United States

(U//FOUO) Delaware Fusion Center: Officer Safety Smart Watches

The Delaware State Police (DSP) Intelligence Unit is providing the following information for officer safety and situational awareness. Officers should be mindful, when placing prisoners in custody, of smart watches and similar devices that can connect via Bluetooth to a cellular device. Smart watches have the capability to both make and receive phone calls and text messages, as well as erasing same. This could cause an issue if a cellular device and it’s contents are being used as evidence. Through experimentation at Troop 7, it was determined that if a prisoner is in the detention area and the phone is seized, the watch could still be operational.

New Jersey Office of Homeland Security Guide: Anarchist Extremists – Antifa

Self-described Antifa groups have been established across the United States and in several major cities, including New York, Philadelphia, Chicago, and San Francisco. A majority of New Jersey-based anarchist groups are affiliated with the Antifa movement and are opposed to “fascism,” racism, and law enforcement. Antifa groups coordinate regionally and have participated in protests in New York City and Philadelphia. There are three loosely organized chapters in New Jersey, known as the North Jersey Antifa, the South Jersey Antifa, and the HubCity Antifa New Brunswick (Middlesex County).

DHS Electromagnetic Pulse (EMP) Protection and Restoration Guidelines for Equipment and Facilities

The EMP protection guidelines presented in this report were initially developed by Dr. George H. Baker, based on his previous work where he led the Department of Defense program to develop EMP protection standards while at the Defense Nuclear Agency (DNA) and the Defense Threat Reduction Agency (DTRA). He is currently serving as a consultant to the Department of Homeland Security (DHS) and is emeritus professor of applied science at James Madison University (JMU). He presently serves on the Board of Directors of the Foundation for Resilient Societies, the Board of Advisors for the Congressional Task Force on National and Homeland Security, the JMU Research and Public Service Advisory Board, the North American Electric Reliability Corporation GMD Task Force, the EMP Coalition, and as a Senior Scientist for the Congressional EMP Commission.

DHS Report: Threats Posed by Autonomous Vehicles

Autonomous vehicles collect and process data from their environments, taking actions that can either help or replace drivers. OCIA assesses that these vehicles will benefit society by improving road safety and reducing deaths, injuries, and costs associated with collisions. Autonomous vehicles will also likely lead to a decrease in traffic congestion, decreasing fuel consumption and emissions per mile, and helping save drivers’ money and time. However, as vehicles become increasingly connected and a part of the Internet of Things, vulnerabilities and potential consequences are likely to increase unless cybersecurity is better integrated into vehicle design and development. Legal and regulatory gaps exist on issues such as collision liability and safety standards; if these gaps are not addressed, cities and states might implement their own laws and regulations, creating inefficiencies for automobile manufacturers, shipping companies, and drivers. Moreover, fully autonomous vehicles will likely have an adverse effect on the professional driver workforce when bus, taxi, and truck drivers are eventually replaced.

DHS Report: Artificial Intelligence Risk to Critical Infrastructure

Artificial Intelligence (AI) is an emerging risk that will affect critical infrastructure (CI) as it becomes common throughout the United States. The purpose of this research paper is to analyze the narratives about AI to understand the prominence of perceived key benefits and threats from AI adoption and the resulting implications for infrastructure security and resilience. Narratives are strongly held beliefs, and understanding them will help decision makers mitigate potential consequences before they become significant problems.

DEA Drug Slang Code Words

This Drug Enforcement Administration (DEA) Intelligence Report contains information from a variety of law enforcement and open sources. It is designed as a ready reference for law enforcement personnel who are confronted by many of the hundreds of slang terms used to identify a wide variety of controlled substances, designer drugs, and synthetic compounds. Every effort has been made to ensure the accuracy and completeness of the information presented. However, due to the dynamics of the ever-changing drug scene, subsequent additions, deletions, and corrections are inevitable. Further addendums to this report will attempt to capture changed terminology, to the extent possible. This compendium of drug slang terms has been alphabetically ordered, and identifies drugs and drug categories in English and foreign language derivations.

FBI Cyber Bulletin: IP Addresses and Domains Used by Iran-Based Cyber Actors to Attack Victims Worldwide

The FBI assesses a group of malicious cyber actors—likely located in Iran—use Virtual Private Server infrastructure hosted in the United States to compromise government, corporate, and academic computer networks based in the Middle East, Europe and the United States. This infrastructure is used in conjunction with identified malicious domains to support a broad cyber campaign which likely includes the use of e-mail spear phishing, social engineering, and malicious Web sites (“watering hole attack”). These cyber actors almost certainly have been involved in this activity since at least early-2015.

DEA Analysis of Overdose Deaths in Pennsylvania 2016

The analysis of drug-related overdose death data plays a pivotal role in law enforcement’s efforts to identify and combat drug suppliers, and ultimately drug abuse and related overdoses. At the most basic level, the drugs that contribute to death are an indicator of drug availability in the user market. Analysis of this data also highlights geographic patterns of abuse and identifies at-risk populations, and when coupled with drug treatment statistics, law enforcement drug seizure data, and public health indicators, allows for multi-disciplinary data-driven decisions regarding resource placement and strategic initiatives.

U.S. Army Mad Scientist Conference Report: The 2050 Cyber Army

The Mad Scientist 2050 Cyber Army project explored the visualization of the Army’s Cyber Force out to 2050 and its ability to address three major objectives of the Army’s Cyberspace Strategy for Unified Land Operations 2025: What does the cyber environment look like in 2040-2050 (how will cyber influence the environment and the population? What will connecting look like / what will they connect to? What are the drivers influencing this or not)? How do we build an Army Cyber Force that can dominate the cyber domain in the context of the multi-domain battle concept to gain a position of relative advantage? How can we build shared goals and expectations as well as develop an understanding of roles and responsibilities in order to build and maintain partnerships with U.S., and international academia, industry, defense departments/ministries and other agencies to enhance cyberspace operations? What new ideas should we be considering? Co-sponsored by the TRADOC G-2 and the Army Cyber Institute at the United States Military Academy, the 2050 Cyber Army project leveraged submitted papers, an on-line technology survey, and a 13-14 September Mad Scientist Conference that generated the insights synthesized in this report.

(U//LES) EPIC Bulletin: Transnational Criminal Organizations (TCOs) Continue to Profit from Marijuana Sales in Legalized Markets

In January 2016, EPIC published Intelligence Note 02303-16a, this product provided analysis of data provided by the Drug Enforcement Administration (DEA) and open source reporting that indicated Transnational Criminal Organizations (TCOs) continued to operate and profit from marijuana sales in legalized U.S. marijuana markets. EPIC research further showed that legalization of marijuana in some U.S. markets had not adversely impacted TCO profitability in marijuana markets, and that the effort of legalization had conversely brought new opportunities for illicit profits from marijuana sales. As of January 2017, EPIC research indicates that TCOs continue to exploit legalized marijuana markets in the United States.

Office of the Director of National Intelligence Countering Foreign Intelligence Threats Implementation and Best Practices Guide

The National Counterintelligence and Security Center (NCSC) is charged with leading and supporting the counterintelligence (CI) and security activities of the U.S. government, the U.S. Intelligence Community, and U.S. private sector entities that are at risk of intelligence collection, penetration, or attack by foreign adversaries and malicious insiders. The capabilities and activities described in this Guide are exemplars of program components delineated as requirements in numerous strategies, policies, and guidelines.

(U//LES) DEA Fentanyl Briefing Guide for First Responders

In the last several years, U.S. Law Enforcement has seen a dramatic increase in the availability of dangerous synthetic opioids. A large majority of these synthetic opioids are structural derivatives of the synthetic drug “fentanyl.” Fentanyl is a synthetic opioid currently listed as a Schedule II prescription drug that mimics the effects of morphine in the human body, but has potency 50–100 times that of morphine. Due to the high potency and availability of fentanyl, both transnational and domestic criminal organizations are increasingly utilizing these dangerous synthetic opioids as an adulterant in heroin and other controlled substances. The presence of these synthetic opioids in the illicit U.S. drug market is extremely concerning as the potency of these drugs has led to a significant increase in overdose incidents and overdose-related deaths throughout the nation.

FBI Cyber Bulletin: Individuals Threatening Distributed Denial of Service of Private-Sector Companies for Bitcoin

An individual or group claiming to be “Anonymous” or “Lizard Squad” sent extortion emails to private-sector companies threatening to conduct distributed denial of service (DDoS) attacks on their network unless they received an identified amount of Bitcoin. No victims to date have reported DDoS activity as a penalty for non-payment.

Defense Intelligence Agency Russia Military Power Report 2017

As part of this vision, DIA has a long history of producing comprehensive and authoritative defense intelligence overviews. In September 1981, Secretary of Defense Caspar Weinberger asked the Defense Intelligence Agency to produce an unclassified overview of the Soviet Union’s military strength. The purpose was to provide America’s leaders, the national security community, and the public a complete and accurate view of the threat. The result: the first edition of Soviet Military Power. DIA produced over 250,000 copies, and it soon became an annual publication that was translated into eight languages and distributed around the world. In many cases, this report conveyed the scope and breadth of Soviet military strength to U.S. policymakers and the public for the first time.

(U//FOUO) DHS Bulletin: Food Product Adulteration Within Reach of Violent Extremists and Insiders

Terrorist and violent extremist groups have long expressed interest in poisoning and adulterating food and beverage supplies in the West but rarely use this as a tactic. Nonetheless, recent incidents in Europe and Africa underscore the continued interest by some groups in targeting food products at point-of-sale, distribution, and storage. The mere threat of product adulteration in the Homeland almost certainly would cause psychological and economic harm. While we have not seen any specific, credible terrorist threats against Homeland food production and distribution infrastructure, we cannot rule out the possibility of inspired violent extremists or disgruntled insiders attempting to adulterate or poison food and beverages with commonly available toxic industrial chemicals or crude biological toxins due to the relative ease of product manipulation, especially at the last point of sale, which criminal actors have demonstrated consistently in the past.

(U//FOUO) DHS Report: Ransomware Goals of Malicious Actors and Current System Vulnerabilities

OCIA assesses that if specific industrial control systems (ICS) were successfully infected with ransomware, it could affect the ability of certain sectors to provide real-time management and control of large networks of geographically scattered equipment. Although security researchers have demonstrated the possibility of ransomware targeting control systems, OCIA assesses that such an attack is highly unlikely given the higher success rate against consumer and business systems, the likelihood that business and process control networks are segmented, and the ability for operators to take a control system out of service and employ manual overrides.

(U//FOUO) DHS Report: Potential Impacts of WannaCry Ransomware on Critical Infrastructure

On May 12, 2017, organizations across the world reported ransomware infections impacting their computer systems. The infections, caused by a ransomware strain referred to as WannaCry, restricts users’ access to a computer and demands a ransom to unlock it. The U.S. Department of Justice defines ransomware as, a type of malicious software cyber actors use to deny access to systems or data until the ransom is paid. After the initial infection, ransomware attempts to spread through systems and networks.

San Bernardino DA Report on Sheriff’s Department Response to 2015 Terror Attack

On December 2, 2015 at about 10:58 am San Bernardino Police began to receive numerous calls of shots fired at the Inland Regional Center located at 1365 South Waterman Avenue in San Bernardino. Initial calls indicated that there were several gunshots heard. Another call reported that there were two or possibly three subjects in all black clothing and masks armed with assault weapons. Within a matter of three to four minutes there were multiple calls reporting that multiple masked subjects had entered in the conference room, located in Building 3 of the Inland Regional Center, and opened fire in the main conference room.

National Guard White Paper: The Role of National Guard Intelligence During Civil Disturbances

Recent large-scale civil disturbances in two states led the respective governors to mobilize state National Guard (NG) forces. These incidents raised questions and concerns about the appropriate and effective use of NG intelligence capabilities to support domestic civil disturbance operations. Domestic missions are no different from overseas missions in that a key requirement for mission success is situational awareness (SA)—leaders and commanders at all levels must be aware of the situation on the ground and have a deep understanding of the operational environment in which their forces are operating and the inherent threats faced in that environment. Overseas, where the threat is by definition foreign, the intelligence component provides the preponderance of threat data. Domestically, defining threat information may entail the collection of information concerning U.S. persons. By law, the military and civilian intelligence components face constraints in the manner they may lawfully collect, disseminate, and retain such information.

U.S. State Department Europe Migrant and Refugee Snapshot March 2017

Since 2014, over 1.6 million migrants and asylum seekers have arrived by sea to Europe. European countries registered over 3.18 million new asylum applications. Over 700,000 applicants were granted a form of protective status, mostly in Germany, France, Sweden, Italy, and the Netherlands, with 450,000 applicants rejected in the same time period, and over 1.1 million pending applications at the end of 2016. Amendments to the Schengen Border Code, proposed in response to terrorist threats, aim to strengthen external borders by requiring systematic database checks at entry and exit.

(U//FOUO) New Jersey Regional Operations and Intelligence Center: Reduce Online Exposure by “Opting-Out”

Law enforcement and public officials should take the following proactive steps to limit the amount of personally identifiable information (PII) that is accessible online. Cyber criminals and extremists, such as the self-proclaimed Islamic State of Iraq and the Levant (ISIL), capture personal information of law enforcement, military, and government officials, and then share it with their associates, encouraging both physical and virtual attacks. The Office of the ROIC Threat Analysis Unit, and the Cyber Threat Intelligence Unit, are providing these “opt-out” guidelines to reduce online exposure from websites that provide or sell PII.

(U//FOUO) Los Angeles Joint Regional Intelligence Center: Vehicle Ramming Attacks Increasing

Use of vehicles by violent extremists for ramming attacks has increased steadily, while use of vehicle-borne improvised explosive devices (VBIEDs) remains rare outside the Middle East. Given the ease with which ramming attacks can be accomplished, it is likely use of this tactic will continue to rise. Unlike VBIEDs, ramming attacks require little specialized training or skill, present minimal risk of detection when acquiring the weapon, and offer flexibility with regard to preparation, timing, and target. Foreign terrorist organizations (FTOs) have pointedly encouraged use of vehicle ramming attacks, offering explicit tactical advice on vehicle selection, driving tips to maximize fatalities, and targeting suggestions that include parades, festivals, street fairs, outdoor markets or conventions, political rallies, and other crowded targets of opportunity.

(U//FOUO) TSA Report: Vehicle Ramming Attacks Threat Landscape, Indicators, Countermeasures

Vehicle-ramming attacks are considered unsophisticated, in that a perpetrator could carry out such an attack with minimal planning and training. It is likely that terrorist groups will continue to encourage aspiring attackers to employ unsophisticated tactics such as vehicle-ramming, since these types of attacks minimize the potential for premature detection and could inflict mass fatalities if successful. Furthermore, events that draw large groups of people—and thus present an attractive vehicle ramming target—are usually scheduled and announced in advance, which greatly facilitates attack planning and training activities.