and how those threats may be connected. Towards that end, intelligence is gathered, consistent with our authorities, to help us understand and prioritize identified threats and to determine where there are gaps in what we know about these threats. We then seek to fill those gaps and learn as much as we can about the threats we are addressing and others on the threat landscape. We do this for national security and criminal threats, on both a national and local field office level. We then compare the national and local perspectives to organize threats into priority for each of the FBI’s 56 field offices. By categorizing threats in this way, we strive to place the greatest focus on the gravest threats we face. This gives us a better assessment of what the dangers are, what’s being done about them, and where we should prioritize our resources.

Cyber

An element of virtually every national security threat and crime problem the FBI faces is cyber-based or facilitated. We face sophisticated cyber threats from state-sponsored hackers, hackers for hire, organized cyber syndicates, and terrorists. On a daily basis, cyber-based actors seek our state secrets, our trade secrets, our technology, and our ideas—things of incredible value to all of us and of great importance to the conduct of our government business and our national security. They seek to strike our critical infrastructure and to harm our economy.

We continue to see an increase in the scale and scope of reporting on malicious cyber activity that can be measured by the amount of corporate data stolen or deleted, personally identifiable information compromised, or remediation costs incurred by U.S. victims. For example, as the committee is aware, the Office of Personnel Management (OPM) discovered earlier this year that a number of its systems were compromised. These systems included those that contain information related to the background investigations of current, former, and prospective Federal government employees, as well as other individuals for whom a federal background investigation was conducted. The FBI is working with our interagency partners to investigate this matter.

FBI agents, analysts, and computer scientists are using technical capabilities and traditional investigative techniques—such as sources, court-authorized electronic surveillance, physical surveillance, and forensics—to fight cyber threats. We are working side-by-side with our federal, state, and local partners on Cyber Task Forces in each of our 56 field offices and through the National Cyber Investigative Joint Task Force (NCIJTF), which serves as a coordination, integration, and information sharing center for 19 U.S. agencies and several key international allies for cyber threat investigations. Through CyWatch, our 24-hour cyber command center, we combine the resources of the FBI and NCIJTF, allowing us to provide connectivity to federal cyber centers, government agencies, FBI field offices and legal attachés, and the private sector in the event of a cyber intrusion.

We take all potential threats to public and private sector systems seriously and will continue to investigate and hold accountable those who pose a threat in cyberspace.

* * *

Finally, the strength of any organization is its people. The threats we face as a nation have never been greater or more diverse and the expectations placed on the Bureau have never been higher. Our fellow citizens look to us to protect the United States from all of those threats and the men and women of the Bureau continue to meet—and exceed—those expectations, every day. I want to thank them for their dedication and their service.

Chairman Johnson, Ranking Member Carper, and committee members, I thank you for the opportunity to testify concerning the threats to the homeland and terrorists’ use of the Internet and social media as a platform for spreading ISIL propaganda and inspiring individuals to target the homeland, and the impact of the Going Dark problem on mitigating their efforts. I am happy to answer any questions you might have.

Recent Testimonies
10.08.15

Threats to the Homeland James B. Comey, Director, Federal Bureau of Investigation, Statement Before the Senate Committee on Homeland Security and Governmental Affairs, Washington, D.C.
08.05.15

Inspector General Access Kevin L. Perkins, Associate Deputy Director, Federal Bureau of Investigation, Joint Statement with Department of Justice Associate Deputy Attorney General Carlos Uriarte Before the Senate Judiciary Committee , Washington, D.C.
07.08.15

Counterterrorism, Counterintelligence, and the Challenges of Going Dark James B. Comey, Director, Federal Bureau of Investigation, Statement Before the Senate Select Committee on Intelligence, Washington, D.C.
07.08.15

Going Dark: Encryption, Technology, and the Balances Between Public Safety … James B. Comey, Director, Federal Bureau of Investigation, Joint Statement with Deputy Attorney General Sally Quillian Yates Before the Senate Judiciary Committee, Washington, D.C.
06.18.15

FBI’s Plans for the Use of Rapid DNA Technology in CODIS Amy S. Hess, Executive Assistant Director, Science and Technology Branch, Federal Bureau of Investigation, Statement Before the House Judiciary Committee, Subcommittee on Crime, Terrorism, Homeland Security, and Investigations, Washington, D.C.
06.03.15

Terrorism Gone Viral: The Attack in Garland, Texas and Beyond Michael B. Steinbach, Assistant Director, Counterterrorism Division, Federal Bureau of Investigation, Statement Before the House Homeland Security Committee, Washington, D.C.
04.29.15

Encryption and Cyber Security for Mobile Electronic Communication Devices Amy Hess, Executive Assistant Director, Science and Technology Branch, Federal Bureau of Investigation, Statement Before the House Oversight and Government Reform Committee, Subcommittee on Information Technology, Washington, D.C.
04.14.15

FBI’s Handling of Sexual Harassment and Misconduct Allegations Kevin L. Perkins, Associate Deputy Director, Federal Bureau of Investigation, Statement Before the House Committee on Oversight and Government Reform, Washington, D.C.
03.25.15

FBI Budget Request for Fiscal Year 2016 James B. Comey, Director, Federal Bureau of Investigation, Statement Before the House Appropriations Committee, Subcommittee on Commerce, Justice, Science, and Related Agencies, Washington, D.C.
03.12.15

FBI Budget Request for Fiscal Year 2016 James B. Comey, Director, Federal Bureau of Investigation, Statement Before the Senate Appropriations Committee, Subcommittee on Commerce, Justice, Science, and Related Agencies, Washington, D.C.
More

Obama Does Gun Control, Putin Does Hockey, No Phone Calls

Scary with all this going on…no one is talking to each other especially when Defense Secretary Ash Carter says we will not cooperate or coordinate with Russia.

Carter: “Now, the Russians originally said they were going in to fight ISIL and al-Nusra and other terrorist organizations. However, within days of deploying their forces, the Russians began striking targets that are not any of these groups. I have said repeatedly over the last week that we, the United States, believed this is a fundamental strategic mistake and that it will inflame and prolong the Syrian civil war. We have not and will not agree to cooperate with Russia so long as they continue to pursue this misguided strategy. We’ve seen increasingly unprofessional behavior from Russian forces. They violated Turkish airspace, which as all of us here made clear earlier this week, and strongly affirmed today here in Brussels, is NATO airspace.” The full remarks by Carter while in Belgium are here.

Confluence or Conflating

Kearsarge ARG Deploys for Europe, Middle East Operations

The Kearsarge Amphibious Ready Group and 26th Marine Expeditionary Unit departed Oct. 6 from the East Coast for a deployment to the Middle East.

The more than 4,000 sailors and Marines will support theater security cooperation and maritime security operations and provide an added crisis response capability to U.S. 5th and 6th Fleet areas of operations.

The ARG/MEU includes amphibious assault ship USS Kearsarge (LHD-3), amphibious transport dock ship USS Arlington (LPD-24), amphibious dock landing ship USS Oak Hill (LSD-51),

The amphibious assault ship USS Kearsarge (LHD-3) as the ship departs for deploymentOct. 6, 2015. US Navy Photo

Kearsarge and the 26th MEU last deployed from March to November 2013, during a time of great unrest in the region. Kearsarge and USS San Antonio (LPD-17) spent a lot of time in the northern part of the region – operating in the Mediterranean out of Rota, Spain, and in the northern Red Sea – while USS Carter Hall (LSD-50) spent time operating independently near Bahrain and Djibouti.

Upon returning home, Kearsarge spent five months in maintenance at BAE Systems Norfolk Ship Repair before beginning sea trials last summer. Kearsarge served as the flagship in the Bold Alligator 2014 amphibious exercise last fall.

Rocket Launch with Secret Payload

United Launch Alliance aims to launch its second Atlas V rocket in less than a week with a blastoff planned Thursday morning from California’s Central Coast.

The rocket is targeting a liftoff at 5:49 a.m. PT from Vandenberg Air Force Base, carrying a classified mission for the National Reconnaissance Office.

There’s a 70% chance of acceptable weather at Vandenberg’s Space Launch Complex-3. The full launch window has not been disclosed.

“We are excited and ready to take on our first Atlas launch of 2015,” said Col. J. Christopher Moss, commander of the 30th Space Wing, in a statement Wednesday. “Our team and mission partners have put a lot of hard work into preparing for this important mission for our nation.”
Amateur spacecraft observers speculate that the rocket is carrying a pair of satellites updating the Naval Ocean Surveillance System, or NOSS.

In addition to the primary mission, the rocket’s Centaur upper stage will deliver a group of 13 experimental and student-developed CubeSats to orbit.

The tiny spacecraft include nine missions sponsored by the NRO and four by NASA. Kennedy Space Center’s Launch Services Program was responsible for securing the ride for the NASA-sponsored payloads known as ElaNA-12.

A successful launch would keep ULA on track to return to Cape Canaveral for an Oct. 30 launch of the Air Force’s next Global Positioning System satellite on an Atlas V. The booster for that mission was delivered to the Cape on Tuesday.
An Atlas V last Friday successfully delivered Mexico’s Morelos-3 communications satellite to orbit, completing ULA’s 100th launch since Boeing and Lockheed Martin formed the joint venture in December 2006.

And Wednesday, in the first launch since an Antares rocket exploded shortly after takeoff on Oct. 29, 2014, a sounding rocket successfully blasted off from NASA’s Wallops Space Facility in Virginia.

 

“It wasn’t an easy decision,” an Iranian official source said when asked about Russia’s intervention in Syria. “The Russians were certain that if they did not move now, the next war they would fight would be inside their borders; this is about Russia’s national security before being about Syria. Therefore, a decision to start this pre-emptive war was taken by the Kremlin.”

For decades, Syria has been one of Russia’s main allies in the Middle East. The collapse of the Soviet Union didn’t change anything in this regard. Moscow continued to support Damascus with whatever necessary to keep the old empire’s last balcony on the warm waters of the Mediterranean Sea.

Russian President Vladimir Putin arrives to speak at a Presidential Council for Civil Society and Human Rights meeting in the Grand Kremlin Palace on Oct. 1, 2015, in Moscow, Russia.

Russia Gets Back in the Game

In 2011, amid the eruption of the revolution in Syria, the Russians started feeling the heat. It was almost obvious to them that the fall of the regime in Damascus would lead to serious changes in Russia’s status in the Middle East; thus this wasn’t an option to even think about, and everything possible should be done to maintain the regime and keep it breathing, should this be using the veto in the UN Security Council, sending arms and ammunitions, or as we are witnessing today, intervening militarily and fighting to keep the status quo. Russia is not the only ally of the Syrian government; Iran also has been supporting President Bashar al-Assad.

Russia and Iran have not previously been allies. They share common interests, common allies and common rivals; however, this doesn’t necessarily mean they act as allies. In Syria, their common interest has been — and still is — keeping their common ally, the regime, alive. Even within the Syrian regime, there are different views among the ranks on how to deal with both countries; there are officials who are seen as “Iranians” and others as “Russians.” This is prompted by fears among one wing that the Islamic Republic’s agenda in Syria involves Islamization of society, while the other wing that prefers the Iranians sees them as very reliable since they were the first to roll their sleeves up in the fight for the regime’s existence. Yet, this is only a matter of preferences, and nothing more.