WH and State Dept. Admitted the Ploy of Iran Deal

Deal or no deal? No deal, no signatures, no vote, no sanctions, no burdens on Iran.

TheTower: Abbas Araghchi, Iran’s deputy foreign minister, warned that if the International Atomic Energy Agency (IAEA) doesn’t close its file of past Iranian nuclear violations, the Islamic Republic will stop complying with the terms of the nuclear agreement it reached with the P5+1 powers, Iran’s semi-official PressTV news service reported on Thursday.

Seyyed Abbas Araqchi said on Wednesday that the IAEA’s Director General Yukiya Amano has decided to release a report on the Iranian nuclear program on December 1, and the Agency’s Board of Governors will review the report and make a final decision in a meeting on December 15.

Araqchi said the report by Amano should result in the closure of the PMD issue.

“In case Yukiya Amano or the Board of Governors presents their report in such a way that it does not meet the stipulated commitments, the Islamic Republic of Iran will also stop [the implementation of] the JCPOA,” he said, in reference to the Joint Comprehensive Plan of Action, the agreement reached between Iran and the P5+1.

The IAEA has been tasked with the monitoring and verification of technical issues under the JCPOA. Full article here.

***
NationalReview: President Obama didn’t require Iranian leaders to sign the nuclear deal that his team negotiated with the regime, and the deal is not “legally binding,” his administration acknowledged in a letter to Representative Mike Pompeo (R., Kan.) obtained by National Review. “The Joint Comprehensive Plan of Action (JCPOA) is not a treaty or an executive agreement, and is not a signed document,” wrote Julia Frifield, the State Department assistant secretary for legislative affairs, in the November 19 letter.
Frifield wrote the letter in response to a letter Pompeo sent Secretary of State John Kerry, in which he observed that the deal the president had submitted to Congress was unsigned and wondered if the administration had given lawmakers the final agreement. Frifield’s response emphasizes that Congress did receive the final version of the deal. But by characterizing the JCPOA as a set of “political commitments” rather than a more formal agreement, it is sure to heighten congressional concerns that Iran might violate the deal’s terms. “The success of the JCPOA will depend not on whether it is legally binding or signed, but rather on the extensive verification measures we have put in place, as well as Iran’s understanding that we have the capacity to re-impose — and ramp up — our sanctions if Iran does not meet its commitments,” Frifield wrote to Pompeo.

Iranian President Hassan Rouhani discouraged his nation’s parliament from voting on the nuclear deal in order to avoid placing legal burdens on the regime. “If the Joint Comprehensive Plan of Action is sent to [and passed by] parliament, it will create an obligation for the government. It will mean the president, who has not signed it so far, will have to sign it,” Rouhani said in August. “Why should we place an unnecessary legal restriction on the Iranian people?” Pompeo cited that comment in his letter to Kerry, but Frifield did not explicitly address it in her reply. “This is not a mere formality,” Pompeo wrote in his September 19 letter. “Those signatures represent the commitment of the signatory and the country on whose behalf he or she is signing. A signature also serves to make clear precisely who the parties to the agreement are and the authority under which that nation entered into the agreement. In short, just as with any legal instrument, signing matters.” The full State Department letter is below:

Letter from State Department Regarding JCPOA

Russia Threatening Scotland?

Britain calls in French to hunt Russian sub lurking off Scotland

A Royal Navy frigate, HMS Sutherland, and a hunter killer submarine have also been sent on the search

Telegraph: French patrol planes are scouring the seas off Scotland for a Russian submarine after Britain was forced to call on allies for help because it has scrapped its own sub-hunting aircraft.

A French Atlantique 2 maritime patrol plane has been searching for the submarine for at least 10 days, since the vessel was detected north of Scotland.

Britain scrapped its own Nimrod sub-hunting aircraft in 2010

A Royal Navy frigate, HMS Sutherland, and a hunter killer submarine have also been sent on the search, amid fears the Russian boat could be trying to spy on a Trident nuclear deterrent sub.

HMS SutherlandHMS Sutherland has been called into the hunt  Photo: MoD

Britain scrapped its own Nimrod maritime patrol aircraft after the cost cutting 2010 defence review, leading to warnings from defence chiefs that the country would be left reliant on others for aircraft to search its own waters.

Admirals have argued that filling the gap is a priority for the Government’s defence review which will be unveiled on Monday. More here.

*** ‘Allied’ Aircraft Hunt Russian Sub Off Scotland

SkyNews: French patrol aircraft are reportedly among those helping with the search from RAF Lossiemouth.

Aircraft based at an RAF base are conducting “activity” off Scotland in response to reports a Russian submarine has been seen nearby, the Ministry of Defence has confirmed.

It is understood that a Royal Navy frigate and a submarine are also involved in the hunt.

It comes days after RAF Typhoons were forced to intercept Russian Tu-160 Blackjack aircraft that strayed into the vicinity of UK airspace.

The Sun on Sunday reported that a French patrol aircraft was carrying out the search as the UK no longer has any specialist sub-hunting aircraft.

Britain scrapped the RAF’s Nimrods with search capability in 2010 after the Strategic Defence Services Review.

The Telegraph reported that two French Atlantique 2 maritime patrol planes and a Canadian plane were now operating out of RAF Lossiemouth, about 37 miles (60km) east of Inverness.

The MoD admitted that allied planes were operating from the base but refused to comment on naval manoeuvres.

“We can confirm that allied maritime patrol aircraft based at RAF Lossiemouth for a limited period are conducting activity with the Royal Navy,” a statement said.

Soldiers

00:00/02:11

Video: More British Troops To Baltics

“We do not discuss the detail of maritime operations.”

The search comes as the Prime Minister is due to announce a large investment in resources for the military, which has undergone several years of cuts.

One of the commitments is to buy nine Boeing P8 Poseidon maritime patrol aircraft which will be capable of hunting submarines.

Norwegian jet in near-miss with Russian plane

00:00/00:20

Video: Pilot’s Shock At Close Call

Last year, the Ministry of Defence faced embarrassment when it emerged it had to seek the help of the US, France and Canada when trying to find another Russian submarine spotted off the west coast of Scotland.

At that time it was thought the Russian vessel was possibly tracking UK nuclear submarine movements from the Clyde.

Russian anti-submarine vessel Severomorsk. Pic US Navy

00:00/01:56

Video: Russian Naval Drills In The Channel

Last May, DHS Warned on Belgium ISIS Cell

UNC L A S S I F I E D / / F O R  O F F I C I A L  US E  O NL Y

IA-0 -15
(U)  Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO).  It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552).  It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
13 May 2015
(U//FOUO)  Future ISIL Operations in West Could Resemble Disrupted Belgian Plot
(U//FOUO)  Prepared by the Office of Intelligence and Analysis (I&A).  Coordinated with NPPD, the FBI, and NCTC.  
(U)  Key Judgments
(U//FOUO)  I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West.  We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little
to no warning. 
(U//FOUO)  I&A assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.  
(U//FOUO)  I&A assesses that items recovered by Belgian authorities suggest the group’s plotting may
have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR).  (See Appendix A for details on the importance of SAR reporting.)
(U//FOUO)  I&A assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.  
(U//FOUO)  I&A assesses that facilitation efforts by
the group were likely aided by members’ criminal
background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  
(U//FOUO)  Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.  
(U//FOUO)  Belgian Plot Signals ISIL’s Interest
in Complex Plots Against the West
(U//FOUO)  The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated
(U)  Scope
(U//FOUO)  This Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL).  This Assessment is intended to support the DHS activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.   
(U)  Background
(U)  On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect.  The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operativessome of whom were returning foreign fighterspossibly targeting police or the public.  The group may have been acting under the direction of a member(s) of ISIL.  There is no publically available information as to whether a specific target was selected.  Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities.  The investigation into this plot remains ongoing.1,2  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 2 of 8
operations in the West.  I&A judges that the threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europewhere several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacksthan in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s
geographic proximity to the conflicts in Syria and Iraq.3,4  While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  I&A notes that small-scale attacks using comparatively less sophisticated tacticssuch as the 3 May attempted attack against a
“Draw the Prophet” event in Garland, Texas by
individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social mediacould proceed with little to no warning.    
(U//FOUO)  Dispersed Activities and Remote Leadership Possibly Intended to Conceal
Activities 
(U//FOUO)  The group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing information about emerging and ongoing threats.  Even though the group likely planned to attack targets in Belgium, the
investigation into the group’s activities spans several
European countries, including France, Greece, Spain, and the Netherlands, as well countries where there is limited- to-no counterterrorism cooperation with the United States,
such as Syria.  
» (U)  The purported leader of the group, Abdelhamid Abaaoud, directed the operation from a safe house in Athens, Greece using a cell phone, while other group members operated in several other European countries, according to European media reporting citing a senior Belgian counterterrorism official.5,6
» (U)  In addition to the 13 arrests made throughout Belgium, two operatives were arrested in France and police apprehended a cell member in Greece after tracing links to a second safe house in Athens, according to a Belgian news conference and Greek media reporting citing senior police officers.7,8,9
» (U)  Multiple members of the cell appear to have been able to communicate and travel unimpeded across borders to facilitate attack planning.  In addition to directing operatives from the safe house in Athens, Abaaoud boasted he was able to return to
Syria after the Verviers raid despite having international warrants for his arrest, according to an interview featured in the February release of ISIL’s
Dabiq magazine.10 
» (U)  The passport of an identified Dutch national
possibly associated with the groupwho likely traveled to Syria in late 2014 was found at the Verviers safe house, according to Dutch media reporting.11  Dutch officials conducted a search of his parents’ home and confiscated laptops and other media.  As of early April, he was reportedly killed while fighting in Syria, according to unconfirmed Dutch media reporting.12  
(U//FOUO)  Material Acquisition Suggests Attacker’s Potential Tactics and Targets 
(U//FOUO)  Items recovered during searches of
residences affiliated with the cell suggest the group’s
plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers.  There is no publicly available information about the acquisition of these items, but the amounts and types of materials acquired by the group highlights the role of the public and private sector in alerting law enforcement through SARs of attempts to acquire or store a large cache of equipment or chemicals needed to support larger operations.
» (U)  Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash during the raid in Verviers, according to statements made by Belgian government officials.14,15,16  At the time
UNCLASSIFIED
(U)  A picture, from ISIL’s Dabiq magazine, of Abdelhmaid Abaaoud (far right) with the two alleged cell members killed during the January 2015 raid in
Verviers, Belgium.13
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 3 of 8
of the raid, the members of this cell were also searching for an ice machine to cool and transport the TATP, according to European press reporting.17
» (U)  Belgian officials were reportedly concerned that the acquisition of police uniforms and discussion by group members of a Molenbeek police stationwhere members of the group had reportedly spent time
suggests that they may have intended to target a police station or to impersonate officers to potentially gain access to a sensitive site. 18,19,20  While there is no confirmation the group was actually going to target police, such an attack would have been consistent with media reports about recent ISIL-linked plots in the West directed at law enforcement and ongoing messaging by ISIL since September 2014.21
(U//FOUO)  Alleged Operational Security Measures Suggest Knowledge of Law Enforcement Methods
(U//FOUO)  The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications.  The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to
deflect scrutiny.
(U//FOUO)  Communications Security.  The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
» (U)  A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for
microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police
officials.23   
» (U)  According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.24    
» (U)  Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious
communications, according to Belgian media reporting.25  
(U//FOUO)  Physical Security.  The group attempted to obscure their operational travel and material acquisition from Belgian officials.
» (U//FOUO)  According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria.  However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.26 
» (U//FOUO)  Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports. 27,28,29  Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning. 30
» (U//FOUO)  The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s
procurement activities and to conceal purchasing patterns.31  Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.
UNCLASSIFIED
(U)   Belgium investigators at scene following the raid in Verviers, Belgium on 15 January 2015.22
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 4 of 8
UNCLASSIFIED
(U)  Figure 1. Map of Group Activities
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 5 of 8
(U//FOUO)  Member’s Criminal Background Likely Aided Planning and Facilitation  
(U//FOUO)  Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious
intentions.
» (U)  At least one alleged cell member, Souhaib el Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.32  The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.33
» (U)  The Belgian police uniforms, large cache of illegal weaponsincluding Kalashnikov rifles, handguns, ammunition, and materials to make explosivesthat were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference.34  Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.35
(U)  Implications
(U//FOUO)  I&A assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small
groups of individuals, raising I&A’s concern that the
involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.*  
(U//FOUO)  DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.
(U//FOUO)  We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts.  While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 6 of 8
(U//FOUO)  Appendix A: Importance of Suspicious Activity Reporting
(U//FOUO)  Given the range of targets and tactics of ISIL-associated plots since last year, we encourage reporting of suspicious activity to appropriate government authorities and encourage our security, military, and law enforcement partners to remain vigilant.  We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists.  Pre-operational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.
(U)  Indicators
(U//FOUO)  DHS encourages federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities, to include suspicious acquisition of materials and construction of explosive devices.  Some observed activities that may be suspicious include constitutionally protected activity.  These activities should not be reported absent articulable facts and circumstances that support the source agency’s suspicion that
the observed behavior is not innocent, but rather reasonably indicative of criminal activity associated with terrorism.  No single behavioral indicator should be the sole basis for law enforcement action.  The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action.
» (U//FOUO)  New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;
» (U//FOUO)  Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
» (U//FOUO)  Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
» (U//FOUO)  Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
» (U//FOUO)  Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of timea possible sign of covert stockpiling;
» (U//FOUO)  Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;
» (U//FOUO)  Internet research for target selection, acquisition of technical capabilities, planning, or logistics; » (U//FOUO)  Insisting on paying in cash or using a credit card in another person’s name; » (U//FOUO)  Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in
a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
» (U//FOUO)  Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
» (U//FOUO)  Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
» (U//FOUO)  Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 7 of 8
(U)  Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8
(U)  Source Summary Statement
(U//FOUO)  This Assessment is based on information drawn from a body of unclassified reporting, including open source media reports, public statements of senior foreign government officials, and public accounts of foreign law enforcement investigations from multiple law enforcement agencies.  We have medium confidence in the press reports used in this product, some of which have been corroborated by public statements made by senior foreign law enforcement officials.  
(U)  Report Suspicious Activity
(U)  To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement.  Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action.  For more information on the Nationwide
SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 8 of 8
1 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
2 (U); OSC; EUL2015041773002595; 17 April 2015. 3 (U); OSC; EUL2015021166933318; 11 February 2015. 4 (U); OSC; EUR2015022528575929; 24 February 2015.
5 (U); OSC; EUN2015020948731295; 31 January 2015. 6 (U); OSC; EUL2015020274740312; 1 February 2015. 7 (U); OSC: EUN2015020947629159; 30 January 2015. 8 (U); OSC; EUL2015011674541100; 16 January 2015. 9 (U); OSC; EUL2015021764970267; 17 February 2015. 10 (U); DHS-OS-0316-15; 12 February 2015. 11 (U); OSC; EUL2015012065248183; 19 January 2015.
12 (U); Teen with Connection to Verviers Deceased in Syria; http://www.nieuwsblad.be/cnt/dmf20150403_01614138;
accessed 9 April 2015.
13 (U); DHS-OS-0316-15; 12 February 2015. 14 (U); OSC; EUL2015011674541100; 16 January 2015. 15 (U); Inside the ISIS Plot to Attack the Heart of Europehttp://www.cnn.com/2015/02/13/europe/europe-
belgium-isis-plot/; accessed 20 March 2015.
16 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
17 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
18 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying;
http://www.rtl.be/info/belgique/societe/verviers-voici-ce-que-les-terroristes-presume; accessed 6 April 2015.
19 (U); OSC; EUL2015021764970267; 17 February 2015. 20 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
21 (U); OSC; TRR2014092201178788; 22 September 2014. 22 (U); Belgian Operation Thwarted ‘Major Terrorist Attacks,’ Kills 2 Suspects; http://www.cnn.com/2015/01/15/
world/belgium-anti-terror-operation/; accessed 13 April 2014.
23 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/societe/
    verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
24 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/
societe/verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
25 (U); OSC; EUL2015012064970018; 20 January 2015. 26 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
27 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
28 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
29 (U); OSC; EUN201502094762159; 31 January 2015. 30 (U); Belgian Police Admit Seeking Wrong Man as Vervier Shooutout Jihadists Named; http://www.telegraph.co.uk/
news/worldnews/europe/belgium/11362093/Belgian-police-admit-seeking-wrong-man-as-Vervier-shooutout-jihadists-named.html; accessed 13 April 2015.
31 (U); OSC; EUN201502094762159; 31 January 2015. 32 (U); Terrorist Threat  Dismantled Verviers Terrorist Cell: 4 Suspects Face Council Chamber;
http://www.thebrusselstimes.com/belgium/terrorist-threat-dismantled-verviers-terrorist-cell-4-suspects-face-
council-chamber/; accessed 1 April 2015.
33 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
34 (U); OSC; EUL2015011674541100; 16 January 2015. 35 (U); OSC; EUR2015012167949567; 21 January 2015. 

Dabiq, Paris and Attackers Identified

 

Embedded image permalink
Dabiq #7  PJMedia: On February 12, 2015, the Islamic State (ISIS) released the seventh issue of its English-language magazine Dabiq. The 83-page issue celebrates the recent attacks in Paris, justifies the burning of the Jordanian pilot, and calls for Muslims in the West to join ISIS, among other topics discussed. It also includes interviews with Hayat Boumeddiene, the wife of Paris kosher supermarket attacker Amedy Coulibaly, and with Belgian ISIS fighter Abdelhamid Abaaoud, the leader of the Verviers cell that planned major attacks in Belgium. Much more here.
Embedded image permalink Images of the moment suspect in Paris attacks was captured.

MiddleEastEye: French prosecutors said seven people carried out the attacks in Paris on Friday, all of whom were either killed by police or killed themselves with suicide vests. Meanwhile, French police are hunting with Belgian police for a suspected “sleeper cell” linked to the attacks.

Authorities have released the identities – or assumed identifies – of five thought to be directly involved in the Paris attacks, and two others believed to have either planned or aided them. Here are the details and backgrounds of those known so far:

Alleged mastermind – Abdelhamid Abaaoud

A French official told the AP news agency on Monday that Abaaoud is a Belgian and the suspected mastermind of the Paris attacks. They released few details, but also linked him to an an attempted gun attack on a Amsterdam-Brussels-Paris train on 21 August, which was thwarted by passengers. RTL radio in France reported that the 27-year-old is of Moroccan origin and “one of the most active Isis executioners” in Syria. He was interviewed in the Islamic State (IS) English-language propaganda magazine Dabiq under the nom de guerre, Abu Umar al-Baljiki.

Bataclan attacker – Samy Amimour

Described by prosecutors as a 28-year-old Frenchman. Amimour was one of three people who attacked the Bataclan concert venue, with 89 people confirmed dead. Prosecutors said Amimour had been charged in a terrorism investigation in 2012, was placed under judicial supervision and was the subject of an international arrest warrant.

Amimour was reported as having lived in the north-eastern suburb of Drancy.

Prosecutors said Amimour was “known to anti-terrorist investigators for being charged on October 19, 2012 for conspiracy to commit terrorism” over a foiled attack in Yemen. He violated his judicial supervision in 2013, prompting judges to issue an international arrest warrant. His family told AFP, in an interview before Friday’s attacks in Paris took place, that he had gone to Syria in 2013.

Bataclan attacker – Ismael Omar Mostefai

The 29-year-old French national was identified by French officials by DNA from a severed fingertip. Mostefi had a record of petty crime in France and had been identified by police as “radicalised”. Turkey on Monday said that they had warned France on two occasions about Mostefi’s activities.

He was reported to have been raised in Courcouronnes in Essonne, 25km south of Paris. His parents, or at least his father, is believed to have been of Algerian descent and his family now lives in the small town of Romilly-sur-Seine, a small town 130km east of Paris.

Mostefi’s 34-year-old brother contacted police on his own initiative before being taken into custody, along with his father. The father’s home in Romilly was searched, along with his brother’s home in nearby Bondoufle.

Stade de France bomber – Ahmad al-Mohammad

A suicide bomber, who blew himself up outside the Stade de France stadium, was found with a Syrian passport with the name Ahmad al-Mohammad, a 25-year-old born in Idlib. The prosecutor’s office says fingerprints from the attacker match the passport, which passed through Greece in October. Greece says he was one of two attackers who passed through their territory in the months before the attack. Serbia yesterday said the passport was also registered at the Presevo border crossing on 7 October, where he formally sought asylum.

Whether Mohammad is the real name of the attacker remains in doubt, however. The passport had been reported fake in the days after the attacks in Paris, and there is a thriving trade in the Middle East for such items. Prosecutors in France on Monday said the name “remained to be verified”.

Stade de France bomber – Bilal Hadfi 

Identified by investigation insiders as a 20-year-old French national who had been living in Belgium. He is reported to have fought for the Islamic State (IS) in Syria.

Restaurant attacker – Brahim Abdeslam

Officials identified Abdelslam as an attacker who blew himself up near a cafe on the Boulevard Voltaire. He was described as a French national and the brother of Salah Abdelslam, who is the subject of an arrest warrant over the Paris attacks.

Alleged fixer – Salah Abdelslam

Abdelslam, a 26-year-old born in Brussels, was arrested late Monday morning. Authorities said Abdeslam rented a Volkswagen Polo that carried attackers to the Bataclan concert venue. French officials told the AP news agency on Saturday that police had questioned and released him early in the day after stopping a car carrying three men near the Belgian border. An arrest warrant, describing Abdelslam as armed and dangerous, had been issued hours before.

 

ISIS propaganda hub appeared on the Darknet

The popular security expert Scot Terban (aka @krypt3ia ) discovered a few hours after the Paris attacks, a new ISIS propaganda hub appeared on the Darknet.

SecurityAffairs: The Paris attacks shocked the world, the war is overwhelmingly coming into our homes and the intelligence experts fear that this is just the beginning. The ISIS knows how to spread his message, none in the past was able to organize a so effective propaganda. Each media is masterfully handled by terrorists, social networks, instant messaging app, gaming platforms and forums course in the darknet.

In June, the Europol announced the creation of a team that aims to find key figures in propaganda campaigns run by ISIS members seeking to recruit foreign fighters. The Isis‘s machine propaganda is scaring as efficient, it generates something like 100.000 daily tweets, and it’s used to recruit foreign fighters to support the group.

The Isis is gaining a lot of power in the last years, for the first time  a terrorist organization has resources and capabilities to proclaim itself a State.

For this reason, the Europol announced the creation of a new Europe-wide police unit to search for the core leaders of Isis’s social media propaganda campaign. The police unit will track the leaders responsible for an average of 100.000 tweets a day.

isis paris attacks post propaganda

The Paris attacks have raised the level of attention on the organizations that could have supported the terrorist operations from the inside. What are the channels used by terrorists to communicate and what technologies they used?
Many intelligence experts point to the revelations of Snowden as an element that has greatly benefited the terrorists to escape the control exercised by the police.  Terrorists are aware that intelligence agencies are carefully monitoring telecom communications, emails, instant messaging apps and much more.

That’s why groups like the ISIS are looking for new channels to reach wider audiences, such as the gaming consoles and the Dark Web, two environments where it is necessary a significant effort to track and identify the source of the messages.

paris attacks

A few hours after the cruel Paris attack, Daesh (al-dowla al-islaamiyya fii-il-i’raaq wa-ash-shaam, a.k.a. ISIS/ISIL) launched his propaganda on the Dark Web.

The website contains translations in English, Turkish, and Russian from the recent statement issued by Daesh claiming credit for the Paris attacks.

The new propaganda center was discovered by the popular researcher Scot Terban (aka ), who reported it to the colleagues at Salted HASH.

The expert noticed a post that explained the need to create a new hub for propaganda, this is the response to the numerous operations against other websites used by the ISIS that were seized by law enforcement of targeted by hacktivists online. The terrorists decided to move on the Darknet to make the Daesh more resilient to take over attempts.

Terban came across the new Al-Hayat hub while performing jihadi research over the weekend.” states Salted HASH. “In a post on the Shamikh forum (a known jihadi bulletin board), someone posted the new address and instructions for reaching it.”

The new website includes a collection of propaganda video and images produced by Al-Hayat Media Center, the media division of Daesh. It is known to the intelligence because it is used to spread content glorifying the jihad against the infidel West, including poems for mujahids and songs (Nasheeds).

In the past, Daesh already had propaganda and recruitment hubs on the Darknet, but as explained by the expert it is the first time ever it published proof of those claims.

Terban has mirrored the website and its files, the intention of the expert is to analyze them and publish more details in the coming days. The site is a mine of information , it includes data from various sources, including standard bulletin boards used by the ISIS terrorists.

“The site mirrors many of the other standard bulletin boards that the jihadi’s have had over the years replete with videos and sections in all languages. Given that this site has popped up today in the Darknet just post the attacks in Paris, one has to assume that an all out media blitz is spinning up by Al-Hayat to capitalize on the situation,” Terban wrote.

The new Daesh hub demonstrates that even if the ISIS is aware of the Internet surveillance of western government, it considers the use of technology as strategical.

The Dark Web is a privileged environment for cyber criminals and state-sponsored hackers due to the anonymity offered by its services. The Dark Web is difficult to monitor for intelligence agencies and it is not so easy to locate members of terrorist organizations like the ISIS that share propaganda content. In the principal black markets hosted on the deep web it is possible to purchase any kind of illegal product and service, but in the dark part of the web it is possible to find propaganda videos and images. Hidden services in the Deep Web also offer the possibility to download the mobile apps used by the jihadists to communicate securely and to transfer Bitcoins to terrorist cells in every place of the world.

The new Daesh hub also suggests ISIS sympathizer the use of Telegram, a secret encrypted messaging platform that is largely adopted by terrorists.

 

Telegram is “A Secret Chat is a one-on-one chat wherein all messages are encrypted with a key held only by the chat’s participants.” It is an essential tool for all the individuals that need to protect their communication from prying eyes.

Telegram’s Channels used by the terrorists allow them to reach tens of thousand followers instantly.