Category Archives: The Denise Simon Experience

Is this an Extension of Red Flag Law(s) by DHS?

Posted on by

JTN: The Department of Homeland Security has launched a $500,000 grant program for research and data collection on insider threats in the country’s law enforcement agencies.

A blue banner displaying the U.S. Department of Homeland Security seal with the text National Terrorism Advisory System - Bulletin - www.dhs.gov/advisories

The premise for the grant, “Insider Threats in American Law Enforcement,” is that the U.S. is facing a rising number of internal threats and an understanding of the changing environment is needed.

“Due to the growing number of threats our nation is combating,” the grant synopsis explains, the DHS Science and Technology Directorate “supports the evolving threat landscape of a dynamic world with changing motivations, actors, communication models and weaponry.”

The grant prioritizes data collection and technological innovation as means to identify, understand and combat the purported threat of penetration of U.S. law enforcement agencies by violent extremists.

“Objectives of this effort will identify high quality data to understand the risks posed to the United States by the potential for violent extremist organizations or lone actors to infiltrate law enforcement agencies (LEAs) and other government institutions,” the synopsis states.

While billing U.S. taxpayers $500K for this initiative to understand these clandestine “extremist organizations” infiltrating law enforcement, the grant neglects to define what it means by “extremist organizations.”

The research and data collected under the grant is to be shared with a variety of agencies, including private organizations. Yet civil rights and liberties will not be violated in the combined public-private harvesting and sharing of data about undefined “extremists,” DHS insists.

“Knowledge and findings from this research will be transferred to federal, state, local, and private organizations to enable education and awareness to reinforce a whole-of-society prevention architecture while respecting civil rights and civil liberties,” according to the grant description. “These prevention efforts will equip and empower local efforts — including peers, teachers, community leaders, and law enforcement — to minimize a threat as it evolves while enhancing emergency preparedness and response.”

The grant will task the awardee with understanding law enforcement threats from the perspectives of numerous fields, including including economics, psychology, politics and criminology. “The awardee(s) will assist with a range of activities,” the grant specifies, including designing data collection strategies, collecting data from primary and secondary sources, and analyzing data while identifying subject matter experts to participate in interviews and/or focus groups.”

Analyzing research from these various fields and experts will help fill in the gaps in understanding the threat environment and help “counter the threats posed by violent extremists and violent ideologies to United States LEAs and the public,”

The closing date for the grant applications is May 16, a day after the country concludes National Police Week. The week of May 9-May 15 has been designated as National Police Week since 1962 to recognize the service and sacrifice of federal, state and local law enforcement.

As reported by Just the News this week, the DHS and the Department of Defense have announced internal investigations of “extremism” within their departments, raising alarms among conservative civil liberties watchdogs, as the agencies’ notions of “extremism” were  vague and appeared to omit from scrutiny far-left extremist groups implicated in widespread political violence in 2020.

***

Date Issued:  Friday, May 14, 2021 02:00 pm ET
View as PDF:  National Terrorism Advisory System Bulletin – May 14, 2021 (pdf, 1 page, 359.67KB)

Summary of Terrorism Threat to the U.S. Homeland

 

The Secretary of Homeland Security has issued a new National Terrorism Advisory System (NTAS) Bulletin regarding the current heightened threat environment across the United States.  The Homeland is facing threats that have evolved significantly and become increasingly complex and volatile in 2021. These threats include those posed by domestic terrorists, individuals and groups engaged in grievance-based violence, and those inspired or influenced by foreign terrorists and other malign foreign influences.  Social media and online forums are increasingly exploited by these actors to influence and spread violent extremist narratives and activity.  Such threats also are exacerbated by the impacts from the ongoing global pandemic.

 

Duration

Issued:  May 14, 2021 02:00 pm
Expires:  August 13, 2021 02:00 pm

Additional Details

  • Violent extremists may seek to exploit the easing of COVID-19-related restrictions across the United States to conduct attacks against a broader range of targets after previous public capacity limits reduced opportunities for lethal attacks.
  • Historically, mass-casualty Domestic Violent Extremist (DVE) attacks linked to racially- or ethnically-motivated violent extremists (RMVEs) have targeted houses of worship and crowded commercial facilities or gatherings. Some RMVEs advocate via social media and online platforms for a race war and have stated that civil disorder provides opportunities to engage in violence in furtherance of ideological objectives.
  • Through 2020 and into 2021, government facilities and personnel have been common targets of DVEs, and opportunistic violent criminals are likely to exploit Constitutionally-protected freedom of speech activity linked to racial justice grievances and police use of force concerns, potentially targeting protestors perceived to be ideological opponents.
  • Ideologically-motivated violent extremists fueled by perceived grievances, false narratives, and conspiracy theories continue to share information online with the intent to incite violence. Online narratives across sites known to be frequented by individuals who hold violent extremist ideologies have called for violence against elected officials, political representatives, government facilities, law enforcement, religious or commercial facilities, and perceived ideologically-opposed individuals.
  • The use of encrypted messaging by lone offenders and small violent extremist cells may obscure operational indicators that provide specific warning of a pending act of violence.
  • Messaging from foreign terrorist organizations, including al-Qa‘ida and ISIS, intended to inspire U.S.-based homegrown violent extremists (HVEs) continues to amplify narratives related to exploiting protests. HVEs, who have typically conducted attacks against soft targets, mass gatherings, and law enforcement, remain a threat to the Homeland.
  • Nation-state adversaries have increased efforts to sow discord. For example, Russian, Chinese and Iranian government-linked media outlets have repeatedly amplified conspiracy theories concerning the origins of COVID-19 and effectiveness of vaccines; in some cases, amplifying calls for violence targeting persons of Asian descent.
  • DHS encourages law enforcement and homeland security partners to be alert to these developments and prepared for any effects to public safety. Consistent with applicable law, state, local, tribal, and territorial (SLTT) law enforcement organizations should maintain situational awareness of online and physical activities that may be related to an evolving threat of violence.

How We Are Responding

  • DHS and the Federal Bureau of Investigation (FBI) continue to provide guidance to SLTT partners about the current threat environment. Specifically, DHS has issued numerous intelligence assessments to SLTT officials on the evolving threat.
  • DHS is collaborating with industry partners to identify and respond to those individuals encouraging violence and attempting to radicalize others through spreading disinformation, conspiracy theories, and false narratives on social media and other online platforms.
  • DHS has prioritized combatting DVE threats within its FEMA grants as a National Priority Area.
  • DHS remains committed to identifying and preventing domestic terrorism.

How You Can Help

Be Prepared and Stay Informed

  • Be prepared for any emergency situations and remain aware of circumstances that may place your personal safety at risk.
  • Maintain digital media literacy to recognize and build resilience to false and harmful narratives.
  • Make note of your surroundings and the nearest security personnel.
  • Business owners should consider the safety and security of customers, employees, facilities, infrastructure, and cyber networks.
  • Government agencies will provide details about emerging threats as information is identified. The public is encouraged to listen to local authorities and public safety officials.

If You See Something, Say Something®. Report suspicious activity to local law enforcement or call 911.

 

Organized Crime in San Francisco Forces Retailers to Close

Posted on by

It all escalated with Prop 47…you remember that right? Going back to 2019, in part from the Federalist:

Rachel Michelin, who currently serves as President of the California Retailers Association, explained to Fox News the crude savviness of the latest generation of shoplifters. “[Shoplifters] know what they’re doing. They will bring in calculators and get all the way up to the $950 limit.” She continued. “One person will go into a store, fill up their backpack, come out, dump it out and go right back in and do it all over again.”

Retailers tried to work through the shoplifting with higher training for employees and more security systems and officers…due to the volume, the retailers just lost the battle. Residents in the area of San Francisco and actually around the state live in lawlessness….

No one is above the law unless it is the woke crowd and there is a value threshold….

*** Slide 1 of 3: Walgreens throughout Sam Francisco have been hit hard during the pandemic.

© Lea Suzuki/The Chronicle 2020// Mallory Moench is a San Francisco Chronicle staff writer

That changed in March when the Walgreens, ravaged by shoplifting, closed. Susoeff, 77, who sometimes uses a cane, now goes six blocks for medication and other necessities.

“It’s terrible,” he said. On his last visit before the store closed, even beef jerky was behind lock and key. A CVS nearby shuttered in 2019, with similar reports of rampant shoplifting.

“I don’t blame them for closing,” Susoeff said.

Last year, burglaries increased in most San Francisco neighborhoods. Shoplifting decreased under pandemic lockdown and dropped slightly the year before, but incidents are often underreported and have become more violent and brazen, police said.

Retailers attributed a majority of losses to professional thieves instead of opportunistic shoplifters who may be driven by poverty, with one CVS leader calling San Francisco a hub of organized retail crime. Losses have shuttered drugstores providing vital services, even more critical during the pandemic as some stores give out vaccines.

“This has been out of control,” said Supervisor Ahsha Safaí, who held a hearing Thursday with retailers, police, the district attorney and probation departments. “People are scared to go into these stores — seniors, people with disabilities, children. It’s just happening brazenly. We can’t just as a city throw up our hands and say this is OK. We have to come up with solutions.”

The cost of business and shoplifting led Walgreens to shut 17 locations in San Francisco in the past five years — an “unpopular and difficult decision,” Jason Cunningham, regional vice president for pharmacy and retail operations in California and Hawaii, said at the hearing. The company still has 53 stores in the city.

Theft in Walgreens’ San Francisco stores is four times the average for stores elsewhere in the country, and the chain spends 35 times more on security guards in the city than elsewhere, Cunningham said.

At CVS, 42% of losses in the Bay Area came from 12 stores in San Francisco, which are only 8% of the market share, Brendan Dugan, director of organized retail crime and corporate investigations, said at the hearing.

CVS and Walgreens said they train employees to be engaged and visible to prevent theft, but to not confront thieves directly when it could turn violent. CVS security guards in San Francisco have been assaulted, especially at the now-closed Seventh and Market streets location, Dugan said. Some businesses instead hire costly off-duty police officers.

Although the majority of CVS shoplifting incidents in the city are by opportunists, Dugan said, professional crime accounts for 85% of the company’s dollar losses. He said San Francisco is one of the “epicenters” of organized retail crime, pointing to an $8 million state bust in the Bay Area last year.

Officials agreed that different responses were needed depending on why someone was committing a crime. San Francisco Deputy Public Defender Doug Welch called in to the hearing to say his clients charged with shoplifting are not part of organized crime, but are homeless or struggling with substance abuse and need more services.

The San Francisco police burglary unit focuses on investigating serial shoplifters, especially if they’re violent, police said. Beat officers patrol known shoplifting areas. Last year, around 31% of shoplifting incidents resulted in arrest, a percentage that declined over the past couple years, police said.

A statement from Safeway read at Thursday’s hearing blamed Proposition 47, which lowered penalties for thefts under $950, for “dramatic increases” in shoplifting losses. Safaí said he is proud of Prop. 47 and supports criminal justice reform and rehabilitation, but also urges prosecution for organized crime and community ambassadors to prevent opportunistic shoplifting.

Professional shoplifters can work the system by stealing items under the threshold from one store and hitting several retailers in the same day. To prosecute, the district attorney has pursued aggregated charges for multiple petty theft incidents by the same person, such as a recent case of stolen scooters. Police said a person could also be charged with possession of stolen property worth more than $950.

As officials try to stave off crime, San Franciscans suffer from shuttered stores. Residents tried to save the Walgreens at Bush and Larkin in March, circulating a petition and arguing that the next closest store was not handicapped-accessible.

“This has become a lifeline for many seniors, people with disabilities, and low income residents who cannot go further out to other stores to get what they need,” the petition said.

The store still wound up closing.

 

 

Looks Like Law Enforcement Actually Shutdown DarkSide

Posted on by

A big hat tip to the work of law enforcement but which agency remains unknown at this point.

Shutting down the servers of DarkSide is a great achievement but not before there were other victims such as Toshiba.

A Toshiba Corp (6502.T) unit said it was hacked by the DarkSide ransomware group, overshadowing an announcement of a strategic review for the Japanese conglomerate under pressure from activist shareholders to seek out suitors.

Toshiba Tec Corp (6588.T), which makes products such as bar code printers and is valued at $2.3 billion, was hacked by DarkSide – the group widely believed to be behind the recent Colonial Pipeline attack, its French subsidiary said.

From Krebs:

The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates.

“Servers were seized (country not named), money of advertisers and founders was transferred to an unknown account,” reads a message from a cybercrime forum reposted to the Russian OSINT Telegram channel.

“A few hours ago, we lost access to the public part of our infrastructure,” the message continues, explaining the outage affected its victim shaming blog where stolen data is published from victims who refuse to pay a ransom.

“Hosting support, apart from information ‘at the request of law enforcement agencies,’ does not provide any other information,” the DarkSide admin says. “Also, a few hours after the withdrawal, funds from the payment server (ours and clients’) were withdrawn to an unknown address.”

DarkSide organizers also said they were releasing decryption tools for all of the companies that have been ransomed but which haven’t yet paid.

“After that, you will be free to communicate with them wherever you want in any way you want,” the instructions read.

The DarkSide message includes passages apparently penned by a leader of the REvil ransomware-as-a-service platform. This is interesting because security experts have posited that many of DarkSide’s core members are closely tied to the REvil gang.

The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims.

The new restrictions came as some Russian cybercrime forums began distancing themselves from ransomware operations altogether. On Thursday, the administrator of the popular Russian forum XSS announced the community would no longer allow discussion threads about ransomware moneymaking programs.

“There’s too much publicity,” the XSS administrator explained. “Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word ‘ransomware’ has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.”

In a blog post on the DarkSide closure, cyber intelligence firm Intel 471 said it believes all of these actions can be tied directly to the reaction related to the high-profile ransomware attacks covered by the media this week.

“However, a strong caveat should be applied to these developments: it’s likely that these ransomware operators are trying to retreat from the spotlight more than suddenly discovering the error of their ways,” Intel 471 wrote. “A number of the operators will most likely operate in their own closed-knit groups, resurfacing under new names and updated ransomware variants. Additionally, the operators will have to find a new way to ‘wash’ the cryptocurrency they earn from ransoms. Intel 471 has observed that BitMix, a popular cryptocurrency mixing service used by Avaddon, DarkSide and REvil has allegedly ceased operations. Several apparent customers of the service reported they were unable to access BitMix in the last week.”

***

“The funds, which the Darkside gang was supposed to split between itself and its affiliates (the threat actors who breach networks and deploy the ransomware), were transferred to an unknown wallet, Darksupp said.” reported TheRecord.

The news was revealed by a member of REvil ransomware gang, known as ‘UNKN,’ in a forum post on the Exploit hacking forum. The post was first spotted by Recorded Future researcher Dmitry Smilyanets, it includes a message allegedly from DarkSide explaining how the gang lost access to their blog, payment servers, and DDoS servers as a result of an action conducted by law enforcement action. source

Darkside

“Since the first version, we have promised to speak honestly and openly about problems. A few hours ago, we lost access to the public part of our infrastructure, namely:

  • Blog.
  • Payment server.
  • DOS servers.”

reads the post from UNKN. “Now these servers are unavailable via SSH, the hosting panels are blocked. Hosting support, apart from information “at the request of law enfocement agencies”, does not provide any other information.”

 

Retired Flag Officers’ Letter to Biden Challenging his Presidency

Posted on by

Primer: As the Democrats are aggressively fighting for election reform with the most disgusting legislation known as H.R. 1, it should also be noted that Liz Cheney (R-WY) was essentially removed from Republican leadership over what she calls the ‘big lie’ But then Mollie Hemmingway, Senior Editor at The Federalist has just released her new book titled Rigged. Her book discussed how media, big tech and the Democrats seized the elections.

We also cannot ignore former Ambassador and former DNI Director Ric Grenell when he asserts that Susan Rice is the shadow president. In fact, he has said it often and rightly so.

Rigged: How the Media, Big Tech, and the Democrats Seized ... source

This is all going on while many state legislatures are passing more secure and stringent election laws.

Meanwhile, enter former flag officers…..

  • A group named “Flag Officers 4 America” released a letter signed by 124 former military leaders.
  • The letter questioned the 2020 election result and Biden’s physical and mental health.
  • One serving Navy leader told Politico the letter was “disturbing and reckless.”

BusinessInsider: More than 120 retired US military leaders have signed an open letter appearing to advance a false conspiracy theory that the 2020 election was rigged, and questioning President Joe Biden’s mental capacity to rule.

“Without fair and honest elections that accurately reflect the ‘will of the people’ our Constitutional Republic is lost,” said the letter released Tuesday by “Flag Officers 4 America,” and signed by 124 former admirals and generals.

“The FBI and Supreme Court must act swiftly when election irregularities are surfaced and not ignore them as was done in 2020.”

On its website, Flag Officers 4 America says it is a collection of “retired military leaders who pledged to support and defend the Constitution of the US against all enemies, foreign and domestic.”

In the letter, the signatories, many of whom have been out of active service for decades, also addressed concerns over Biden’s health.

“The mental and physical condition of the Commander in Chief cannot be ignored. He must be able to quickly make accurate national security decisions involving life and limb anywhere, day or night,” the letter said.

Insider has contacted the Department of Defense for comment.

Throughout the 2020 election campaign former President Donald Trump regularly cast doubts on Biden’s health and suitability to rule, calling him “Sleepy Joe” and saying in March 2020 that there was “something going on” with Biden’s mental abilities.

Earlier this month Biden’s personal doctor, Dr. Kevin O’Connor, released a report on the president’s health, in which he called him a “healthy, vigorous, 77-year-old male, who is fit to successfully execute the duties of the Presidency.”

Biden is the oldest serving US president in history, and the White House said this week that the president will undergo a full check-up this year.

© Melina Mara/The Washington Post via AP, Pool Biden addresses a joint session of Congress on April 28, 2021. Melina Mara/The Washington Post via AP, Pool

In the Tuesday letter, the Flag Officers 4 America signatories also laid out what they deem to be the major threats facing the US, namely the rise of China, the rejoining of the Iran nuclear deal, immigration, and the ending of the Keystone Pipeline project.

The signatories also called for the removal of Section 230, a part of US law that shields tech companies from legal liability. Trump called for the section to be removed last year after Twitter flagged two of his tweets about mail-in voting.

“Our Nation is in deep peril,” the signatories wrote in the introduction to the letter.

“We are in a fight for our survival as a Constitutional Republic like no other time since our founding in 1776. The conflict is between supporters of Socialism and Marxism vs. supporters of Constitutional freedom and liberty.”

Several military experts told Politico the letter was an outright partisan attack and dangerous.

One serving Navy officer told Politico the letter was “disturbing and reckless” while Jim Golby, an expert in civil-military relations, told the outlet it was a “shameful effort to use their rank and the military’s reputation for such a gross and blatant partisan attack.”

The letter’s organizer, Maj. Gen. Joe Arbuckle, told Politico: “Retired generals and admirals normally do not engage in political actions.”

“But the situation facing our nation today is dire … We are facing threats greater than at any other time since our country was founded. To remain silent would be a dereliction of duty.”

Read the original article on Business Insider

More Exact Colonial Pipeline Hack Details

Posted on by

It is prudent to review several sources for the real evidence and details and most often non-government companies are the ‘go-to’ places for that. Government spins stuff but private cyber experts offer up great context and such is the case below.

FBI Confirms Darkside Behind Colonial Pipeline Ransomware ... source

As a primer, CISA is a government agency launched by the Trump administration for all the right reasons.

Alert (AA20-049A)

Ransomware Impacting Pipeline Operations

But read on.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an Alert that offers a set of best practices to protect against ransomware-induced business disruptions. The Alert was prompted by the attack against Colonial Pipeline, and it includes in its introductory section the preliminary conclusion that DarkSide ransomware affected Colonial’s IT systems only, and had no direct effect on the company’s OT networks. The best practices CISA advocates are familiar. The Alert closes with a statement strongly discouraging any victim from paying the ransom their attackers demand: “Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered.”

FireEye yesterday published a report on DarkSide that emphasizes the group’s ransomware-as-a-service model. It’s a selective operation (criminal applicants for affiliate status are, for example, interviewed before being given access to DarkSide’s control panel) but it’s also not a monolithic one. FireEye’s Mandiant unit currently tracks five “clusters” of DarkSide threat activity. The affiliate model DarkSide uses shares criminal profits: “Affiliates retain a percentage of the ransom fee from each victim. Based on forum advertisements, this percentage starts at 25 percent for ransom fees less than $500,000 USD and decreases to 10 percent for ransom fees greater than $5M USD.”

Colonial Pipeline’s website came back online late yesterday, newly armored with a reCAPTCHA landing page. The company published an update in which it reported progress toward resumption of refined petroleum deliveries, with some 967,000 barrels delivered to Atlanta, Belton and Spartanburg in South Carolina, Charlotte and Greensboro in North Carolina, Baltimore, and Woodbury and Linden (close to the Port of New York and New Jersey). Some lines have been operated under manual control since Monday, at least, and have been moving existing inventory. As the company prepares to restart deliveries, they’ve taken delivery of an additional two million barrels, which they’ll ship once service is restored.

The company appears also to be addressing some concerns about its pipelines’ physical security, having “increased aerial patrols of our pipeline right of way and deployed more than 50 personnel to walk and drive ~ 5,000 miles of pipeline each day.” (hat tip to CyberWire)

Related reading:

Colonial Pipeline using vulnerable, outdated version of Microsoft Exchange: report
Pipeline operators were warned about potential attacks in 2020

“Energy Sector…developed the 2011 Roadmap to Achieve Energy Delivery Systems Cybersecurity…sector’s vision that “by 2020, resilient energy delivery systems are designed, installed, operated, and maintained to survive a cyber-incident while sustaining critical functions…”