Does the White House Know ‘all’ about North Korea?

Posted on March 8, 2017March 8, 2017 by Denise Simon

Check your personal cell phone, who manufactured it… ZTE is the No. 4 smartphone vendor in the United States, selling handset devices to U.S. mobile carriers AT&T Inc (T.N), T-Mobile US Inc (TMUS.O) and Sprint Corp (S.N).

Since 1995, the United States has provided North Korea with over $1.2 billion in assistance, of which about 60% has paid for food aid and about 40% for energy assistance. As of early March 2010, the United States is not providing any aid to North Korea, except for a small medical assistance program. The Obama Administration, along with the South Korean government, have said that they would be willing to provide large-scale aid if North Korea takes steps to irreversibly dismantle its nuclear program. The main vehicle for persuading Pyongyang to denuclearize is the Six-Party Talks, involving North Korea, the United States, China, South Korea, Japan, and Russia. The Talks have not met since late 2008.

North Korea did not militarily threaten the region until the Obama administration. Since, North Korea has taken exceptional steps in the realm of illicit activities, collusion, theft and shadow companies to finesse sanctions. China is essentially in the diplomatic field responsible for checks and balances on North Korea and once again is calling for a truce of sorts. This objective is not new and has failed each time.

Enter Japan, where the Prime Minister, Shinzo Abe who has been in contact with the White House is escalating responsive military actions against North Korea. This could lead to a much more hostile region. It seems that the recent missile launches coordinated with Iran are part of a mission to strike U.S. bases in the region. There are 3 of distinction, however the United States maintains additional joint locations.

Rattled by North Korean military advances, influential Japanese lawmakers are pushing harder for Japan to develop the ability to strike preemptively at the missile facilities of its nuclear-armed neighbor.

Japan has so far avoided taking the controversial and costly step of acquiring bombers or weapons such as cruise missiles with enough range to strike other countries, relying instead on its U.S. ally to take the fight to its enemies.

But the growing threat posed by Pyongyang, including Monday’s simultaneous launch of four rockets, is adding weight to an argument that aiming for the archer rather than his arrows is a more effective defense.

“If bombers attacked us or warships bombarded us, we would fire back. Striking a country lobbing missiles at us is no different,” said Itsunori Onodera, a former defense minister who heads a ruling Liberal Democratic Party committee looking at how Japan can defend against the North Korean missile threat. “Technology has advanced and the nature of conflict has changed.”

*** Meanwhile, as an indication of illicit activities and fraud, below is a sample.

China’s ZTE pleads guilty, settles with U.S. over Iran, North Korea sales

NEW YORK (Reuters) – Chinese telecom equipment maker ZTE Corp <000063.SZ> has agreed to pay $892 million and plead guilty to criminal charges for violating U.S. laws that restrict the sale of American-made technology to Iran and North Korea.

While a guilty plea deals a blow to ZTE’s reputation, the resolution could lift some uncertainty for a company that relies on U.S. suppliers for 25 percent to 30 percent of its components.

A five-year investigation found ZTE conspired to evade U.S. embargoes by buying U.S. components, incorporating them into ZTE equipment and illegally shipping them to Iran.

In addition, it was charged in connection with 283 shipments of telecommunications equipment to North Korea.

“ZTE Corporation not only violated export controls that keep sensitive American technology out of the hands of hostile regimes like Iran’s, they lied … about their illegal acts,” U.S. Attorney General Jeff Sessions said in a statement.

The investigation, spearheaded by the U.S. Department of Commerce, followed reports by Reuters in 2012 that ZTE had signed contracts to ship millions of dollars worth of hardware and software from some of the best-known U.S. technology companies to Iran’s largest telecoms carrier.

The Justice Department noted one Reuters article in its statement announcing the plea deal on Tuesday. The original report can be read here: http://www.reuters.com/article/us-iran-telecoms-idUSBRE82L0B820120322.

The company’s guilty pleas, which must be approved by a judge, will take place in U.S. District Court in Texas. The Shenzhen-based company has a U.S. subsidiary in Richardson, Texas.

In March 2016, ZTE was placed on a list of entities that U.S. firm could not supply without a license. ZTE acted contrary to U.S. national security or foreign policy interests, the Commerce Department said at the time.

ZTE purchases about $2.6 billion worth of components a year from U.S. technology companies, according to a company spokesman. Qualcomm (QCOM.O), Microsoft (MSFT.O) and Intel (INTC.O) are among its suppliers.

Items shipped in violation of U.S. export laws included routers, microprocessors and servers controlled under export regulations.

Authorities said executives at ZTE approved the scheme to prevent disclosure of the sales. The scheme included a data team that destroyed or sanitized materials involving ZTE’s Iran business after March 2012.

“Despite ZTE’s repeated attempts to thwart the investigation, the dogged determination of investigators uncovered damning evidence,” said Douglas Hassebrock, director of the Commerce Department office that led the investigation.

Last year, Commerce released internal documents showing senior ZTE executives instructing the company to carry out a project for dodging export controls in Iran, North Korea, Syria, Sudan and Cuba.

The company on Tuesday agreed to a seven-year suspended denial of export privileges, which could be activated if there are further violations. A denial order would bar the receipt of U.S. origin goods and technology.

The denial order is key to keeping ZTE in line, said Eric Hirschhorn, former Under Secretary at the Commerce Department, who was involved in the investigation.

“If the suspension is removed, they’ll probably be put out of business,” he said.

ZTE also agreed to three years of probation, a compliance and ethics program, and a corporate monitor.

The settlement includes a $661 million penalty to Commerce; $430 million in combined criminal fines and forfeiture; and $101 million paid to the Treasury’s Office of Foreign Assets Control (OFAC). The action marks OFAC’s largest-ever settlement with a non-financial entity.

ZTE also agreed to an additional penalty of $300 million to the U.S. Commerce Department that will be suspended during a seven-year term on the condition the company complies with requirements in the agreement.

In addition to being one of the world’s biggest telecommunications gear makers, ZTE is the No. 4 smartphone vendor in the United States, selling handset devices to U.S. mobile carriers AT&T Inc (T.N), T-Mobile US Inc (TMUS.O) and Sprint Corp (S.N).

WikiLeaks Releases CIA Cyber Docs, Problem?

Posted on March 7, 2017March 7, 2017 by Denise Simon

Primer: Steve Bannon works for President Trump in the White House.

Steve Bannon is a star – for Al-Qaeda, that featured him on the cover of their newspaper

Then this headline….

The new scandal headlines for today is WikiLeaks, telling us they published the largest cache of secret CIA documents relating to the CIA’s ability to hack, break encryption and install malware. This is a problem? The problem is not the tools the CIA has, the problem is that someone inside the agency stole them and delivered them to WikiLeaks.

It is a good thing that the agency has these resources, why you ask?

Well….try this…The threat is real from Russians, Chinese, North Korea, Iran, Syria, Ukraine, al Qaeda and Islamic State…

Remember Stuxnet? This was a successful joint program under the Bush presidency with Israel to infect the Iranian nuclear program and it was to forces the centrifuges to spin out of control, which they did. Ultimately, it caused the progress of the Iranian infrastructure to be delayed substantially. It was in fact later uncovered by cyber scientists working for Siemens, the hardware and software platform used as the operating system. Good right? Yes.

Well, there is more…

In recent years, Iran and North Korea have been sharing nuclear scientists and engineers, parts, testing and missile collaboration. So far, the missiles launched by North Korea for the most part have been unsuccessful, or at least did not achieve the ultimate objective and that is an official target strike. Why? Because of the United States. How so you ask?

Over the weekend, North Korea fired off 4 missiles in succession toward Japan. They did not reach the mainland but did reach the waterway that is part of the Japanese economic zone for maritime operations. We have American cyberwarriors that are doing effective work causing the missiles to fly off course or to technically fail. The objective is to use non-explosive weaponry to foul the North Korea and hence Iran’s missile program and while North Korea is not especially connected to the internet, some related systems are connected and then there is electronic warfare.

We know that Islamic State is a terror operation that has militant cells in an estimated 30 countries. While they have depraved methods of murder, rape and terror, they too have a cyber operation.

The Will to Act

One question is whether ISIS will be consumed with the protection and continued expansion of its immediate fighting fronts, i.e., the “near enemy,” or whether its scope of vision includes America’s homeland. The Economist advances a strong case that desire for such expansion not only exists but will be exercised: “With its ideological ferocity, platoons of Western passport holders, hatred of America and determination to become the leader of global jihadism, ISIS will surely turn, sooner or later, to the ‘far enemy’ of America and Europe.”

And perhaps any doubt the militant’s sights are on America was removed by ISIS leader Abu Bakr al-Baghdadi’s Sept. 22 call for jihadists to not wait for the order but to rise, take up arms, and “kill Americans and other infidels” wherever they are. Clearly the group is showing no hesitancy in its desire to strike the U.S. heartland on a personal scale.

Cyber Operations Capability?

As to whether ISIS will have the capability to mount cyber operations against the U.S., David DeWalt, head of cybersecurity firm FireEye, believes that ISIS will follow in the footsteps of the Syrian Electronic Army and the Iran-based Ajax Security Team to target the United States and other Western nations.

“We’ve begun to see signs that rebel terrorist organizations are attempting to gain access to cyber weaponry,” DeWalt stated recently. He added that booming underground markets dealing in malicious software make offensive cyber weapons just an “Internet transaction” away for groups such as ISIS. More here.

Is there more to this that we should know? Yes…

There is the Middle East and we have a major vested interest in the region.

***

Cybersecurity in the Gulf: The Middle East’s Virtual Frontline

Cybersecurity is often discussed in relation to the major global powers: China’s economic espionage, Russian influence operations, and U.S. dragnet global surveillance to thwart terrorism.

However, as other countries move to digitize their economies, cybercriminals are zeroing in on these new and lucrative targets while regional players are quickly incorporating cyber capabilities into their own arsenals for achieving strategic ends.

The Middle East, particularly the Gulf states, are quickly recognizing the urgent need for better cybersecurity, while regional adversaries such as Iran have begun weaponizing code as an extension of broader strategic goals within the region. What, though, is the Gulf’s current cybersecurity atmosphere, and how does Iran’s emerging use of offensive cyber capabilities fit into its broader strategy in the Middle East?

Wajdi Al Quliti, the Director of Information Technology at the Organization of Islamic Cooperation, notes that “the region’s dramatic strides towards digitization—expected to add over $800 billion to GDP and over 4 million jobs by 2020—is making the Gulf a major target for fast evolving cyber threats.” Much like other regions, the Gulf is finding it difficult to sufficiently create criminal deterrence due to segmented laws and difficulties in attribution. Al Quliti argues “cross-border cooperation and common cybersecurity structures could prove to be a game-changing advantage in the fight against cybercrime.” However, “the elephant in the room,” according to Al Quliti, “is the issue of state-sponsored hacking, in which case harmonized laws are unlikely to make a difference.”

A critical point in nation-state hacking in the Middle East begins with the Stuxnet worm. Discovered in 2010 burrowed deep in Iranian networks, the worm had slowly been sabotaging Iran’s nuclear ambitions. Then in 2011 CrySyS Lab discovered Duqu, a cyber espionage tool tailored to gather information from industrial control systems, and in 2012, Kaspersky Labs identified Flame, another espionage tool, targeting various organizations in the Middle East. Both Duqu and Flame are associated with Stuxnet and attributed back to the Equation Group, widely considered an arm of the National Security Agency.

In 2012, Iranian officials found a wiper virus erasing files in the network of the Oil Ministry headquarters in Tehran, leading the ministry to disconnect all oil terminals from the Internet to prevent the virus from spreading. It is uncertain who was behind the attacks, but a mere four months later, Saudi Arabia’s largest oil company, Saudi Aramco, was hit with a similar wiper virus known as Disttrack—possibly coopted from the previous attack on Iran’s oil industry.

The data-erasing malware sabotaged three-quarters, some 35,000 of the company’s computers while branding screens with an image of a burning American flag. A few months later, another wiper virus attacked Qatar’s RasGas.

Al Quliti identifies “the region’s heavy dependence on oil and gas—as well as the oil and gas-powered desalination plants that provide much of the region’s fresh water”—as “a source of cyber vulnerability,” adding that “any cyber attack on these installations could prove catastrophic and might result in a humanitarian disaster.”

The sabotage operations against the Gulf’s oil industry have been attributed by various cybersecurity firms—but not officially by any government—to a group called Shamoon, thought to be an arm of the Iranian government.

Michael Eisenstadt, the Director of the Military and Security Studies Program at the Washington Institute for Near East Policy, notes that “cyber allows Iran to strike at adversaries globally, instantaneously, and on a sustained basis, and to potentially achieve strategic effects in ways it cannot in the physical domain.” For example, in March 2016, the Justice Department indicted seven Iranian Revolutionary Guard members for distributed denial of service attacks against U.S. banks in 2012 in retaliation for Iran sanctions imposed the previous year, as well as for infiltrating the systems of a small New York dam in 2013—a possible testing ground for penetrating larger pieces of U.S. critical infrastructure. In 2014, the same year North Korea set its sights on Sony Pictures, Iran’s cyber capabilities again reached into the United States, using another wiper virus to sabotage the operations of the Las Vegas Sands casino, whose chief executive, a staunch supporter of Israel, had suggested detonating a nuclear bomb in the heart of Tehran.

Last November, right before a major OPEC meeting, a variation of the Disttrack wiper used against Saudi Aramco struck again, now fitted with a picture of Alan Kurdi, the drowned Syrian toddler who washed up in Turkey in 2015. The virus targeted six Saudi organizations, most notably the Saudi General Authority of Civil Aviation, delivering its payload at the close of business on a Thursday, the start of the Islamic weekend, for maximum impact. Some experts speculate the November attack could have also been a false-flag operation to derail the Iranian nuclear deal.

Interestingly, for both the 2012 and 2016 Shamoon attacks, the wiper came fitted with stolen login credentials that Symantec now believes could have been gleaned from a cyber espionage tool, known as Greenbug, found on one of the administrator computers of a Saudi organization targeted in November. The potential link between Greenbug and the Shamoon group opens up possible investigations into the group’s involvement in a host of other Greenbug attacks throughout the Middle East, including breaches in Saudi Arabia, Bahrain, Iraq, Qatar, Kuwait, Turkey, and even Iran—though likely for domestic surveillance on dissidents. Just last week, another wiper virus hit 15 Saudi organizations, including the Ministry of Labor, prompting the government to issue an urgent warning of pending Shamoon attacks.

Eisenstadt points out that “Iran’s cyber activities show that a third-tier cyber power can carry out significant nuisance and cost-imposing attacks,” and “its network reconnaissance activities seem to indicate that it is developing contingency plans to attack its enemies’ critical infrastructure.” According to Eisentadt, is now seems that “in the past decade, Iran’s cyber toolkit has evolved from a low-tech means of lashing out at its enemies by defacing websites and conducting DDoS attacks, to a central pillar of its national security concept.”

Beginning to understand why the CIA and the other agencies are building cyber command war-rooms?

U.S. Military Footprint in Syria Expands

Posted on March 6, 2017March 6, 2017 by Denise Simon

The hunt for ISIS leader Abu Bakr al-Baghdadi also continues in earnest. Raqqa is now surrounded by Kurdish and Free Syrian forces and Mosul is crumbling, a military official told ABC News, promising al-Baghdadi’s death at the hands of the U.S.-led coalition is “just a matter of time.”

In Syria, coalition military forces conducted eight strikes consisting of 11 engagements against ISIS targets:

— Near Abu Kamal, two strikes destroyed a wellhead and an oil inlet manifold.

— Near Raqqa, two strikes engaged an ISIS tactical unit, destroyed two vehicles, and suppressed an ISIS tactical unit.

— Near Dayr Az Zawr, two strikes destroyed four tactical vehicles, four ISIS-held buildings, two wellheads, two engineering equipment pieces and a tank.

— Near Manbij, two strikes destroyed a vehicle and an artillery system.

All strikes are conducted by fighter, attack, bomber, rotary-wing or remotely piloted aircraft; rocket-propelled artillery; and some ground-based tactical artillery when fired on planned targets, officials noted.

U.S. Special Forces have been on the move in northern Syria, deploying near the city of Manbij over the weekend to act as a buffer between American-backed Syrian militias and forces controlled by Turkey. Photos have emerged of U.S. Stryker vehicles configured for the U.S. Army’s 75th Ranger Regiment and specialized Humvees used by Special Forces moving near the city, and U.S. officials confirmed that the American presence around the city had been beefed up. The Ankara-backed Free Syrian Army militia — bolstered by Turkish special forces — moved on Manbij last week, as Turkish officials said they wanted to clear the Kurdish YPG out of the area. Local Syrian forces and the U.S. military deny that the Kurdish forces are near the city.

On a recent trip to northern Syria, FP’s Paul McLeary spent time with both U.S. Special Forces and their local allies near the city, and found the Syrians clearly worried about the Turkish threat. The view from Baghdad. Speaking with FP on Monday, spokesman for the U.S. military command in Baghdad Col. John Dorrian said the American troop presence in Syria and Iraq hasn’t grown, despite the movement of more U.S. troops to Manbij. “There are adequate forces in the area” to handle the situation and “reassure our allies and our partners,” he said. The Manbij Military Council has also said that it turned back a Russian convoy of armored vehicles and troops that tried to enter the area, but Dorrian said he hasn’t seen any increase in Russian troops or aircraft around the city.
“Until now, U.S. military commanders have ruled out anything beyond some artillery support and an advisory role for U.S. special operations forces. But some officials and administration advisors are open to at least considering the idea of using conventional forces in a full-fledged combat role.”

US SOF base at cement plant between Manbij, Raqqa.

A Syrian MiG-23 crashed in Turkey and the pilot is now claiming he was shot down. Reuters reports that the pilot, who was rescued by Turkish authorities, says he was downed while flying over Idlib. The Islamist rebel group Ahrar al-Sham has claimed responsibility for downing the aircraft although the assertion has yet to be independently verified. The rescue by Turkey marks yet another sign of the turnaround in relations between Ankara, the Assad regime, and its supporters. In November 2015, a Turkish F-16 shot down a Russian Su-24 carrying out operations over Syria after it violated Turkish airspace, leading to a lengthy and bitter dispute between Turkey and Russia.

***

On Sunday, Syrian forces pushed ahead with their military campaign against the Takfiri Jabhat Fatah al-Sham group, formerly known as al-Nusra Front, in the Dar’a al-Balad neighborhood of the southwestern city of Dara’a, managing to retake several blocks of buildings, Syria’s official news agency, SANA, reported.

Large groups of the militants were killed in the areas of al-Masri, al-Karak and al-Arba’een.

Separately, the Syrian government forces targeted Daesh (ISIL or ISIS) positions on the southern outskirts of al-Qassr village in the northeastern countryside of Sweida province, leaving dozens of the terrorists dead and injured.

Additionally, the Daesh militants suffered serious setbacks in the western city of Deir ez-Zor after the army and its allies shelled their positions in the areas of al-Bogheiliyeh, Hatla, al-Sannof, al-Rwad, al-Sinaa and al-Rushdiye in the province.

Syria has been gripped by civil war since March 2011 with various terrorist groups, including Daesh, currently controlling parts of it.

North Korea fires four ballistic missiles

Posted on March 6, 2017March 6, 2017 by Denise Simon

The Asahi Shimbun

SEOUL, March 6 (Yonhap) — North Korea on Monday fired four ballistic missiles into the East Sea, Seoul’s Joint Chiefs of Staff said, in an apparent reaction to the ongoing joint military drills between South Korea and the United States.

The four projectiles were launched from an area near the North’s Dongchang-ri long-range missile site at 7:36 a.m. and flew about 1,000 kilometers before splashing into the East Sea, JCS said in a text message.

“We estimate the North fired four ballistic missiles. We are conducting an analysis (with the U.S.) on the missiles to determine their type and other specifications. It will take a while before we can come up with a final analysis (based on U.S. satellite data),” the JCS said.

South Korean and U.S. troops here will stay on high alert to counter any provocations by the North, the defense ministry said.

Acting President and Prime Minister Hwang Kyo-ahn convened a National Security Council meeting after the missile launches.

Military officials raised the possibility that the projectiles could be intercontinental ballistic missiles (ICBMs) capable of reaching the west of the U.S. mainland if launched at a high angle.

In this photo taken on March 6, 2017, two men watch a news report on North Korea’s firing of ballistic missiles into the East Sea early Monday morning. (Yonhap)

But experts say the projectiles could be short-range Scud with a range of 500-700 km or mid-range Rodong missiles with a range of 1,300-1500 km given the number of missiles.

“If North Korea test-fired a new long-range missile, it was not an ICBM as it’s not capable of launching multiple ones at the same time,” said Kim Dong-yub, an analyst at the Institute for Far Eastern Studies in Kyungnam University.

An ICBM with a range of more than 6,000 km could fly far less than 6,000 km if launched at a high angle. But as the long-range missile is still being developed and has yet to be deployed, the North could not have fired several missiles, he said.

The North test-fired a long-range ballistic missile at the Dongchang-ri or “Sohae” missile launch site in February last year. It launched seven ballistic missiles, including three Musudan intermediate-range missiles, during the Foal Eagle drills last year.

Japanese Chief Cabinet Secretary Yoshihide Suga reportedly said three out of four missiles fired by the North fell into Japan’s exclusive economic zone (EEZ), some 250 km west of Akita Prefecture.

The latest provocation comes a day after the U.S. said it may consider redeploying a tactical nuclear weapon to South Korea as a deterrent against growing nuclear and missile threats posed by the rogue regime.

On Friday, Pyongyang threatened to conduct more missile firings in response to the two-month-long Foal Eagle exercise between Seoul and Washington, which lasts through April.

The Rodong Sinmun, the ruling party’s official newspaper, said in a commentary that “new types of strategic weapons will soar” if Seoul and Washington continue their annual war drills, which the North claims to be a preparation for a war against it.

The communist state has staged a series of missile tests with increasing range, with the aim of eventually building long-range nuclear missiles capable of striking the U.S. mainland.

In its latest provocations, Pyongyang launched an intermediate-range ballistic missile into the East Sea on Feb. 12 to boast its military readiness and test the response from the new Donald Trump administration.

It was the first test-firing of a North Korean missile since Trump became U.S. president on Jan. 20. and the country’s first major provocation in 2017.

***

How worrisome is this North Korea missile program? It is in fact worrisome while U.S. cyber interference may have had a real impact on the effectiveness of the missile launch successes which are coordinated with Iran.

American cyberwarriors are trying to sabotage North Korea’s missile program — but analysts argue over whether the effort has had real results, a New York Times investigation found.

Soon after ex-President Obama ordered the secret program three years ago, North Korean missiles began exploding, veering off course or crashing into the sea, the newspaper said Saturday.

By most accounts, the North Korean missile failures were caused by US sabotage, the Times says. But it’s also likely many of the missile failures resulted from North Korean incompetence.

North Korean dictator Kim Jong-un may have been rattled by the US cyber effort. Last fall, he was widely reported to have ordered an investigation into whether the US was sabotaging his country’s missiles.

Kim has said his country is in the final stage or preparations of launching an intercontinental missile that could reach much of the world. It might be a bluff — or it might not.

Obama reportedly ordered the cyber sabotage in early 2014 after deciding that 60 years of US efforts to figure out how to shoot down incoming missiles had not yielded a system that would reliably defend against a missile attack.

Obama’s effort is now left to President Trump and his administration. According to a senior administration official, the White House is looking at pre-emptive military strike options, the Times said.

It’s also possible the US will move tactical nuclear weapons to South Korea. The weapons were withdrawn about 25 years ago.

Terrorists in U.S. Several Years Before Being Radicalized, then Canada

Posted on March 3, 2017March 3, 2017 by Denise Simon

The Homeland Security report is based on unclassified information from Justice Department press releases on terrorism-related convictions and attackers killed in the act, State Department visa statistics, the 2016 Worldwide Threat Assessment from the U.S. intelligence community and the State Department Country Reports on Terrorism 2015.

The three-page report challenges Trump’s core claims. It said that of 82 people the government determined were inspired by a foreign terrorist group to carry out or try to carry out an attack in the United States, just over half were U.S. citizens born in the United States. The others were from 26 countries, led by Pakistan, Somalia, Bangladesh, Cuba, Ethiopia, Iraq and Uzbekistan. Of these, only Somalia and Iraq were among the seven nations included in the ban.

Of the other five nations, one person each from Iran, Sudan and Yemen was also involved in those terrorism cases, but none from Syria. It did not say if any were Libyan.

The report also found that terrorist organizations in Iran, Libya, Somalia and Sudan are regionally focused, while groups in Iraq, Syria and Yemen do pose a threat to the U.S.

The seven countries were included in a law President Barack Obama signed in 2015 that updated visa requirements for foreigners who had traveled to those countries. More here from Associated Press.

Then we have the gullible Prime Minister of Canada, Justin Trudeau who has invited Middle Eastern migrants, asylees and refugees in a welcome to Canada. Yet the intelligence and security authorities in Canada have a different position.

Terrorism

The principal terrorist threat to Canada remains that posed by violent extremists who could be inspired to carry out an attack in Canada. Violent extremist ideologies espoused by terrorist groups like Daesh and Al Qaeda (AQ) continue to appeal to certain individuals in Canada.

Long description of infographic: Terrorism timeline

Terrorism Timeline

As of December 31, 2016

October 20, 2014
CAF member killed in a ramming attack in Saint-Jean-Sur-Richelieu

October 22, 2014
CAF member fatally shot at the Canadian War Memorial in Ottawa

January 14, 2016
Canadian killed in an attack on a Starbucks in Jakarta, Indonesia

January 16, 2016
6 Canadians killed during an attack on their hotel in Burkina Faso

March 14, 2016
2 CAF members stabbed at a CAF recruiting centre in Toronto

April 25, 2016
Canadian beheaded by the Abu Sayyaf group in the Philippines

June 12, 2016
Canadian beheaded by the Abu Sayyaf group in the Philippines

June 25, 2016
Canadian killed in an attack on the Somali parliament, Somalia

December 18, 2016
Canadian killed in an attack in Karak, Jordan

The principal terrorist threat to Canada remains that posed by violent extremists who could be inspired to carry out an attack in Canada. Violent extremist ideologies espoused by terrorist groups like Daesh and Al Qaeda (AQ) continue to appeal to certain individuals in Canada.

As in recent years, the Government of Canada has continued to monitor and respond to the threat of extremist travellers, that is, individuals who are suspected of travelling abroad to engage in terrorism-related activity. The phenomenon of extremist travellers—including those abroad, those who return, and even those prevented from travelling—poses a range of security concerns for Canada. As of the end of 2016, the Government was aware of approximately 180 individuals with a nexus to Canada who were abroad and who were suspected of engaging in terrorism-related activities. The Government was also aware of a further 60 extremist travellers who had returned to Canada.

The threat environment has also evolved beyond Canada’s borders. Daesh has continued to dominate the landscape in the Middle East, where other terrorist groups such as Jabhat al-Nusra and Hizballah also operate. Elsewhere in the Middle East, Al Qaeda in the Arabian Peninsula (AQAP) has taken advantage of the civil conflict in Yemen to capture territory there and strengthen itself. In addition, 2016 saw Daesh’s expansion in Africa, and Boko Haram (now rebranded as a Daesh affiliate in West Africa) continues to pose a major threat to regional stability. In South and Southeast Asia, Daesh expansionism and entrenched regional groups shaped the threat environment.

Canadians and Canadian interests are also affected. Canadian Armed Forces (CAF) personnel, government officials and private citizens are under constant threat in certain regions. In September 2015, two Canadians were kidnapped in the Philippines. Both were killed by their captors in the spring of 2016. In January 2016, an AQ-affiliated group based in Mali attacked a hotel in Burkina Faso, killing six Canadians. That same month, attackers linked to Daesh targeted a coffee shop in Jakarta, Indonesia, killing one Canadian. In June 2016, a Somali government minister with Canadian citizenship was killed in an Al-Shabaab terrorist attack on a hotel in Mogadishu, Somalia. Also in June, 15 Nepalese security guards who protected the Embassy of Canada to Afghanistan in Kabul were killed when terrorists targeted the bus that was transporting them to work.

International Cooperation

The international security environment continues to result in increased threats to Canada and its interests, both domestically and abroad. Ongoing conflicts in several regions of Africa, the Middle East, Asia, Eastern Europe and elsewhere show no signs of abating and continue to have serious national and international security implications. Worldwide incidents of terrorism, espionage, weapons proliferation, illegal migration, cyber-attacks and other acts targeting Canadians—directly or indirectly—remain ever present. Since the bulk of such threats originate from (or have a nexus to) regions beyond Canada’s borders, CSIS needs to be prepared and equipped to investigate the threat anywhere.

Additionally, certain security threats continue to evolve. Over the past several years, the globalization of terrorism, fueled by elaborate online propaganda videos by extremist groups, has expanded the breadth of radicalization. In some instances, individuals influenced by extremist ideology and driven by a need to feed their sense of belonging have travelled (or attempted to travel) abroad to participate in terrorist activity. Others may continue to support their extremist ideology through training, fundraising, recruitment and attack planning within Canada. As the threat posed by ‘foreign fighters’ is international in scope, a global reach is an absolute necessity in efforts to track and thwart threats to Canada and its allies posed by such individuals.

Furthermore, while the international focus has been on countering terrorism, espionage threats remain ever present and have become far more complex due to continuing advancements in technology and the globalization of communications. On the cyber front, foreign governments and hackers continue to exploit the Internet and other means to target critical infrastructure and information systems of other countries.

Such threats cannot be countered in isolation, and CSIS must remain adaptable in order to keep abreast of developments in both the domestic and international spheres. Despite differences in mandate, structure or vision, security intelligence agencies around the globe are all faced with very similar priorities and challenges. To meet the Government of Canada’s priority intelligence requirements, CSIS maintains a well-established network of relationships with foreign agencies. In accordance with s.17(1)(b) of the CSIS Act, all such arrangements are authorized by the Minister of Public Safety and supported by the Minister of Foreign Affairs. These arrangements provide CSIS access to timely information linked to a number of threats and allow the Service (and, in turn, the Government of Canada) to obtain information which might otherwise not be available.

As of March 31, 2016, CSIS had established over 300 foreign arrangements in some 150 countries. Of those, 69 remain defined as ‘Dormant’ (due to a lack of need for engagement or exchanges for a period of one year or more), while nine remained defined as ‘Restricted’ due to concerns over the affected agencies’ respect for human rights or its reliability. The human rights reputations of foreign agencies with which CSIS engages is not something which the Service takes lightly. In order to mitigate potential risks of sharing information, CSIS regularly assesses its foreign relationships and reviews various government and non-government human rights reports for all countries with which the Service has implemented ministerially approved arrangements, always cognizant of the fact that our first responsibility is to the Canadian people and their safety. CSIS opposes in the strongest possible terms the mistreatment of any individual by a foreign agency. The Service must and does comply with Canada’s laws and legal obligations in sharing information with foreign entities, and expects the same from its foreign counterparts.

Terrorist Group Profiles

Abu Sayyaf Group

Al Qaeda

Al Qaeda in the Arabian Peninsula

Al Qaeda in the Islamic Maghreb

Al-Shabaab

Jabhat Al-Nusra

Daesh

Boko Haram

Hizballah

The Cyber Threat

Cyber threats from hostile actors continue to evolve. State-sponsored entities and terrorists alike are using Computer Network Operations (CNO) directed against Canadian interests, both domestically and abroad. Canada remains both a target for malicious cyber activities, and a platform from which these hostile actors conduct CNO against entities in other countries.

Long description of infographic: Canadian sectors at risk

The Cyber Threat

Energy and utilities

Information and communication technology

Finance

Health

Food

Water

Transportation

Safety

Government

Manufacturing

These state-sponsored and terrorist CNO actors are increasing in number, capability and aggression, and have access to a growing range of tools and techniques that they can employ to accomplish their mission. As these tools and techniques evolve and become more complex, so too do the challenges of detecting and attributing CNO.

Moreover, despite the fact that they originate in the virtual realm, the consequences of CNO can be very real. For example, in December 2015, a cyber-attack conducted against three Ukrainian power companies resulted in a power outage that left hundreds of thousands of people in the dark. The type of systems the actors exploited in this attack is used by energy companies worldwide. Should such destructive cyber-operations be targeted against similar systems in Canada, they could potentially affect any and all areas of its critical infrastructure.

Unfortunately, CNOs are not uncommon and agencies at all levels of government in Canada have faced this threat. The Government of Canada witnesses serious attempts to penetrate its networks on a daily basis.

CSIS is also aware of state-sponsored cyber-espionage and influence activities targeting the private sector in Canada and abroad. The targets of these attacks often fall within Canada’s advanced technology sector and throughout the critical infrastructure spectrum. Universities engaged in advanced research and development have also been subjected to CNO. In addition to stealing intellectual property, one of the objectives of state-sponsored CNO is to obtain information which will give their own companies a competitive edge over Canadian firms. This could impact investment or acquisition negotiations involving Canadian companies and the Government of Canada, and, in turn, lead to lost jobs, revenue, and market share. Ultimately, cyber-espionage negatively impacts Canada’s economy as a whole.

In responding to these threats, CSIS relies on specialized collection techniques to report on state-sponsored cyber-espionage or cyber-terrorism activity. For instance, by analyzing networks or malware behind CNOs, the Service can uncover clues that help identify the origins of the cyber-attacks (known as “attribution”).

The Service also maintains relationships with domestic and foreign agencies to provide the Government of Canada with the most up-to-date intelligence regarding the cyber threats facing Canada and who is behind them.

Security Screening program

The CSIS Security Screening program represents one of the most visible of the Service’s operational sectors. It helps defend Canada and Canadians from threats to national security emanating from terrorism and extremism, espionage, and the proliferation of weapons of mass destruction. Security screening prevents persons who pose these threats from entering or obtaining status in Canada, or from obtaining access to sensitive sites, government assets or information. In addition, through its government screening program, CSIS assists the RCMP with the accreditation process for Canadians and foreign nationals seeking access to or participating in major events in Canada.

Note: Figures have been rounded
**Individuals claiming refugee status in Canada or at ports of entry

Long description of infographic: Statistics from the security screening program

Statistics from the security screening program

Immigration and Citizenship Screening Programs

Requests received* 2014-2015 2015-2016

Permanent resident applications 33,900 56,500

Refugees (front-end screening)** 10,200 13,500

Citizenship applications 185,600 124,000

Temporary resident applications 46,600 56,700

Total 276,300 250,700

*Note: Figures have been rounded
** Individuals claiming refugee status in Canada or at ports of entry

Government Screening Programs

Requests received* 2014-2015 2015-2016

Federal government departments 53,700 51,200

Site access

Free and Secure Trade (FAST) 10,700 21,400

Transport Canada (Marine and Airport) 40,400 43,700

Parliamentary precinct 1,200 4,300

Nuclear facilities 8,700 12,700

Provinces 210 220

Others 3,400 4,600

Foreign screening 610 580

Special events accreditation 35,600 87,400

Total 154,520 226,100

* Figures have been rounded

Long description of infographic: Statistics for the 2015 Pan Am Games

Statistics for the 2015 Pan Am Games

In fiscal years 2014-2015 and 2015-2016, CSIS completed 119,000 requests for the accreditation of applicants to the Toronto 2015 Pan Am/Parapan Am Games.

Read more about the CSIS Security Screening program

The CSIS Security Screening program also played a key role in achieving the Government of Canada’s goal to resettle 25,000 refugees from Syria by February 29, 2016. Between November 2015 and February 2016, CSIS conducted screening investigations on the applicants selected for resettlement in Canada. CSIS continues to work closely with the Canada Border Services Agency (CBSA) and Immigration, Refugees, and Citizenship Canada (IRCC) to provide timely security advice regarding permanent resident applicants who could represent a threat to Canada’s national security, while ensuring legitimate refugees are screened and resettled in a timely manner.

A Unique Workplace

The people of CSIS are committed to ensuring a Service that is nimble, flexible and innovative, and takes responsible risks in the delivery of its mandate and in the pursuit of its strategic outcome.

As of March 31, 2016

Long description of infographic: Statistics related to CSIS’ workforce and awards received

A Unique Workplace

Service population

3,200+ employees

women 48%

men 52%

Employment equity

member of visible minorities 15%

women 48%

aboriginal peoples 2%

persons with disabilities 4%

Language

foreign language 18%

unilingual 32%

bilingual 69%

Awards and recognition

Canada’s top 100 employers – 8^th consecutive year

National Capital Region’s top employers – 9^th consecutive year

Canada’s top employers for young people – 1^st year

Recruiting

Recruiting the right talent to deliver on our mandate remains a key priority for the Service and the CSIS recruiting website, csiscareers.ca represents the cornerstone of our efforts. During 2014-2016, there were over 2 million hits to the site resulting in close to 90,000 applications being submitted.

Long description of infographic: Statistics from the CSIS recruiting site

Statistics from the CSIS recruiting site

Hits to csiscareers.ca

Hits to website Applications received

2014-2015 1,116,335 44,598

2015-2016 916,379 45,166

CSIS. smart career choice visit our website

The Service prioritizes a diverse workforce which allows us to better understand the demographics of the Canadian communities we protect, therefore better equipping us to collect relevant and accurate intelligence. Our recruiting team includes a diversity recruiter who liaises with a variety of community leaders across the country, and attends diversity job fairs and networking events in an effort to attract applicants from designated groups such as visible minorities, Aboriginal peoples and persons with disabilities.

In addition, a partnership has been established with Public Safety, the Royal Canadian Mounted Police (RCMP), Canada Border Services Agency (CBSA), Correctional Service Canada (CSC), Communication Security Establishment (CSE) and Department of National Defence to share best recruiting practices and hold joint initiatives.

Academic Outreach

The Academic Outreach (AO) program at CSIS seeks to promote conversations with experts from a variety of disciplines and cultural backgrounds working in universities, think tanks and other research institutions in Canada and abroad.

Long description of infographic: Academic Outreach statistics

Academic Outreach statistics

Academic Outreach statistics

2014-2015 2015-2016

Expert briefings 46 38

Visiting experts 101 110

Workshops and seminars 12 17

Conferences 2 1

Publications 2 3

Long description of infographic: Publications from Academic Outreach

Publications from Academic Outreach

Academic Outreach publications 2014–2016

Political Stability in West and North Africa – Highlights from the Conference

Pitfalls and Promises: Security Implications of a Post-revolutionary Middle East – Highlights from the Conference

Russia and the West: The Consequences of Renewed Rivalry – Highlights from the Workshop

Brittle Might? Testing China’s Success – Highlights from the Conference

Foreign Fighters Phenomenon and Related Security Trends in the Middle East – Highlights from the Workshop

In 2014-2015, AO hosted a conference that brought together multi-disciplinary experts from several countries. The conference was entitled “A Brave New World: Exploring the Evolving Nature of Cyber-conflict” and examined cyber threats facing Canada and its Western allies, our adversaries and their intent, as well as countermeasures that could help mitigate the proliferation of cyber conflict. In 2015-2016, we hosted another conference, “Brittle Might? Testing China’s Success”, which explored the challenges facing modern China, assessed the strengths and weaknesses of the country’s leadership, examined Beijing’s involvement in global affairs and debated China’s trajectory in the coming years.

The international conferences, however, represent only one component of the AO program. We also hosted a number of in-depth briefings on other topics of interest. For instance, one reviewed the global banking sector’s experience at identifying money laundering and terrorist financing activity. Another expert explored the phenomenon of radicalization in Western countries, while another guest specialist assessed the capabilities of Shia militias operating in Iraq and Syria.

During the period of review, outside experts engaged CSIS staff on discussions covering a range of security and strategic issues, including Russia’s strategy towards the Arctic; the uses and limitations of ‘big data’ for intelligence analysis; Boko Haram’s campaign of violence in Nigeria; and the regional consequences of the conflict in Iraq and Syria on Lebanon.

Checks and Balances

The Security Intelligence Review Committee (SIRC) is an external independent review body that reports to Parliament on CSIS’ operations. It does so through its three core functions: certifying the CSIS Director’s annual report to the Minister of Public Safety, carrying out in-depth reviews of CSIS activities and conducting investigations into public complaints about CSIS. CSIS’ External Review and Liaison Unit (ER&L) manages the Service’s relationship with SIRC, ensuring that it receives all of the necessary information required to fulfil its mandate.

Long description of infographic: SIRC reviews and complaints 2014-2015 and 2015-2016

SIRC reviews and complaints 2014-2015 and 2015-2016

Reviews

N⁰ of SIRC reviews

2014-2015: 8

2015-2016: 10

Average n⁰ of documents per review

5,000 short review

15,000 thematic review

Briefings by Service employees per review

5-10 briefings

Average duration of a review

3-6 months

Complaints

N⁰ of new complaints to SIRC

2014-2015: 11

2015-2016: 17

Average n⁰ of documents per complaint

100-1,000 simple cases

3,000-13,000 complex cases

Average n⁰ of service witnesses providing testimony to SIRC

3-5 witnesses

Each year, SIRC provides a research plan identifying the reviews it plans to undertake. For each review, ER&L works closely with SIRC to ensure it has the documents it needs and to arrange briefings by CSIS employees. ER&L manages the correspondence between SIRC and the Service during a review as well as the Service’s response to the resulting report. These reviews, reflected in SIRC’s Annual Public Report, provide comprehensive assurance to Parliament and the Canadian public about the Service’s exercise of its authorities.

ER&L is also the primary point of contact for all stakeholders on public complaints made to SIRC and ensures that SIRC’s legal counsel has the information required for complaint investigations. When an investigation involves a hearing, ER&L assists Department of Justice legal counsel in preparing the CSIS case, including preparation of submissions, exhibits and arranging witnesses to testify at hearings.

ER&L coordinates CSIS responses to SIRC on questions, requests, recommendations, and correspondence. While CSIS is not required to accept all SIRC recommendations, they are reviewed carefully and CSIS responds in writing and these responses are reflected in SIRC’s Annual Report. In ensuring continuity and transparency, ER&L tracks progress and reports to SIRC on CSIS’ implementation of actions recommended by SIRC.

CSIS Internal Audit Branch / Disclosure of Wrongdoing and Reprisal Protection

The Internal Audit (IA) Branch is led by the Chief Audit Executive (CAE), who reports to the CSIS Director and to the CSIS External Audit Committee (AC). The IA Branch is subject to the Treasury Board Policy on Internal Audit, the Internal Auditing Standards for the Government of Canada as well as the International Standards for the Professional Practice of Internal Auditing.

The CAE provides assurance services to the Director, Senior Management and the AC, as well as independent, objective advice and guidance on the Service’s risk management practices, control framework, and governance processes. The CAE is also the Senior Officer for Disclosure of Wrongdoing.

The AC examines CSIS’ performance in the areas of risk management, control and governance processes relating to both operational activities and administrative services. By maintaining high standards in relation to its review function in particular following-up on the implementation of management action plans derived from audit recommendations, the AC supports and enhances the independence of the audit function.

In the capacity of Senior Officer for Disclosure of Wrongdoing, the CAE is responsible for administering the Internal Disclosure of Wrongdoing and Reprisal Protection Policy. The Policy provides a confidential mechanism for employees to come forward if they believe that serious wrongdoing has taken place. It also provides protection against reprisal when employees come forward, and ensures a fair and objective process for those against whom allegations are made.

Access to Information and Privacy

The mandate of the Access to Information and Privacy (ATIP) Unit is to fulfill the Service’s obligations under the Access to Information Act and the Privacy Act. The Service’s Chief, ATIP is entrusted with the delegated authority from the Minister of Public Safety Canada to exercise and perform the duties of the Minister as head of the institution.

Long description of infographic: ATIP statistics

ATIP statistics

98+% on-time completion rate

Privacy Act requests

2014-2015: 486

2015-2016: 1,212

Access to Information Act requests

2014-2015: 366

2015-2016: 669

Informal requests

2014-2015: 298

2015-2016: 329

As the custodian of expertise related to the Service’s obligations under the Access to Information Act and the Privacy Act, the ATIP Unit processes all requests made under the relevant legislation and responds to informal requests for information. In doing so, the unit must balance the need for transparency and accountability in government institutions while ensuring the protection of the Service’s most sensitive information and assets.

Financial Resources

The Financial Resources table below provides a snapshot of CSIS expenditures over the last 6 years (from 2010-2011 to 2015-2016).

Long description of infographic: CSIS expenditures from 2010-2016