The Orange County Intelligence Assessment Center (OCIAC) has received reporting indicating cybercriminals are manipulating e-mail filters as a means to monitor and divert e-mail communications.
Office of the Director of National Intelligence Countering Foreign Intelligence Threats Implementation and Best Practices Guide
The National Counterintelligence and Security Center (NCSC) is charged with leading and supporting the counterintelligence (CI) and security activities of the U.S. government, the U.S. Intelligence Community, and U.S. private sector entities that are at risk of intelligence collection, penetration, or attack by foreign adversaries and malicious insiders. The capabilities and activities described in this Guide are exemplars of program components delineated as requirements in numerous strategies, policies, and guidelines.
In the last several years, U.S. Law Enforcement has seen a dramatic increase in the availability of dangerous synthetic opioids. A large majority of these synthetic opioids are structural derivatives of the synthetic drug “fentanyl.” Fentanyl is a synthetic opioid currently listed as a Schedule II prescription drug that mimics the effects of morphine in the human body, but has potency 50–100 times that of morphine. Due to the high potency and availability of fentanyl, both transnational and domestic criminal organizations are increasingly utilizing these dangerous synthetic opioids as an adulterant in heroin and other controlled substances. The presence of these synthetic opioids in the illicit U.S. drug market is extremely concerning as the potency of these drugs has led to a significant increase in overdose incidents and overdose-related deaths throughout the nation.
FBI Cyber Bulletin: Individuals Threatening Distributed Denial of Service of Private-Sector Companies for Bitcoin
An individual or group claiming to be “Anonymous” or “Lizard Squad” sent extortion emails to private-sector companies threatening to conduct distributed denial of service (DDoS) attacks on their network unless they received an identified amount of Bitcoin. No victims to date have reported DDoS activity as a penalty for non-payment.
As part of this vision, DIA has a long history of producing comprehensive and authoritative defense intelligence overviews. In September 1981, Secretary of Defense Caspar Weinberger asked the Defense Intelligence Agency to produce an unclassified overview of the Soviet Union’s military strength. The purpose was to provide America’s leaders, the national security community, and the public a complete and accurate view of the threat. The result: the first edition of Soviet Military Power. DIA produced over 250,000 copies, and it soon became an annual publication that was translated into eight languages and distributed around the world. In many cases, this report conveyed the scope and breadth of Soviet military strength to U.S. policymakers and the public for the first time.
Terrorist and violent extremist groups have long expressed interest in poisoning and adulterating food and beverage supplies in the West but rarely use this as a tactic. Nonetheless, recent incidents in Europe and Africa underscore the continued interest by some groups in targeting food products at point-of-sale, distribution, and storage. The mere threat of product adulteration in the Homeland almost certainly would cause psychological and economic harm. While we have not seen any specific, credible terrorist threats against Homeland food production and distribution infrastructure, we cannot rule out the possibility of inspired violent extremists or disgruntled insiders attempting to adulterate or poison food and beverages with commonly available toxic industrial chemicals or crude biological toxins due to the relative ease of product manipulation, especially at the last point of sale, which criminal actors have demonstrated consistently in the past.
OCIA assesses that if specific industrial control systems (ICS) were successfully infected with ransomware, it could affect the ability of certain sectors to provide real-time management and control of large networks of geographically scattered equipment. Although security researchers have demonstrated the possibility of ransomware targeting control systems, OCIA assesses that such an attack is highly unlikely given the higher success rate against consumer and business systems, the likelihood that business and process control networks are segmented, and the ability for operators to take a control system out of service and employ manual overrides.
An annual report for the Bilderberg Association from 2016 made available through the U.K. Charities Commission. The Bilderberg Association is one of several international non-profit affiliates of the group known as Bilderberg Meetings. The U.S. affiliate is called American Friends of Bilderberg, Inc. and is a registered non-profit in the State of New York.
An annual report for the Bilderberg Association from 2015 made available through the U.K. Charities Commission. The Bilderberg Association is one of several international non-profit affiliates of the group known as Bilderberg Meetings. The U.S. affiliate is called American Friends of Bilderberg, Inc. and is a registered non-profit in the State of New York.
The 65th Bilderberg Meeting will take place from 1-4 June 2017 in Chantilly, Virginia, USA. As of today, 131 participants from 21 countries have confirmed their attendance. As ever, a diverse group of political leaders and experts from industry, finance, academia and the media has been invited.
On May 12, 2017, organizations across the world reported ransomware infections impacting their computer systems. The infections, caused by a ransomware strain referred to as WannaCry, restricts users’ access to a computer and demands a ransom to unlock it. The U.S. Department of Justice defines ransomware as, a type of malicious software cyber actors use to deny access to systems or data until the ransom is paid. After the initial infection, ransomware attempts to spread through systems and networks.
On December 2, 2015 at about 10:58 am San Bernardino Police began to receive numerous calls of shots fired at the Inland Regional Center located at 1365 South Waterman Avenue in San Bernardino. Initial calls indicated that there were several gunshots heard. Another call reported that there were two or possibly three subjects in all black clothing and masks armed with assault weapons. Within a matter of three to four minutes there were multiple calls reporting that multiple masked subjects had entered in the conference room, located in Building 3 of the Inland Regional Center, and opened fire in the main conference room.
Recent large-scale civil disturbances in two states led the respective governors to mobilize state National Guard (NG) forces. These incidents raised questions and concerns about the appropriate and effective use of NG intelligence capabilities to support domestic civil disturbance operations. Domestic missions are no different from overseas missions in that a key requirement for mission success is situational awareness (SA)—leaders and commanders at all levels must be aware of the situation on the ground and have a deep understanding of the operational environment in which their forces are operating and the inherent threats faced in that environment. Overseas, where the threat is by definition foreign, the intelligence component provides the preponderance of threat data. Domestically, defining threat information may entail the collection of information concerning U.S. persons. By law, the military and civilian intelligence components face constraints in the manner they may lawfully collect, disseminate, and retain such information.
Since 2014, over 1.6 million migrants and asylum seekers have arrived by sea to Europe. European countries registered over 3.18 million new asylum applications. Over 700,000 applicants were granted a form of protective status, mostly in Germany, France, Sweden, Italy, and the Netherlands, with 450,000 applicants rejected in the same time period, and over 1.1 million pending applications at the end of 2016. Amendments to the Schengen Border Code, proposed in response to terrorist threats, aim to strengthen external borders by requiring systematic database checks at entry and exit.
These guidelines briefly highlight the strategic considerations that guide, oversee and provide the resources for the operational and tactical use of force. While the strategic considerations of the use of force are rooted in the core peacekeeping principles, mission mandate and rules of engagement, the guidelines recognize that political and other context specific factors influence the strategic considerations on the use of force. The main emphasis, however, is on the operational and tactical considerations regarding the use of force. This document examines the required thinking and action (including situational awareness and operational/strategic communications) at these levels to pre-empt, deter, contain or respond to threats without excessive use of force.
(U//FOUO) New Jersey Regional Operations and Intelligence Center: Reduce Online Exposure by “Opting-Out”
Law enforcement and public officials should take the following proactive steps to limit the amount of personally identifiable information (PII) that is accessible online. Cyber criminals and extremists, such as the self-proclaimed Islamic State of Iraq and the Levant (ISIL), capture personal information of law enforcement, military, and government officials, and then share it with their associates, encouraging both physical and virtual attacks. The Office of the ROIC Threat Analysis Unit, and the Cyber Threat Intelligence Unit, are providing these “opt-out” guidelines to reduce online exposure from websites that provide or sell PII.
Use of vehicles by violent extremists for ramming attacks has increased steadily, while use of vehicle-borne improvised explosive devices (VBIEDs) remains rare outside the Middle East. Given the ease with which ramming attacks can be accomplished, it is likely use of this tactic will continue to rise. Unlike VBIEDs, ramming attacks require little specialized training or skill, present minimal risk of detection when acquiring the weapon, and offer flexibility with regard to preparation, timing, and target. Foreign terrorist organizations (FTOs) have pointedly encouraged use of vehicle ramming attacks, offering explicit tactical advice on vehicle selection, driving tips to maximize fatalities, and targeting suggestions that include parades, festivals, street fairs, outdoor markets or conventions, political rallies, and other crowded targets of opportunity.
Vehicle-ramming attacks are considered unsophisticated, in that a perpetrator could carry out such an attack with minimal planning and training. It is likely that terrorist groups will continue to encourage aspiring attackers to employ unsophisticated tactics such as vehicle-ramming, since these types of attacks minimize the potential for premature detection and could inflict mass fatalities if successful. Furthermore, events that draw large groups of people—and thus present an attractive vehicle ramming target—are usually scheduled and announced in advance, which greatly facilitates attack planning and training activities.
Cloud services offer a number of benefits such as scalability, high availability, and decreased ownership cost. As a result, owners and operators in several critical infrastructure sectors such as Communications, Energy, Financial Services, Information Technology, and Transportation Services have migrated in-house computing resources to cloud infrastructures. However, cloud service environments still possess many of the same potential vulnerabilities associated with internally hosted environments, as well as additional exploits to virtual systems or networks. Owners and operators of critical infrastructure need to fully understand the risk environment as they address current cloud services and consider additional migration.
The Department of Homeland Security (DHS) assesses that given the high value of patient information and proprietary data on the black market, the Healthcare and Public Health Sector will continue to be one of the primary targets for malicious cyber actors. Stolen health data sells on the black market for more than 10 to 20 times the price of stolen credit card data. DHS assesses that growth in the medical device market over the next 4 years will result in more devices connected to the Internet, and an increase in the number of cyber-related incidents that target those devices. This is partly because manufacturers do not place enough emphasis on the security of medical devices.
It seemed as if war had been declared on cops. First a sniper in Dallas and then an active shooter in Baton Rouge. “It has been a tough week physically and emotionally,” said Senior Corporal Trevor Perez, one of a couple dozen Dallas police officers and honor guard members to make the seven-hour trip to Baton Rouge to attend the funerals of Baton Rouge police officers, in this case that of Matthew Gerald. All the more tough because the corporal and his colleagues had just recently paid their respects at nearly a dozen similar funerals back in Texas.
With utilities in the U.S. and around the world increasingly moving toward smart grid technology and other upgrades with inherent cyber vulnerabilities, correlative threats from malicious cyber attacks on the North American electric grid continue to grow in frequency and sophistication. The potential for malicious actors to access and adversely affect physical electricity assets of U.S. electricity generation, transmission, or distribution systems via cyber means is a primary concern for utilities contributing to the bulk electric system. This paper seeks to illustrate the current cyber-physical landscape of the U.S. electric sector in the context of its vulnerabilities to cyber attacks, the likelihood of cyber attacks, and the impacts cyber events and threat actors can achieve on the power grid. In addition, this paper highlights utility perspectives, perceived challenges, and requests for assistance in addressing cyber threats to the electric sector.