FBI Newark Ct Sir - 20111207

UNCLASSIFIED// LAW ENFORCEMENT SENSITIVE


FEDERAL BUREAU OF INVESTIGATION NEW JERSEY OFFICE OF HOMELAND SECURITY &

PREPAREDNESS SITUATIONAL INFORMATION REPORT

Nationwide Intelligence Reporting Newark Division

7 December 2011

(U) Newark Division Weekly Intelligence Highlights

Threats and Activities

(U//FOUO) Location and Intentions of Middle Eastern Males Smuggled into the United States from Mexico, Early October 2011 (Low Credibility) (U//FOUO) As of early October 2011, a group of six Middle Eastern males (NFI) were believed to be located in either Pennsylvania or New Jersey, with the intent to “cause disruptions” in December (NFI). (Source Comment. The “disruptions” would occur far from Mexico so United States law enforcement could not determine that the Middle Eastern males had traveled through Mexico to get to their destinations.) (U//FOUO) FBI Newark Comment. This report is assessed by FBI Newark to have very low credibility. The source failed the polygraph examination on substantive issues. (U) FBI IIR 4 214 0595 12 (UNCLASSIFIED). (U//FOUO) Germany Conducts Investigation into Iranian Attack Plot on US Bases in Germany (U//FOUO) As of December 2011, Iran is reportedly planning attacks on US bases in Germany, according to open sources. Specifically, the German Federal Office of Criminal Investigation opined that in the event of a US military action against Tehran, Iranian President Mahmoud Ahmadinejad planned to attack US military airfields in Germany to disrupt US military supply and logistics activities. German federal prosecutors have launched a preliminary investigation against a German businessman suspected of espionage and having conspiratorial contact with the Iranian Embassy in Berlin. (U) CIA Open Source Center, EUP 20111201085007, 1 December 2011 (UNCLASSIFIED).

1


(U//FOUO) Possible Violent Actions against the US Government by Fruit of Islam (U//FOUO) Members of a Cleveland-based mosque associated with US organization Fruit of Islam (FOI) as of November 2011 believed the US Government was trying to assassinate US person Louis Farrakhan, according to a collaborative source with good access. (Source Comment. Farrakhan’s death would serve as a trigger for the FOI to take violent action against the US Government and/or local police. The local police would be the main target because they have more visibility and interaction with FOI in African-American neighborhoods.) (U//FOUO) FBI Comment. Open source information indicates FOI is the male-only paramilitary wing of an identified US organization that espouses a black separatist extremist ideology, specifically the removal of white, Arab, and Chinese people from Cleveland area African-American neighborhoods, possibly through violence. (U//FOUO) FBI Newark Comment. There is currently no known specific or imminent threat from FOI to local law enforcement. However, there is a known FOI presence in New Jersey and, although recent FBI reporting as of mid-September 2011 from a collaborative source with good access had indicated membership in the New Jersey-based FOI had declined, a thinning membership would not necessarily preclude local FOI participation in possible FOI organizational mandated violence. (U) FBI IIR 4 201 1580 12 (UNCLASSIFIED). (U//FOUO) Violent Rhetoric against Caucasians by Israelite Church of God in Jesus Christ Members in New Jersey (U//FOUO) The Israelite Church of God in Jesus Christ (ICGJC) as of October 2011 held meetings in Camden, New Jersey, containing violent rhetoric towards Caucasians and advised members to obey the Comforter or die by the sword, according to a collaborative source with excellent access. (FBI Comment. ICJGC is led by an individual known as the Comforter who is believed to be the Holy Spirit incarnate.) (U//FOUO) FBI Newark Comment. An open source search indicated the ICGJC has a presence in New Jersey. The group claims to be descended from the twelve tribes of Israel, and believes the reign of the Edomites (white race) is nearing its end. It is actively training for the time when “a black Jesus will return to earth to kill or enslave all whites.” (U) FBI IIR 4 201 1644 12 (UNCLASSIFIED).

UNCLASSIFIED// LAW ENFORCEMENT SENSITIVE 2


Trends and Tactics

(U//LES) Use of Fraudulent US Military Common Access Cards and Uniforms by Argentine National (U//LES) San Antonio-based Argentine national Mario Oscar Achaval as of October 2011 created and possessed five unfinished US Army Common Access Cards (CACs), according to an FBI Agent. One identified Achaval as a Lieutenant Colonel with Task Force ODIN and listed his security clearance as “TS/SCI L5.” (FBI Comment. Task Force ODIN was based in Fort Hood, Texas. ODIN is acronymic for “observe, detect, identify and neutralize.”) Achaval also possessed a fraudulent letterhead memorandum marked “classified” addressed to “LTC Mario Achaval” from the “US Department of Homeland Security, Counterterrorism Division, Joint Terrorism Task Force,” including command, intelligence, surveillance, and reconnaissance resources requests. Achaval also created a fraudulent White House visitor access pass. (FBI Comment. US Secret Service advised it did not resemble a valid pass.) Finally, Achaval possessed two full sets of US military digital patterned camouflage uniforms bearing his name, rank, and Special Forces insignias. Achaval, who was awaiting removal to Argentina by US Immigration and Customers Enforcement (ICE), at one time claimed he intended to use the fraudulent identification cards to re-enter the United States. (U//FOUO) FBI Newark Comment. As indicated in the below FBI-DHS Joint Intelligence Bulletin, al-Qa’ida and allied terrorist groups continue to seek innovative ways to conduct attacks and circumvent security procedures. Fraudulent military credentials could be used as an ‘innovative’ way to infiltrate the Homeland and gain entry to secure areas in buildings, mass gathering places, and other possible terror targets, to conduct preoperational activities or to perpetrate an attack. (U) FBI IIR 4 214 0535 12 (UNCLASSIFIED). (U//FOUO) Methodologies of New York–Based Counterfeit Cigarette Smuggling Distributors (U//FOUO) Counterfeit cigarettes of an identified US brand as of September 2010 were manufactured in China and shipped via containers to New York and New Jersey, according to a collaborative source with good access. The counterfeit cigarettes were then sold to middlemen, who in turn sold the cigarettes and counterfeit tax stamps to grocery store and bodega owners of Yemeni descent. A presumed US person of Palestinian descent from the Gaza Strip known as Ahmed was the middleman. To avoid detection by law enforcement, the counterfeit cigarettes were shipped in the same overseas container and in the same cartons as legitimate merchandise. (U//FOUO) FBI Newark Comment. Lebanese Hizballah and HAMAS are both known to have leveraged and used proceeds from counterfeit cigarette trafficking operations to support group terror activities. Other counterfeit products that have been sold in the service of terrorism have included: DVD/CDs, designer apparel, designer pocketbooks, pharmaceuticals, electrical appliances, auto parts, toys, software, perfumes, sunglasses, watches and jewelry. (U) FBI Current Intelligence Report, 7 December 2011 (UNCLASSIFIED).



Security Strategies

(U//FOUO) Terrorist Interest in the Holiday Season (U//FOUO) While we are not aware of any credible terrorist threats to the Homeland specifically timed to coincide with the 2011 holiday season, attempted terrorist incidents during last year’s holiday season, as well as intelligence received over the past 12 months, suggest terrorists recognize that the large gatherings occurring during the holiday season provide an opportunity for mass casualty attacks. Attack planning, however, is likely to depend more on terrorist readiness to execute an attack rather than on a desire to attack on a specific date.

• (U//FOUO) As of February 2010, al-Qa’ida was contemplating large attacks in the Homeland on symbolic dates and specifically identified Christmas and other prominent American holidays as key dates, presumably for attacks. We are uncertain how widely al-Qa’ida’s interest in timing attacks to symbolic dates has been shared or accepted within the group or among its affiliates and allies, and we have no specific credible information to suggest any plotting targeting the Homeland was developed based on al-Qa’ida’s February 2010 intent.

• (U//FOUO) On 26 November 2010, a US citizen was arrested for allegedly plotting to detonate an explosive-laden van at the annual Christmas tree lighting ceremony in Portland, Oregon. This was the first incident we know of in which a homegrown violent extremist (HVE) specifically planned an attack during a holiday event.

(U//FOUO) Based on past terrorist interest, we remain concerned that violent extremists could seek to conduct small-scale attacks during this year’s holiday season. Lone offenders, unburdened by organizational constraints that can slow operational decisions by established terrorist groups, could also attempt an attack against easily-accessible, low-security targets. (U//FOUO) Al-Qa’ida propaganda has encouraged individuals to conduct local attacks in their home country—using simple improvised explosive devices (IEDs) or small arms—that would not require overseas travel for training or communication with known terrorists; such activities would provide opportunities for plot disruption by law enforcement and first responders. (U//FOUO) Although we judge that al-Qa’ida has not abandoned interest in terrorist attacks approximating the scale of the attacks of 9/11, the group’s Yemen-based affiliate—al-Qa’ida in the Arabian Peninsula (AQAP)—has praised relatively inexpensive and smaller-scale attacks. AQAP has publicly championed even its disrupted plots, stressing the economic damage and disruption it has inflicted on the West and how it has forced Western nations to spend a disproportionate amount of money on security. (U//FOUO) Although some of the following indicators may constitute constitutionally protected activity, given the context of all available information, they may be indicative of preoperational surveillance or preparation for an attack.



• (U//FOUO) Suspicious Purchases of Explosive Precursors: In preparation for his attack on the New York City subway system in 2009, convicted terrorist US person Nazjibullah Zazi made several large purchases of nail polish remover and various “hair salon” products containing acetone and hydrogen peroxide—explosive precursors—from a beauty supply store in Denver, Colorado. Convicted terrorist US person Faisal Shahzad made large purchases of urea nitrate fertilizer, which he believed could act as an explosive precursor, from a local hardware store prior to his failed vehicle-borne IED (VBIED) attack in Times Square.

• (U//FOUO) Preoperational Surveillance: On 22 June 2011, US persons Joseph Anthony Davis and Frederick Domingue Jr. were arrested for allegedly plotting an attack against a Military Entrance Processing Station in Seattle, Washington. The two men purportedly conducted extensive surveillance by driving past and parking at the recruiting station to collect sensitive information regarding security personnel, entry points, security cameras, and security procedures, resulting in a hand-drawn map of the facility, according to court documents.

• (U//FOUO) Suspicious Questions and Materials: On 27 July 2011, US person Naser Jason Abdo was arrested at a hotel in Killeen, Texas, outside of Fort Hood. Authorities were alerted to Abdo’s suspicious activities after he allegedly attempted to purchase an unusually large amount of black powder and firearms from a local gun shop. When arrested, Abdo purportedly had in his possession a copy of the Inspire article, “How to Make a Bomb in the Kitchen of your Mom,” and Fort Hood uniform patches purchased from a local military surplus store.

(U//FOUO) The following measures are recommended to mitigate the threat from IED, VBIED, or small arms attacks—these are applicable to federal, state, local, and private sector partners to protect against the identified attack scenarios:

• (U//FOUO) Establish a public awareness and vigilance campaign to reinforce awareness of the threat environment; if possible, repeat security notices in language(s) germane to the ethnicities particular to the region’s demographics;

• (U//FOUO) Ensure that a simple and consistent mechanism is in place to report suspicious activities to local law enforcement;

• (U//FOUO) Implement appropriate protective measures identified during threat vulnerability and risk assessments;

• (U//FOUO) Train and update personnel on all security response procedures and incorporate current and previous threat information into employee briefings;

• (U//FOUO) Confirm communication systems are interoperable between facility or event organizations and local emergency responders. Test communications equipment, including primary and backup systems, frequently depending on the situation and level of threat;

• (U//FOUO) Use internal surveillance systems that can be accessed remotely; UNCLASSIFIED// LAW ENFORCEMENT SENSITIVE

5


• (U//FOUO) Maintain police presence at strategic locations at high-profile events, specifically at all personnel entrance sites or traffic choke points; post additional security personnel in areas where large groups of people congregate; and, implement canine roving patrols in parking lots and critical facility areas;

• (U//FOUO) Establish a comprehensive security plan and emergency response plan for events;

• (U//FOUO) Identify and pre-designate primary and secondary evacuation routes and assembly areas for building or site occupants; develop and exercise procedures for shutting down the facility or event if a threat is deemed too credible to continue operations;

• (U//FOUO) Establish liaison, protocols, and regular communications with law enforcement and emergency responders to clarify and coordinate emergency responses;

• (U//FOUO) Prevent pattern recognition by an adversary by modifying security procedures, such as the placement of security barriers and timing of perimeter patrols, so they occur at irregular intervals;

• (U//FOUO) Consider using a centralized parking site and shuttle service to keep vehicles away from critical assets. Tow all illegally parked vehicles;

• (U//FOUO) Where possible create vehicle access control points to impede the approach of a VBIED toward its intended target;

• (U//FOUO) Prepare messages to be broadcast over intercoms to instruct personnel about immediate actions to be taken;

• (U//FOUO) Identify procedures for dealing with special needs populations (e.g., physical disabilities, non-English-speaking);

• (U//FOUO) In the event of an incident, conduct an evacuation of the area surrounding a package or vehicle which is considered a threat, and ensure the evacuation site is a considerable distance away to avoid blast and fragmentation hazards.

(U//FOUO) Although leadership losses over the past year have likely degraded their capabilities, al-Qa’ida and allied terrorist groups continue to seek innovative ways to conduct attacks and circumvent security procedures. We remain concerned that the upcoming holiday season will provide attractive opportunities for terrorists and HVEs to target the Homeland. It is imperative that first responders and security personnel remain alert for indicators of attack planning and immediately report any suspicious activity. We continue to operate under the premise that terrorists not yet identified by the Intelligence Community and law enforcement may be operating in the United States and could advance and execute attacks without warning. (U) FBI-DHS Joint Intelligence Bulletin, 23 November 2011 (UNCLASSIFIED).



(U//FOUO) Suspected Members of Anonymous and LulzSec Targeting Law Enforcement Personnel and Case Information in Retaliation for Arrests (U//FOUO) The FBI assesses with high confidence that suspected members of Anonymous will continue to target law enforcement personnel in retaliation for the arrests and searches conducted against Anonymous and affiliated groups, such as LulzSec. These tactics could be used to obtain information about law enforcement officers or compromise case information regarding Anonymous. Some techniques used to target law enforcement include “doxing” officers, destroying information, providing misinformation, and social engineering. (U//FOUO) FBI Comment. “Doxing” refers to a common practice among hackers in which hackers release a victim’s identifying information, including full name, date of birth, address, and pictures—typically retrieved from the social networking site profiles of a targeted individual. (U//FOUO) Following the January 2011 and July 2011 search warrants and arrests of Anonymous and LulzSec members and the more recent arrests against Occupy protesters, law enforcement personnel and their families were subject to doxing in retaliation for these actions. Information used in doxing may be obtained from exfiltrated data, or doxing can occur by collecting and assembling accessible information and disseminating it to the public.

• (U) In January 2011, a subject of an Anonymous investigation posted a message on the Web site reddit.com containing a photograph of the warrant he was served, an inventory of the property that was seized, and a business card of the FBI agent who conducted the search warrant.

• (U) In October 2011, following the arrests of Occupy Wall Street protesters, Anonymous released sensitive information obtained from multiple police associations. The information included internal documents, names, ranks, social security numbers, addresses, phone numbers, and passwords.

(U//FOUO) Subjects who have contact with law enforcement through interviews or service of search warrants may attempt to relay messages to other members of their group, potentially jeopardizing officer safety, operations, and intelligence collection. Subjects could warn associates that search warrants or arrests may be imminent giving those associates time to prepare or destroy information.

• (U) Following questioning by FBI personnel in June 2011, a suspected member of Anonymous participated in an exclusive interview with an Internet news site. The member divulged information pertaining to FBI interview tactics that included the questions asked, the answers provided, and a reported request from the FBI to infiltrate Anonymous. Specifically, the questions revealed law enforcement interest in another suspected member of Anonymous.

(U//FOUO) Following law enforcement action against Anonymous and LulzSec, individuals claiming to be members of the groups contacted FBI field offices in an attempt to provide information and become informants. While some individuals may have had honest intentions when contacting the FBI, others may have engaged in social engineering to solicit information about law enforcement personnel or active investigations of Anonymous and LulzSec. In



addition, individuals may have also contacted the FBI to provide misinformation about the identities of Anonymous and LulzSec members and their activities as a means of interfering with law enforcement investigations.

• (U//FOUO) In June 2011, suspected members of LulzSec discussed a scheme to provide misinformation to the FBI in a private Internet Relay Chat (IRC) channel. Members discussed having an FBI informant with access to the IRC channel contact his handling agent to provide misinformation in exchange for payment. Once this occurred, the group then planned to publicize the incident and to give the impression that the FBI was funding LulzSec activities.

• (U//FOUO) In October 2011, an FBI source with unknown reliability reported that an individual contacted FBI field offices via e-mail claiming to have information regarding Anonymous. Source reporting suggests that this individual had previously discussed in chat logs attempts to social engineer an FBI agent to download malware.

(U//FOUO) The FBI judges that the retaliatory reactions of Anonymous and LulzSec, combined with law enforcement activity aimed at dismantling the group, points toward the continued targeting and intimidation of law enforcement personnel. The FBI judges that law enforcement personnel may be subjected to increased contact by individuals regarding information about Anonymous and LulzSec members and activities, as additional law enforcement action against suspected members of Anonymous and splinter groups are conducted. This contact could lead to the increase of social engineering tactics against officers to obtain sensitive information that could be used to compromise active cases. In addition, suspected members of Anonymous and LulzSec may continue to provide misinformation in an effort to thwart law enforcement investigations, which may impact future prosecution of these subjects. (U//FOUO) The FBI judges that the following precautions are likely to enhance law enforcement ability to preserve information and ensure officer safety during interviews and search warrants:

• (U//FOUO) Being Aware of Social Engineering Tactics. Subjects may gather personal and employment information about law enforcement officers by manipulating them into divulging sensitive information. This information would enhance “doxing” by enabling subjects to gather further identifiers.

• (U//FOUO) Limiting Access to Video Equipment. Access to mobile phones, video recording devices, digital cameras, and Web cams would allow subjects to photograph law enforcement personnel. These pictures and videos may then be uploaded to the Internet and included in “doxes” of law enforcement.

• (U//FOUO) Limiting Access to Mobile Devices. Subjects may attempt to contact other Anonymous members to alert members of law enforcement presence, through making phone calls, sending text messages, and accessing social networking sites using mobile devices. Members have been known to access Internet Relay Chat (IRC) channels through mobile phones, therefore subjects may be able to communicate with other members without appearing to be on the Internet.



• (U//FOUO) Being Aware of Encryption Methods. Further efforts that may impede intelligence collection include encryption techniques such as full disk encryption. In these instances, information may be lost if suspects are notified before the search warrant is executed and the computer is turned off prior to law enforcement arrival.

• (U//FOUO) Obtaining Proper Consent for Minors. Some of the subjects of Anonymous are minors, which may hinder intelligence collection. Differences in state authorities designating the age at which someone is considered a minor may make it difficult to interview these subjects. Proper approval and parental consent may be required prior to contacting a minor and collecting information.

(U) FBI Intelligence Bulletin, Cyber Intelligence Section, 22 November 2011 (UNCLASSIFIED). Cyber Security

(U//FOUO) No Evidence of Intrusion or Malicious Activity at Illinois Water Utility (U//FOUO) DHS and FBI have found no evidence of a cyber intrusion into a water utility in Illinois, according to a 22 November 2011 DHS report. The suspected incident came to light after an initial report from DHS was leaked to the press on 18 November claiming there was an intrusion that had caused damage to a water pump. (U//FOUO) After an on-site investigation, the DHS and FBI reported there was no evidence to support claims made in the initial report—which was based on raw, unconfirmed data—that credentials had been stolen or that the vendor had been involved in malicious activity that led to a pump failure at the water plant. The DHS and FBI have concluded that there was no malicious or unauthorized traffic from Russia or any other foreign entities, as previously reported. (U) CIA Cyber Threat Intelligence Highlights, 23 November 2011 (UNCLASSIFIED). (U//FOUO) Companies Face Cyber Threat from their Own IT Departments (U//FOUO) PricewaterhouseCoopers LLP released survey results on 29 November 2011 indicating that cybercrime is one of the top four economic crimes facing businesses and that more than half of the cybercrimes originate from the businesses’ own IT departments, according to an online press report. Almost one quarter of theft victims in the past year were affected by cybercrime, which rose by 13 percent since 2009, according to PricewaterhouseCoopers. Half of the respondents said they saw greater awareness of the cybercrime threat, but most do not have a corporate plan to deal with the issue. (U) CIA Threat Intelligence Highlights, 21 November 2011 (UNCLASSIFIED).



(U//LES) Denial of Service Attack on Railway in Portland, Oregon, Tracked to Dutch and Russian IP Addresses (U//LES) Beginning on 30 November and ending on 1 December 2011, an unidentified individual(s) conducted a denial of service attack using IP addresses originating from Russia and the Netherlands, which disrupted commuter rail service in the Portland, Oregon area.

• (U//LES) The regional transportation agency Tri-Met was unable to access ten network back-up devices spaced along heavy rail lines known as the WES line, running 14.7 miles.

• (U//LES) Tri-Met protocol automatically slowed commuter trains to 15 mph and switched to manual control. Freight trains that share the same rail line were also impacted.

(U) DHS Daily Intelligence Highlights, 5 December 2011.


(U) This report has been prepared by the Newark Division of the FBI. Comments and queries may be addressed to the Newark Field Intelligence Group at (973) 792-3000.

10


Distribution

LEO-Newark SIG and New Jersey Regional Operations and Intelligence Center SIG Department of Homeland Security, ICE-Newark Office United States Secret Service, New Jersey Division Port Authority of New York and New Jersey Police Department New Jersey Transit Police Department New Jersey State Police New Jersey Regional Operations and Intelligence Center New Jersey Office of Homeland Security and Preparedness United States Attorney's Office, District of New Jersey New Jersey County Terrorism Coordinators New Jersey County Sheriffs’ and Prosecutors’ Offices New Jersey County and Municipal Police Departments



FBI Customer Satisfaction Survey

Please take a moment to complete this survey and help evaluate the quality, value, and relevance of our product. Your response will help us serve you more effectively and efficiently in the future. Thank you for your cooperation and assistance. Return to: FBI-Newark Division Squad I-2 11 Center Place Newark, NJ 07102

Customer and Product Information Product: Title: Newark Division Weekly Intelligence Highlights Dated: 7 December 2011 Customer Agency: _________________________________________ Relevance to Your Needs 1. The product increased my knowledge of an issue or topic. (Check one) ___5. Strongly Agree ___4. Somewhat Agree ___3. Neither Agree or Disagree ___2. Somewhat Disagree ___1. Strongly Disagree



Actionable Value 2. The product helped me decide on a course of action. (Check one) ___5. Strongly Agree ___4. Somewhat Agree ___3. Neither Agree or Disagree ___2. Somewhat Disagree ___1. Strongly Disagree Timeliness Value 3. The product was timely to my needs. (Check one) ___5. Strongly Agree ___4. Somewhat Agree ___3. Neither Agree or Disagree ___2. Somewhat Disagree ___1. Strongly Disagree Comments (if any): ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________


Documents

FBI Newark Ct Sir - 20111207