A guide produced by the Madison Police Department documenting the use of iP-BOX a tool that can unlock iPhones and other iOS devices that have been secured using a simple 4-digit passcode.
United States
National Counterterrorism Center
NCTC Terrorist Identities Datamart Environment (TIDE) Watchlisting Overview
National Counterterrorism Center
(U//FOUO) NCTC Bulletin: Community-Oriented Policing Offers Framework for Counterradicalization
The community-oriented policing (COP) paradigm provides an existing framework for collaborative grassroots engagement that has the potential for success in counterradicalization outreach efforts. COP leverages already established community-based social service programs to address individual, group, and community radicalization factors.
California, New York
(U//FOUO) FDNY Presentation on San Bernardino Terror Attack
U.S. Army
U.S. Army Expeditionary Warrior Experiments (AEWE) Systems Book 2016
Department of State
State Department Presentation on ISIL Antiquities Trafficking
Department of Homeland Security
DHS Reference Aid on Illicit Uses of Drones and Model Aircraft
Model Aircraft are custom built or commercially produced unmanned aircraft systems (UAS) that meet the statutory definition of Model Aircraft and operate in accordance with the statutory requirements for Model Aircraft. These are sometimes referred to as radio controlled airplanes or aircraft and usually require one individual for operational control. Some Model Aircraft are capable of sustained flight for approximately 2 hours or less depending on the type of Model Aircraft (Rotary or Fixed Wing) and power source (e.g. nitromethane, lithium ion, and lithium polymer batteries). Model Aircraft must be flown within visual line of sight of the operator; however, there is an increasing use of first person view technology that allows operation to occur beyond line of sight and at altitudes in excess of several hundred feet.
New York
(U//FOUO) FDNY Presentation on Paris Terror Attacks
Federal Bureau of Investigation
FBI Cyber Bulletin: Chinese Hackers Targeting U.S. Navy Contractors
The FBI has obtained information regarding a group of cyber actors who have compromised and stolen sensitive military information from US cleared defense contractors (CDCs) through cyber intrusions. This group utilizes infrastructure emanating from China to conduct their nefarious computer network exploitation (CNE) activities. Information obtained from victims and subsequent analysis indicates that they were targeted based on their US Navy Seaport Enhanced contracts. The actors did not target information pertaining to a specific contract but instead stole all information that they accessed via their malicious cyber activities. Any activity related to this group detected on a network should be considered an indication of a compromise requiring extensive mitigation and contact with law enforcement.
Department of Homeland Security
DHS Report on Cyber-Physical Infrastructure Risks to Smart Cities
As technology pervades into our everyday lives, once simple devices have become smarter and more interconnected to the world around us. This technology is transforming our cities into what are now referred to as “Smart-Cities”. Smart Cities have been defined as urban centers that integrate cyber-physical technologies and infrastructure to create environmental and economic efficiency while improving the overall quality of life. The goal of these new cities is to create a higher quality of life, a more mobile life and an overall increased efficient use of available resources. Some examples of Smart-City technologies are interconnected power grids reducing power waste, smarter transportation resulting in increased traffic management, and smarter infrastructures that reduce hazards and increase efficiency.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Bulletin: Criminal Hackers Target Police to Protest Perceived Injustices
Disruptive cyber attacks by criminal hackers—primarily distributed-denial-of-service (DDoS) attacks—targeting local law enforcement websites have increased since August 2014. We judge that this is almost certainly a result of the heightened coverage surrounding the alleged use of excessive force by law enforcement and an increased focus on incidents of perceived police brutality. The primary impact from the majority of these attacks has been the temporary disruption of the targeted public-facing websites.
Corporate, Department of Defense
The Application of “Spiral Analysis” to Activity-Based Intelligence Lessons Learned Report
The purpose of this white paper is to provide an in-depth examination of ABI-like analytic techniques that were developed, refined and employed to successfully support multiple, high-level, but dissimilar interagency law enforcement investigations over an extended period of time. The premise of this paper is that, as the Intelligence Community developes a strategy, framework and roadmap for enterprise-wide adoption of ABI, lessons learned from the law enforcement community are worthy of examination and possible incorporation into the IC strategy for ABI.
Federal Bureau of Investigation
(U//LES) FBI Suicide Vest and Belt Use in Middle East, Africa, and Europe Show Minimal Signs of Tactic Migration
The FBI Terrorism Explosive Device Analytical Center (TEDAC) assesses the tactics used to construct suicide vest and belt improvised explosive devices (IEDs) in the Middle Eastern, African, and European regions likely have minimal correlation. Use of these tactics allows suicide bombers to discretely move to a desired target location and make real-time decisions to maximize lethality. The suicide belt design allows the wearer to conceal the device and blend in with their surrounding environment, as well as to position themselves in potentially crowded environments while not raising suspicion.
Department of Homeland Security, Federal Bureau of Investigation, National Counterterrorism Center
(U//FOUO) DHS-FBI-NCTC Bulletin: Tactics, Techniques, and Procedures Used in November 2015 Paris Attacks
This Joint Intelligence Bulletin (JIB) is intended to provide a review of the tactics, techniques, and procedures demonstrated by the perpetrators of the 13 November 2015 attacks in Paris, France. This JIB does not provide analysis of any follow-on operations or operations occurring in Europe in the wake of the attacks. It relies on a variety of open source and media reporting for the analysis, which could change as official details of the post-incident investigations come to light. This JIB is intended to support the activities of DHS, FBI and NCTC to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private-sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.
Department of the Treasury
U.S. National Terrorist Financing Risk Assessment 2015
After the September 11, 2001 terrorist attacks, the United States adopted a preventive approach to combating all forms of terrorist activity. Efforts to combat the financing of terrorism (CFT) are a central pillar of this approach. Cutting off financial support to terrorists and terrorist organizations is essential to disrupting their operations and preventing attacks. To that end, the U.S. government has sought to identify and disrupt ongoing terrorist financing (TF) and to prevent future TF. The law enforcement community, including various components of the U.S. Departments of Justice, Homeland Security, and the Treasury, along with the intelligence community and the federal functional regulators, applies robust authorities to identify, investigate, and combat specific TF threats, enforce compliance with applicable laws and regulations, and prosecute supporters in order to deter would-be terrorist financiers. The U.S. Department of the Treasury (Treasury), which leads financial and regulatory CFT efforts for the U.S. government, employs targeted financial sanctions, formulates systemic safeguards, and seeks to increase financial transparency to make accessing the U.S. financial system more difficult and risky for terrorists and their facilitators. All of these efforts involve extensive international engagement to try to prevent any form of TF, particularly financing that does not necessarily originate in the United States, from accessing the U.S. financial system.
Drug Enforcement Administration
DEA Assessment of U.S. Areas of Influence of Major Mexican Transnational Criminal Organizations
Mexican transnational criminal organizations (TCOs) pose the greatest criminal drug threat to the United States; no other group is currently positioned to challenge them. These Mexican poly-drug organizations traffic heroin, methamphetamine, cocaine, and marijuana throughout the United States, using established transportation routes and distribution networks. They control drug trafficking across the Southwest Border and are moving to expand their share, particularly in the heroin and methamphetamine markets.
Drug Enforcement Administration
DEA Assessment of Mexican Drug Trafficking Organizations’ Areas of Dominant Control
DEA continues to identify eight major cartels currently operating in Mexico: Sinaloa, Cartel de Jalisco Nueva Generacion (New Generation Jalisco Cartel or CJNG), Beltran-Leyva Organization (BLO), Los Zetas, Gulf, Juarez/La Linea, La Familia Michoacana (LFM), and Los Caballeros Templarios (Knights Templar or LCT); however, leadership losses for LFM and LCT over the last year have significantly degraded their operational capabilities and organizational cohesion. The attached graphic illustrates fluctuations in the areas of dominant control for Mexico’s major DTOs, most notably the significant expansion of CJNG.
Department of State, Iraq
OSAC Bulletin: Mustard Agent Likely Used in ISIL Attack in Iraq August 2015
Early tests show that the Islamic State of Iraq and the Levant (ISIL) used chemical agents during an attack on Kurdish Peshmerga forces on August 11 in Makhmour, Iraq. U.S. government officials reported that preliminary tests on shell fragments indicated a presence of chemical agents, although additional analyses would be necessary to determine the full composition. Early media reports have pointed to the use of mustard agent. Overall, ISIL’s use of mustard agent appears to be largely undeveloped – although the group is likely seeking to advance its capabilities – and there is no evidence that they have used mustard agent (also known as mustard gas) against civilian interests at this point.
National Counterintelligence Executive
U.S. National Counterintelligence Strategy 2016
The National Counterintelligence Strategy of the United States of America 2016 (Strategy) was developed in accordance with the Counterintelligence Enhancement Act of 2002 (Pub.L. No. 107-306, 116 Stat. 2383 (as amended) codified at 50 U.S.C. sec. 3383(d)(2)). The Strategy sets forth how the United States (U.S.) Government will identify, detect, exploit, disrupt, and neutralize foreign intelligence entity (FIE) threats. It provides guidance for the counterintelligence (CI) programs and activities of the U.S. Government intended to mitigate such threats.
Joint Chiefs of Staff
Joint Staff Strategic Assessment: Neurobiological Insights on Radicalization and Mobilization to Violence
This concise review presents theories, findings, and techniques from the neurobiology and cognitive sciences, as well as insights from the operational community, to provide a current and comprehensive description of why individuals and groups engage in violent political behavior. This report is based primarily on recent findings from the academic community. It has been compiled with the policy, planning, and operational community as the primary audience.
Intelligence Fusion Centers, New Jersey
(U//FOUO) New Jersey Fusion Center Special Events List November 2015
The New Jersey Office of Homeland Security and Preparedness (OHSP) compiles a statewide list of special events that provides situational awareness to law enforcement, as well as to assist in local planning requirements. Special events include any events that attracts large numbers of participants. Examples include concerts, marathons, parades, sporting events, holiday gatherings, etc.
U.S. Army
U.S. Army Protection of Civilians Techniques Publication
ATP 3-07.6 discusses the importance of civilian protection during unified land operations and presents guidelines for Army units that must consider the protection of civilians during their operations. Protection of civilians refers to efforts to protect civilians from physical violence, secure their rights to access essential services and resources, and contribute to a secure, stable, and just environment for civilians over the long-term. ATP 3-07.6 describes different considerations including civilian casualty mitigation and mass atrocity response operations.
China, Federal Bureau of Investigation
(U//FOUO) FBI Counterintelligence Note: Huawei Chinese Government-Subsidized Telecommunications Company
Huawei is a threat to intellectual property and business communications due to its opaque relationship with the Chinese Government. Huawei has legal obligations to work on behalf of the Chinese state, probably through the Chinese Communist Party (CCP) committee residing within Huawei. This relationship likely influences the company’s decision-making through threats of corruption investigations.
U.S. Army
Restricted U.S. Army Cryptologic Linguist Training Manual
This publication is for soldiers holding military occupation specialty (MOS) 98G and their trainer/first-line supervisor. It contains standardized training objectives in the form of task summaries that support unit missions during wartime. Soldiers holding MOS 98G should be issued or have access to this publication. It should be available in the soldier’s work area, unit learning center, and unit libraries. Trainers and first-line supervisors should actively plan for soldiers to have access to this publication. It is recommended that each 98G soldier be issued an individual copy.
Financial Crimes Enforcement Network
(U//LES) Financial Crimes Enforcement Network: Tor IP Addresses Increasingly Linked to Cybercrime
Our BSA analysis of 6048 IP addresses associated with the Tor darknet found that in the majority of the SAR filings, the underlying suspicious activity, most frequently account takeovers, might have been prevented if the filing institution had been aware that their network was being accessed via Tor IP addresses. Darknets are Internet based networks used to access content in a manner designed to obscure the identity of the user and his or her associated Internet activity.