Intelligence Fusion Centers

(U//FOUO) New York Fusion Center Historical Pre-Election Terrorist Attacks Analysis

In light of the upcoming 2012 US presidential election, NYSIC is providing a snapshot of four historical cases where terrorists conducted attacks in conjunction with upcoming local or national elections, including the tactics, techniques, and procedures (TTP) used and how the attacks met or failed to meet the terrorists’ goals of altering the outcome of the election.

(U//FOUO) Los Angeles Fusion Center: Liquid Carbon Dioxide Leaks Pose Risks to Public

Within the past year, first responders and members of the public have died of asphyxiation, or fallen ill, following accidental inhalation of concentrated carbon dioxide (CO2) gas in public locations. At least two recent incidents are connected with significant gas leaks caused by the failure of liquid CO2 lines connected to beverage dispensers in commercial facilities. Emergency personnel responding to medical or service calls can use signs and symptoms to determine possible CO2 exposure and correspondent risks to first responders.

(U//FOUO) New Jersey Fusion Center Incident Assessment: Mass Shooting at Colorado Movie Theater

James Eagan Holmes, a 24-year-old male, allegedly shot and killed12 people and wounded approximately 38 more after opening fire in a crowded movie theater during a showing of the new Batman movie, “The Dark Knight Rises.” The shooting erupted during the midnight showing at the multiplex in Aurora, Colorado, not far from Denver, where a large crowd had gathered, some dressed as characters from the highly anticipated Batman sequel. Holmes began the attack by throwing two gas canisters into the theater after entering through an exit door that had been propped open. Witnesses stated many assumed it was a promotional stunt related to the movie and did not initially react. After both canisters had deployed, Holmes commenced shooting into the crowd.

(U//FOUO) New Jersey Fusion Center: Attack on Afghan Resort Demonstrates Vulnerability of Hotels

A recent terrorist attack on a resort hotel in Afghanistan demonstrates the vulnerability of hotels and other “soft” targets to these types of assaults. On June 22, 2012, Afghan forces retook a lakeside hotel outside of Kabul from a Taliban suicide assault team that was holding dozens of civilian hostages. The Taliban claimed credit for the attack, calling the hotel and others near it a “hub of obscenity and vulgarity.”

(U//FOUO) Central Florida Intelligence Exchange Online Jihadist Calls for Arson Attacks

Past statements from al‐Qa’ida Central, as well as their franchise groups, highlight the importance of targeting the U.S. economy as part of their strategy of confronting the West. Most recently, militant propagandists, such as Adam Gadahn, American mouthpiece for Al‐Qa’ida in Pakistan, have made statements advising Muslims in the West to “…undermine the West’s already struggling economies with…targeted attacks on symbols of capitalism which will shake consumer confidence and stifle spending”. Additionally, in November 2010, al‐Qa’ida in the Arabian Peninsula introduced the “strategy of a thousand cuts”, where they encouraged their mujahideen brothers to “attack the enemy with smaller, but more frequent operations…the aim is to bleed the enemy to death”.

(U//FOUO) New York Fusion Center Bulletin: Use of Cloned Vehicles in Terrorist or Criminal Operations

Criminals and terrorists have long used official vehicles, “cloned” vehicles (those painted/decorated to appear official), or seemingly legitimate vehicles (e.g. livery, maintenance or delivery) to circumvent security measures at targets of interest. There have been numerous terrorist attacks overseas wherein operatives used police vehicles or ambulances (or vehicles painted to resemble same) to conceal improvised explosive devices. Within the US Homeland, the most common use of cloned official vehicles by criminals is for drug smuggling; however, at least one terrorist targeting New York envisioned misusing vehicles that would appear to be legitimate, in order to conduct an attack. Dhiren Barot, an al Qaeda operative involved in the 2004 Financial Centers Plot, allegedly plotted to detonate three limousines packed with explosives and gas cylinders in underground parking lots in Manhattan. While the limousines would not have masqueraded as “official vehicles” per se they would have appeared to be legitimately entering those parking structures.

(U//FOUO) DHS Terrorist Interest in Using Fire as a Weapon

International terrorist groups and violent extremists have long shown interest in using fire as a weapon due to the low cost and limited technical expertise required, the potential for causing large-scale damage, and the low risk of apprehension. Recent encouragement of use of this tactic by terrorist groups and violent extremists in propaganda materials and extremist Web forums is directed at Western audiences and supports Homeland attacks.

(U//FOUO) FBI Inspire Magazine Encourages the Use of Wildfires in Jihad

Al-Qaida in the Arabian Peninsula (AQAP) has released issue 9 of its English-language “Inspire” Magazine. There is a portion of the magazine dedicated to attacking the United States by starting wildfires. The article instructs the audience to look for two necessary factors for a successful wildfire, which are dryness and high winds to help spread the fire. Specific fire conditions that are likely to spread fire quickly are Pinewood, crownfires (where the trees and branches are close together), and steep slope fires (fire spreads faster going up a slope).

(U//LES) Louisiana Fusion Center Slide Fire Fully Automatic AR-15 Converter Bulletin

A new stock is being produced by Slide Solutions as a product named the SSAR-15. The product, a bump fire stock, is being sold over the internet and at local gun stores which easily converts special models of the AR to a fully automatic weapon. Information has been received that a Louisiana gun store in Lafayette has ten of them in stock and are selling them for around $380.00 a piece.

(U//FOUO) Michigan Fusion Center Energy Substations Copper Thefts Bulletin

Over the last week, approximately 10 Energy Sector substations in the Marshall and Battle Creek area have been the victims of copper theft. Because the current street value for scrap copper is over $4.00 per pound, electric substations have become lucrative targets. The targeting of substations for copper has been an issue for over a year. The recent thefts from substations in the greater Flint area caused significant power outages to the area and safety issues for first responders. The suspects are stealing the grounding system conductors and other wires stored at the substation at night. This is accomplished by digging up sections of the grounding system conductors and cutting it off from the power units. The process is time-consuming and requires the suspects to go inside the substation perimeter fence. A few sites have experienced repeated offenses of copper theft.

(U//FOUO) San Diego Fusion Center Terrorism Imagery Recognition

Group logos, flags, and other extremist imagery are prevalent throughout most terrorist and extremist groups. Imagery provides a means of evoking existing emotional and historical memories in addition to communicating ideas to potential recruits. Logos and symbols are often used as visual representation of groups and/or their ideology. Print, internet propaganda, tattoos, clothing and accessories, stickers, and other graphic media are the most common representations of extremist imagery. First responders need to be aware of common extremist imagery as it may indicate involvement or support for a particular domestic extremist organization or international terrorist group.

(U//LES) Central Florida Intelligence Exchange CopBlock.org Bulletin

Cop Block, based on the description on their Facebook page, is a “decentralized project supported by a diverse group of individuals united by their shared goals of police accountability, education of individual rights and the dissemination of effective tactics to utilize while filming police.” The project was founded in 2010 by an individual who started Cop Block due to his personal experiences with law enforcement when he was “a victim of the war on drugs, twice”.

(U//FOUO) Massachusetts Fusion Center: Schools Receiving White Powder Letters

Two Massachusetts schools received letters postmarked from Dallas, TX today, March 6, 2012, which contained a white powder. The letters were received at the Memorial Elementary School in Milford, MA and the Dedham Middle School in Dedham, MA. The incidents are being investigated by the FBI and the Department of Fire Services Hazardous Materials Emergency Response Division. Additionally, a letter was also received at a school in Warwick, Rhode Island, one at a school in Fort Kent, Maine and one at a school in Goffstown, NH. On 3/5/2012, a school in CT received a white powder letter. A photo of one of the envelopes is shown below as well as maps of the affected MA schools.

(U//FOUO/LES) Washington D.C. Fusion Center: White Powder Letters Warning March 2012

Since 2007 an unknown subject has sent more than 360 letters containing a white, powder substance to various government officials, public schools and other locations. In May, 2011 20 letters were delivered to public schools in Washington, DC. Over the past two days similar letters have been received in Washington, DC; New York, New York; Dallas, Texas and Enfield, Connecticut.

(U//FOUO) San Diego Fusion Center: The Role of the Firefighter Terrorism Liaison Officer (TLO)

Firefighters’ roles as a first responder and an emergency medical service allow for unique access to people and information, which can generate invaluable tips and leads. Because the presence and effectiveness of firefighters mitigate the impact of a terrorist incident involving massive human casualties, terrorists have historically conducted preoperational planning that target firefighting agencies in order to limit the effectiveness of their reaction capabilities.

Orange County Private Sector Terrorism Response Group TV Guide Weekly Bulletin

An example of a weekly bulletin released by the Orange County Intelligence Assessment Center to local businesses through its “Private Sector Terrorism Response Group” (PSTRG) on January 6, 2012. The PSTRG was created in “December 2001 to create a private sector partnership [that can] effectively address private sector safety, incident management, employee education and public health consequences of potential attacks on the critical infrastructure within Orange County. Two large groups involved with PSTRG are the Orange County Business Council, of which 80% of the major businesses in Orange County are members, and Technet, a consortium of 28 high tech firms.” The bulletin includes excerpts of news articles related to terrorism, a list of upcoming events, including dirt bike events and rodeos, as well as a helpful list of upcoming television shows on the History Channel and other networks that relate in some manner to terrorism.

(U//FOUO) Los Angeles Fusion Center: Steganography Intelligence Bulletin

Steganography—the practice of concealing data within a carrier—may be used to obscure malicious or criminal information and activity from law enforcement. While steganography dates to the fifth century BC, it has long been regarded as, and remains, one of the most advanced forms of clandestine communication. In modern usage, the Internet allows accessibility to, and broad dissemination of, steganography tools, and its application continues to evolve with technology. Understanding steganography in its current state is essential to its identification and detection.

(U//FOUO) DHS-FBI-USSS 2012 State of the Union Address Joint Threat Assessment

We have no specific or credible information indicating a threat to the US Capitol or the National Capital Region (NCR) to coincide with the 2012 State of the Union address. We assess, however, that al-Qa‘ida and its affiliates and allies remain committed to attacking the Homeland and, as of February 2010, al-Qa‘ida identified the NCR and the State of the Union address itself as important targets, presumably for attacks. Moreover, homegrown violent extremists (HVEs) as well as lone offenders could view the event as an attractive target, offering the means to inflict casualties and garner extensive media coverage. Detecting homeland plots involving HVEs and lone offenders continues to challenge law enforcement and intelligence agencies due to the operational independence of the perpetrators, which can reduce or eliminate preoperational indicators.

(U//FOUO/LES) Maryland Fusion Center Criminal Use of Police Scanner Apps and RadioReference.com

During several recent contacts with criminal gang members, an identified Maryland law enforcement agency has heard their radio transmissions broadcast over a suspect’s smartphone. In one incident, officers pursuing a suspect on foot overheard the suspect listening to the pursuing officers’ radio transmission over a smartphone. The radio broadcasts of the agency’s primary secure law enforcement channel had an approximate delay of three seconds on the suspect’s smartphone. Further investigation revealed that the general public, as well as criminal gang members and associates, are utilizing the website www.radioreference.com to listen to law enforcement secure channels streaming via the Internet. Registration and access to the site is free, with advanced features available to premium subscribers. A customer is able to search radio frequencies throughout the country by state, metro area, city and/or zip code. The website advertises a search for trunked frequencies as well. The frequencies are obtained over the Internet and any cell phone that has web access can listen in.

(U//FOUO) Los Angeles Fusion Center: Detecting and Mitigating Cyber Threats

US citizens and assets – including the White House, the Central Intelligence Agency, InfraGard, the state of Arizona, and major defense contracting companies – experienced high-profile cyber threats and attacks in the first half of 2011. Most of the tactics and techniques used were not new, however the increase in attacks during the past few months exemplifies the growth of cyber incursions and reinforces the need to be aware of risks and mitigation techniques associated with cyber threats.

(U//FOUO/LES) Los Angeles Fusion Center: Methods to Defeat Law Enforcement Crowd Control

The purpose of this bulletin is officer awareness. Officers should know that instigators involved in violent demonstrations might be familiar with, and might try to apply, techniques from the “Crowd Control and Riot Manual.” The handbook, from Warrior Publications teaches protestors how to defeat law enforcement crowd control techniques. Although it does not address specific groups or organizations, the information is widely applicable.

(U//FOUO) Georgia Fusion Center: Suspicious Incident at Haralson County Water Treatment Facility

The Georgia Information Sharing and Analysis Center (GISAC) is releasing this informational bulletin to enhance the situational awareness of law enforcement and security personnel with regard to a highly suspicious break-in incident that occurred on 24 October 2011 at the Haralson County Water Treatment Facility. During this incident, a subject broke in to the facility and was recorded (via security camera) taking pictures of the facility’s chlorination system, including the chlorine tank. In light of this highly suspicious incident, GISAC is urging facilities to be vigilant in their security measures and report any suspicious activity regarding water treatment facilities, or other critical infrastructure as soon as possible.