Author Archive for Public Intelligence

Archistrategos.

Department of Homeland Security

DHS National Cybersecurity and Communications Integration Center: Suspicious “Invoic” Email Sent to Government Personnel

On 15 October 2014, a phishing email was dispersed to a wide variety of government employees. NCCIC has also received a number of reports indicating that members within the Education Sector and Financial Sector; International, State, Local, and Tribal organizations have also received similar email messages. The email suggested that the recipient had an unpaid debt and the attachment was an invoice showing the debt information. The subject line reads “UNPAID INVOIC” and the content simply instructs recipients to open the attachment which is a PDF file that is believed to be malicious. Rather than installing malware files from the PDF file itself, it appears to use embedded JavaScript within the file to redirect victims to a malicious website where additional malware can be installed.

Read more →

California

Modesto Police Department Correspondence with Predictive Policing Company PredPol, Inc.

A collection of correspondence and contract information between the Modesto Police Department and PredPol, Inc., a company that sells software used for so-called predictive policing. The material was obtained by journalist Darwin BondGraham via the California Public Records Act. BondGraham’s Twitter account was suspended following a complaint issued by PredPol, Inc. after he posted images of a few pages from the documents. It is unclear what specific content was the reason for the complaint.

Read more →

U.S. Army

(U//FOUO) U.S. Army Military Intelligence Battalion Interrogation Manual

TC 2-22.304 provides doctrinal guidance concerning the military intelligence (MI) battalion (interrogation). The TC complements existing doctrine, in particular FM 2-22.3, and incorporates lessons learned from recent operations. The MI battalion (interrogation) is specifically designed to operate within a joint interrogation and debriefing center (JIDC). The battalion command, staff, personnel, and equipment form the nucleus of the JIDC. The battalion is task-organized and augmented with additional personnel from other Services, Government civilians, and civilian contractors to form a JIDC.

Read more →

Central Intelligence Agency

Senate Select Committee on Intelligence Study of the CIA Detention and Interrogation Program

On April 3, 2014, the Senate Select Committee on Intelligence voted to send the Findings and Conclusions and the Executive Summary of its final Study on the CIA’s Detention and Interrogation Program to the President for declassification and subsequent public release. This action marked the culmination of a monumental effort that officially began with the Committee’s decision to initiate the Study in March 2009, but which had its roots in an investigation into the CIA’s destruction of videotapes of CIA detainee interrogations that began in December 2007. The full Committee Study, which totals more than 6,700 pages, remains classified but is now an official Senate report. The full report has been provided to the White House, the CIA, the Department of Justice, the Department of Defense, the Department of State, and the Office of the Director of National Intelligence in the hopes that it will prevent future coercive interrogation practices and inform the management of other covert action programs.

Read more →

Federal Bureau of Investigation

FBI Cyber Bulletin: Korean Malware Potentially Used in Sony Pictures Attack

Destructive malware used by unknown computer network exploitation (CNE) operators has been identified. This malware has the capability to overwrite a victim host’s master boot record (MBR) and all data files. The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods. Analysis of this malware is presented to provide the computer network defense (CND) community with indicators of this malware.

Read more →

News

DHS Analysis Finds ISIL Most Likely to Conduct IED, Small Arms Attacks in Western Countries

An intelligence assessment released last month by the Department of Homeland Security’s Office of Intelligence and Analysis found that a domestic terrorist attack conducted by individuals affiliated with or inspired by the Islamic State of Iraq and the Levant (ISIL) would most likely “employ tactics involving edged weapons, small arms, or improvised explosive devices (IEDs).” The assessment, which was obtained by Public Intelligence, was released in October following several recent attacks conducted in Europe and Australia by individuals sympathetic to ISIL. Based on a review of these and other planned attacks, analysts at DHS evaluated the tactics and targets, as well as operational security measures employed in order to determine “tactics, targets, and tradecraft that potentially could be used in the Homeland by individuals associated with or inspired” by ISIL.

Read more →

Department of Homeland Security

(U//FOUO) DHS Intelligence Assessment: Potential Tactics and Targets in ISIL-Linked Western Attacks

This Assessment highlights the tactics, targets, and tradecraft that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL); we do not address the likelihood of an attack against the United States by the group. This Assessment is intended to support the activities of DHS to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.

Read more →

White House

White House Review of Federal Support for Local Law Enforcement Equipment Acquisition

For decades, the federal government has provided billions of dollars in equipment to state and local law enforcement agencies (LEAs) through excess equipment transfers, asset forfeiture programs and federal grants. Particularly in the years since September 11, 2001, Congress and the Executive Branch have steadily increased spending and support for these programs, in light of legitimate concerns about the growing threat of terrorism, shrinking local budgets, and the relative ease with which some criminals are able to obtain high-powered weapons. These programs have significantly expanded over decades across multiple federal agencies without, at times, a commensurate growth in the infrastructure required to standardize procedures governing the flow of equipment from the federal government to LEAs. At the same time, training has not been institutionalized, specifically with respect to civil rights and civil liberties protections, or the safe use of equipment received through the federal government. Concerns over the lack of consistent protections have received renewed focus and attention in light of the recent unrest in Ferguson, Missouri.

Read more →

Department of Justice

Implementing a Body-Worn Camera Program: Recommendations and Lessons Learned

Police leaders who have deployed body-worn cameras say there are many benefits associated with the devices. They note that body-worn cameras are useful for documenting evidence; officer training; preventing and resolving complaints brought by members of the public; and strengthening police transparency, performance, and accountability. In addition, given that police now operate in a world in which anyone with a cell phone camera can record video footage of a police encounter, body-worn cameras help police departments ensure events are also captured from an officer’s perspective.

Read more →

Drug Enforcement Administration

DEA National Drug Threat Assessment Summary 2014

The 2014 NDTA Summary uses information provided by 1,226 state and local law enforcement agencies through the 2014 National Drug Threat Survey (NDTS). At a 95 percent confidence level, the 2014 NDTS results are within 2.59 percentage points of the estimates reported. NDTS data used in this report do not imply that there is only one drug threat per state or region or that only one drug is available per state or region. A percentage given for a state or region represents the proportion of state and local law enforcement agencies in that state or region that identified a particular drug as their greatest threat or as available at low, moderate, or high levels.

Read more →

U.S. Air Force

U.S. Air Force Cyber Warfare Operations Education and Training Plan

Training guide released in November 2014 for airmen who perform “duties to develop, sustain, and enhance cyberspace capabilities to defend national interests from attack and to create effects in cyberspace to achieve national objectives. Conduct Offensive Cyberspace Operations (OCO) and Defensive Cyberspace Operations (DCO) using established tactics, techniques and procedures (TTPs) to achieve COCOM and national objectives. Executes command and control (C2) of assigned cyberspace forces and de-conflict cyberspace operations across the kinetic and non-kinetic spectrum. Supports cyberspace capability development, testing and implementation. Partners with DoD, interagency and Coalition Forces to detect, deny, disrupt, deceive, and mitigate adversarial access to sovereign national cyberspace systems.”

Read more →

Department of Justice

Bureau of Justice Assistance Managing Large-Scale Security Events Planning Guide

Large-scale events provide local governments with a number of valuable opportunities, including increasing revenue, revitalizing a city, and providing an increased sense of community. With these benefits comes greater responsibility for local law enforcement to ensure the public’s safety. When law enforcement executives are tasked with managing a large event, they can maximize their efforts by learning from other agencies and adopting proven practices. Too often, however, past lessons learned are not documented in a clear and concise manner. To address this information gap, the U.S. Department of Justice’s Bureau of Justice Assistance worked in partnership with CNA to develop this Planning Primer.

Read more →

Department of Homeland Security

(U//FOUO) DHS Sensitive Compartmented Information Facility (SCIF) Construction Standards

This handbook contains standard security designs and procedures common to Sensitive Compartmented Facilities (SCIF) and physical security construction standard and established by the Director National Intelligence (DNI) for protection of classified intelligence information. Users should refer to Director of Central Intelligence Directives (DCIDS) and other documents cited under Authorities for guidance on specific security functions.

Read more →

Afghanistan, United Nations

UNODC Afghanistan Opium Survey 2014

The Afghanistan Opium Survey is implemented annually by the Ministry of Counter Narcotics (MCN) of Afghanistan in collaboration with the United Nations Office on Drugs and Crime (UNODC). The survey team collects and analyses information on the location and extent of opium cultivation, potential opium production and the socio-economic situation in rural areas. Since 2005, MCN and UNODC have also been involved in the verification of opium eradication conducted by provincial governors and poppy-eradication forces. The results provide a detailed picture of the outcome of the current year’s opium season and, together with data from previous years, enable the identification of medium- and long-term trends in the evolution of the illicit drug problem. This information is essential for planning, implementing and monitoring the impact of measures required for tackling a problem that has serious implications for Afghanistan and the international community.

Read more →

National Institute of Standards and Technology

NIST Special Publication 800-150: Guide to Cyber Threat Information Sharing Draft

As the magnitude and complexity of cyberspace increases, so too does the threat1 landscape. Cyber attacks have increased in both frequency and sophistication resulting in significant challenges to organizations that must defend their infrastructure from attacks by capable adversaries. These adversaries range from individual attackers to well-resourced groups operating as part of a criminal enterprise or on behalf of a nation-state. These adversaries are persistent, motivated, and agile; and employ a variety of tactics, techniques, and procedures (TTPs) to compromise systems, disrupt services, commit financial fraud, expose sensitive information, and steal intellectual property. To enhance incident response actions and bolster cyber defenses, organizations must harness the collective wisdom of peer organizations through information sharing and coordinated incident response. This publication expands upon the guidance introduced in Section 4, Coordination and Information Sharing of NIST Special Publication (SP) 800-61, Computer Security Incident Handling Guide and explores information sharing, coordination, and collaboration as part of the incident response life cycle.

Read more →

Florida, Intelligence Fusion Centers

(U//FOUO) CFIX Bulletin: Jihadist Propaganda Provides Guidance for Attacks on Law Enforcement

Propaganda providing guidance and/or encouraging “individual jihad” or small cell operations against the West continues to be a prevalent theme in jihadist messaging. This bulletin was created by the CFIX in order to address recent propaganda from the Islamic State and its supporters which provides guidance on targeting law enforcement officers. The CFIX bases its analysis in this bulletin from open source reporting and internet postings with varying degrees of reliability, especially in regards to the true intention and capabilities of terrorist organizations and their supporters. This information is intended to support local, state and federal government agencies along with other entities in developing / prioritizing protective and support measures relating to an existing or emerging threat to homeland security.

Read more →

Florida, Intelligence Fusion Centers

(U//FOUO) Central Florida Information Exchange Brief: Ebola Guidance for Law Enforcement

The purpose of this brief is to provide law enforcement, first responders, corrections officers, and other personnel who interact with the general public, with guidance and protective measures when coming in contact with individuals demonstrating symptoms of the Ebola Virus Disease (EVD). Personnel who become familiar with the identification of possible exposure, proper response protocols and protective measures will be better prepared to respond, secure, transport and decontaminate to prevent further spread of this deadly disease.

Read more →

Defense Security Service

Defense Security Service Counterintelligence Best Practices for Cleared Industry

United States cleared industry is a prime target of many foreign intelligence collectors and foreign government economic competitors. Cleared employees working on America’s most sensitive programs are of special interest to other nations. The number of reported collection attempts rises every year, indicating an increased risk for industry. While any geographic region can target sensitive or classified U.S. technology, DSS has consistently found that the majority of suspicious contacts reported by cleared industry originate from East Asia and the Pacific regions. Every region has active collectors. Cleared contractors should remain vigilant regardless of the collector’s assumed country of origin.

Read more →

Africa, Guinea, Liberia, Mali, Sierra Leone, United Nations

UN Use of Foreign Military and Civil Defence Assets (MCDA) for Ebola Response in West Africa

The current Ebola virus disease outbreak was declared a ‘Public Health Emergency of International Concern’ by WHO on 8 August 2014. On 8 September, the UN Secretary-General activated the UN system-wide crisis framework and subsequently announced the establishment of the ‘United Nations Mission on Ebola Emergency Response’ – UNMEER. UNMEER is described as a ‘unified mission’, different from a ‘regular’ or ‘integrated’ mission, with HQ UNMEER in Accra, Ghana, and offices in each of Liberia, Sierra Leone and Guinea.

Read more →