Department of Homeland Security

Department of Homeland Security, Federal Bureau of Investigation, National Counterterrorism Center

DHS-FBI-NCTC Bulletin: Acid Attacks Potential Opportunistic Threat and Treatment Awareness

The number of criminal and gang-related assaults involving acid or other corrosive substances has risen sharply in some Western countries. As of July 2017, police statistics in England indicate assaults and threats involving corrosives have risen from 183 in 2012 to more than 500 this year, according to open source reporting. Although there has been minimal specific interest by terrorists in acid attacks to date, we judge the increase in criminal incidents coupled with recent English-language terrorist messaging encouraging attacks using acid may spur opportunistic terrorist use of the tactic, underscoring the potential threat and importance of an immediate on-scene emergency response.

Read more →

Intelligence Fusion Centers

(U//FOUO) Northern California Fusion Center: Violent Tactics Showcased at Berkeley Riots Likely to be Used at Future Demonstrations

Tactics used by violent Anti-fascists at events in Berkeley on 1 February, 4 March, and 15 April 2017 highlight their ability to exploit peaceful protests with coordinated violent demonstrations, attack law enforcement personnel, destroy property, and conduct information campaigns to advance their socio-political goals. This Advisory Bulletin is intended to inform law enforcement involved in operational planning and event safety at gatherings that violent anti-fascist elements may target.

Read more →

Department of Homeland Security

DHS Infrastructure Assessment: Electric Vehicle Charging Stations

Electric vehicle (EV) usage continues to increase in the United States, along with its supporting infrastructure. As EVs increase in market share, issues like charging speed and battery capacity will drive future development of EV charging technology. As EV demand increases, manufacturers will continue to develop, build, and deploy additional Internet-connected charging stations and new connected technologies to satisfy demand.

Read more →

Customs and Border Protection

Customs and Border Protection Alert: Fentanyl Analogues Not Resistant to Narcan (Naloxone)

Contrary to recent news reporting, there are no fentanyl analogues resistant to Naloxone. News reports indicated a “new” fentanyl analogue, acrylfentanyl, was “extremely powerful” and implied it resisted Naloxone’s effects. However, acrylfentanyl binds to the same receptors within the human body as fentanyl, meaning correctly administered Naloxone is effective against it.

Read more →

Department of Homeland Security

(U//FOUO) DHS Reference Aid: Overview of Recently Successful or Arrested HVEs’ Radicalization to Violence

This Reference Aid is based on I&A’s review of the radicalization to violence of 39 US homegrown violent extremists (HVEs) who either successfully carried out or were arrested before attempting to carry out attacks in the Homeland between 1 January 2015 and 31 December 2016. It is intended to inform federal, state, local, tribal, and territorial counterterrorism, law enforcement, and countering violent extremism (CVE) officials. For additional information about these HVEs, please see the classified I&A Intelligence Assessment “(U//FOUO) Commonalities in HVEs’ Radicalization to Violence Provide Prevention Opportunities,” published 10 February 2017.

Read more →

Department of Homeland Security, Federal Bureau of Investigation, National Counterterrorism Center

(U//FOUO) DHS-FBI-NCTC Guide: Terrorist Attack Planning Cycle – A Homeland Case Study

This case study is an examination of behaviors that resulted in a disrupted terrorist attack, revealing a cycle of planning and preparation that could provide indicators for preventing similar attempts. The terrorist attack planning cycle is not a static, linear process but rather could begin in any of the several stages with variances in details, sequence, and timing. An individual’s mobilization to violence often provides observable behavioral indicators such as, pre-attack surveillance, training, and rehearsal. The indicators potentially allow third-party observers and law enforcement to identify individuals moving to violence, circumstances that may allow for disruption of planned attacks. This product is intended to cultivate an awareness of the planning cycle among stakeholders for identification, mitigation, and disruption of attack planning.

Read more →

Department of Homeland Security, Federal Bureau of Investigation, National Counterterrorism Center

DHS-FBI-NCTC Guide: International Partnerships Necessary To Mitigate ISIS’s Organ Harvesting for Terrorist Funding

The Islamic State of Iraq and ash-Sham (ISIS) is attempting to obtain money from organ harvesting, including from its own injured members, captives, and deceased individuals. Identification, prevention, and interdiction of organ harvesting and trafficking is a highly complex issue which may be effectively addressed through international partnerships among governmental, health, law enforcement, legal, and private-sector entities.

Read more →

Department of Homeland Security, Federal Bureau of Investigation, National Counterterrorism Center

(U//FOUO) DHS-FBI-NCTC Guide: Cyber Threats to First Responders are a Persistent Concern

We assess with moderate confidence that cyber actors, including those who support violent extremism, are likely to continue targeting first responders on the World Wide Web, including by distributing personally identifiable information (PII) for the purpose of soliciting attacks from willing sympathizers in the homeland, hacking government websites, or attacking 911 phone systems to hinder first responders’ ability to respond to crises.

Read more →

Delaware, Intelligence Fusion Centers

(U//FOUO) Delaware Fusion Center: Officer Safety Smart Watches

The Delaware State Police (DSP) Intelligence Unit is providing the following information for officer safety and situational awareness. Officers should be mindful, when placing prisoners in custody, of smart watches and similar devices that can connect via Bluetooth to a cellular device. Smart watches have the capability to both make and receive phone calls and text messages, as well as erasing same. This could cause an issue if a cellular device and it’s contents are being used as evidence. Through experimentation at Troop 7, it was determined that if a prisoner is in the detention area and the phone is seized, the watch could still be operational.

Read more →

Department of Homeland Security

DHS Electromagnetic Pulse (EMP) Protection and Restoration Guidelines for Equipment and Facilities

The EMP protection guidelines presented in this report were initially developed by Dr. George H. Baker, based on his previous work where he led the Department of Defense program to develop EMP protection standards while at the Defense Nuclear Agency (DNA) and the Defense Threat Reduction Agency (DTRA). He is currently serving as a consultant to the Department of Homeland Security (DHS) and is emeritus professor of applied science at James Madison University (JMU). He presently serves on the Board of Directors of the Foundation for Resilient Societies, the Board of Advisors for the Congressional Task Force on National and Homeland Security, the JMU Research and Public Service Advisory Board, the North American Electric Reliability Corporation GMD Task Force, the EMP Coalition, and as a Senior Scientist for the Congressional EMP Commission.

Read more →

Department of Homeland Security

DHS Report: Threats Posed by Autonomous Vehicles

Autonomous vehicles collect and process data from their environments, taking actions that can either help or replace drivers. OCIA assesses that these vehicles will benefit society by improving road safety and reducing deaths, injuries, and costs associated with collisions. Autonomous vehicles will also likely lead to a decrease in traffic congestion, decreasing fuel consumption and emissions per mile, and helping save drivers’ money and time. However, as vehicles become increasingly connected and a part of the Internet of Things, vulnerabilities and potential consequences are likely to increase unless cybersecurity is better integrated into vehicle design and development. Legal and regulatory gaps exist on issues such as collision liability and safety standards; if these gaps are not addressed, cities and states might implement their own laws and regulations, creating inefficiencies for automobile manufacturers, shipping companies, and drivers. Moreover, fully autonomous vehicles will likely have an adverse effect on the professional driver workforce when bus, taxi, and truck drivers are eventually replaced.

Read more →

Department of Homeland Security

DHS Report: Artificial Intelligence Risk to Critical Infrastructure

Artificial Intelligence (AI) is an emerging risk that will affect critical infrastructure (CI) as it becomes common throughout the United States. The purpose of this research paper is to analyze the narratives about AI to understand the prominence of perceived key benefits and threats from AI adoption and the resulting implications for infrastructure security and resilience. Narratives are strongly held beliefs, and understanding them will help decision makers mitigate potential consequences before they become significant problems.

Read more →

Drug Enforcement Administration, Intelligence Fusion Centers

(U//LES) EPIC Bulletin: Transnational Criminal Organizations (TCOs) Continue to Profit from Marijuana Sales in Legalized Markets

In January 2016, EPIC published Intelligence Note 02303-16a, this product provided analysis of data provided by the Drug Enforcement Administration (DEA) and open source reporting that indicated Transnational Criminal Organizations (TCOs) continued to operate and profit from marijuana sales in legalized U.S. marijuana markets. EPIC research further showed that legalization of marijuana in some U.S. markets had not adversely impacted TCO profitability in marijuana markets, and that the effort of legalization had conversely brought new opportunities for illicit profits from marijuana sales. As of January 2017, EPIC research indicates that TCOs continue to exploit legalized marijuana markets in the United States.

Read more →

Department of Homeland Security

(U//FOUO) DHS Bulletin: Food Product Adulteration Within Reach of Violent Extremists and Insiders

Terrorist and violent extremist groups have long expressed interest in poisoning and adulterating food and beverage supplies in the West but rarely use this as a tactic. Nonetheless, recent incidents in Europe and Africa underscore the continued interest by some groups in targeting food products at point-of-sale, distribution, and storage. The mere threat of product adulteration in the Homeland almost certainly would cause psychological and economic harm. While we have not seen any specific, credible terrorist threats against Homeland food production and distribution infrastructure, we cannot rule out the possibility of inspired violent extremists or disgruntled insiders attempting to adulterate or poison food and beverages with commonly available toxic industrial chemicals or crude biological toxins due to the relative ease of product manipulation, especially at the last point of sale, which criminal actors have demonstrated consistently in the past.

Read more →

Department of Homeland Security

(U//FOUO) DHS Report: Ransomware Goals of Malicious Actors and Current System Vulnerabilities

OCIA assesses that if specific industrial control systems (ICS) were successfully infected with ransomware, it could affect the ability of certain sectors to provide real-time management and control of large networks of geographically scattered equipment. Although security researchers have demonstrated the possibility of ransomware targeting control systems, OCIA assesses that such an attack is highly unlikely given the higher success rate against consumer and business systems, the likelihood that business and process control networks are segmented, and the ability for operators to take a control system out of service and employ manual overrides.

Read more →

Department of Homeland Security

(U//FOUO) DHS Report: Potential Impacts of WannaCry Ransomware on Critical Infrastructure

On May 12, 2017, organizations across the world reported ransomware infections impacting their computer systems. The infections, caused by a ransomware strain referred to as WannaCry, restricts users’ access to a computer and demands a ransom to unlock it. The U.S. Department of Justice defines ransomware as, a type of malicious software cyber actors use to deny access to systems or data until the ransom is paid. After the initial infection, ransomware attempts to spread through systems and networks.

Read more →

California, Intelligence Fusion Centers

(U//FOUO) Los Angeles Joint Regional Intelligence Center: Vehicle Ramming Attacks Increasing

Use of vehicles by violent extremists for ramming attacks has increased steadily, while use of vehicle-borne improvised explosive devices (VBIEDs) remains rare outside the Middle East. Given the ease with which ramming attacks can be accomplished, it is likely use of this tactic will continue to rise. Unlike VBIEDs, ramming attacks require little specialized training or skill, present minimal risk of detection when acquiring the weapon, and offer flexibility with regard to preparation, timing, and target. Foreign terrorist organizations (FTOs) have pointedly encouraged use of vehicle ramming attacks, offering explicit tactical advice on vehicle selection, driving tips to maximize fatalities, and targeting suggestions that include parades, festivals, street fairs, outdoor markets or conventions, political rallies, and other crowded targets of opportunity.

Read more →

Transportation Security Administration

(U//FOUO) TSA Report: Vehicle Ramming Attacks Threat Landscape, Indicators, Countermeasures

Vehicle-ramming attacks are considered unsophisticated, in that a perpetrator could carry out such an attack with minimal planning and training. It is likely that terrorist groups will continue to encourage aspiring attackers to employ unsophisticated tactics such as vehicle-ramming, since these types of attacks minimize the potential for premature detection and could inflict mass fatalities if successful. Furthermore, events that draw large groups of people—and thus present an attractive vehicle ramming target—are usually scheduled and announced in advance, which greatly facilitates attack planning and training activities.

Read more →

Department of Homeland Security

DHS Guide: Risks to Critical Infrastructure Using Cloud Services

Cloud services offer a number of benefits such as scalability, high availability, and decreased ownership cost. As a result, owners and operators in several critical infrastructure sectors such as Communications, Energy, Financial Services, Information Technology, and Transportation Services have migrated in-house computing resources to cloud infrastructures. However, cloud service environments still possess many of the same potential vulnerabilities associated with internally hosted environments, as well as additional exploits to virtual systems or networks. Owners and operators of critical infrastructure need to fully understand the risk environment as they address current cloud services and consider additional migration.

Read more →

Department of Homeland Security

(U//FOUO) DHS Critical Infrastructure Note: Healthcare and Public Health Sector Cyberdependencies

The Department of Homeland Security (DHS) assesses that given the high value of patient information and proprietary data on the black market, the Healthcare and Public Health Sector will continue to be one of the primary targets for malicious cyber actors. Stolen health data sells on the black market for more than 10 to 20 times the price of stolen credit card data. DHS assesses that growth in the medical device market over the next 4 years will result in more devices connected to the Internet, and an increase in the number of cyber-related incidents that target those devices. This is partly because manufacturers do not place enough emphasis on the security of medical devices.

Read more →

Regional Information Sharing Systems

Regional Organized Crime Information Center Research Report: War on Cops

It seemed as if war had been declared on cops. First a sniper in Dallas and then an active shooter in Baton Rouge. “It has been a tough week physically and emotionally,” said Senior Corporal Trevor Perez, one of a couple dozen Dallas police officers and honor guard members to make the seven-hour trip to Baton Rouge to attend the funerals of Baton Rouge police officers, in this case that of Matthew Gerald. All the more tough because the corporal and his colleagues had just recently paid their respects at nearly a dozen similar funerals back in Texas.

Read more →

Department of Homeland Security

(U//FOUO) DHS Intelligence Note: Unknown Cyber Actors Target US Water and Sewage Authority Network

An unidentified actor or actors between November 2016 and January 2017 targeted a US water and sewage authority’s network, resulting in excessive cellular charges and unusual traffic on ports 10000 and 9600, according to an FBI source with excellent access who spoke in confidence but whose reliability cannot be determined. The FBI source indicated that four of the seven devices on the authority’s cellular data plan were impacted with high data usage, which was likely a result of compromised network devices. The November 2016–December 2016 billing cycle totaled $45,000, and the December 2016–January 2017 billing cycle totaled $53,000.

Read more →