On December 2, 2015 at about 10:58 am San Bernardino Police began to receive numerous calls of shots fired at the Inland Regional Center located at 1365 South Waterman Avenue in San Bernardino. Initial calls indicated that there were several gunshots heard. Another call reported that there were two or possibly three subjects in all black clothing and masks armed with assault weapons. Within a matter of three to four minutes there were multiple calls reporting that multiple masked subjects had entered in the conference room, located in Building 3 of the Inland Regional Center, and opened fire in the main conference room.
Recent large-scale civil disturbances in two states led the respective governors to mobilize state National Guard (NG) forces. These incidents raised questions and concerns about the appropriate and effective use of NG intelligence capabilities to support domestic civil disturbance operations. Domestic missions are no different from overseas missions in that a key requirement for mission success is situational awareness (SA)—leaders and commanders at all levels must be aware of the situation on the ground and have a deep understanding of the operational environment in which their forces are operating and the inherent threats faced in that environment. Overseas, where the threat is by definition foreign, the intelligence component provides the preponderance of threat data. Domestically, defining threat information may entail the collection of information concerning U.S. persons. By law, the military and civilian intelligence components face constraints in the manner they may lawfully collect, disseminate, and retain such information.
Since 2014, over 1.6 million migrants and asylum seekers have arrived by sea to Europe. European countries registered over 3.18 million new asylum applications. Over 700,000 applicants were granted a form of protective status, mostly in Germany, France, Sweden, Italy, and the Netherlands, with 450,000 applicants rejected in the same time period, and over 1.1 million pending applications at the end of 2016. Amendments to the Schengen Border Code, proposed in response to terrorist threats, aim to strengthen external borders by requiring systematic database checks at entry and exit.
These guidelines briefly highlight the strategic considerations that guide, oversee and provide the resources for the operational and tactical use of force. While the strategic considerations of the use of force are rooted in the core peacekeeping principles, mission mandate and rules of engagement, the guidelines recognize that political and other context specific factors influence the strategic considerations on the use of force. The main emphasis, however, is on the operational and tactical considerations regarding the use of force. This document examines the required thinking and action (including situational awareness and operational/strategic communications) at these levels to pre-empt, deter, contain or respond to threats without excessive use of force.
(U//FOUO) New Jersey Regional Operations and Intelligence Center: Reduce Online Exposure by “Opting-Out”
Law enforcement and public officials should take the following proactive steps to limit the amount of personally identifiable information (PII) that is accessible online. Cyber criminals and extremists, such as the self-proclaimed Islamic State of Iraq and the Levant (ISIL), capture personal information of law enforcement, military, and government officials, and then share it with their associates, encouraging both physical and virtual attacks. The Office of the ROIC Threat Analysis Unit, and the Cyber Threat Intelligence Unit, are providing these “opt-out” guidelines to reduce online exposure from websites that provide or sell PII.
Use of vehicles by violent extremists for ramming attacks has increased steadily, while use of vehicle-borne improvised explosive devices (VBIEDs) remains rare outside the Middle East. Given the ease with which ramming attacks can be accomplished, it is likely use of this tactic will continue to rise. Unlike VBIEDs, ramming attacks require little specialized training or skill, present minimal risk of detection when acquiring the weapon, and offer flexibility with regard to preparation, timing, and target. Foreign terrorist organizations (FTOs) have pointedly encouraged use of vehicle ramming attacks, offering explicit tactical advice on vehicle selection, driving tips to maximize fatalities, and targeting suggestions that include parades, festivals, street fairs, outdoor markets or conventions, political rallies, and other crowded targets of opportunity.
Vehicle-ramming attacks are considered unsophisticated, in that a perpetrator could carry out such an attack with minimal planning and training. It is likely that terrorist groups will continue to encourage aspiring attackers to employ unsophisticated tactics such as vehicle-ramming, since these types of attacks minimize the potential for premature detection and could inflict mass fatalities if successful. Furthermore, events that draw large groups of people—and thus present an attractive vehicle ramming target—are usually scheduled and announced in advance, which greatly facilitates attack planning and training activities.
Cloud services offer a number of benefits such as scalability, high availability, and decreased ownership cost. As a result, owners and operators in several critical infrastructure sectors such as Communications, Energy, Financial Services, Information Technology, and Transportation Services have migrated in-house computing resources to cloud infrastructures. However, cloud service environments still possess many of the same potential vulnerabilities associated with internally hosted environments, as well as additional exploits to virtual systems or networks. Owners and operators of critical infrastructure need to fully understand the risk environment as they address current cloud services and consider additional migration.
The Department of Homeland Security (DHS) assesses that given the high value of patient information and proprietary data on the black market, the Healthcare and Public Health Sector will continue to be one of the primary targets for malicious cyber actors. Stolen health data sells on the black market for more than 10 to 20 times the price of stolen credit card data. DHS assesses that growth in the medical device market over the next 4 years will result in more devices connected to the Internet, and an increase in the number of cyber-related incidents that target those devices. This is partly because manufacturers do not place enough emphasis on the security of medical devices.
It seemed as if war had been declared on cops. First a sniper in Dallas and then an active shooter in Baton Rouge. “It has been a tough week physically and emotionally,” said Senior Corporal Trevor Perez, one of a couple dozen Dallas police officers and honor guard members to make the seven-hour trip to Baton Rouge to attend the funerals of Baton Rouge police officers, in this case that of Matthew Gerald. All the more tough because the corporal and his colleagues had just recently paid their respects at nearly a dozen similar funerals back in Texas.
With utilities in the U.S. and around the world increasingly moving toward smart grid technology and other upgrades with inherent cyber vulnerabilities, correlative threats from malicious cyber attacks on the North American electric grid continue to grow in frequency and sophistication. The potential for malicious actors to access and adversely affect physical electricity assets of U.S. electricity generation, transmission, or distribution systems via cyber means is a primary concern for utilities contributing to the bulk electric system. This paper seeks to illustrate the current cyber-physical landscape of the U.S. electric sector in the context of its vulnerabilities to cyber attacks, the likelihood of cyber attacks, and the impacts cyber events and threat actors can achieve on the power grid. In addition, this paper highlights utility perspectives, perceived challenges, and requests for assistance in addressing cyber threats to the electric sector.
An unidentified actor or actors between November 2016 and January 2017 targeted a US water and sewage authority’s network, resulting in excessive cellular charges and unusual traffic on ports 10000 and 9600, according to an FBI source with excellent access who spoke in confidence but whose reliability cannot be determined. The FBI source indicated that four of the seven devices on the authority’s cellular data plan were impacted with high data usage, which was likely a result of compromised network devices. The November 2016–December 2016 billing cycle totaled $45,000, and the December 2016–January 2017 billing cycle totaled $53,000.
This TC serves as a guide to describe the fundamentals of how to incorporate IO at the tactical and operational level. Appendixes A through F offer tactics, techniques, and procedures (TTP) Special Forces (SF) Soldiers can use to analyze and plan information operations. This TC implements Army and joint IO doctrine established in FM 3-13, Inform and Influence Activities, and Joint Publication (JP) 3-13, Information Operations. This TC reinforces the definition of IO used by Army forces: IO employs the core capabilities of electronic warfare (EW), computer network operations (CNO), Military Information Support operations (MISO), military deception (MILDEC), and operations security (OPSEC), in concert with specified supporting and related capabilities, to affect or defend information and information systems and to influence decisionmaking. This TC is specifically targeted for SF; however, it is also useful to Army special operations forces (ARSOF) and the Army in understanding how SF employs IO.
U.S. competitors pursuing meaningful revision or rejection of the current U.S.-led status quo are employing a host of hybrid methods to advance and secure interests that are in many cases contrary to those of the United States. These challengers employ unique combinations of influence, intimidation, coercion, and aggression to incrementally crowd out effective resistance, establish local or regional advantages, and manipulate risk perceptions in their favor. So far, the United States has not come up with a coherent countervailing approach. It is in this “gray zone”—the awkward and uncomfortable space between traditional conceptions of war and peace—where the United States and its defense enterprise face systemic challenges to U.S. position and authority. As a result, gray zone competition and conflict should be pacers for defense strategy.
(U//FOUO) U. S. Marine Corps Forces Europe and Africa Campaign Plan 2016-2020: Theater Crisis and Contingency Response Forces in Readiness
The U.S. Marine Corps Forces Europe and Africa Campaign Plan 2016-2020 defines the organization’s desired baseline operating conditions and capabilities beyond a one-year planning and execution cycle and directs action to achieve desired end states. The Campaign Plan synthesizes strategic guidance provided by U.S. European Command (USEUCOM), U.S. Africa Command (USAFRICOM), and Headquarters Marine Corps (HQMC); accounts for the Commanders’ priorities and vision; establishes a deliberate yet broadly-defined multi-year plan to achieve stated objectives; and provides a framework for implementation, periodic assessment, and refinement.
(U//FOUO) NCTC Homegrown Violent Extremist Mobilization Indicators for Public Safety Personnel 2017 Edition
The indicators of violent extremist mobilization described herein are intended to provide federal, state, local, territorial and tribal law enforcement a roadmap of observable behaviors that could inform whether individuals or groups are preparing to engage in violent extremist activities including potential travel overseas to join a Foreign Terrorist Organization (FTO). The indicators are grouped by their assessed levels of diagnosticity—meaning how clearly we judge the behavior demonstrates an individual’s trajectory towards terrorist activity.
FBI Cyber Bulletin: Cyber Criminals Targeting FTP Servers to Compromise Protected Health Information
The FBI is aware of criminal actors who are actively targeting File Transfer Protocol (FTP) servers operating in “anonymous” mode and associated with medical and dental facilities to access protected health information (PHI) and personally identifiable information (PII) in order to intimidate, harass, and blackmail business owners.
Published in three volumes, (Ground; Airspace & Air Defense Systems; and Naval & Littoral Systems) the WEG is the approved document for OPFOR equipment data used in U.S. Army training. Annual updates are posted on the ATN website. Therefore it is available for downloading and local distribution. Distribution restriction is unlimited. This issue replaces all previous issues.
The primary goal of Boko Haram is to institute an Islamic state throughout Nigeria based on a fundamentalist interpretation of Islamic law with an inevitable regional expansion. The founder and spiritual leader of Boko Haram, Muhammed Yusuf, and his followers originally believed in a peaceful transition and made what the current Boko Haram leadership considered illegitimate concessions to and compromises with secular and government leaders. The group has since adopted a takfirist ideology—the belief that less than a strict adherence to Salafist Islam makes a Muslim an “apostate” equal to infidels and, therefore, a legitimate target. Boko Haram has targeted and killed a number of prominent Muslim leaders who have been critical of the organization. Boko Haram considers any support of Western or secular ideas, such as schools based on Western influence, heretical and worthy of attack.
Department of Homeland Security, Federal Bureau of Investigation, Intelligence Fusion Centers, U.S. Secret Service
(U//FOUO) DHS-FBI-USSS Joint Threat Assessment 2017 Presidential Address to a Joint Session of Congress
This Joint Threat Assessment (JTA) addresses threats to the 2017 Presidential Address to a Joint Session of Congress (the Presidential Address) at the US Capitol Building in Washington, DC, on 28 February 2017. This assessment does not consider nonviolent civil disobedience tactics (for example, protests without a permit) that are outside the scope of federal law enforcement jurisdiction; however, civil disobedience tactics designed to cause a hazard to public safety and/or law enforcement fall within the scope of this assessment.
Cell phones, smart phones, the Internet, and GPS are increasingly available and are changing the nature of conflict, even in remote areas. Information can now reach out in new ways to global audiences because of the revolution in Information Technology (IT), particularly using cell phones and smart phones. The revival of hybrid warfare manifested in recent developments in the international security environment – such as the Arab Spring, the Ukrainian crisis, the rise of Jihadist-Salafist terrorism, and the European migrant crisis – demonstrates the power of communication, broadly based on IT advantages: messages and perceptions become predominant of physical engagements and strongly impact the behaviour of people. Orchestrated activities carry messages and have a crucial effect on 55 public opinions, decision-making processes, and domestic support.
Recent calls over the past year for attacks on hospitals in the West by media outlets sympathetic to the Islamic State of Iraq and ash-Sham (ISIS) highlight terrorists’ perception of hospitals as viable targets for attack. Targeting hospitals and healthcare facilities is consistent with ISIS’s tactics in Iraq and Syria, its previous calls for attacks on hospitals in the West, and the group’s calls for attacks in the West using “all available means.” While we have not seen any specific, credible threat against hospitals and healthcare facilities in the United States, we remain concerned that calls for such attacks may resonate with some violent extremists and lone offenders in the Homeland because of their likely perceived vulnerabilities and value as targets.