This Joint Intelligence Bulletin (JIB) updates a DHS-FBI joint analytic product of the same title dated 3 September 2010 and is intended to provide warning and perspective regarding the scope of the potential terrorist threats to the United States, specifically towards US persons. This product is provided to support the activities of DHS and FBI and to help federal, state, and local government counterterrorism and law enforcement officials deter, prevent, preempt, or respond to terrorist attacks directed against the United States.
Tag Archive for Department of Homeland Security
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS/FBI “Body Packing” Criminal Tactic with Possible Terrorist Applications
“Body packing” is a well-documented concealment method criminals have used to smuggle drugs or other contraband. Body packing in humans and animals may involve several forms of concealment — including insertion into body orifices, ingestion, or possibly surgical implantation—of illicit items or material inside or hidden on the body to escape detection by security systems and personnel. Terrorists often assign high priority to concealment in planning attacks, and such methods—to include surgical implantation—offer potential means for suicide operatives to deliver improvised explosive devices to targets.
Department of Homeland Security
(U//FOUO) DHS Rising Copper Thefts Disrupting Homeland Infrastructure
Reported copper thefts from critical infrastructure and key resource (CIKR) sectors in the United States rose at least 50 percent in 2010 compared to the previous year, largely driven by record-high prices for copper. Individuals and criminal organizations have engaged in copper thefts primarily for financial gain. We have seen no indication that terrorists are using copper thefts in the homeland as a tactic to damage or destroy CIKR facilities or to fund terrorist activity.
Immigration and Customs Enforcement
ICE Facilities Standard CCTV Camera Information and Locations
The SM-CCTV System is a computer network consisting of closed-circuit video cameras, digital video recorders (DVRs), and monitoring capabilities that capture video-only feeds in and around ICE facilities. The purpose of the SM-CCTV System is to help ICE secure and regulate physical access to ICE facilities. The system also serves to enhance officer safety, prevent crimes, and assist in the investigation of criminal acts committed inside and on the perimeter of protected ICE facilities. Video surveillance also supports terrorism prevention and facility protection with its visible presence, and detects and deters unauthorized intrusion at ICE facilities. The SM-CCTV System is planned to be deployed in numerous ICE facilities nationwide.
Department of Homeland Security
DHS Terrorist Watchlist Service Privacy Impact Assessment
The Department of Homeland Security (DHS) currently uses the Terrorist Screening Database (TSDB), a consolidated database maintained by the Department of Justice Federal Bureau of Investigation Terrorist Screening Center (TSC) of identifying information about those known or reasonably suspected of being involved in terrorist activity in order to facilitate DHS mission-related functions, such counterterrorism, law enforcement, border security, and inspection activities. DHS and TSC are improving the current method of transmitting TSDB data from TSC to DHS. Through a new service called the “DHS Watchlist Service” (WLS), TSC and DHS will automate and simplify the current manual process. TSC remains the authoritative source of watchlist data and will provide DHS with near real-time synchronization of the TSDB. DHS will ensure that each DHS component system receives only those TSDB records which they are authorized to use under the WLS Memorandum of Understanding and authorized under existing regulations and privacy compliance documentation between TSC and DHS (WLS MOU) and any amendments or modifications thereto. DHS conducted this privacy impact assessment (PIA) because the WLS will maintain a synchronized copy of the TSDB, which contains personally identifiable information (PII), and disseminate it to authorized DHS components.
Department of Homeland Security
DHS Bulletin: Anonymous/LulzSec Has Continued Success Using Rudimentary Hacking Methods
This Bulletin is being provided for your Executive Leadership, Operational Management, and Security Administrators situational awareness. The actors who make up the hacker group “Anonymous” and several likely related offshoots like “LulzSec”, continue to harass public and private sector entities with rudimentary exploits and tactics, techniques, and procedures (TTPs) commonly associated with less skilled hackers referred to as “Script Kiddies”. Members of Anonymous routinely claim to have an overt political agenda and have justified at least a portion of their exploits as retaliation for perceived ‘social injustices’ and ‘freedom of speech’ issues. Attacks by associated groups such as LulzSec have essentially been executed entirely for their and their associates’ personal amusement, or in their own hacker jargon “for the lulz”.
Department of Homeland Security
(U//FOUO) DHS Red Cell Report: How Terrorists Might Infect U.S. Poultry With Bird Flu
This report explores how terrorists or other non-state adversaries could potentially facilitate an avian influenza outbreak within the United States. The report was primarily intended to assist the Secretary of Homeland Security, Chief Intelligence Officer, Deputy Assistant Secretary, and Chief Medical Officer as they consider the implications of avian influenza to the Homeland. The scenarios explored in this paper are speculative and meant only to broaden the scope of thinking. They are not based on specific evidence or intelligence about terrorists’ plans and capabilities, but are considered scientifically feasible, according to experts that were interviewed.
Department of Homeland Security
(U//FOUO) DHS Utility-Sector Employee Insider Threats Warning
Insiders often possess detailed operational and system-security knowledge, as well as authorized physical and systems access to utilities. Insiders can be employees, contractors, service providers, or anyone with legitimate access to utility systems. They often are self-motivated, know system security measures, and raise no alarms due to their authorized systems access. With knowledge of and access to a utility’s network, malicious actors could seize control of utility systems or corrupt information sent to plant operators, causing damage to plant systems and equipment. Systems and networks used by utilities are potential targets for a variety of malicious cyber actors. Threat actors who target these systems may be intent on damaging equipment and facilities, disrupting services, stealing proprietary information, or other malicious activities. The greater the individual’s knowledge and authorized systems access, the greater risk the individual poses. Furthermore, any individual with access to a plant’s systems could unwittingly or inadvertently introduce malware into a system through portable media or by falling victim to socially engineered e-mails.
Department of Homeland Security
(U//FOUO) DHS U.S. Lodging Industry Protective Measures Guide
Preventing terrorism, enhancing security, and ensuring resilience to disasters are core missions of the U.S. Department of Homeland Security (DHS). Accomplishing these missions necessitates building and fostering a collaborative environment in which the private sector and Federal, State, local, tribal, and territorial governments can better protect critical infrastructure and key resources (CIKR). The U.S. Lodging Industry is designated as CIKR because it is essential to the Nation’s economic vitality and way of life. It is critical to the Department’s vision of ensuring a homeland that is safe, secure, and resilient against terrorism and other hazards. As such, DHS developed the Protective Measures Guide for the U.S. Lodging Industry in collaboration with the American Hotel & Lodging Association to provide options for hotels to consider when implementing protective measures. The guide provides an overview of threat, vulnerability, and protective measures designed to assist hotel owners and operators in planning and managing security at their facilities. It provides suggestions for successful planning, organizing, coordinating, communicating, operating, and training activities that contribute to a safe environment for guests and employees. In addition, when contemplating appropriate protective measures to implement, owners and operators should consider their own knowledge of the property‘s operations and vulnerabilities, as well as the general surroundings and its place within the community. When implementing appropriate protective measures, owners and operators should make use of additional resources, from local law enforcement and emergency management agencies to the security resources listed in the appendices of this guide.
Department of Homeland Security
(U//FOUO) DHS LulzSec Bulletin: Hacktivist Groups Target U.S. and Foreign Networks
The National Cybersecurity and Communications Integration Center (NCCIC), through coordination with its partners and monitoring of multiple sources, is tracking reports that members of the hacktivist collectives ‘LulzSec’ and ‘Anonymous’ have combined their efforts and continue to perpetrate cyber attacks targeting U.S. and foreign networks. LulzSec Members have posted statements on the internet claiming the attacks, referred to as ‘Operation AntiSecurity’ (AntiSec), are ‘designed to demonstrate the weakness of general internet security’ and have allowed them to collect massive amounts of data. LulzSec is purported to be a group of former Anonymous members who typically use widely available and crude tools to hijack or deface web pages as a political statement. They also routinely post information regarding planned and ongoing activities on publicly available Internet Relay Chat (IRC) sessions and social networking sites like Twitter. Recent attacks by LulzSec and Anonymous have proven simple Tactics, Techniques and Procedures (TTPs) are often successful, even against entities who have invested a significant amount of time and capital into designing and securing their information networks.
News
DHS National Cybersecurity Center Warns of Crude, But Effective LulzSec/Anonymous/AntiSec Attacks
A bulletin released in late June by the Department of Homeland Security’s (DHS) National Cybersecurity and Communications Integration Center (NCCIC) warning of the recent activities by LulzSec and Anonymous has surfaced online. The unclassified bulletin titled “Hacktivist Groups Target U.S. and Foreign Networks” was recently posted to an unknown online network security website Aisle.net before being subsequently removed. The site it was posted to has also disappeared and now visitors to the domain are greeted with a blank screen. While the full document is not recoverable at this point in time, a cached version of the document’s summary contains a number of surprising admissions regarding the effectiveness of basic techniques utilized by LulzSec/Anonymous.
Department of Homeland Security
(U//FOUO) DHS Interagency Security Committee Threats to Federal Facilities Assessment
The DBT Report is a stand-alone threat analysis to be used with the Physical Security Criteria for Federal Facilities: An ISC Standard. The document establishes a profile of the type, composition, and capabilities of adversaries, and it is also designed to correlate with the countermeasures in the compendium of standards and to be easily updated as needed. The DBT is an estimate of the threats that face Federal facilities across a range of undesirable events and based on the best intelligence information, Intelligence Community (IC) reports and assessments, and crime statistics available to the working group at the time of publication. Users of the DBT must consider that undiscovered plots may exist, adversaries are always searching for new methods and tactics to overcome security measures, and the lone-wolf adversary remains largely unpredictable.
Immigration and Customs Enforcement
ICE Pattern Analysis and Information Collection (ICEPIC) System
The ICE Pattern Analysis and Information Collection (ICEPIC) system was established in 2008 to enable ICE law enforcement agents and analysts to look for non-obvious relationship patterns among individuals and organizations that are indicative of violations of the customs and immigration laws that are enforced by DHS agencies, as well as possible terrorist threats and plots. From these relationships, ICE agents develop specific leads and intelligence for active and new investigations. Identified relationships are also recorded for reuse in subsequent investigative analyses. The information processed by ICEPIC comes from existing ICE investigative and apprehension records systems, as well as immigration and alien admission records systems. ICEPIC includes capabilities that assist investigators in recording results of analyses performed in support of investigations and in capturing additional relevant information obtained from outside sources. The information collected by, on behalf of, in support of, or in cooperation with DHS and its components may contain personally identifiable information collected by other Federal, State, local, tribal, foreign government agencies, or international organizations.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) LulzSec Release: DHS-FBI Use of Common Chemicals to Make Homemade Explosives
Terrorists can acquire precursor materials legally through a variety of commercial transactions, secondhand from individuals with access to such substances, or through theft. Many precursors can be purchased legitimately and without special authorization from chemical supply stores. They also are available at retail stores that sell beauty supply products, hardware and home improvement materials, groceries, and swimming pool supplies, and are used widely in hospitals, universities, construction sites, industrial facilities, farms, and mining operations.
Department of Homeland Security
(U//FOUO) LulzSec Release: DHS National Socialist Movement Reference Aid
The National Socialist Movement (NSM) USPER is the most active neo-Nazi group operating in the United States. It has grown from a small organization with a limited following confined to the mid-western United States to the preeminent National Socialist group in the nation. Despite having recently suffered a defection of several regional leaders, NSM remains an influential force within white supremacist circles and the only major racist group that eschews all attempts to distance its methods and objectives from those of the Third Reich. NSM has a reputation for conducting numerous public rallies that have triggered a violent response, including a riot in Toledo, Ohio, in October 2005.
Department of Homeland Security
(U//FOUO) LulzSec Release: DHS Evaluating Threats 2008-2013
The 2008 Homeland Security Threat Assessment (HSTA) is a strategic assessment looking out five years. The HSTA represents the analytical judgments of the Department of Homeland Security (DHS) Intelligence Enterprise (IE) regarding the critical threats to the U.S. Homeland that the Department will need to address in the period 2008-2013.
Department of Homeland Security
(U//FOUO/LES) LulzSec Release: DHS Mexico Sonora-Based Threats to U.S. Border Security
This Homeland Security Assessment examines threats to U.S. border security emanating from the Mexican state of Sonora, which borders Arizona and a small section of New Mexico. It discusses drug and alien smuggling, border violence, and Mexican federal, state, and local government capabilities to confront organized crime. This is the fifth of six planned assessments on current threats to homeland security arising in Mexican states along the U.S. border. It is intended primarily for working-level analysts and operators engaging in homeland security-related activities and concerned with pertinent developments in Sonora and nearby U.S. territory.
Immigration and Customs Enforcement
(U//FOUO) U.S. Immigration and Customs Enforcement Information Sharing Overview
A presentation from U.S. Immigration and Customs Enforcement’s Enforcement Systems Branch on the status of information sharing presented at the 2011 AFCEA Homeland Security Conference on February 23, 2011.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Unsubstantiated “Electronic Jihad” Warning November 2007
According to Debkafile, an Israeli electronic news website, a group claiming to be al-Qa‘ida has declared 11 November 2007 as the first day of a campaign of “electronic jihad” on the Internet. According to Debkafile, unspecified “al-Qa‘ida electronic experts” allegedly would begin attacking “Western, Jewish, Israeli, Muslim apostate and Shiite Web sites on that date with many more jihadist hackers joining in the attacks later [sic].” DHS and the FBI have no specific or credible information corroborating these cyber attack claims, or intelligence indicating this group is tied to al-Qa‘ida.
Department of Homeland Security
(U//FOUO) DHS Hotels Threat Assessment
This assessment is intended to support the activities of DHS and to assist federal, state, and local government counterterrorism and law enforcement officials, and the private sector in deterring, preventing, preempting, or responding to terrorist attacks against soft targets such as hotels in the United States. It is intended to support the national “See Something, Say Something” campaign.
Department of Homeland Security, Intelligence Fusion Centers
(U//FOUO) DHS Identifying Clandestine Biological, Chemical, Explosives, and Methamphetamine Laboratories
The purpose of this assessment is to assist members of the law enforcement and public safety communities in differentiating among four types of clandestine laboratories: biological, chemical, explosives, and methamphetamine. It provides descriptions, distinguishing features, and hazards of each type of laboratory and includes four reference guides for distribution to public safety personnel. This assessment expands on a related product—Distinguishing a Biological Agent Production Laboratory from a Methamphetamine Laboratory, Lawrence Livermore National Laboratory, 22 January 2008—by including indicators and warning signs associated with clandestine chemical and explosives laboratories.
Department of Homeland Security
(U//LES) DHS Chemical Storage Facility Terrorist Indicators Report
To consider terrorist threat indicators in relationship to chemical storage facilities, it is useful to understand the basic structure of the industry and what general types of facilities might be attractive targets for terrorist attack. Chemical storage facilities are attractive terrorist targets because they can contain toxic and hazardous materials, can create extensive casualties and property damage, and can be a source of materials for use in other attacks. Figure 1 shows some of the potential terrorist targeting objectives.
Department of Homeland Security
(U//LES) DHS Petroleum Pipeline Vulnerabilities and Terrorist Indicators Reports
The United States (U.S.) has two types of pipelines that transport petroleum: those that carry crude oil and those that carry refined petroleum products, such as gasoline, diesel fuel, jet fuel, and home heating oil. Pipelines transport more than two-thirds of all crude oil and refined products in the U.S. Other transportation modes are water, which includes ocean tankers and barges and accounts for 28% of petroleum transportation; tanker trucks, which account for 3% of petroleum transportation; and railroads, which account for 2% of petroleum transportation. The U.S. has more than 200,000 miles of petroleum pipelines.
Department of Homeland Security
(U//LES) DHS Highway Tunnel Terrorist Indicators Report
Highway tunnels are enclosed passageways for road vehicles to travel through or under an obstruction, such as a city, mountain, river, or harbor. Tunnels may have one or more “tubes,” and some are also equipped with rail lines for trains. Highway tunnels are generally classified with regard to their method of construction: bored, cut and cover, or submerged. Tunnels through hard rock formations are usually bored (i.e., drilled) and finished to facilitate vehicular traffic. Very large boring machines are often used to cut the tunnel tubes through the hard rock formation.
Department of Homeland Security
(U//LES) DHS Petroleum Refinery Characteristics and Common Vulnerabilities Report
A refinery comprises upstream components, process units, downstream components, and product storage. There are four basic processes used in refineries to produce products. Distillation is used to separate hydrocarbons of similar boiling range into intermediate and final products. Chemical processes are used to change the structure of the hydrocarbons to give them different properties breaking them into smaller pieces or combining them into larger ones. Treating processes are used to remove impurities such as sulfur, and blending systems are used to combine intermediate products and additives into final products for sale.