DIPLOMATIC SECURITY DAILY

S E C R E T STATE 117478


NOFORN

E.O. 12958: DECL: MR
TAGS: ASEC
SUBJECT: DIPLOMATIC SECURITY DAILY

Classified By: Derived from Multiple Sources

SECRET//FGI//NOFORN//MR
Declassify on: Source marked 25X1-human, Date of source:
November 3, 2008


1. (U) Diplomatic Security Daily, November 4, 2008


2. (U) Significant Events ) Paragraphs 7-22


3. (U) Key Concerns ) Paragraphs 23-36


4. (U) Threats & Analysis ) Paragraphs 37-50


5. (U) Cyber Threats ) Paragraphs 51-58


6. (U) Suspicious Activity Incidents ) Paragraphs 59-68


7. (U) Significant Events


8. (SBU) WHA - Argentina - Emergency Action Committee (EAC)
Buenos Aires convened November 3 to review security
preparations for the U.S. election night event scheduled for
November 4 at the American Club. The RSO reviewed the
security arrangements, which include the Argentine Federal
Police (PFA) providing dedicated security/police support for
the event and the Local Guard Force (LGF) augmenting the PFA
and building security to control access to the site. (Buenos
Aires 1510)


9. (SBU) Guyana - An intruder entered the Grand Coastal (GC)
hotel compound in Guyana, which is frequently used by U.S.
Embassy contractors and visitors, November 3 at 5:10 a.m.
During rounds, the GC security guard saw the intruder on the
outside second-floor corridor and confronted him. The
intruder jumped from the second floor to the ground, scaled
the fence, ran to his motorcycle, and fled the area. As the
intruder ran away, the security guard fired a warning shot. A
U.S. Embassy contractor heard the commotion outside his room
and contacted his supervisor. At 5:50 a.m., the RSO was
notified and met with hotel security elements to obtain a
statement of the incident. The RSO discussed with security
assets the use of force and provided suggestions on physical
security upgrades to decrease the possibility of future
incidents. (RSO Georgetown Spot Report)


10. (SBU) Mexico - EAC Nogales convened November 30 to assess
the U.S. Consulate,s security posture in light of the
previous night,s shooting of Sonora State Police Chief Pavon
Felix at the makeshift State Police Operations
Center/Headquarters located in a hotel less than 1,000 yards
from the Consulate and less than 300 yards from Embassy
officers, residences. On Sunday, November 2, grenade
explosions and gunfire erupted in various parts of Nogales,
Sonora, where police Chief Felix was killed and two other
state police officials were wounded. EAC members believe
that, while these developments are not specifically directed
at the local American community nor toward U.S. business
interests, there continues to be a trend of increasing
potential random violence affecting members of the Consulate
community and other Americans living, working, and/or
visiting the Consular district. Post will hold a Town Hall
meeting this week to discuss policies regarding localized
violence. The EAC concluded Post,s current security posture
remains adequate. EAC members will continue to monitor this
situation and review any further developments or potential
threats. (Nogales 0242)


11. (SBU) Venezuela - An AmCit was shot to death in Catia La
Mar (near the Caracas airport) by two unknown assailants who
were attempting to rob him at around 1 a.m. on November 1.
The victim was reportedly walking out of a hotel when the men
approached him and demanded his fanny pack and watch; when he
refused to comply with their instruction, he was shot.
American Citizen Services is assisting the family and
performing all services for the death of American overseas.
The RSO will maintain contact with police on the homicide
investigation. (RSO Caracas Spot Report)


12. (SBU) EUR - Austria - Approximately 400 to 500 protesters
gathered at the Westbahnhof Train Station in Vienna and
marched to the Parliament building, adjacent to the U.S.
Embassy residential building, November 1. The group,
comprised of Kurdish individuals, protested against the
imprisonment of Kurdistan Workers, Party leader Abdullah
Ocalan and called for general peace in the province of
Kurdistan. The demonstration ended without incident. (RSO
Vienna Spot Report)


13. (C) Macedonia - EAC Skopje met on October 31 to discuss
the host country,s threat environment and the U.S.
Embassy,s security preparations for election night events.
The Ambassador will host an event at the Macedonian Army Hall
in Skopje on November 5. The RSO briefed the EAC on event
concerns and discussed security arrangements in place for the
venue. The RSO is working with the Macedonian Police as well
as Embassy security assets to ensure maximum security
coverage for the event. The EAC concurred that the security
arrangements were appropriate to the local conditions, and
there was no specific threat information to address.
(Appendix source 1)


14. (SBU) Romania - A Peace Corps volunteer (PCV) was
assaulted by three unidentified males while walking alone in
a cemetery in Targu Mures November 1. The assailants
assaulted the PCV and took his wallet. The PCV went to the
hospital for treatment of several non-serious injuries. A
police report has been filed. (RSO Bucharest Spot Report)


15. (SBU) Russia - A large demonstration took place November
2 on Nuvinskiy Bulvar, located across the street from the
U.S. Embassy Moscow existing office building. The group was
organized by Nashi, a pro-Kremlin, -Putin youth group, and
advertised the event as &A Big American Show8 to protest
U.S. policies in Iraq and the former Yugoslavia. Russian
police services provided 1,700 officers to control the
demonstration, and Regional Security Office and Marine
Security Guard staff monitored the demonstration, which ended
peacefully. (RSO Moscow Spot Report)


16. (SBU) AF - Democratic Republic of the Congo - EAC
Kinshasa convened November 1 and approved USG employees
resuming work in Goma during the operating hours of the
Congolese and Rwandan border; however, all employees must
return to Gisenyi, Rwanda, by 5 p.m. each day until further
notice. EAC members will continue to monitor the situation.
(Kinshasa 0960)


17. (SBU) Guinea - Due to civil disturbances in Conakry, the
EAC convened twice on November 3 to review the security
situation in-country. These disturbances continue to target
key traffic routes within the capital; demonstrators have
closed routes by using impromptu tire barricades and have
thrown stones and other objects at passing vehicles,
including U.S. Embassy vehicles. Government police and
gendarmes have responded to the protests by discharging small
arms into the air and releasing tear gas in an attempt to
disperse the crowds. The EAC reviewed Post,s security
posture and will issue a Warden Message urging AmCits to
exercise caution and avoid traveling in-country. The EAC
further determined that Post will limit U.S. Mission travel
to emergencies, and travel outside the Embassy requires RSO
concurrence. The EAC has also adopted a Liberal Leave policy
for foreign service national staff effective today, November

4. Post officials will continue to monitor the situation and
reconvene today. (Conakry 0665; 0669)


18. (SBU) Mali - EAC Bamako met November 3 to discuss
security preparations for the U.S. Embassy,s election night
event at the Radisson Hotel. The RSO has met with
host-country counterparts and hotel personnel regarding
security for the event. The host country will provide traffic
police as well as plainclothes officers to monitor security
around the perimeter of the hotel, and Embassy security
elements will monitor the events inside the conference area.
(Bamako 0866)


19. (S//NF) Niger - EAC Niamey met November 3 to discuss
security preparations for the election day event scheduled in
the capital on November 5, the National Movement for the
Development of Society (MNSD) party, and security
arrangements for the upcoming visit of Office of Inspector
General (OIG) personnel. EAC members noted security
preparations are in place for the election event, the MNSD
party has not held any public demonstrations after being
refused a demonstration permit, and the necessary security
arrangements for the OIG visit have been made. Post officials
will continue to monitor events in-country and adjust the
security posture as needed. (Appendix source 2)


20. (SBU) NEA - Saudi Arabia - RSO Riyadh reported a fire
occurred in Khobar, located near the U.S. Embassy, November 3
at 11:40 a.m. According to RSO Dhahran, a light industrial
fire had set off an explosion from chemical barrels located
nearby. The local fire department responded and gained
control of the fire. No injuries or deaths were reported.
(RSO Riyadh telcon)


21. (SBU) Domestic - California - Approximately 200
Taiwanese-American individuals staged a peaceful
demonstration in front of the Chinese Consulate in San
Francisco at 1 p.m. November 1. The protesters held flags and
signs stating, &One Taiwan, One China,8 and one
demonstrator stated the demonstration was being held in
support of the recent rally of 600,000 pro-independence
Taiwanese supporters in Taipei. Demonstrators cooperated with
police requests and departed peacefully within an hour. (San
Francisco Field Office Spot Report)


22. (SBU) New York - Approximately 20 members of the Pakistan
USA Freedom Forum assembled in the vicinity of the Pakistani
Consulate in New York (NY) November 3 protesting the one-year
anniversary of former Pakistani President Musharraf,s arrest
of Supreme Court judges in Pakistan. The Diplomatic Security
NY Field Office coordinated with Pakistani security elements
prior to and during the demonstration, and the NY Police
Department was present for the duration of the demonstration.
The protest ended without incident. (NYFO Spot Report)


23. (U) Key Concerns


24. (S//NF) AF - South Africa - According to recent GRPO
reporting, a Moroccan-based extremist allegedly linked to
al-Qa,ida in the Lands of the Islamic Maghreb (AQIM) planned
to attack U.S. Embassy Pretoria in early November (NFI).
Assan Shuaib Munir, a trained pilot, planned to crash an
explosive-laden plane into Post at 9:45 a.m. Additional
details regarding the plan of attack or the type of aircraft
that was to be used were not provided. Supposedly, Ayman
al-Zawahiri, a member of the al-Qa,ida senior leadership,
personally directed Munir to conduct this attack in South
Africa. A Terrorist Identities Datamart Environment (TIDE)
search failed to provide any additional information on Munir.


25. (S//NF) DS/TIA/ITA is unaware of any reporting that would
corroborate this threat to U.S. Embassy Pretoria. DS/TIA/ITA
also notes AQIM has never conducted attacks in Southern
Africa, nor is it likely an al-Qa,ida senior leader would
direct the group to conduct an attack in the region. Although
al-Qa,ida-linked extremists do operate in South Africa, the
network is generally limited to the facilitation of attacks
in Europe. Overall, DS/TIA/ITA assesses this attack to be
unlikely; however, given the Embassy,s vulnerabilities to
aerial attacks, DS/TIA/ITA cannot completely dismiss the
possibility of an attack and will continue to monitor the
situation. (Appendix source 3)


26. (S//NF) SCA - Afghanistan - Taliban kidnapping plots: The
Taliban planned to abduct one American and two Canadian men
working for an unspecified construction company in the Baluch
Bawrai area of Kandahar city and located near the
intersection of Kandahar Air Field Road and Kandahar bypass
near a gas station. The guards were providing information to
the Taliban.


27. (S//NF) Separately, the Taliban planned to kidnap two
foreign women working for a non-governmental organization
(NGO) in Kandahar city that focuses on women,s issues. The
women were observed in the ladies, market on Rang Rezano
Street. They worked and lived close to the farmer,s market
in the northeast of Kandahar city.


28. (S//NF) Also, the Taliban postponed until approximately
November 25 its plan to kidnap a heavyset Western female
believed to be working at the British Embassy. The Taliban
intended to bring in an &abduction expert8 named Maulawi
Hamdullah to conduct the operation.


29. (S//NF) DS/TIA/ITA notes, because this source appears to
have general information on threats in Kandahar and Kabul,
the first threat is likely to be circular reporting. In
mid-October, a developing source with direct access to
Taliban elements similarly stated a group of Taliban members
led by Mullah Sadullah and Mullah Salam reportedly planned to
kidnap an unnamed American or Canadian national who worked at
a construction site southeast of Kandahar city.


30. (S//NF) While DS/TIA/ITA cannot corroborate the second
threat to the two women working for an NGO in Kandahar city,
a number of foreigners have been taken hostage this year.
Notably, information indicates the abduction of AmCit Cydney
Mizell on January 26 in Kandahar city was well planned and
executed, indicating the kidnappers had conducted thorough
surveillance of their target beforehand. The Taliban is also
particularly opposed to persons working on women,s issues.
Malali Kakar, head of the Kandahar Department of Crimes
against Women and an iconic figure among women,s groups in
Afghanistan, was assassinated in late September. The Taliban
has also made it clear NGOs are now legitimate targets. The
Agency Coordinating Body for Afghan Relief statistics
indicate there have been over 84 incidents against NGO
workers this year, including 21 in June, more than any other
month in the past six years.


31. (S//NF) The third threat was earlier reported by a
sensitive source with firsthand access. The source claimed
insurgents under Mullah Samiullah planned to kidnap a
red-haired, heavy-set British female working at the British
Embassy while she was out shopping in the city. Note the
current report states the British Embassy indicated there was
no individual fitting this description. Security incidents in
Kabul involving foreigners have escalated over the last
month. On November 1, unknown Afghans kidnapped Dutch
journalist Julie Rijke near Surowbi, Kabul Province. The
kidnapping of the Canadian journalist in Kabul in mid-October
remains unresolved. (Appendix sources 4-7)


32. (S//NF) Pakistan - Alleged meeting of high-level
extremist leaders discussing attack plans against U.S.:
Senior al-Qa,ida leader Ayman al-Zawahiri and various
anti-Coalition militia leaders, including Said Gul, allegedly
met at an Islamic festival in Lahore in late October,
according to a sensitive source claiming first- and
secondhand access. At the meeting, the leaders reportedly
chose 15 operatives to conduct an unspecified large-scale
attack against the United States.


33. (S//NF) A review of previous information DS/TIA/ITA
suspects is from the same source is indeed increasingly
sensationalistic and likely increasingly non-credible.
Late-September and mid-October reporting from this source
citing access to the meetings where former Northwest Frontier
Province (NWFP) provincial assembly member Said Gul is in
attendance has alleged Pakistan-based extremists are planning
to attack high-ranking U.S. officials in Pakistan and
government buildings in the United States. Earlier, and
likely more credible, reporting from probably the same source
characterized Gul as a facilitator working under Al-Badr
Mujahideen commander Bakht Zamin (TIDE number 12275313) and
former NWFP minister Siraj ul-Haq (TIDE number 209748),who
focused on fund-raising activities instead of operational
planning. (Appendix source 8-25)


34. (S//FGI//NF) Pakistan - Unsubstantiated report about
biological attack against U.S. missions: On November 2, a
Pakistan-based individual -- self-identified as Abu Shoaib
and a messenger and translator for al-Qa,ida -- contacted
the USG to report five unidentified al-Qa,ida members
planned to launch experimental biological attacks against
U.S. Embassy Islamabad and U.S. Consulate Karachi by November

4. A successful attack, barring the withdrawal of U.S. troops
from Iraq and Afghanistan, would be followed by a similar
operation against the U.S. homeland.


35. (S//NF) DS/TIA/ITA assesses the difficulties associated
with obtaining and using sophisticated chemical and
biological materials render it unlikely al-Qa,ida or other
Pakistani-based extremists currently possesses the capability
to launch a biological attack. Indeed, al-Qa,ida,s top
expert on chemical and biological weapons, Egyptian militant
Midhat Mursi al-Sayid Umar, a.k.a. Abu Khabab al-Masri, is
believed to have been killed on July 28 when a suspected U.S.
drone targeted a mosque in South Waziristan. His death
represents a significant setback for the group. Furthermore,
this threat is similar in tenor to early-October tearline
reporting, possibly suggesting warnings of an impending
biological attack are meant to harass and annoy. &In early
October, a Pakistan-based individual claiming to be a member
of al-Qa,ida informed the Italian and Japanese Ministry of
Foreign Affairs that al-Qa,ida currently has the capability
to launch a rudimentary biological attack.8


36. (S//NF) Name checks on Abu Shoaib yielded inconclusive
results; although, it may be a reference to Abu Shoaid
(a.k.a. Abu Shuaib, Mohammad Shabaz),the leader of a
purported Lashkar-e-Tayyiba off-shoot called Khair ul-Nass
(a.k.a. Jundallah),according to June 2007 reporting.
(Appendix sources 26-36)


37. (U) Threats & Analysis


38. (S//NF) AF - Somalia - Investigative update and fallout
from suicide bombings: The October 29 vehicle-borne
improvised explosive device detonations in Hargeysa,
Somaliland, targeted the Presidential Palace, Ethiopian
Embassy, and United Nations Development Program compound,
while a similar method of attacks were used by terrorists in
attacking two Puntland Intelligence Service offices in
neighboring Bossasso. Initial reports indicate significant
damage at all sites, with an estimated 29 dead and scores
more seriously injured (no AmCits). The well-timed,
coordinated attacks will possibly galvanize Somalilanders and
Puntlanders to address the presence of Islamic extremists in
their homeland; unfortunately, the suicide car bombings in
Hargeysa have also created a sense of xenophobia among
Somalilanders who are seeking retribution against refugees
from southern Somalia.


39. (U) Investigative update


40. (S//NF) Varied reports note authorities in Puntland have
arrested a well-known sheikh for his involvement in the
attacks in Bossasso; Sheikh Mohamed Ismail, who was arrested
on October 30, has a history of supporting extremist
activities in the region. Somaliland security officials have
also captured persons allegedly associated with the suicide
attacks in Hargeysa. Said persons are supposedly from central
Somalia and were in possession of a vehicle loaded with mines
and weapons, as reported by special intelligence (tearline).
Separate, yet related, reporting indicates some of these
attackers came from Mogadishu. Correspondingly, Somaliland
authorities have identified the license plate numbers of the
vehicles involved in the attacks in Hargeysa, and recent
intelligence gathered by the Ethiopian National Intelligence
and Security Service indicates the attacks in Hargeysa were
undertaken by three teams of suicide bombers who were driving
three Toyota Surf SUVs. Each team allegedly had two members;
the six operatives were reportedly all Somalis. They
originated from southern/central Somalia and were members of
the Hawiye clan. Varied reports also note security officials
in Hargeysa have located three houses that were used in
preparation for the operation. While no group has publicly
claimed ownership for the well-timed attacks, Somaliland
officials suspect al-Shabaab al-Islamiya as being responsible
for the deadly detonations. Recent special intelligence
(tearline) indicates al-Shabaab leader Mukhtar Robow is
likely involved.


41. (U) Aftermath of the attacks


42. (S//NF) Immediately after the attacks, the Somaliland
Government imposed a 9 p.m. to 5 a.m. curfew; increased the
number of police patrols on the streets; closed the region,s
land borders; enhanced security at key buildings throughout
the capital; and tightened airport security (NFI). The
Somaliland administration has also requested assistance with
its investigation from U.S. Embassy Nairobi, and the FBI has
opened a foreign assistance case in order to help with
laboratory analysis of any evidence that might be passed to
it. Unfortunately, these detonations have also resulted in a
ground swelling of xenophobia being exhibited among
Somalilanders who are seeking revenge against southerners
living in the north.


43. (S//NF) Specifically, Hargeysa is currently home to a
large population of southern Somalis -- those predominantly
from the Hawiye/Haber Gedir/Ayr clan -- who fled Mogadishu
due to attacks from armed forces/militias aligned with the
Darood-led Transitional Federal Government. According to a
well-known East Africa expert based in Nairobi who has
extensive experience working throughout Somalia, a large
segment of Somaliland,s population currently views these
displaced southerners as being supportive of/linked to
extremist elements in southern Somalia; in particular, the
violent al-Shabaab terrorist organization. Such perceived
linkages have created an atmosphere in Hargeysa that is
encouraging extrajudicial violence and killings. According to
an employee of a named humanitarian organization recently
based in Hargeysa and current U.S. Embassy reporting, there
are indications that mobs were threatening revenge against
southern Somalis in Hargeysa, blaming them for the car bomb
attacks.


44. (S//NF) DS/TIA/ITA notes it is not surprising al-Shabaab
leader Robow has claimed -- in special intelligence reporting
-- responsibility for the late-October suicide attacks in
Hargeysa and Bossasso. Ethiopian interests have been and will
remain an attractive target for al-Shabaab fighters and
extremist elements in Somalia, to include parts of the north.
However, the recent attacks in the north will hopefully
energize the local authorities to not only redouble their
efforts in rooting out extremist elements, but they may have
also resulted in al-Shabaab losing the &hearts and minds8
of the local populace who previously resented Ethiopia,s
presence in their country; the majority of those killed or
injured in the bombings were not Ethiopian. (Open sources;
Nairobi 2519; 2513; Appendix sources 37-43)


45. (S//NF) EAP - Indonesia: As of October 26, individuals
from the Poso Kayamanya Mujahidin allegedly planned to carry
out revenge attacks against Balinese people living in what
was described as the transmigration area located
approximately 15 miles from Poso, Central Sulawesi. The
attacks were to take place after the planned executions of
the three individuals convicted for their roles in the
October 2002 bombings in Bali. The Indonesian Armed Forces
Strategic Intelligence Agency (BAIS) information indicated
similar attacks were also planned against Christian churches
in Central Java. The Indonesian Government has publicly
announced its intention to execute the Bali bombers in early
November. There is no additional information on the Poso
Kayamanya Mujahidin group, but &Kayamanya8 was one of the
names used by recently arrested terrorist suspect Wahyu,
whose arrest by the Indonesian National Police (POLRI)
Detachment 88 has been widely reported in the open press. It
is also not clear whether the group is associated or
identifiable with a militant group known as the Poso
Mujahidin Group.


46. (S//NF) According to BAIS, several ex-Afghan mujahedeen
safehouses in the greater Jakarta area were vacated
immediately after the arrest of Wahyu on October 21.
Explosives found in Wahyu,s house were believed to be from
Maluku. BAIS officials assessed there would be attempts to
set off similar explosives through Christmas and New Year

2009. Separate information from late October indicates the
pending execution of the Bali bombers had raised concerns
within POLRI regarding possible retaliatory actions, and
there was widespread concern among senior POLRI officers that
the Indonesian Christian community would be targeted for such
retaliation. Acting upon this concern, POLRI had increased
the presence of plainclothes police in Bali, as well as
throughout various Christian communities in Java in the hope
of preventing violent actions and controlling any
demonstrations following the executions. In late October,
POLRI Chief General Bambang Hendarso Danuri had issued
instructions for the bombers to be executed sometime between
November 2 and 15, but he had not yet issued a specific time
or date for the execution due to fear that the information
would leak to the media.


47. (S//NF) Despite the government,s concerns, DS/TIA/ITA
assesses demonstrations -- some potentially violent --
against the government and possibly Western interests are the
most likely reaction to the executions. Such demonstrations
would probably be most prevalent during and after the
funerals of the three Bali bombers. The likelihood of a
terrorist attack conducted against U.S. or other Western
interests in direct response to the executions is low.
Although some elements in Jemaah Islamiyah (JI) -- the
traditional threat in the region -- would not pass on an
opportunity to attack U.S. interests, the organization is in
a state of disarray and does not currently possess the
capability to conduct a successful attack timed to coincide
soon after the executions. Nonetheless, the possibility
exists that individuals or small cells outside JI,s central
structure could use the executions or funerals as an
opportunity to conduct a smaller-scale attack against a soft
target. (Appendix sources 44-45)


48. (S//NF) SCA - Pakistan - Weekend attacks in NWFP: A
suspected rocket attack within 2,000 meters of U.S. Consulate
Peshawar residential areas and official annexes on November
1, another suspected rocket attack against the Peshawar
International Airport on November 3, and a suicide
assassination operation against the Pakistani deputy
inspector general of police in a neighboring district on
October 31 underscore the continued capacity of extremists to
operate in and around Peshawar using distinct tactics to
effectively attack a variety of targets. Troublingly,
sensitive reporting from late October suggested
al-Qa,ida-linked militants aimed to use car bombs, mortars,
and suicide operations against four targets, including mortar
attacks against the U.S. Consulate. Indeed, the operational
pace in and around Peshawar suggests militants are able to
conduct a series of attacks in a remarkably short period of
time; although, there is little visibility into whether
extremists have organized a coordinated system for operations
or maintain various cells launching attacks on their own.


49. (S//NF) Thus far, rocket attacks in Peshawar have been
generally inaccurate and have caused little in the way of
significant damage. The November 1 incident occurred at a
police substation located 1,500 to 2,000 meters from
Consulate residences and annexes, killing one and wounding
several. The second suspected rocket strike against Peshawar
International Airport caused no injuries or significant
damage. Regardless, the suspected extremists who are
orchestrating these attacks have noticeably increased the
frequency of their attempts. In 2007, two rocket attacks
occurred in Peshawar, and one was disrupted. In 2008,
including these two incidents in November, militants have
launched six rocket attacks. According to available reporting
detailing the nine total incidents, six utilized between two
to four rockets, while the three most recent attacks have
ostensibly utilized a single rocket.


50. (SBU) The October 31 suicide operative attack against the
deputy inspector general,s motorcade as he left his
residence in Mardan, located about an hour north of Peshawar,
proved much more deadly. The blast wounded at least 21 and
killed nine. Previous suicide operations in Pakistan,
including Peshawar, have similarly demonstrated a willingness
to inflict mass casualties in pursuit of a specific target.
In the first week of October, three other prominent Pakistani
officials have been the targets of assassination attempts in
NWFP. On October 6, a suicide bomber killed 26 and injured
over 90 at an attack at the home of a Pakistan Muslim
League-Nawaz National Assembly member in Bhakkar, Punjab,
which borders Dera Ismail Khan, NWFP. On October 5, two
rockets targeted the home of Chief Minister NWFP Amir Haider
Hoti in Mardan District, NWFP. On October 2, another suicide
bomber attempted to kill the leader of the secular Awami
National Party at his residence in Charsadda, NWFP. (Open
sources; Appendix sources 46-59)


51. (U) Cyber Threats


52. (U) India - Separatist groups seek support online:


53. (SBU) Key highlights:
Many Indian insurgent and other anti-government groups are
continuing operations online.
Maoist insurgents petition for recruits through e-mail
solicitation and forum participation.
Pro-Sikh and Kashmir separatists, online presences are
also steadily growing.
These and similar groups are establishing cyber
capabilities to supplement other programs.


54. (SBU) Source paragraph: &Since January, the OSC (Open
Source Center) has observed an increased presence of Indian
separatist groups on the Internet. Groups such as the Maoists
and Kashmir separatists are using the Internet to propagate
their views and recruit followers. Sikh separatists, who have
a considerable Internet presence, have been observed to be
lobbying for independence in addition to highlighting human
rights violations, by the Indian Government. Supporters of
these groups have also been running an ever-growing number of
blogs (Web logs) and discussion forums. According to media
reports, ULFA (United Liberation Front of Asom) and other
northeastern insurgent groups have unleashed a virtual
blitzkrieg, against the Indian Army on the Internet.8


55. (SBU) CTAD comment: Many groups are increasingly turning
to the Internet in order to take advantage of its efficient
outreach and to fill gaps from the lack of access to or
influence by other media platforms. Much like the growing
number of Islamic extremist organizations (e.g., al-Qa,ida)
that are developing cyber capabilities and espousing online
campaigns against Western targets (see CTAD Daily Read Files
(DRFs) dated October 20 and May 8),several Indian
anti-government groups are beginning to realize the Internet
is a valuable resource for advancing their causes, spreading
propaganda, and recruiting members to further enhance their
viability and technical capacity. Some militant Indian
organizations are possibly employing the tactics of the
Indian Mujahideen and are steadily arming themselves with
sophisticated cyber attack programs to use in conjunction
with physical operations. This shift in strategy will likely
provide a regeneration and intensity that will enable Indian
separatists and insurgents to strengthen and extend their
battlefield online.


56. (U) CTAD comment: India,s Maoist insurgent groups have
increased recruitment via the Internet in addition to
larger-scale physical attacks. Despite reports of the decline
of the Maoist insurgency,s resources and capabilities,
enrollment efforts seem to have renewed online. The group,s
extensive propaganda campaign includes the use of a growing
number of websites and blogs targeting potential recruits for
new diversified roles (e.g., within an &intelligence wing8)
in order to increase their area of influence. Additionally,
officials have noted the use of e-mail messages sent to
various groups of students and other candidates, especially
tech-savvy individuals, in order to solicit specific
qualifications and abilities. These acquired capabilities
could provide Maoist insurgent organizations throughout India
and Nepal with added resources to facilitate further growth
and use of the Internet in conjunction with kinetic
operations. Internet outreach also allows Indian Maoists to
efficiently and securely coordinate with activists around the
world.


57. (U) CTAD comment: Pro-Sikh websites and blogs are
continuing to grow in size and intensity, discussing their
overall initiatives and attempting to garner additional
support for the &Sikh freedom movement.8 Likewise,
pro-Kashmir sites are steadily emerging in order to bring
attention to the group,s separatist endeavors as well as to
the overall issue of human rights throughout Southern Asia.
The ULFA is also using social-networking sites and online
forums such as Orkut and Facebook to promote its efforts and
attract prospective members or sponsorship. Due in part to
the relatively low cost of establishing online programs,
these groups are able to rapidly disseminate information and
better organize their campaigns through Internet campaigns
against larger, more capable institutions (e.g.,
state-sponsored intelligence agencies and other government
organizations). In addition, increased global collaboration
offers a level of anonymity and diversification that could
add longevity and sophistication to these groups,
technological advancement.


58. (SBU) CTAD comment: The steady rise of extremist and
activist use of the Internet to disseminate various groups,
messages and foster coordination also raises concern for
system security of those who oppose or do not support their
causes. While some of the groups seem to currently have
rudimentary capabilities, many are likely to continue to
recruit technically adept personnel in order to broaden the
scope and potency of their overall initiatives as well as to
expand their targeting efforts. The efficiency and privacy
afforded by blogs, forums, and other Web-based outlets help
to provide these ambitious organizations with a tremendous
resource for accessing significant numbers of new users and
tools, as well as financial assistance. As has been observed
with other groups, such as al-Qa,ida and the Indian
Mujahideen, Indian hackers and extremists are quickly
becoming aware of the advantages available through Internet
campaigns and other online operations (see CTAD DRF dated
September 9). These examples have also illustrated the
progression of resource development and allocation from
simple information sharing to the integration of cyber
activities into large-scale virtual and physical attacks.
(OSC, &Indian Separatist Groups Seen Increasing Presence on
Internet,8 October 31, 2008)


59. (U) Suspicious Activity Incidents


60. (SBU) EUR - Azerbaijan - An Iranian national photographed
the Landmark building (houses U.S. Embassy) and government
guesthouse, which is adjacent to the Landmark building, in
Baku on November 1. The subject held the camera at waist
level. Police stopped and questioned the man, who indicated
he is a journalist and came to Baku as a tourist. He went on
to say that he was photographing people and Baku sights.
Police erased the photographs of the Landmark building. The
subject was later interviewed by a member of the Ministry of
National Security in the police station before being
released.


61. (SBU) RSO Action/Assessment: Subject: Mohsen Karim
Mosiehl. Passport number: Z1661972. (SIMAS Event:
Baku-00508-2008)


62. (SBU) Romania - Surveillance Detection Team Bucharest
noticed a suspicious vehicle with two Arab male occupants
drive past the U.S. Embassy October 31. This vehicle was seen
on two previous occasions. The vehicle followed the
Ambassador,s vehicle back to Post on October 7. A few weeks
later, on October 23, it drove slowly past the Embassy.


63. (SBU) Record Check/Investigation: More information will
be reported as it becomes available. (SIMAS Event:
Bucharest-01019-2008)


64. (SBU) Slovakia - Three Middle Eastern-appearing men
walked around Bratislava October 28. When they reached the
square in front of the U.S. Embassy, they photographed Post
and its surroundings. After 5 minutes, they departed the area
on foot. (SIMAS Event: Bratislava-00292-2008)


65. (SBU) NEA - Yemen - Two men walked near the guard,s
booth at the Sheraton Hotel in Sana,a October 29. The
subjects asked the guard about a party that was taking place
in the hotel and wrote down the license plate numbers of
diplomatic vehicles. The U.S. Embassy Mobile Patrol unit
responded to the hotel and noted that the two men are
Political Security Organization (PSO) soldiers. The PSO
officer assigned to the hotel told the two men to leave the
area. (SIMAS Event: Sana,a-00973-2008)


66. (SBU) Yemen - Three Middle Eastern-appearing men loitered
about 40 meters from U.S. Embassy Sana,a November 1
observing Post and vehicles entering the compound. When
stopped and questioned by the Mission,s Mobile Patrol unit,
they indicated they were waiting for their families who were
inside the Embassy (NFI).


67. (SBU) Record Check/Investigation: Subject 1: Mrwan
Mohamed Absullah Al-Refai. Identification number: 73671.
Subject 2: Adel Ahmed Yahya. Passport number: 1528725.
Subject 3: Aziz Ail Al-Doabi. Passport number: 57241899.
Identification number: 22092. (SIMAS Event:
Sana,a-00974-2008)


68. (SBU) EAP - Indonesia - A man with a camera sat on a park
bench across the street from the U.S. Ambassador,s residence
in Jakarta November 1. The subject aimed his camera at
various sites in the park and the residence. By the time a
LGF member could respond, the man got in a car and departed
the area. (SIMAS Event: Jakarta-01900-2008)

SECRET//FGI//NOFORN//MR
Full Appendix with sourcing available upon request.
RICE