More to the Venezuela Revolution, Carnet de la Patria

SOCIAL CONTROL

Let lil miss Alexandria Ocasio-Cortez in please on a few of these details:

Sorta president Nicolas Maduro blames the United States for leading the mission to remove him from office. He has cut off diplomatic relations with the United States, while calling for the expulsion of our diplomatic staff. Only non-essential personnel of the United States has been told to leave Venezuela.

Presently, a self declared president is in hiding for his own safety it seems, Juan Guaido. Guaido has been approved and recognized not only by the United States, but Europe and Canada as other countries in the region have done the same.

On January 10, 2019, the Organization of American States, a Latin American council have all agreed to not recognize the legitimacy of Nicolas Maduro’s new term, hence any political action he has taken since the beginning of 2019 has also been deemed as illegitimate.

Maduro put simply is a killer, criminal and globally corrupt.

It is also important to note Maduro’s #2 man in country, Tareck Zaidan El Aissami Maddah. He was born in Venezuela to a Lebanese mother and Syrian father. He is just as corrupt as noted by the United States.

According to PanAm Post, US prosecutors have alleged that El Aissami was Venezuela’s “liaison” with Hezbollah and has provided passports to “terrorist organizations.” A report by the Center for a Secure Free Society released in 2014 alleged that El Aissami has “developed a sophisticated financial network and multi-level networks as a criminal-terrorist pipeline to bring Islamic militants to Venezuela and neighboring countries, and to send illicit funds from Latin America to the Middle East.” The alleged “pipeline” consists of 40 shell companies which have bank accounts in Venezuela, Panama, Curacao, St. Lucia, Miami and Lebanon and is also involved in drug smuggling.

Most all of the El Aissami family worked for Saddam Hussein and the Baathist Party including in Iraq and in Venezuela.

Meanwhile, with the previous Venezuelan president Chavez and through Maduro, Venezuela has been under the multi track influence of China, Russia, Syria, Cuba and Iran.

While much political and national security debate in the United States has included Huawei, other other telecom threat is ZTE. ZTE along with Huawei have both been banned from any government use by legislation signed by President Trump.

ZTE is important to understand as millions of U.S. cell phones in use are manufactured by ZTE. There is spy intrusion technology inside these phones. But there is something much more nefarious about China, ZTE and Venezuela and that is the ‘carnet de la patria’ otherwise known as the ‘fatherland card’.

This application was created and is in use today in China so Venezuela is doing the same. Read on for the nastiness and here is what lil Ms. Ocasio-Cortez along with the rest of the socialists in Congress are subscribing to.

***  Venezuela’s Nicolas Maduro wins reelection, officials say ...

Caracas (Reuters) – In April 2008, former Venezuelan President Hugo Chavez dispatched Justice Ministry officials to visit counterparts in the Chinese technology hub of Shenzhen. Their mission, according to a member of the Venezuela delegation, was to learn the workings of China’s national identity card program.

Chavez, a decade into his self-styled socialist revolution, wanted help to provide ID credentials to the millions of Venezuelans who still lacked basic documentation needed for tasks like voting or opening a bank account. Once in Shenzhen, though, the Venezuelans realized a card could do far more than just identify the recipient.

There, at the headquarters of Chinese telecom giant ZTE Corp, they learned how China, using smart cards, was developing a system that would help Beijing track social, political and economic behavior. Using vast databases to store information gathered with the card’s use, a government could monitor everything from a citizen’s personal finances to medical history and voting activity.

“What we saw in China changed everything,” said the member of the Venezuelan delegation, technical advisor Anthony Daquin. His initial amazement, he said, gradually turned to fear that such a system could lead to abuses of privacy by Venezuela’s government. “They were looking to have citizen control.”

The following year, when he raised concerns with Venezuelan officials, Daquin told Reuters, he was detained, beaten and extorted by intelligence agents. They knocked several teeth out with a handgun and accused him of treasonous behavior, Daquin said, prompting him to flee the country.

Government spokespeople had no comment on Daquin’s account.

The project languished.

But 10 years after the Shenzhen trip, Venezuela is rolling out a new, smart-card ID known as the “carnet de la patria,” or “fatherland card.” The ID transmits data about cardholders to computer servers. The card is increasingly linked by the government to subsidized food, health and other social programs most Venezuelans rely on to survive.

And ZTE, whose role in the fatherland project is detailed here for the first time, is at the heart of the program.

As part of a $70 million government effort to bolster “national security,” Venezuela last year hired ZTE to build a fatherland database and create a mobile payment system for use with the card, according to contracts reviewed by Reuters.

A team of ZTE employees is now embedded in a special unit within Cantv, the Venezuelan state telecommunications company that manages the database, according to four current and former Cantv employees.

The fatherland card is troubling some citizens and human-rights groups who believe it is a tool for Chavez’s successor, President Nicolas Maduro, to monitor the populace and allocate scarce resources to his loyalists.

Opposition and drivers reject vehicle census in Venezuela ...

“It’s blackmail,” Hector Navarro, one of the founders of the ruling Socialist Party and a former minister under Chavez, said of the fatherland program. “Venezuelans with the cards now have more rights than those without.”

In a phone interview, Su Qingfeng, the head of ZTE’s Venezuela unit, confirmed ZTE sold Caracas servers for the database and is developing the mobile payment application. The company, he said, violated no Chinese or local laws and has no role in how Venezuela collects or uses cardholder data.

“We don’t support the government,” he said. “We are just developing our market.”

An economic meltdown in Venezuela is causing hyperinflation, widespread shortages of food and medicines, and a growing exodus of desperate citizens. Maduro has been sanctioned by the United States and is criticized by governments from France to Canada as increasingly autocratic.

In that, critics say, Maduro has an ally. The fatherland card, they argue, illustrates how China, through state-linked companies like ZTE, exports technological know-how that can help like-minded governments track, reward and punish citizens.

The database, according to employees of the card system and screenshots of user data reviewed by Reuters, stores such details as birthdays, family information, employment and income, property owned, medical history, state benefits received, presence on social media, membership of a political party and whether a person voted.

So far, the government’s disclosure of ZTE’s involvement in the fatherland project has been limited to a passing reference in a February 2017 press release that credited the company with helping to “fortify” the underlying database.

Venezuela’s government didn’t respond to requests for comment for this article. Nadia Perez, a spokeswoman for Cantv, the state-run telecoms firm, declined to comment and Manuel Fernandez, the company’s president, didn’t respond to emails or text messages from Reuters. China’s Justice Ministry and its embassy in Caracas didn’t respond to requests for comment.

Although ZTE is publicly traded, a Chinese state company is its largest shareholder and the government is a key client. ZTE has run afoul of Washington before for dealings with authoritarian governments.

The company this year paid $1 billion to settle with the U.S. Commerce Department, one of various penalties after ZTE shipped telecommunications equipment to Iran and North Korea, violating U.S. sanctions and export laws. The Commerce action was sparked by a 2012 Reuters report that ZTE sold Iran a surveillance system, which included U.S. components, to spy on telecommunications by its citizens.

Legal experts in the United States said it is unclear whether ZTE and other companies that supply the fatherland system are violating U.S. sanctions on Venezuelan leaders by providing tools that critics believe strengthen the government’s grip on power.

Fernandez, the Cantv president, is one of the targets of those sanctions because of the telecom company’s censorship of the internet in Venezuela, according to a U.S. Treasury Department statement. But the prohibitions thus far are meant primarily to thwart business with Maduro and other top officials themselves, not regular commerce in Venezuela.

Still, U.S. lawmakers and other critics of Maduro’s rule are concerned about ZTE’s role in Venezuela. “China is in the business of exporting its authoritarianism,” U.S. Senator Marco Rubio told Reuters in an email. “The Maduro regime’s increasing reliance on ZTE in Venezuela is just the latest example of the threat that Chinese state-directed firms pose to U.S. national security interests.”

To understand how the fatherland card works and how it came to be, Reuters reviewed confidential contracts and internal government documents related to its development. Reporters also interviewed dozens of current and former employees of ZTE, Venezuela’s government and Cantv, or Compania Anonima Nacional Telefonos de Venezuela, as the company is formally known.

They confirmed details of the project and the outlines of Daquin’s account of its origins.

“AN ATTEMPT TO CONTROL ME”

Maduro for the past year has urged citizens to sign up for the new card, calling it essential to “build the new Venezuela.” As many as 18 million people, over half the population, already have, according to government figures.

“With this card, we are going to do everything from now on,” Maduro said on state television last December.

To encourage its adoption, the government has granted cash prizes to cardholders for performing civic duties, like rallying voters. It has also given one-time payouts, such as awarding moms enrolled in the card a Mother’s Day bonus of about $2. The payment, last May, was nearly a monthly minimum wage – enough to buy a carton of eggs, given the current pace of inflation.

Maduro is also taking steps to force the card’s adoption. The government now says Venezuelans need it to receive public benefits including medicine, pensions, food baskets and subsidized fuel. In August, retirees protested outside social security offices and complained the fatherland rule limits access to hard-won pensions.

Benito Urrea, a 76-year-old diabetic, told Reuters a state doctor recently denied him an insulin prescription and called him “right wing” because he hasn’t enrolled. Like some other Venezuelan citizens, especially those who oppose the Maduro administration, Urrea sees the card with suspicion.

“It was an attempt to control me via my needs,” Urrea said in his Caracas apartment. Reuters was unable to contact the doctor.

Using the servers purchased from ZTE, the government is creating a database some citizens fear is identifying Venezuelans who support the government and those who don’t.

Some of the information, such as health data, is gathered with card usage. Some is obtained when citizens enroll. Cardholders and local human rights groups told Reuters that administrators ask questions about income, political activities and social media profiles before issuing the card.

Civil servants are facing particular pressure to enroll, according to more than a dozen state workers.

When scanning their cards during a presidential election last May, employees at several government offices were told by bosses to message photos of themselves at polls back to managers, they said. A Justice Ministry document reviewed by Reuters featured a list of state employees who didn’t vote.

After Chavez became president in 1999, he sought to empower “invisible” Venezuelans who couldn’t access basic services. In the following years, more citizens received documentation, but the cards were fragile and easily forged, according to a 2007 Justice Ministry report.

The report, reviewed by Reuters, recommended a new, microchip-enabled card that would be harder to counterfeit. No such effort got underway.

That December, after nearly a decade of soaring popularity, Chavez suffered his first electoral defeat, losing a referendum to scrap term limits. Oil prices plummeted shortly thereafter, hammering the economy.

Chavez worked to appease his working-class base, including throngs still lacking identity credentials. He sent Daquin, the top information security advisor at the Justice Ministry, to China.

The technology Daquin and colleagues learned about in Shenzhen underpinned what would become China’s “Social Credit System.”

The still-evolving system, part of which uses “smart citizen cards” developed by ZTE, grades citizens based on behavior including financial solvency and political activity. Good behavior can earn citizens discounts on utilities or loans. Bad marks can get them banned from public transport or their kids blocked from top schools.

ZTE executives showed the Venezuelans smart cards embedded with radio-frequency identification, or RFID, a technology that enables monitors through radio waves to track location and data. Other cards used so-called Quick Response, or QR, codes, the matrix barcodes now commonly used to store and process information.

After the trip, Venezuela turned to Cuba, its closest ally, and asked for help creating its own version of RFID cards. “The new goal was Big Data,” Daquin said.

In June 2008, Venezuela agreed to pay a Cuban state company $172 million to develop six million of the cards, according to a copy of the contract. Cuban government officials didn’t respond to questions about the agreement.

By 2009, Daquin grew uneasy about the potential for abuses of citizens’ privacy.

He expressed those concerns to officials including Vladimir Padrino, a general at the time and now Venezuela’s defense minister. The Defense Ministry didn’t respond to phone calls, emails or a letter presented by Reuters for comment.

On the morning of Nov. 12, at his local Caracas bakery, six armed officials in uniforms of Venezuela’s national intelligence agency awaited Daquin, he told Reuters.

They showed him photos of his daughter and forced him to drive east toward the town of Guatire. Off a back road, Daquin said, they beat him with pistols, forced a handgun into his mouth and dislodged several teeth, still missing.

“Why are you betraying the revolution?” one asked.

They demanded $100,000 for his release, Daquin said.

Daquin, who says he had been saving for years to buy property, went home, pulled cash from a safe and delivered it to the men. That evening, he booked a flight for himself, his wife and their three children to the United States, where he has lived since, working as an information security consultant.

His brother, Guy, who also lives in the United States, confirmed Daquin’s account. Documentation reviewed by Reuters corroborates his role at the ministry, and people familiar with Daquin’s work confirmed his involvement in the card project.

After Daquin fled, the Cuban contract went nowhere, according to another former advisor.

In March 2013, Chavez died. Maduro, his heir as Socialist Party candidate, was elected president the next month. The lingering oil crash dragged Venezuela into recession.

“WE’LL FIND OUT”

With hunger increasing, the government in 2016 launched a program to distribute subsidized food packages. It hired Soltein SA de CV, a company based in Mexico, to design an online platform to track them, according to documents reviewed by Reuters. The platform was the beginning of the database now used for the fatherland system.

Soltein’s directors, according to LinkedIn profiles, are mostly former Cuban state employees. A person who answered a telephone listed for Soltein denied the firm worked on the fatherland system. A woman at the company’s registered address in the resort city of Cancun told Reuters she had never heard of Soltein.

The system worked. Nearly 90 percent of the country’s residents now receive the food packages, according to a study published in February by Andres Bello Catholic University and two other universities.

Now more satisfied with its ability to track handouts, the government sought to know more about the recipients, according to people involved in the project. So it turned back to ZTE.

The Chinese company, now in Venezuela for about a decade, has over 100 employees working in two floors of a Caracas skyscraper. It first worked with Cantv, the telecommunications company, to enable television programming online.

Like many state enterprises in Venezuela, Cantv has grown starved for investment. ZTE became a key partner, taking on many projects that once would have fallen to Cantv itself, people familiar with both companies said.

ZTE is helping the government build six emergency response centers monitoring Venezuela’s major cities, according to a 2015 press release. In 2016, ZTE began centralizing video surveillance for the government around the country, according to current and former employees.

In its final push for the fatherland cards, the government no longer considered RFID, according to people familiar with the effort. The location-tracking technology was too costly.

Instead, it asked ZTE for help with QR codes, the black-and-white squares smartphone users can scan to get directed to web sites. ZTE developed the codes, at a cost of less than $3 per account, and the government printed the cards, linking them to the Soltein database, these people said.

In a phone call with Reuters in September, Su, the head of ZTE’s Venezuela business, confirmed the company’s card deal with Cantv. He declined to answer follow-up questions.

Maduro introduced the cards in December 2016. In a televised address, he held one up, thanked China for lending unspecified support and said “everybody must get one.”

The ID system, still running on the Soltein platform, hadn’t yet migrated to ZTE servers. Disaster soon struck. In May 2017, hackers broke into the fatherland database.

The hack was carried out by anonymous anti-Maduro activists known as TeamHDP. The group’s leader, Twitter handle @YoSoyJustincito, said the hack was “extremely simple” and motivated by TeamHDP’s mission to expose Maduro secrets.

The hacker, who spoke to Reuters by text message, declined to be identified and said he is no longer in Venezuela. A Cantv manager who later helped migrate the database to ZTE servers confirmed details of the breach.

During the hack, TeamHDP took screenshots of user data and deleted the accounts of government officials, including Maduro. The president later appeared on television scanning his card and receiving an error message: “This person doesn’t exist.”

Screenshots of the information embedded in various card accounts, shared by TeamHDP with Reuters, included phone numbers, emails, home addresses, participation at Socialist Party events and even whether a person owns a pet. People familiar with the database said the screenshots appear authentic.

Shortly after the hack, Maduro signed a $70 million contract with Cantv and a state bank for “national security” projects. These included development of a “centralized fatherland database” and a mobile app to process payments, such as the discounted cost of a subsidized food box, associated with the card.

“Imperialist and unpatriotic factions have tried to harm the nation’s security,” the contract reads.

It says an undisclosed portion of the funding would come from the Venezuela China Joint Fund, a bilateral financing program. A related contract, also reviewed by Reuters, assigns the database and payment app projects to ZTE. The document doesn’t disclose how much of the $70 million would go to the Chinese company.

ZTE declined to comment on financial details of its business in Venezuela. Neither the Venezuelan nor the Chinese government responded to Reuters queries about the contracts.

In July 2017, Soltein transferred ownership of fatherland data to Cantv, project documents show. A team of a dozen ZTE developers began bolstering the database’s capacity and security, current and former Cantv employees said.

Among other measures, ZTE installed data storage units built by U.S.-based Dell Technologies Inc, according to one ZTE document. Dell spokeswoman Lauren Lee said ZTE is a client in China but that Dell doesn’t sell equipment to ZTE in Venezuela. She said Dell reviewed its transactions in Venezuela and wasn’t aware of any sale to Cantv, either.

“Dell is committed to compliance with all applicable laws where we do business,” Lee said in an email. “We expect our customers, partners and suppliers to follow these same laws.”

In May, Venezuela held elections that were widely discredited by foreign governments after Maduro banned several opposition parties.

Ahead of the vote, ruling party officials urged voters to be “grateful” for government largesse dispensed via the fatherland cards. They set up “red point” kiosks near voting booths, where voters could scan their cards and register, Maduro himself promised, for a “fatherland prize.”

Those who scanned their cards later received a text message thanking them for supporting Maduro, according to several cardholders and one text message reviewed by Reuters. The prizes for voting, however, were never issued, cardholders and people familiar with the system said.

Current and former Cantv employees say the database registers if, but not how, a person voted. Still, some voters were led to believe the government would know. The belief is having a chilling effect.

One organizer of a food handout committee in the west-central city of Barinas said government managers had instructed her and colleagues to tell recipients their votes could be tracked. “We’ll find out if you voted for or against,” she said she told them.

State workers say they are a target.

An internal Cantv presentation from last year said the system can feed information from the database to ministries to help “generate statistics and take decisions.” After the vote, government offices including Banco Bicentenario del Pueblo, a state bank, sent Cantv lists with employees’ names to determine whether they had voted, according to the manager who helped set up the servers.

Banco Bicentenario didn’t respond to a request for comment. Officials at the Economy Ministry, which the bank reports to, didn’t respond to requests, either.

With personal data now so available, some citizens fear they can lose more than just their jobs, said Mariela Magallanes, an opposition lawmaker who headed a commission that last year investigated how the fatherland card was being linked to the subsidized food program.

The government, the commission said in a report, is depriving some citizens of the food boxes because they don’t possess the card. “The government knows exactly who is most vulnerable to pressure,” she said.

US Treasury’s Evidence Iran and Russia Cooperating in Syria

The U.S. Treasury Department sanctioned nine targets last week related to an illicit oil network between Iran and Russia.

“We are acting against a complex scheme Iran and Russia have used to bolster the [Bashar] Assad regime and generate funds for Iranian malign activity,” said Treasury Secretary Steven Mnuchin. “Central Bank of Iran officials continue to exploit the international financial system, and in this case even used a company whose name suggests a trade in humanitarian goods as a tool to facilitate financial transfers supporting this oil scheme.

“The United States is committed to imposing a financial toll on Iran, Russia and others for their efforts to solidify Assad’s authoritarian rule, as well as disrupt the Iranian regime’s funding of terrorist organizations,” he added.

Experts said this move was crucial in combating the Iranian threat.

“The scheme uncovered by the Treasury Department shows just how closely Iran and Russia are cooperating to not only help prop up the Assad regime financially, but to help finance the leading players in Iran’s global terrorism,” Boris Zilberman of the Foundation for Defense of Democracies told JNS. “So when Russia talks about cooperating with the United States to counter-terrorism this is empty rhetoric plain and simple.”

“As this scheme shows, Russia works hand in hand with some of the very terror groups we seek to counter,” he continued. “Russia is not a partner in our counter-terrorism efforts, but is, in fact, an adversary.”

“There are already sanctions on Russian arms exporters, but the United States should continue to uncover and sanction schemes such as this,” added Zilberman. “The administration could also consider, in conjunction with Israel, striking destabilizing arms transfers by Hezbollah.

“It’s an important step, and highlights just how much [Russian President Vladimir] Putin has supported Iran, Hezbollah and Assad, and how committed he is, despite hopes that Putin’s partnership with Iran is skin-deep short-lived,” the Washington Institute for Near East Policy’s Anna Borshchevskaya told JNS.

“Hard to tell if this pressure will succeed without being incorporated into a broader strategy,” she continued. “It comes as no surprise that the Kremlin said earlier this month it will continue to help Iran trade oil. It’s possible to imagine Moscow setting up another intermediary to continue shipping oil to the Syrian regime, but nonetheless, this is an important step.”

The State Department joined Treasury in sending a message to the Islamic Republic.

Islamic State crisis: US hits IS oil targets in Syria ...

“The sanctions levied today directly target the Iranian regime’s exploitation of the international financial system to hide revenue streams it uses to fund terrorist activity, provide support for sectarian militias responsible for abuses against civilian populations and destabilize the region,” said the department in a statement. “The Iranian regime, Iranian-commanded forces inside Syria and the proxy terrorist groups it supports such as those targeted today continue to foment instability to extend their malign influence. These actions by the Iranian and Assad regimes undermine the legitimate processes to resolve the conflict in Syria.”

This development preceded Secretary of State Pompeo blasting Iranian President Hassan Rouhani on Monday for calling Israel a “cancerous tumor” and a “fake regime.”

“This is a dangerous and irresponsible step that will further deepen Iran’s isolation,” warned Pompeo.

“The Iranian regime is no friend of America or Israel when they repeatedly call for the death of millions, including Muslims,” he added. “The Iranian people know better and do not agree with their government, which has badly represented them to the world for 39 years. The people have suffered under this tyranny for far too long.”

*** It is quite right that Iran is no friend of the United States or Israel. That Obama/Kerry nuclear deal was supposed to lay the groundwork for Iran to be a good citizen of the world….read on…not so much.

***

Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, Municipalities, and Public Institutions, Causing Over $30 Million in Losses

A federal grand jury returned an indictment unsealed today in Newark, New Jersey charging Faramarz Shahi Savandi, 34, and Mohammad Mehdi Shah Mansouri, 27, both of Iran, in a 34-month-long international computer hacking and extortion scheme involving the deployment of sophisticated ransomware, announced Deputy Attorney General Rod J. Rosenstein, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney Craig Carpenito for the District of New Jersey and Executive Assistant Director Amy S. Hess of the FBI.

The six-count indictment alleges that Savandi and Mansouri, acting from inside Iran, authored malware, known as “SamSam Ransomware,” capable of forcibly encrypting data on the computers of victims.  According to the indictment, beginning in December 2015, Savandi and Mansouri would then allegedly access the computers of victim entities without authorization through security vulnerabilities, and install and execute the SamSam Ransomware on the computers, resulting in the encryption of data on the victims’ computers.  These more than 200 victims included hospitals, municipalities, and public institutions, according to the indictment, including the City of Atlanta, Georgia; the City of Newark, New Jersey; the Port of San Diego, California; the Colorado Department of Transportation; the University of Calgary in Calgary, Alberta, Canada; and six health care-related entities: Hollywood Presbyterian Medical Center in Los Angeles, California; Kansas Heart Hospital in Wichita, Kansas; Laboratory Corporation of America Holdings, more commonly known as LabCorp, headquartered in Burlington, North Carolina; MedStar Health, headquartered in Columbia, Maryland; Nebraska Orthopedic Hospital now known as OrthoNebraska Hospital, in Omaha, Nebraska and Allscripts Healthcare Solutions Inc., headquartered in Chicago, Illinois.

According to the indictment, Savandi and Mansouri would then extort victim entities by demanding a ransom paid in the virtual currency Bitcoin in exchange for decryption keys for the encrypted data, collecting ransom payments from victim entities that paid the ransom, and exchanging the Bitcoin proceeds into Iranian rial using Iran-based Bitcoin exchangers.  The indictment alleges that, as a result of their conduct, Savandi and Mansouri have collected over $6 million USD in ransom payments to date, and caused over $30 million USD in losses to victims.

“The Iranian defendants allegedly used hacking and malware to cause more than $30 million in losses to more than 200 victims,” said Deputy Attorney General Rosenstein.  “According to the indictment, the hackers infiltrated computer systems in 10 states and Canada and then demanded payment. The criminal activity harmed state agencies, city governments, hospitals, and countless innocent victims.”

“The allegations in the indictment unsealed today—the first of its kind—outline an Iran-based international computer hacking and extortion scheme that engaged in 21st-century digital blackmail,” said Assistant Attorney General Benczkowski.  “These defendants allegedly used ransomware to infect the computer networks of municipalities, hospitals, and other key public institutions, locking out the computer owners, and then demanded millions of dollars in payments from them. As today’s charges demonstrate, the Criminal Division and its law enforcement partners will relentlessly pursue cybercriminals who harm American citizens, businesses, and institutions, regardless of where those criminals may reside.”

“The defendants in this case developed and deployed the SamSam Ransomware in order to hold public and private entities hostage and then extort money from them,” said U.S. Attorney Carpenito.  “As the indictment in this case details, they started with a business in Mercer County and then moved on to major public entities, like the City of Newark, and healthcare providers, like the Hollywood Presbyterian Medical Center in Los Angeles and the Kansas Heart Hospital in Wichita—cravenly taking advantage of the fact that these victims depend on their computer networks to serve the public, the sick, and the injured without interruption.  The charges announced today show that the U.S. Attorney’s Office for the District of New Jersey will continue to act to disrupt such criminal acts, and identify those who are responsible for them, no matter where in the world they may seek to hide.”

“This indictment demonstrates the FBI’s continuous commitment to unmasking malicious actors behind the world’s most egregious cyberattacks,” said Executive Assistant Director Hess.  “By calling out those who threaten American systems, we expose criminals who hide behind their computer and launch attacks that threaten our public safety and national security.  The actions highlighted today, which represent a continuing trend of cyber criminal activity emanating from Iran, were particularly threatening, as they targeted public safety institutions, including U.S. hospital systems and governmental entities.  The FBI, with the assistance of our private sector and U.S. government partners, are sending a strong message that we will work together to investigate and hold all criminals accountable.”

Savandi and Mansouri are charged with one count of conspiracy to commit wire fraud, one count of conspiracy to commit fraud and related activity in connection with computers, two substantive counts of intentional damage to a protected computer and two substantive counts of transmitting a demand in relation to damaging a protected computer.

According to the indictment, Savandi and Mansouri created the first version of the SamSam Ransomware in December 2015, and created further refined versions in June and October 2017.  In addition to employing Iran-based Bitcoin exchangers, the indictment alleges that the defendants also utilized overseas computer infrastructure to commit their attacks.   Savandi and Mansouri would also use sophisticated online reconnaissance techniques (such as scanning for computer network vulnerabilities) and conduct online research in order to select and target potential victims, according to the indictment.  According to the indictment, the defendants would also disguise their attacks to appear like legitimate network activity.

To carry out their scheme, the indictment alleges that the defendants also employed the use of Tor, a computer network designed to facilitate anonymous communication over the internet.  According to the indictment, the defendants maximized the damage caused to victims by launching attacks outside regular business hours, when a victim would find it more difficult to mitigate the attack, and by encrypting backups of the victims’ computers.  This was intended to—and often did—cripple the regular business operations of the victims, according to the indictment.  The most recent ransomware attack against a victim alleged in the indictment took place on Sept. 25, 2018.

This case was investigated by the FBI’s Newark Field Office.  Senior Counsel William A. Hall Jr. of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney and Chief of the Cybercrimes Unit Justin S. Herring of the District of New Jersey are prosecuting the case.  The Department thanks its law enforcement colleagues at the National Crime Agency (UK), West Yorkshire Police (UK), Calgary Police Service (Canada), and the Royal Canadian Mounted Police.  Significant assistance was provided by the Justice Department’s National Security Division and the Criminal Division’s Office of International Affairs.

This the Reason N Korea Cancelled the Meeting?

The excuses both sides explain scheduling conflicts. C’mon, lil Kim is not exactly that busy to take a meeting with America, right? As North and South Korea have begin to dismantle 20 guard posts along the DMZ. South Korea has 60 such positions while North Korea has an estimated 160. Allegedly, all firearms have been already removed from the guard posts. Personnel is still there but it is said they are unarmed.

Back to that cancelled meeting….

 A satellite image of a secret North Korean ballistic missile base. The North has offered to dismantle a different major missile launching site while continuing to make improvements at more than a dozen others.CreditCreditCSIS/Beyond Parallel, via DigitalGlobe 2018

More detail is explained here.

What is the reason then? Missile sites….hummm

North Korea are still operating undeclared missile bases and even improving some of their missile sites instead of shutting them down.

The latest report from the Center for Strategic and International Studies in Washington said it had identified 13 of an estimated 20 secret missile operating bases inside North Korea.

They could be used to house ballistic missiles of various ranges, with the largest believed to be capable of striking anywhere in the United States.

The report, written by researcher Joseph Bermudez, said maintenance and minor infrastructure improvements have been observed at some of the sites.

The sites identified in the report are scattered in remote, mountainous areas across North Korea.

It even identified improvements being made to its Sakkanmol site, close to the border with South Korea.

President Trump is still hoping to persuade Pyongyang to give up its nuclear weapons and long-range missiles.

The North Korean leader Kim Jong Un and U.S. President Donald Trump pledged to work towards ‘denuclearization’ at their landmark June summit in Singapore.

Shortly after the summit, Trump tweeted that there was no longer a nuclear threat from North Korea.

North Korea declared its nuclear force ‘complete’ and halted missile and nuclear bomb testing earlier this year.

North Korea has said it has closed its Punggye-ri nuclear testing site and the Sohae missile engine test facility.

It also raised the possibility of shuttering more sites and allowing international inspections if Washington took ‘corresponding measures’.

Last week, North Korea called off a meeting with U.S. Secretary of State Mike Pompeo in New York.

The country’s state media said on Monday the resumption of some small-scale military drills by South Korea and the United States violated a recent agreement aimed at lowering tensions on the Korean peninsula.

‘Missile operating bases are not launch facilities,’ Bermudez wrote.

‘While missiles could be launched from within them in an emergency, Korean People’s Army (KPA) operational procedures call for missile launchers to disperse from the bases to pre-surveyed or semi-prepared launch sites for operations.’

None of the missile bases have been acknowledged by North Korea, and analysts say an accurate disclosure of nuclear weapons and missile capabilities would be an important part of any denuclearization deal.

 

U.S. Treasury Employee Arrested Charged with Leaking to Media

The official 18 page indictment is here.

US Treasury employee arrested, accused of leaking media secret information about suspicious financial transactions related to Paul Manafort, Russians

  • A U.S. Treasury employee has been arrested and charged with leaking to a BuzzFeed News reporter multiple secret reports about suspicious financial transactions.
  • The documents relate to former Trump campaign chief Paul Manafort, Trump campaign official Richard Gates, accused Russian agent Maria Butina, the Russian Embassy and suspected Russian money launderer Prevezon Alexander.
  • The accused employee, Natalie Mayflower Sours Edwards will face criminal charges in New York.

A U.S. Treasury employee has been arrested on charges that she leaked to BuzzFeed News multiple reports about suspicious financial transactions involving ex-Trump campaign chief Paul Manafort, law-enforcement officials said.

The highly confidential documents allegedly leaked by the employee also were related to former Trump campaign official Richard Gates, accused Russian agent Maria Butina, a suspected Russian money launderering entity and the Russian Embassy in Washington, according to a criminal complaint.

Natalie Mayflower Sours Edwards

Natalie Mayflower Sours Edwards, a 40-year-old senior advisor in Treasury’s financial crimes enforcement network who was arrested Tuesday, will face federal criminal charges in New York, officials said.

She is charged with unlawfully disclosing so-called suspicious activity reports, or SARS, and conspiracy to do the same. Both felony counts carry a maxmium potential sentence of five years in prison.

A Quinton, Virginia, resident, Edwards was released on a $100,000 personal recognizance bond after her presentment Wednesday afternoon in U.S. District Court for the Eastern District of Virginia. Under the conditions of her release, Edwards is barred from contacting reporters or handling documents belonging to her Treasury division without approval.

A lawyer for Edwards did not immediately respond to a request for comment.

SARS are used to alert Treasury officials and other authorities about financial transactions that may be related to criminal conduct, such as money laundering. Treasury’s FinCEN division, for which Edwards works, manages the collection of SARS. It is illegal for a government employee to disclose a SAR or its contents outside of the scope of their work.

The complaint against Edwards says that she started leaking “numerous SARS in October 2017” to an unidentified reporter, and continued doing so until this month.

She had “hundreds of electronic communications” with the reporter, “many via an encrypted application,” the complaint said.

After Edwards began leaking SARS, the journalist wrote about a dozen articles which mentioned the details of those reports, according to the complaint.

Articles cited in the complaint carry the bylines of Jason Leopold and Anthony Cormier, two BuzzFeed reporters, as well as other journalists at that media outlet.

The articles cited documents transactions pertaining to Manafort and Gates, both of whom have since pleaded guilty to financial crimes related to their consulting work for a pro-Russia political party in Ukraine.

They also related to Butina, who is currently being held without bond on charges of being a Russian agent, the accused money launderering real-estate entity Prevezon Alexander, and the Russian Embassy in Washington.

At the time of Edwards’ arrest, according to federal prosecutors in Manhattan, she “was in possession of a flash drive” that appeared to be the same device “on which she saved the unlawfully disclosed” SARS.

Also in her possession was “a cellphone containing numerous communications over an encrypted application in which she transmitted [SARS] and other sensitive government information” illegally, prosecutors said.

“When questioned by law enforcement officials [Tuesday], Edwards confessed she has provided [SARS] to [the reporter] via an encrypted application, through falsely denied knowing that [the reporter] intended to or did publish that information” through a news organization, the complaint said.

BuzzFeed News declined to comment. Leopold and Cormier did not immediately return requests for comment.

 

Items SecState Pompeo Manages in Dealing with N Korea

All is not so copacetic with North Korea. The United States has many channels of intelligence regarding North Korea and dealing with Kim Jung Un with many of the moving parts requires diplomatic artistry.
Below are but two examples and the prediction of a second summit between the United States and North Korea being noted, the logistics is a chess game.
Pompeo Meets North Korean Leader Kim Jong Un | One-News
FireEye has released a report stating the tools and techniques used by the group, “We believe APT38’s financial motivation, unique toolset, and tactics, techniques, and procedures (TTPs) observed during their carefully executed operations are distinct enough to be tracked separately from other North Korean cyber activity. There are many overlapping characteristics with other operations, known as “Lazarus” and the actor we call TEMP.Hermit; however, we believe separating this group will provide defenders with a more focused understanding of the adversary and allow them to prioritize resources and enable defense.
In their official blog, the company further explained the distinction of the group from any other hackers out there. Foremost, the malware tools used overlap or are similar indicating the similar developer behind the scenes.
The general pattern used by APT38 was observed to be this way –
  • First, the information is gathered by targeting third-party vendors to understand the mechanics of their transactions.
  • Then, initial compromise takes place followed by internal reconnaissance, pivot to victim servers used for swift transactions.
  • After this, finally, the funds are transferred or stolen.
  • This group does not stop just there but it removes all the evidence that might help the authorities trace them back or know the exact way or methodology of the fraud.
FireEye addressed the threat the group poses to its targeted sector by stating, “APT38 is unique in that it is not afraid to aggressively destroy evidence or victim networks as part of its operations. This attitude toward destruction is probably a result of the group trying to not only cover its tracks but also to provide cover for money laundering operations.The full 32 page report is here.
Meanwhile:

The U.S. Treasury Department last week sanctioned a Turkish company, two Turkish individuals, and a North Korean individual for violating UN sanctions on Pyongyang. These sanctions came just before Secretary of State Mike Pompeo’s fourth trip to North Korea in preparation for an anticipated second Trump-Kim summit.

Treasury targeted the Turkey-based company SIA Falcon International Group; the company’s chief executive officer, Huseyin Sahin; the company’s general manager, Erhan Culha; and North Korea’s economic and commercial counselor in Mongolia, Ri Song Un. The sanctions were issued pursuant to Executive Order 13551, which restricts trade in arms and luxury goods with North Korea. UN Security Council Resolution 1718 from 2006 also prohibits member states from conducting such trade.

In a press release, Treasury noted that SIA Falcon operates in Latvia. In February 2018, Treasury’s Financial Crimes Enforcement Network (FinCEN) named ABLV Bank of Latvia an institution of primary money laundering concern. FinCEN noted that ABLV “institutionalized money laundering as a pillar of the bank’s business practices” and conducted illicit financial transactions for North Korean procurement or export of ballistic missiles. Treasury did not confirm, however, that SIA Falcon’s Latvian branch office used ABLV’s bank services.

Treasury’s latest sanctions came the same day as The Rodong Sinmun, a North Korean state-run newspaper, published an article lambasting U.S. sanctions policy. Just days earlier, North Korea’s foreign minister, Ri Yong Ho, implored the UN Security Council to lift sanctions in response to Pyongyang’s moves to freeze missile and nuclear testing and to destroy the Punggye-ri test facility. However, until North Korea agrees to denuclearization and a full declaration of Pyongyang’s nuclear weapons program, facilities, and capabilities, Washington has confirmed it will not ease sanctions pressure

After Secretary Pompeo’s latest trip to North Korea, Pyongyang’s media outlets suggested U.S.-North Korea relations are improving. Of course, these latest designations, as well as ongoing U.S. diplomatic efforts to ensure international compliance with UN sanctions, could stir further tensions. Despite these risks, the sanctions send a useful message to Pyongyang that the Trump administration will not back down until the Kim regime meets its core demands. Hat tip FDD.