Russian FSB Officers Charged in Yahoo Hack and More

Posted on March 15, 2017March 15, 2017 by Denise Simon

NBC, Washington

Yahoo announced on Thursday that the account information of at least 500 million users was stolen by hackers two years ago, in the biggest known intrusion of one company’s computer network.

In a statement, Yahoo said user information — including names, email addresses, telephone numbers, birth dates, encrypted passwords and, in some cases, security questions — was compromised in 2014 by what it believed was a “state-sponsored actor.” More here from NYT’s.

U.S. Charges Russian FSB Officers and Their Criminal Conspirators for Hacking Yahoo and Millions of Email Accounts

FSB Officers Protected, Directed, Facilitated and Paid Criminal Hackers

Karim Taloverov, arrested in Canada

A grand jury in the Northern District of California has indicted four defendants, including two officers of the Russian Federal Security Service (FSB), for computer hacking, economic espionage and other criminal offenses in connection with a conspiracy, beginning in January 2014, to access Yahoo’s network and the contents of webmail accounts. The defendants are Dmitry Aleksandrovich Dokuchaev, 33, a Russian national and resident; Igor Anatolyevich Sushchin, 43, a Russian national and resident; Alexsey Alexseyevich Belan, aka “Magg,” 29, a Russian national and resident; and Karim Baratov, aka “Kay,” “Karim Taloverov” and “Karim Akehmet Tokbergenov,” 22, a Canadian and Kazakh national and a resident of Canada.

The defendants used unauthorized access to Yahoo’s systems to steal information from about at least 500 million Yahoo accounts and then used some of that stolen information to obtain unauthorized access to the contents of accounts at Yahoo, Google and other webmail providers, including accounts of Russian journalists, U.S. and Russian government officials and private-sector employees of financial, transportation and other companies. One of the defendants also exploited his access to Yahoo’s network for his personal financial gain, by searching Yahoo user communications for credit card and gift card account numbers, redirecting a subset of Yahoo search engine web traffic so he could make commissions and enabling the theft of the contacts of at least 30 million Yahoo accounts to facilitate a spam campaign.

The charges were announced by Attorney General Jeff Sessions of the U.S. Department of Justice, Director James Comey of the FBI, Acting Assistant Attorney General Mary McCord of the National Security Division, U.S. Attorney Brian Stretch for the Northern District of California and Executive Assistant Director Paul Abbate of the FBI’s Criminal, Cyber, Response and Services Branch.

“Cyber crime poses a significant threat to our nation’s security and prosperity, and this is one of the largest data breaches in history,” said Attorney General Sessions. “But thanks to the tireless efforts of U.S. prosecutors and investigators, as well as our Canadian partners, today we have identified four individuals, including two Russian FSB officers, responsible for unauthorized access to millions of users’ accounts. The United States will vigorously investigate and prosecute the people behind such attacks to the fullest extent of the law.”

“Today we continue to pierce the veil of anonymity surrounding cyber crimes,” said Director Comey. “We are shrinking the world to ensure that cyber criminals think twice before targeting U.S. persons and interests.”

“ The criminal conduct at issue, carried out and otherwise facilitated by officers from an FSB unit that serves as the FBI’s point of contact in Moscow on cybercrime matters, is beyond the pale,” said Acting Assistant Attorney General McCord. “Once again, the Department and the FBI have demonstrated that hackers around the world can and will be exposed and held accountable. State actors may be using common criminals to access the data they want, but the indictment shows that our companies do not have to stand alone against this threat. We commend Yahoo and Google for their sustained and invaluable cooperation in the investigation aimed at obtaining justice for, and protecting the privacy of their users.”

“This is a highly complicated investigation of a very complex threat. It underscores the value of early, proactive engagement and cooperation between the private sector and the government,” said Executive Assistant Director Abbate. “The FBI will continue to work relentlessly with our private sector and international partners to identify those who conduct cyber-attacks against our citizens and our nation, expose them and hold them accountable under the law, no matter where they attempt to hide.”

“Silicon Valley’s computer infrastructure provides the means by which people around the world communicate with each other in their business and personal lives. The privacy and security of those communications must be governed by the rule of law, not by the whim of criminal hackers and those who employ them. People rightly expect that their communications through Silicon Valley internet providers will remain private, unless lawful authority provides otherwise. We will not tolerate unauthorized and illegal intrusions into the Silicon Valley computer infrastructure upon which both private citizens and the global economy rely,” said U.S. Attorney Stretch. “Working closely with Yahoo and Google, Department of Justice lawyers and the FBI were able to identify and expose the hackers responsible for the conduct described today, without unduly intruding into the privacy of the accounts that were stolen. We commend Yahoo and Google for providing exemplary cooperation while zealously protecting their users’ privacy.”

Summary of Allegations

According to the allegations of the Indictment:

The FSB officer defendants, Dmitry Dokuchaev and Igor Sushchin, protected, directed, facilitated and paid criminal hackers to collect information through computer intrusions in the U.S. and elsewhere. In the present case, they worked with co-defendants Alexsey Belan and Karim Baratov to obtain access to the email accounts of thousands of individuals.

Belan had been publicly indicted in September 2012 and June 2013 and was named one of FBI’s Cyber Most Wanted criminals in November 2013. An Interpol Red Notice seeking his immediate detention has been lodged (including with Russia) since July 26, 2013. Belan was arrested in a European country on a request from the U.S. in June 2013, but he was able to escape to Russia before he could be extradited.

Instead of acting on the U.S. government’s Red Notice and detaining Belan after his return, Dokuchaev and Sushchin subsequently used him to gain unauthorized access to Yahoo’s network. In or around November and December 2014, Belan stole a copy of at least a portion of Yahoo’s User Database (UDB), a Yahoo trade secret that contained, among other data, subscriber information including users’ names, recovery email accounts, phone numbers and certain information required to manually create, or “mint,” account authentication web browser “cookies” for more than 500 million Yahoo accounts.

Belan also obtained unauthorized access on behalf of the FSB conspirators to Yahoo’s Account Management Tool (AMT), which was a proprietary means by which Yahoo made and logged changes to user accounts. Belan, Dokuchaev and Sushchin then used the stolen UDB copy and AMT access to locate Yahoo email accounts of interest and to mint cookies for those accounts, enabling the co-conspirators to access at least 6,500 such accounts without authorization.

Some victim accounts were of predictable interest to the FSB, a foreign intelligence and law enforcement service, such as personal accounts belonging to Russian journalists; Russian and U.S. government officials; employees of a prominent Russian cybersecurity company; and numerous employees of other providers whose networks the conspirators sought to exploit. However, other personal accounts belonged to employees of commercial entities, such as a Russian investment banking firm, a French transportation company, U.S. financial services and private equity firms, a Swiss bitcoin wallet and banking firm and a U.S. airline.

During the conspiracy, the FSB officers facilitated Belan’s other criminal activities, by providing him with sensitive FSB law enforcement and intelligence information that would have helped him avoid detection by U.S. and other law enforcement agencies outside Russia, including information regarding FSB investigations of computer hacking and FSB techniques for identifying criminal hackers. Additionally, while working with his FSB conspirators to compromise Yahoo’s network and its users, Belan used his access to steal financial information such as gift card and credit card numbers from webmail accounts; to gain access to more than 30 million accounts whose contacts were then stolen to facilitate a spam campaign; and to earn commissions from fraudulently redirecting a subset of Yahoo’s search engine traffic.

When Dokuchaev and Sushchin learned that a target of interest had accounts at webmail providers other than Yahoo, including through information obtained as part of the Yahoo intrusion, they tasked their co-conspirator, Baratov, a resident of Canada, with obtaining unauthorized access to more than 80 accounts in exchange for commissions. On March 7, the Department of Justice submitted a provisional arrest warrant to Canadian law enforcement authorities, requesting Baratov’s arrest. On March 14, Baratov was arrested in Canada and the matter is now pending with the Canadian authorities.

An indictment is merely an accusation, and a defendant is presumed innocent unless proven guilty in a court of law.

The FBI, led by the San Francisco Field Office, conducted the investigation that resulted in the charges announced today. The case is being prosecuted by the U.S. Department of Justice National Security Division’s Counterintelligence and Export Control Section and the U.S. Attorney’s Office for the Northern District of California, with support from the Justice Department’s Office of International Affairs.

Defendants: At all times relevant to the charges, the Indictment alleges as follows:

- Dmitry Aleksandrovich Dokuchaev, 33, was an officer in the FSB Center for Information Security, aka “Center 18.” Dokuchaev was a Russian national and resident.

- Igor Anatolyevich Sushchin, 43, was an FSB officer, a superior to Dokuchaev within the FSB, and a Russian national and resident. Sushchin was embedded as a purported employee and Head of Information Security at a Russian investment bank.

- Alexsey Alexseyevich Belan, aka “Magg,” 29, was born in Latvia and is a Russian national and resident. U.S. Federal grand juries have indicted Belan twice before, in 2012 and 2013, for computer fraud and abuse, access device fraud and aggravated identity theft involving three U.S.-based e-commerce companies and the FBI placed Belan on its “Cyber Most Wanted” list. Belan is currently the subject of a pending “Red Notice” requesting that Interpol member nations (including Russia) arrest him pending extradition. Belan was also one of two criminal hackers named by President Barack Obama on Dec. 29, 2016, pursuant to Executive Order 13694, as a Specially Designated National subject to sanctions.

- Karim Baratov, aka “Kay,” “Karim Taloverov” and “Karim Akehmet Tokbergenov,” 22. He is a Canadian and Kazakh national and a resident of Canada.

Victims: Yahoo; more than 500 million Yahoo accounts for which account information about was stolen by the defendants; more than 30 million Yahoo accounts for which account contents were accessed without authorization to facilitate a spam campaign; and at least 18 additional users at other webmail providers whose accounts were accessed without authorization.

Time Period: As alleged in the Indictment, the conspiracy began at least as early as 2014 and, even though the conspirators lost their access to Yahoo’s networks in September 2016, they continued to utilize information stolen from the intrusion up to and including at least December 2016.

Crimes:

Count(s)	Defendant(s)	Charge	Statute 18 U.S.C.	Conduct	Maximum Penalty
1	All	Conspiring to commit computer fraud and abuse	§ 1030(b)	Defendants conspired to hack into the computers of Yahoo and accounts maintained by Yahoo, Google and other providers to steal information from them. First, Belan gained access to Yahoo’s servers and stole information that allowed him, Dokuchaev, and Sushchin to gain unauthorized access to individual Yahoo user accounts. Then, Dokuchaev and Sushchin tasked Baratov with gaining access to individual user accounts at Google and other Providers (but not Yahoo) and paid Baratov for providing them with the account passwords. In some instances, Dokuchaev and Sushchin tasked Baratov with targeting accounts that they learned of through access to Yahoo’s UDB and AMT (e.g., Gmail accounts that served as a Yahoo user’s secondary account).	10 years
2	Dokuchaev Sushchin Belan	Conspiring to engage in economic espionage	§ 1831(a)(5)	Starting on Nov. 4, 2014, Belan stole, and the defendants thereafter transferred, received and possessed the following Yahoo trade secrets: the Yahoo UDB, which was proprietary and confidential Yahoo technology and information, including subscriber names, secondary accounts, phone numbers, challenge questions and answers; the AMT, Yahoo’s interface to the UDB; and Yahoo’s cookie “minting” source code, which enabled the defendants to manufacture account cookies to then gain access to individual Yahoo user accounts.	15 years
3	Dokuchaev Sushchin Belan	Conspiring to engage in theft of trade secrets	§ 1832(a)(5)	See Count 2	10 years
4-6	Dokuchaev Sushchin Belan	Economic espionage	§§ 1831(a)(1), (a)(4), and 2	See Count 2	15 years (each count)
7-9	Dokuchaev Sushchin Belan	Theft of trade secrets	§§ 1832(a)(1), and 2	See Count 2	10 years (each count)
10	Dokuchaev Sushchin Belan	Conspiring to commit wire fraud	§ 1349	The defendants fraudulently schemed to gain unauthorized access to Yahoo’s network through compromised Yahoo employee accounts and then used the Yahoo trade secrets to gain unauthorized access to valuable non-public information in individual Yahoo user accounts.	20 years
11-13	Dokuchaev Sushchin Belan	Accessing (or attempting to access) a computer without authorization to obtain information for the purpose of commercial advantage and private financial gain.	§§ 1030(a)(2)(C), 1030(c)(2)(B)(i)-(iii), and 2	The defendants gained unauthorized access to Yahoo’s corporate network and obtained information regarding Yahoo’s network architecture and the UDB.	5 years (each count)
14-17	Dokuchaev Sushchin Belan	Transmitting code with the intent to cause damage to computers.	§§ 1030(a)(5)(A), 1030(c)(4)(B), and 2	During the course of their unauthorized access to Yahoo’s network, the defendants transmitted code on Yahoo’s network in order to maintain a persistent presence, to redirect Yahoo search engine users and to mint cookies for individual Yahoo accounts.	10 years (each count)
18-24	Dokuchaev Sushchin Belan	Accessing (or attempting to access) a computer without authorization to obtain information for the purpose of commercial advantage and private financial gain.	§§ 1030(a)(2)(C), 1030(c)(2)(B)(i)-(iii), and 2	Defendants obtained unauthorized access to individual Yahoo user accounts.	5 years (each count)
25-36	Dokuchaev Sushchin Belan	Counterfeit access device fraud	§§ 1029(a)(1), 1029(b)(1), and 2	Defendants used minted cookies to gain unauthorized access to individual Yahoo user accounts.	10 years (each count)
37	Dokuchaev Sushchin Belan	Counterfeit access device making equipment	§§ 1029(a)(4)	Defendants used software to mint cookies for unauthorized access to individual Yahoo user accounts.	15 years
38	Dokuchaev Sushchin Baratov	Conspiring to commit access device fraud	§§ 1029(b)(2)	Defendants Dokuchaev and Sushchin tasked Baratov with gaining unauthorized access to individual user accounts at Google and other Providers and then paid Baratov for providing them with the account passwords. In some instances, Dokuchaev and Sushchin tasked Baratov with targeting accounts that they learned of through access to Yahoo’s UDB and AMT (e.g., Gmail accounts that served as a Yahoo user’s secondary account).	7 ½ years.
39	Dokuchaev Sushchin Baratov	Conspiring to commit wire fraud	§ 1349	See Count 38	20 years
40-47	Dokuchaev Baratov	Aggravated identity theft	§ 1028A(a)(1)	See Count 38	2 years

Dmitri Dokuchae et al Indictment Redacted

17-278

National Security Division (NSD)

USAO – California, Northern

Topic:

Counterintelligence and Export Control

Updated March 15, 2017

North Korea = Iran, China, Syria, Russia, Egypt

Posted on March 15, 2017March 15, 2017 by Denise Simon

There are many worries about building military actions by North Korea such that deployments of U.S. military assets along with that of Japan, S. Korea and other nations in the region are preparing for various conditions due to continued threats by the DPRK.

CNN

There is a standing sanction program against North Korea, but they are not holding due to Africa.

JOHANNESBURG (AP) — North Korean weapons barred by U.N. sanctions ended up in the hands of U.N. peacekeepers in Africa, a confidential report says. That incident and others in more than a half-dozen African nations show how North Korea, despite facing its toughest sanctions in decades, continues to avoid them on the world’s most impoverished continent with few repercussions.

The annual report by a U.N. panel of experts on North Korea, obtained by The Associated Press, illustrates how Pyongyang evades sanctions imposed for its nuclear and ballistic missile programs to cooperate “on a large scale,” including military training and construction, in countries from Angola to Uganda.

Among the findings was the “largest seizure of ammunition in the history of sanctions” against North Korea, with 30,000 rocket-propelled grenades found hidden under iron ore that was destined for Egypt in a cargo vessel heading toward the Suez Canal. The intended destination of the North Korean-made grenades, seized in August, was not clear.

A month before that, the report says, a U.N. member state seized an air shipment destined for a company in Eritrea containing military radio communications items. It was the second time military-related items had been caught being exported from North Korea to Eritrea “and confirms ongoing arms-related cooperation between the two countries.” Eritrea is also under U.N. sanctions for supporting armed groups in the Horn of Africa.

***

Experts point to China as the father and manager of North Korea and there is real truth to that, yet the collaborations go far beyond China, to include Iran, Syria and Russia and in some cases Egypt. Nearly all of the North Korea country’s communications and Internet traffic is routed through China. Firms that monitor that traffic say it is comparable to only about 1,000 high-speed homes in the United States.

North Korea has intermediate-range ballistic missiles as well. North Korea has tested nuclear weapons on three occasions; Iran and Syria’s nuclear programs have raised suspicions that those countries are pursuing nuclear weapons. However, Iran has, according to the IC, halted its nuclear weapons program, and Syria does not appear to have an active nuclear weapons program.

Congress has held numerous hearings regarding these countries’ nuclear and missile programs. It has also passed legislation providing for sanctions on countries whose entities assist Iran, North Korea, and Syria to obtain weapons of mass destruction (WMD) and missile delivery systems. For example, the Iran, North Korea and Syria Nonproliferation Act (INKSNA, P.L. 106-178) imposes penalties on countries whose companies’ exports. See report here.

***

Secretary of State Rex Tillerson will warn China’s leaders that the United States is prepared to step up missile defenses and pressure on Chinese financial institutions if they fail to use their influence to restrain North Korea’s nuclear and missile programs, according to several officials involved in planning his first mission to Asia.

Reinforcing military ties, Gen. Joseph F. Dunford Jr., the chairman of the Joint Chiefs of Staff, conducted a 30-minute phone call on Tuesday with his South Korean counterpart, Gen. Lee Sun-jin. A Pentagon statement said the generals discussed the possibility that North Korea could carry out “provocative actions” during the joint American and South Korean exercises now underway, or in April when North Korean authorities commemorate the birthday of Kim Il-sung, the founder and first leader of the country.

Daniel L. Glaser, a former Treasury official who constructed many of the sanctions, and now a principal at the Financial Integrity Network, said in an interview that the largest Chinese banks often shun dealings with North Korea and that some of the smaller ones have little exposure to the American banking system. More here from the NYT’s.

Trump administration officials have signaled there will be even greater financial pressure placed on Beijing if it doesn’t cut off North Korea, a step that risks Chinese retaliation. “We are putting the world on notice: The games are over,” Commerce Secretary Wilbur Ross said while announcing the sanctions on ZTE last week. [….]

U.S. officials said Mr. Tillerson would be discussing North Korea at all his stops in Asia, including the issue of “secondary” sanctions against non-North Korean companies that have been aiding Pyongyang. “All of the existing tools that we have to try to bring pressure on North Korea are on the table, and we’ll be looking to try to see what the most effective combination is,” said a senior U.S. official briefed on the Asia trip.

Republican senators wrote Treasury Secretary Steven Mnuchin last month and called for an investigation into the Bank of China and other Chinese firms for their alleged roles in helping North Korea. [Wall Street Journal, Jay Solomon; link to senator’s letter here]

***

Nuclear Proliferation

Kumsan Trading. Member states are supposed to freeze the assets of, and expel the representatives of, companies involved in North Korean nuclear, missile, and other WMD proliferation. According to the Panel, the Korea Kumsan Trading Corporation is a front for North Korea’s General Bureau of Atomic Energy and helps it procure materials and fund its operations. Kumsan advertises itself online openly as dealing in sanctioned products, including vanadium and precious metals, with locations in both Moscow and Dandong. (Paras. 18-20.)

Korea Mining Development Trading Corp. (KOMID) is North Korea’s main arms dealer. It was designated in 2009 for WMD proliferation, but probably earns most of its revenue through violations of an embargo on conventional arms sales, by selling to governments in Africa and the Middle East. KOMID operates through multiple front companies that do business more-or-less openly in China. China is required to expel the representatives of these companies, but it almost never does. When one of them is exposed, it may revoke a business license or registration, but the operative goes right back into business under a new name at a new address. The Panel also found that at least nine KOMD representatives traveled through China in 2016, despite a requirement that member states deny them entry. (Table 8, Page 68.)

One of KOMID’s fronts is Namchongang Trading, which was designated by the U.N. in 2009 for procuring nuclear-related items. It operates openly in Beijing and Dandong, China, through several Chinese commercial websites. (Para. 156.) Namchongang has also operated as (or in cahoots with) Taeryonggang Trading, Namhung Trading, and Sobaeksu United Corporation, which operates in Beijing, Yingkou and Dandong. The EU designated Sobaeksu in 2010 for “the research and acquisition of sensitive products and equipment.” The Panel suspects that this entire network is involved with KOMID. (Paras. 156-59.) KOMID also does business through a front company called Beijing New Technology. (Para. 163.)

Another KOMID front, Korea Heungjin Trading, which was designated in 2012, for nuclear, missile, and other WMD proliferation, also operates openly in Dandong and Dalian. A North Korean diplomat posted at the embassy in Beijing serves as its director. (Para. 187-89.)

Green Pine Associated was designated by the U.N. in 2012 for its involvement in North Korea’s nuclear, missile, and other WMD programs. It’s still doing business openly in both Beijing, Shenyang, and Hong Kong as Green Pine, Natural Resources Development Investment Corporation, King Helong International Trading, Korea Unhasu Trading Company, and Saeng Pil Trading Corporation. (Paras. 166-83.) Green Pine is the company behind the attempted sale of the lithium from … guess where:

24. The Panel investigated the 2016 attempted online sale of lithium metal by the Democratic People’s Republic of Korea. The enriched lithium-6 isotope, and products or devices containing it, are on the list of prohibited nuclear-related items adopted by the Security Council (see annex 4-4). According to IAEA, lithium-6 is used to produce tritium, an isotope found in boosted nuclear devices. This sales attempt suggests that the Democratic People’s Republic of Korea has access to remaining quantities of the material.

25. Li-6 is advertised for sale by a company of the Democratic People’s Republic of Korea, General Precious Metal, which the European Union has identified as an alias of Green Pine Associated Corporation (Green Pine). Mr. Chol Yun was listed as the contact person of General Precious Metal for sale of the mineral and has an address and phone numbers in Beijing (see annex 4-5). The same name appeared as third secretary of the embassy of the Democratic People’s Republic of Korea in Beijing on an official diplomatic list dated 24 September 2012 (see annex 4-6). The Panel notes a pattern whereby the Democratic People’s Republic of Korea has accredited Green Pine overseas representatives as diplomats. The Panel continues to investigate this diplomat’s involvement in prohibited activities and his possible connection with another prohibited activity (see para. 91).

Korea Ryonha Machinery Joint Venture was designated in 2013 for WMD proliferation, mainly for buying, selling, and manufacturing machine tools used for making both conventional weapons and WMDs. It shows up in POE reports year after year because it continues to operate, and to display its wares at trade shows, in both Russia and China. In 2016, a Chinese company exported several machine tools to North Korea, and the Chinese government was reportedly investigating (!) Ryonha’s involvement. (Para. 196.)

[From the U.N. Panel’s 2014 report]

Training of scientists. The resolutions ban member states from training North Koreans in sensitive technology that could be used for North Korea’s WMD programs. The North Korean universities that train the country’s nuclear and missile scientists have exchange agreements with universities in Russia and China. The Panel asked the Chinese universities to explain, but they never responded. (Para. 135.)

Missile Proliferation

Kwangmyongsong missile parts. Someone, presumably the U.S. Navy, recovered the pieces of a Kwangmyongsong missile North Korea launched in February 2016 and found that it contained “ball bearings and engraved Cyrillic characters … identical to those from the 2012 Unha-3, and a “camera [and] EMI filter” from a “Chinese manufacturer, Beijing East Exhibition High-Tech Technology Co. Ltd.” (Paras. 57-58.) That “someone” also discovered the Pyongyang had imported pressure transmitters from the U.K. and Ireland, via the manufacturer’s distributor in China, via middlemen in China. (Para. 59.) This suggests several layers of violations — China’s failure to expel North Korean representatives of sanctioned entities, to enforce export controls, or to inspect cargo going to North Korea.

Shipment of Scud parts to Egypt. Paragraphs 71-77 of last year’s report discuss a shipment of Scud missile parts to Egypt. Since then, the Panel has determined that the whole scheme was run out of the North Korean embassy in Beijing. (Paras. 88-89.) The shipper was Ryongsong Trading Company, and the seller was Rungrado Trading Company, which you may remember for its human trafficking in Europe. Rungrado was designated by the Treasury Department last year for “the exportation of workers” from North Korea to earn foreign currency for Pyongyang, some of which went to North Korean agencies that were designated for supporting WMD programs. South Korea considers Rungrado to be an alias for Ryongsong. (FN.99.) Although the U.S. Treasury Department routinely designates aliases, it has not designated Ryongsong.

Weapons Trafficking

North Korea is subject to a U.N. embargo on the import, export, sale, or purchase of weapons, including weapons components, technology, services, training, and dual-use items. Since March, China has been required to inspect all cargo “that has originated in the DPRK, or that is destined for the DPRK, or has been brokered or facilitated by the DPRK or its nationals, or by individuals or entities acting on their behalf or at their direction, or entities owned or controlled by them, or by designated individuals or entities, or that is being transported on DPRK flagged aircraft or maritime vessels.” (Para. 18.) Pretty clearly, that isn’t happening.

Syria rocket shipment. You’ve already read my post on this, right? Last August, Egyptian authorities seized a record haul of North Korean weapons, mostly PG-7 antitank rockets, hidden under iron ore aboard the M/V Jie Shun. I guessed that Syria was the destination because of the geography, but it’s possible that the client could have been Hamas or Hezbollah (which have also been Pyongyang’s arms clients).

This transaction also relied heavily on North Korean agents based in China. The bill of lading lists a shipper whose address is a hotel room in Dalian, a city often used by North Korean operatives. (Para. 63.) The holder of the ship’s compliance document was one Fan Mintan. A second man, Zhang Qiao, was its emergency contact, arranged for the ship’s insurance, and registered the ship’s operator in the Marshall islands. (Paras. 65-66.) Zhang is also involved in the coal trade with North Korea (para. 68), and thus played a role in violating UNSCR 2270 and 2321. He is also linked to another suspected North Korean smuggling ship, the M/V Light. A third man, Li Anshan, whom the Panel links to Ocean Maritime Management, a North Korean shipping company designated by the U.N. for arms smuggling, helped arrange for the Jie Shun’s Cambodian registration.

Eritrea radios shipment and Glocom. I previously posted about Glocom, the Reconnaissance General Bureau front company that manufactured sophisticated military radios and was based in Malaysia. Glocom made headlines after it was exposed just after the assassination of Kim Jong-nam. Starting at Paragraph 72 of its report, the Panel described how Glocom shipped radios to Eritrea. According to the Panel, that shipment “originated in China.”

75. The air waybills listed the shipper as Beijing Chengxing Trading Co. Ltd. According to the Chinese business registry, the company is still active, mainly trading in electronics, mining equipment and machinery (see annex 8-3). Mr. Pei Minhao (???) was listed as a legal representative until 26 February 2016 and still owns most shares in the company (see para. 164).

Glocom had North Korean representatives based in both Malaysia and China; had bank accounts, front companies, and procurement agents in both Malaysia and China; used mostly Chinese suppliers; and shipped its components to Beijing or Dandong for assembly (the report didn’t specify where). (Para. 77-84, 164.) Glocom did most of its business in U.S. dollars or euro through a sanctioned bank, Daedong Credit Bank, “to transfer funds to a supply chain of more than 20 companies located primarily on the Chinese mainland; in Hong Kong, China; and in Singapore.” (Paras. 233-25.)

Naval vessel repair & construction. Last year, the Panel reported that Green Pine had refurbished military patrol boats for Angola in violation of the arms embargo. The parts were shipped from China, the Panel has asked China for an explanation, and China still hasn’t given one. (Para. 103.)

North Korean UAV that crashed in South Korea. A Beijing company, Microfly Engineering and Technology, made it. After that, the trail leads to another Chinese company and two middlemen, who either point fingers at one another or deny all involvement. The Panel asked China to investigate, but China hasn’t responded. (Para. 107.) More here to FreeKorea, remarkable work.

Russian Special Forces now in Libya

Posted on March 14, 2017March 14, 2017 by Denise Simon

Image result for Khalifa Haftar libya oil ports Haftar was protected by and lived in the U.S., becoming a citizen. We dispatched him to Libya to launch an interim government. Now he and Egypt both have turned to Russia for full control and support, Putin has complied, happily. John Kerry, Hillary Clinton and Barack Obama are not responding to calls on line 4. Hah…

BBC: Forces loyal to Libyan military strongman Khalifa Haftar say they have retaken key oil-rich areas in the country’s east.

Ground, sea and air forces were engaged in the fight for sites at Ras Lanuf, Sidra and Ben Jawad from a rival Islamist militia, a spokesman said.

Meanwhile, Russia has denied reports that it has deployed special forces to the region in support of Gen Haftar. {See below, emphasis added}

Libya has been in chaos since the overthrow of Colonel Gaddafi in 2011.

The oil terminals had been seized by the Benghazi Defence Brigades (BDB) – a mix of militias that includes Islamists – earlier this month, which then handed them over to the Petroleum Facilities Guard, affiliated to the UN-backed unity government based in Tripoli.

Gen Haftar is allied to an administration based in the eastern city of Tobruk, which is challenging the authority of the UN-backed government.

Russia moving special forces into Libya

U.S. sources claim Russia moving special forces into Libya to aid Libyan military commander Khalifa Haftar.

U.S., Egyptian and diplomatic sources say that Russia has apparently been moving special forces to an airbase in western Egypt near the border with Libya in recent days, according to a report by Reuters.

Newsweek

The U.S. is concerned that such a Russian deployment may signify Russian support for Libyan military commander Khalifa Haftar, who suffered a setback on March 3 when the Benghazi Defense Brigades (BDB) attacked oil ports controlled by his forces.

U.S. officials claimed that their surveillance units had observed Russian special operations forces and unmanned aircraft at Sidi Barrani, which is about 100 km from the Egypt-Libya border. The apparent Russian deployments have not been previously reported.

The Russian defense ministry did not respond to these claims on Monday and Egypt denied the presence of any Russian contingent on its soil.

Mohamed Manfour, commander of the Benina air base near Benghazi in Libya, denied that Haftar’s Libyan National Army (LNA) had received military assistance from the Russian state or from Russian military contractors, and said there were no Russian forces or bases in eastern Libya.

Over the past two years a number of Western countries, including the U.S., have sent special operations forces and military advisors into Libya. The U.S. also carried out air strikes to support a successful Libyan campaign last year to oust ISIS from its stronghold in the city of Sirte.

Russia has shown increasing involvement in Libya in recent months and appears to be taking steps to back Haftar to lead the battle-torn kingdom, which has been split between local warlords in the aftermath of a 2011 NATO-backed uprising against the late leader Muammar Gaddafi, who was an ally of Russia. Several dozen armed private security contractors from Russia operated until February in a part of Libya that is under Haftar’s control.

The top U.S. military commander overseeing troops in Africa, Marine General Thomas Waldhauser, told the U.S. Senate last week that Russia was trying to exert influence in Libya to strengthen its leverage over whoever ultimately holds power.

“They’re working to influence that,” Waldhauser told the Senate Armed Services Committee on Thursday. Asked whether it was in the U.S. interest to let that happen, Waldhauser said: “It is not.”

Russian involvement in Libyan affairs appears to be growing at a time when it is limiting its operations in Syria to attempts to force a resolution without taking charge of the country. Waldhauser believes that this is Russia’s eventual goal in Libya, which will enable it to gain leverage there in the event that Haftar gains control of the country. It is also eyeing Libya’s oil fields as a source of economic opportunities.

Russia, however, says that its primary objective in the Middle East is to contain the spread of violent Islamist groups.

Meanwhile who is Khalifa Belqasim Haftar? (Wikipedia file)

Haftar was born in eastern Libya. He served in the Libyan army under Muammar Gaddafi, and took part in the coup that brought Gaddafi to power in 1969. He commanded the Libyan contingent against Israel in the Yom Kippur War of 1973.^[3] In 1987, he became a prisoner of war during the war against Chad. While held prisoner, he and his fellow officers formed a group hoping to overthrow Gaddafi. He was released around 1990 in a deal with the United States government and spent nearly two decades in the United States, gaining U.S. citizenship.^[4] Haftar lived comfortably in Virginia, relatively close to CIA headquarters, from the early 1990s until 2011.^[5] In 1993, while living in the United States, he was convicted in absentia of crimes against the Jamahiriya and sentenced to death.

Haftar held a senior position in the forces which overthrew Gaddafi in the 2011 Libyan Civil War. In 2014 he was commander of the Libyan Army when the General National Congress (GNC) refused to give up power in accordance with its term of office. Haftar launched a campaign against the GNC and its Islamic fundamentalist allies. His campaign allowed elections to take place to replace the GNC, but then developed into a civil war.

Haftar’s campaign attracted opponents to the GNC to join him as well as armed groups including Zintan‘s al-Qaqaa and Sawaaq brigades, regional military police, the Saiqa special forces group in Benghazi, the Libyan air force and Ibrahim Jadhran’s federalist militias.^[6]

Haftar has been described as “Libya’s most potent warlord,” having fought “with and against nearly every significant faction” in Libya’s conflicts, and as having a “reputation for unrivalled military experience”.

***

Internal rivalries based on region, city, tribe, political factions, ethnicity, and militia membership have supplanted dictatorial repression. The costs of this multi-layered disunity are stark: Libya has lost billions of dollars in potential revenues due to fights over control of the oil sector. And nearly 5,000 people have been killed due to the instability since 2014, when Libya formally divided politically.

Perhaps the most immediate barrier to implementation is the role of General Khalifa Haftar, commander of the Libyan National Army (LNA). Although Secretary of State John Kerry did not mention him by name in his statement in Vienna after the meeting to support Libya on May 16, Haftar was clearly on his mind when he said battles of individuals serving their own interests undermined Libya’s security, and that Libya was at a crossroads between a fate of chaos fueled by personal rivalries or unity and peace. Article Eight of the current agreement stipulates that the Presidency Council should be the Supreme Commander of the Libyan Army, in control of all senior-level security official appointments and dismissals. In effect, this provision would give the Presidency Council control of Haftar’s fate. The pro-Haftar eastern government has made removal of this article one of its few conditions for recognizing the Government of National Accord (GNA).

This impasse underscores the need for Libyans to decide once and for all what relationship the military should have with civilian institutions in Libya, and specifically what role Haftar can or will play in the future of Libya. This has also been a difficult impasse for Western governments to navigate, harkening to a recurring Middle East policy battle between prioritizing counter-terrorism and security, and longer-term interests like political stability, rule of law and human rights. Haftar has contributed to counter-terrorism efforts against groups like Islamic State, especially in Benghazi, while undermining Libya’s long-term stability. More here from May of 2016.

Sidley Austin an Agent Firm for the Russian ‘Garchs’?

Posted on March 13, 2017March 13, 2017 by Denise Simon

Sidley Austin Reps Clinton Confidante in Benghazi Probe

Former DAG James Cole appears with Sidney Blumenthal for depo in House investigation.

Sidney Blumenthal, a longtime Clinton family friend, on Tuesday sat for a closed-door deposition in the House over his communications with former Secretary of State Hillary Clinton around the time of the 2012 attack on the U.S. diplomatic compound in Benghazi, Libya. James Cole, a former deputy attorney general under Eric Holder Jr. who is now a partner in Sidley Austin’s Washington office, represents Blumenthal.

*** Then this in a snippet:

The complaint, filed in October, names Sidley Austin and partner Edward McNicholas, alleging that they assisted one Joseph Garcia in securing millions in investments from a woman named Carrie Birkel. Birkel is looking to recover $1.5 million from the lawyers. Birkel claims that she had millions to invest after she got her $10 million divorce settlement — a divorce precipitated by Garcia providing her, unsolicited, with compromising photos of her husband, before introducing her to McNicholas, who vetted divorce lawyers for her on a $25,000 retainer.

As the complaint states:

Birkel’s claims arise out of a truly bizarre set of circumstances that would seem more appropriate for an episode of “Law and Order” than in reality.

Indeed.

Garcia, who is serving a 37-month sentence for similar activity, is a curious character by all accounts:

Garcia and his wife used multiple aliases to go along with numerous Social Security numbers. While peddling phony investments, Garcia would only reference his time as a Navy SEAL; the details were confidential. And he instructed his family to always have “go bags” packed should they need to flee one of the many lavish homes they rented across the country. More here.

***

For the confirmation hearing for Loretta Lynch, Statement of David B. Barlow ,Partner, Sidley Austin LLP made an endorsing and glowing recommendation for her.

Okay, so Sidley Austin is a very big and weird law firm with clear power in Washington DC, so what?

Well, let’s bring in the Russian lobby operation shall we? Sidley is the law firm of record to influence Congress and the White House against sanctions and political cover. The lobby agreement was generated by VTB Bank with Sidley Austin.

You can read the full document/agreement here.

In part from VOA:

The International Consortium of Investigative Journalists (ICIJ) reported in April that suspicious payments made by “Putin’s cronies may have, in some cases, been intended as payoffs, possibly in exchange for Russian government aid or contracts.”

The secret documents suggested that much of the money originally came from a bank in Cyprus, the ICIJ said, “that, at the time, was majority-owned by the Russian state-controlled VTB Bank.”

The documents also showed dozens of transactions, over more than a decade, involving people or companies linked to Putin, who has been in power at the Kremlin since 2000. Among those identified in the document were Putin’s longtime friend, cellist Sergei Roldugin, and the wife of Putin’s spokesman, Dmitry Peskov.

Putin has admitted there were transactions between him and Roldugin, but said there was no evidence of illegal activity.

Roldugin has dismissed any suggestion that he was either a custodian or a conduit for Putin’s money or assets.

*** Back in 2014:

VTB Bank and Bank of China today signed an Agreement on Cooperation in the presence of Russian President Vladimir Putin and Chinese President Xi Jinping.

The agreement was signed by First Deputy President and Chairman of VTB Bank Management Board Vasily Titov and Bank of China President Chen Siqing.

Under the agreement, the banks plan to develop their partnership in a number of areas, including cooperation on ruble and renminbi settlements, investment banking, inter-bank lending, trade finance and capital-markets transactions.

Vasily Titov said :”The signing of the agreement underscores VTB Group’s ongoing drive to grow its business in Asia, and will help facilitate the development of bilateral trade and economic relations between Russia and China, which have always been reliable partners.”

***

The Russian state-controlled bank VTB confirmed that its websites had been targeted by a cyber attack. The VTB is the second largest bank in the country. In December of 2016, Security Affairs reported:

Last week the Russian intelligence service FSB revealed that an unnamed foreign power is planning to undermine Russian Banks with cyber attacks and PSYOPS via social media.

According to the Russian intelligence, a group of servers in the Netherlands and leased to the Ukrainian web hosting firm BlazingFast were ready to launch an assault next Monday.

“Russia’s domestic intelligence agency, the Federal Security Service (FSB), said that the servers to be used in the alleged cyber attack were located in the Netherlands and registered to a Ukrainian web hosting company called BlazingFast.” reported the Reuters.

“The attack, which was to target major national and provincial banks in several Russian cities, was meant to start on Dec. 5, the FSB said in a statement.”

A few hours after the announcement made by the FSB, the Russian Central Bank confirmed that hackers have stolen 2 billion rubles, roughly 31 million US dollars, from accounts at the Russian central bank.

The Russian authorities haven’t disclosed the identity of the alleged threat actor behind the attack.

The Russian bank industry was recently hit by a string of cyber attacks, a few day ago experts from Kaspersky Lab revealed that at least five of Russia’s largest banks were targeted by massive DDoS attacks.

The attacks were powered by devices located in 30 countries across the world, including the United States.

The Russian Government was accused by Washington of interference in the recent US Presidential Election.

The Office of the Director of National Intelligence and the Department of Homeland Security have issued a joint security statement to accuse the Russian government of a series of intrusions into the networks of US organizations and state election boards involved in the Presidential Election.

“The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process” reads the statement.

There is more to the Obama administration and decisions than we know. This matter of cyber intrusions, sanctions, lawyers, Russian interference will not go away any time soon.

C’mon Trump, Americans are Still Angry

Posted on March 13, 2017March 13, 2017 by Denise Simon

Hey President Donald, how about assigning a leader to a whistleblower task force that coughs up the goods on the Obama administration.

In the past eight years we have almost forgotten all the fraud, collusion, deception and nefarious work of the previous administration and how far reaching those operations were. We still want consequences….why? If left unchallenged, rather unexposed, those operatives will dig in deeper and with wild abandon. The media cannot be left out of this whistleblowing mission either. Complicity and political behavior modeling by the left will only gain traction if not forced into the sunlight.

Trump pledged to restore law and order, voters should know how far afield the law was fractured under the Obama administration.

Much in the news is the Russian intrusion into our election infrastructure, which did happen without dispute. Altering the vote count or influencing voters to cast votes to a preferred candidate did NOT happen, such there is no evidence. The Russians have a history of such intrusions beyond the United States including Ukraine, Germany and Europe. The U.S. intelligence agencies warned of forced log-ins long before the November election. Now British intelligence is making the same warnings.

A particular item that requires a whistleblower headline is how the Obama White House interfered in the election process in Israel paying operatives to remove Netanyahu from power. Hello Trump team, can you expose more details on this please? We already know about Jeremy Bird, but we want the full story and in the end, we want punishment.

Some items that need attention and exposure are noted below but this list is hardly complete. In fact you are invited to add to the list in the comments section.

We need to know the culprits, the money, the facts and the rest of the stories on many scandals. This is the moment now leading into the building mid-term elections, but mostly due to the DNC being led by two terrifying people Tom Perez and Keith Ellison. The DNC, DNCC, Center for American Policy and others are houses of UnAmerican activities, if we even remember what America is and should be anymore.

There is no better source or investigator than Trevor Louden. He helped us with his movie, ‘Enemies Within’ as he laid the foundation for the viewers to take the baton and run to expose more.

Congress has an ‘oversight committee’ that does investigate and expose countless cases yet it is time consuming and burdensome given scheduling, subpoenas, testimony and document requests. Then we have Judicial Watch that is doing great work using the legal machinery, but all reliance cannot be placed there.

The Trump White House has this lifetime opportunity to own the headlines, the stories of connected events and provide the full account of scandals and people that today are left still with unanswered question.

Here are some samples Mr. President we need to know more about, begin here with the whistleblowing now that your administration is in power with access.

The matter of Fast and Furious, the gun-running operation to Mexico was never fully told. Did Kevin O’Reilly ever cooperate and provide testimony, when in the middle of the scandal he was suddenly deployed to Iraq?
Judicial Watch just obtained almost 7000 documents relating to the IRS targeting scandal. Exactly why is John Koskinen still the commissioner and has anyone moved to sue Lois Lerner in civil suits? Is there evidence of White House collusion including some members of Congress?
What is the rest of the story when it comes to new solar/energy businesses launched with government loan guarantees that have gone belly up? Who is responsible, what did it really cost the taxpayer and are any monies recoverable? How about the DoJ investigations where some financial reports were altered?
Benghazi stands on its own..
Who at the Department of Energy is responsible for the lead in the water in Flint, Michigan and polluting the Colorado river?
With the ransom money given to Iran and the side deals all but forgotten of the Iranian nuclear deal, how much is still out there to be uncovered and reported? What more do we need to know about Ploughshares, NIAC, Ben Rhodes and John Kerry?
We have new leadership at the Veterans Administration. Great now how about exposing the hidden case files, the corruption of the unions, jailing those that falsified status reports and got big bonuses? The VA Inspector General has done some great work so far, but who in leadership is going down for the never-ending issues at the VA?
Can we have a team that reveals the ‘slush funds’ from the ‘stimulus money’ and who is guilty in both parties that scammed the taxpayers?
Clearly there is more to know about Obama’s amnesty and his DACA program. Who was behind it, how much money was involved? Are judges being paid off? Who gets grants to sponsor children and illegals and how much money was spent in transportation of people all over the country hiding the from the legal system?
Obamacare is a major topic, what more do we need to know such that it is being used to blame democrats and repeal the law? How about HHS contracts, sharing patient databases with outside agencies and foreign governments? What about cyber security, what about paying off big pharma and insurance companies?
Where are we with the Clinton Foundation and the emails to Hillary’s private server that included Obama emails and the computer belonging to Huma Abedin? Is anyone still at the State Department still providing the Clinton operation cover? Can Patrick Kennedy or John Kerry be prosecuted?
What is the rest of the story of Eric Holder and Loretta Lynch on corporate fines for violations and company officials not going to prison?
The Department of Justice maintained a victims fund which selectively paid surviving family members in cases of attacks and murder victims. Why was Obama personally involved and how was it decided who got money and how much?
The DoJ funded leftist organizations. Two examples were National Council of La Raza, the National Community Reinvestment Coalition and the National Urban League.
Obama and his team negotiated with the Taliban. What is the real truth, how much money did we give the terror organization and where are the Taliban 5 released from Gitmo today?
Several on the Democrat side of the House of Representatives hired a rogue team of IT professionals that were not vetted and had access to computer systems and passwords causing more national security threats. Why? Who was fired, who is responsible? Are there more we don’t know about?

Once again, this is hardly a comprehensive list, we must know more. We want consequences. build the case, tell us what we need to know going forward.