DIPLOMATIC SECURITY DAILY

S E C R E T STATE 117478 NOFORN E.O. 12958: DECL: MR TAGS: ASEC SUBJECT: DIPLOMATIC SECURITY DAILY Classified By: Derived from Multiple Sources SECRET//FGI//NOFORN//MR Declassify on: Source marked 25X1-human, Date of source: November 3, 2008 ¶1. (U) Diplomatic Security Daily, November 4, 2008 ¶2. (U) Significant Events ) Paragraphs 7-22 ¶3. (U) Key Concerns ) Paragraphs 23-36 ¶4. (U) Threats & Analysis ) Paragraphs 37-50 ¶5. (U) Cyber Threats ) Paragraphs 51-58 ¶6. (U) Suspicious Activity Incidents ) Paragraphs 59-68 ¶7. (U) Significant Events ¶8. (SBU) WHA - Argentina - Emergency Action Committee (EAC) Buenos Aires convened November 3 to review security preparations for the U.S. election night event scheduled for November 4 at the American Club. The RSO reviewed the security arrangements, which include the Argentine Federal Police (PFA) providing dedicated security/police support for the event and the Local Guard Force (LGF) augmenting the PFA and building security to control access to the site. (Buenos Aires 1510) ¶9. (SBU) Guyana - An intruder entered the Grand Coastal (GC) hotel compound in Guyana, which is frequently used by U.S. Embassy contractors and visitors, November 3 at 5:10 a.m. During rounds, the GC security guard saw the intruder on the outside second-floor corridor and confronted him. The intruder jumped from the second floor to the ground, scaled the fence, ran to his motorcycle, and fled the area. As the intruder ran away, the security guard fired a warning shot. A U.S. Embassy contractor heard the commotion outside his room and contacted his supervisor. At 5:50 a.m., the RSO was notified and met with hotel security elements to obtain a statement of the incident. The RSO discussed with security assets the use of force and provided suggestions on physical security upgrades to decrease the possibility of future incidents. (RSO Georgetown Spot Report) ¶10. (SBU) Mexico - EAC Nogales convened November 30 to assess the U.S. Consulate,s security posture in light of the previous night,s shooting of Sonora State Police Chief Pavon Felix at the makeshift State Police Operations Center/Headquarters located in a hotel less than 1,000 yards from the Consulate and less than 300 yards from Embassy officers, residences. On Sunday, November 2, grenade explosions and gunfire erupted in various parts of Nogales, Sonora, where police Chief Felix was killed and two other state police officials were wounded. EAC members believe that, while these developments are not specifically directed at the local American community nor toward U.S. business interests, there continues to be a trend of increasing potential random violence affecting members of the Consulate community and other Americans living, working, and/or visiting the Consular district. Post will hold a Town Hall meeting this week to discuss policies regarding localized violence. The EAC concluded Post,s current security posture remains adequate. EAC members will continue to monitor this situation and review any further developments or potential threats. (Nogales 0242) ¶11. (SBU) Venezuela - An AmCit was shot to death in Catia La Mar (near the Caracas airport) by two unknown assailants who were attempting to rob him at around 1 a.m. on November 1. The victim was reportedly walking out of a hotel when the men approached him and demanded his fanny pack and watch; when he refused to comply with their instruction, he was shot. American Citizen Services is assisting the family and performing all services for the death of American overseas. The RSO will maintain contact with police on the homicide investigation. (RSO Caracas Spot Report) ¶12. (SBU) EUR - Austria - Approximately 400 to 500 protesters gathered at the Westbahnhof Train Station in Vienna and marched to the Parliament building, adjacent to the U.S. Embassy residential building, November 1. The group, comprised of Kurdish individuals, protested against the imprisonment of Kurdistan Workers, Party leader Abdullah Ocalan and called for general peace in the province of Kurdistan. The demonstration ended without incident. (RSO Vienna Spot Report) ¶13. (C) Macedonia - EAC Skopje met on October 31 to discuss the host country,s threat environment and the U.S. Embassy,s security preparations for election night events. The Ambassador will host an event at the Macedonian Army Hall in Skopje on November 5. The RSO briefed the EAC on event concerns and discussed security arrangements in place for the venue. The RSO is working with the Macedonian Police as well as Embassy security assets to ensure maximum security coverage for the event. The EAC concurred that the security arrangements were appropriate to the local conditions, and there was no specific threat information to address. (Appendix source 1) ¶14. (SBU) Romania - A Peace Corps volunteer (PCV) was assaulted by three unidentified males while walking alone in a cemetery in Targu Mures November 1. The assailants assaulted the PCV and took his wallet. The PCV went to the hospital for treatment of several non-serious injuries. A police report has been filed. (RSO Bucharest Spot Report) ¶15. (SBU) Russia - A large demonstration took place November 2 on Nuvinskiy Bulvar, located across the street from the U.S. Embassy Moscow existing office building. The group was organized by Nashi, a pro-Kremlin, -Putin youth group, and advertised the event as &A Big American Show8 to protest U.S. policies in Iraq and the former Yugoslavia. Russian police services provided 1,700 officers to control the demonstration, and Regional Security Office and Marine Security Guard staff monitored the demonstration, which ended peacefully. (RSO Moscow Spot Report) ¶16. (SBU) AF - Democratic Republic of the Congo - EAC Kinshasa convened November 1 and approved USG employees resuming work in Goma during the operating hours of the Congolese and Rwandan border; however, all employees must return to Gisenyi, Rwanda, by 5 p.m. each day until further notice. EAC members will continue to monitor the situation. (Kinshasa 0960) ¶17. (SBU) GUINEA - Due to civil disturbances in Conakry, the EAC convened twice on November 3 to review the security situation in-country. These disturbances continue to target key traffic routes within the capital; demonstrators have closed routes by using impromptu tire barricades and have thrown stones and other objects at passing vehicles, including U.S. Embassy vehicles. Government police and gendarmes have responded to the protests by discharging small arms into the air and releasing tear gas in an attempt to disperse the crowds. The EAC reviewed Post,s security posture and will issue a Warden Message urging AmCits to exercise caution and avoid traveling in-country. The EAC further determined that Post will limit U.S. Mission travel to emergencies, and travel outside the Embassy requires RSO concurrence. The EAC has also adopted a Liberal Leave policy for foreign service national staff effective today, November ¶4. Post officials will continue to monitor the situation and reconvene today. (Conakry 0665; 0669) ¶18. (SBU) Mali - EAC Bamako met November 3 to discuss security preparations for the U.S. Embassy,s election night event at the Radisson Hotel. The RSO has met with host-country counterparts and hotel personnel regarding security for the event. The host country will provide traffic police as well as plainclothes officers to monitor security around the perimeter of the hotel, and Embassy security elements will monitor the events inside the conference area. (Bamako 0866) ¶19. (S//NF) Niger - EAC Niamey met November 3 to discuss security preparations for the election day event scheduled in the capital on November 5, the National Movement for the Development of Society (MNSD) party, and security arrangements for the upcoming visit of Office of Inspector General (OIG) personnel. EAC members noted security preparations are in place for the election event, the MNSD party has not held any public demonstrations after being refused a demonstration permit, and the necessary security arrangements for the OIG visit have been made. Post officials will continue to monitor events in-country and adjust the security posture as needed. (Appendix source 2) ¶20. (SBU) NEA - Saudi Arabia - RSO Riyadh reported a fire occurred in Khobar, located near the U.S. Embassy, November 3 at 11:40 a.m. According to RSO Dhahran, a light industrial fire had set off an explosion from chemical barrels located nearby. The local fire department responded and gained control of the fire. No injuries or deaths were reported. (RSO Riyadh telcon) ¶21. (SBU) Domestic - California - Approximately 200 Taiwanese-American individuals staged a peaceful demonstration in front of the Chinese Consulate in San Francisco at 1 p.m. November 1. The protesters held flags and signs stating, &One Taiwan, One China,8 and one demonstrator stated the demonstration was being held in support of the recent rally of 600,000 pro-independence Taiwanese supporters in Taipei. Demonstrators cooperated with police requests and departed peacefully within an hour. (San Francisco Field Office Spot Report) ¶22. (SBU) New York - Approximately 20 members of the Pakistan USA Freedom Forum assembled in the vicinity of the Pakistani Consulate in New York (NY) November 3 protesting the one-year anniversary of former Pakistani President Musharraf,s arrest of Supreme Court judges in Pakistan. The Diplomatic Security NY Field Office coordinated with Pakistani security elements prior to and during the demonstration, and the NY Police Department was present for the duration of the demonstration. The protest ended without incident. (NYFO Spot Report) ¶23. (U) Key Concerns ¶24. (S//NF) AF - South Africa - According to recent GRPO reporting, a Moroccan-based extremist allegedly linked to al-Qa,ida in the Lands of the Islamic Maghreb (AQIM) planned to attack U.S. Embassy Pretoria in early November (NFI). Assan Shuaib Munir, a trained pilot, planned to crash an explosive-laden plane into Post at 9:45 a.m. Additional details regarding the plan of attack or the type of aircraft that was to be used were not provided. Supposedly, Ayman al-Zawahiri, a member of the al-Qa,ida senior leadership, personally directed Munir to conduct this attack in South Africa. A Terrorist Identities Datamart Environment (TIDE) search failed to provide any additional information on Munir. ¶25. (S//NF) DS/TIA/ITA is unaware of any reporting that would corroborate this threat to U.S. Embassy Pretoria. DS/TIA/ITA also notes AQIM has never conducted attacks in Southern Africa, nor is it likely an al-Qa,ida senior leader would direct the group to conduct an attack in the region. Although al-Qa,ida-linked extremists do operate in South Africa, the network is generally limited to the facilitation of attacks in Europe. Overall, DS/TIA/ITA assesses this attack to be unlikely; however, given the Embassy,s vulnerabilities to aerial attacks, DS/TIA/ITA cannot completely dismiss the possibility of an attack and will continue to monitor the situation. (Appendix source 3) ¶26. (S//NF) SCA - Afghanistan - Taliban kidnapping plots: The Taliban planned to abduct one American and two Canadian men working for an unspecified construction company in the Baluch Bawrai area of Kandahar city and located near the intersection of Kandahar Air Field Road and Kandahar bypass near a gas station. The guards were providing information to the Taliban. ¶27. (S//NF) Separately, the Taliban planned to kidnap two foreign women working for a non-governmental organization (NGO) in Kandahar city that focuses on women,s issues. The women were observed in the ladies, market on Rang Rezano Street. They worked and lived close to the farmer,s market in the northeast of Kandahar city. ¶28. (S//NF) Also, the Taliban postponed until approximately November 25 its plan to kidnap a heavyset Western female believed to be working at the British Embassy. The Taliban intended to bring in an &abduction expert8 named Maulawi Hamdullah to conduct the operation. ¶29. (S//NF) DS/TIA/ITA notes, because this source appears to have general information on threats in Kandahar and Kabul, the first threat is likely to be circular reporting. In mid-October, a developing source with direct access to Taliban elements similarly stated a group of Taliban members led by Mullah Sadullah and Mullah Salam reportedly planned to kidnap an unnamed American or Canadian national who worked at a construction site southeast of Kandahar city. ¶30. (S//NF) While DS/TIA/ITA cannot corroborate the second threat to the two women working for an NGO in Kandahar city, a number of foreigners have been taken hostage this year. Notably, information indicates the abduction of AmCit Cydney Mizell on January 26 in Kandahar city was well planned and executed, indicating the kidnappers had conducted thorough surveillance of their target beforehand. The Taliban is also particularly opposed to persons working on women,s issues. Malali Kakar, head of the Kandahar Department of Crimes against Women and an iconic figure among women,s groups in Afghanistan, was assassinated in late September. The Taliban has also made it clear NGOs are now legitimate targets. The Agency Coordinating Body for Afghan Relief statistics indicate there have been over 84 incidents against NGO workers this year, including 21 in June, more than any other month in the past six years. ¶31. (S//NF) The third threat was earlier reported by a sensitive source with firsthand access. The source claimed insurgents under Mullah Samiullah planned to kidnap a red-haired, heavy-set British female working at the British Embassy while she was out shopping in the city. Note the current report states the British Embassy indicated there was no individual fitting this description. Security incidents in Kabul involving foreigners have escalated over the last month. On November 1, unknown Afghans kidnapped Dutch journalist Julie Rijke near Surowbi, Kabul Province. The kidnapping of the Canadian journalist in Kabul in mid-October remains unresolved. (Appendix sources 4-7) ¶32. (S//NF) Pakistan - Alleged meeting of high-level extremist leaders discussing attack plans against U.S.: Senior al-Qa,ida leader Ayman al-Zawahiri and various anti-Coalition militia leaders, including Said Gul, allegedly met at an Islamic festival in Lahore in late October, according to a sensitive source claiming first- and secondhand access. At the meeting, the leaders reportedly chose 15 operatives to conduct an unspecified large-scale attack against the United States. ¶33. (S//NF) A review of previous information DS/TIA/ITA suspects is from the same source is indeed increasingly sensationalistic and likely increasingly non-credible. Late-September and mid-October reporting from this source citing access to the meetings where former Northwest Frontier Province (NWFP) provincial assembly member Said Gul is in attendance has alleged Pakistan-based extremists are planning to attack high-ranking U.S. officials in Pakistan and government buildings in the United States. Earlier, and likely more credible, reporting from probably the same source characterized Gul as a facilitator working under Al-Badr Mujahideen commander Bakht Zamin (TIDE number 12275313) and former NWFP minister Siraj ul-Haq (TIDE number 209748),who focused on fund-raising activities instead of operational planning. (Appendix source 8-25) ¶34. (S//FGI//NF) Pakistan - Unsubstantiated report about biological attack against U.S. missions: On November 2, a Pakistan-based individual -- self-identified as Abu Shoaib and a messenger and translator for al-Qa,ida -- contacted the USG to report five unidentified al-Qa,ida members planned to launch experimental biological attacks against U.S. Embassy Islamabad and U.S. Consulate Karachi by November ¶4. A successful attack, barring the withdrawal of U.S. troops from Iraq and Afghanistan, would be followed by a similar operation against the U.S. homeland. ¶35. (S//NF) DS/TIA/ITA assesses the difficulties associated with obtaining and using sophisticated chemical and biological materials render it unlikely al-Qa,ida or other Pakistani-based extremists currently possesses the capability to launch a biological attack. Indeed, al-Qa,ida,s top expert on chemical and biological weapons, Egyptian militant Midhat Mursi al-Sayid Umar, a.k.a. Abu Khabab al-Masri, is believed to have been killed on July 28 when a suspected U.S. drone targeted a mosque in South Waziristan. His death represents a significant setback for the group. Furthermore, this threat is similar in tenor to early-October tearline reporting, possibly suggesting warnings of an impending biological attack are meant to harass and annoy. &In early October, a Pakistan-based individual claiming to be a member of al-Qa,ida informed the Italian and Japanese Ministry of Foreign Affairs that al-Qa,ida currently has the capability to launch a rudimentary biological attack.8 ¶36. (S//NF) Name checks on Abu Shoaib yielded inconclusive results; although, it may be a reference to Abu Shoaid (a.k.a. Abu Shuaib, Mohammad Shabaz),the leader of a purported Lashkar-e-Tayyiba off-shoot called Khair ul-Nass (a.k.a. Jundallah),according to June 2007 reporting. (Appendix sources 26-36) ¶37. (U) Threats & Analysis ¶38. (S//NF) AF - Somalia - Investigative update and fallout from suicide bombings: The October 29 vehicle-borne improvised explosive device detonations in Hargeysa, Somaliland, targeted the Presidential Palace, Ethiopian Embassy, and United Nations Development Program compound, while a similar method of attacks were used by terrorists in attacking two Puntland Intelligence Service offices in neighboring Bossasso. Initial reports indicate significant damage at all sites, with an estimated 29 dead and scores more seriously injured (no AmCits). The well-timed, coordinated attacks will possibly galvanize Somalilanders and Puntlanders to address the presence of Islamic extremists in their homeland; unfortunately, the suicide car bombings in Hargeysa have also created a sense of xenophobia among Somalilanders who are seeking retribution against refugees from southern Somalia. ¶39. (U) Investigative update ¶40. (S//NF) Varied reports note authorities in Puntland have arrested a well-known sheikh for his involvement in the attacks in Bossasso; Sheikh Mohamed Ismail, who was arrested on October 30, has a history of supporting extremist activities in the region. Somaliland security officials have also captured persons allegedly associated with the suicide attacks in Hargeysa. Said persons are supposedly from central Somalia and were in possession of a vehicle loaded with mines and weapons, as reported by special intelligence (tearline). Separate, yet related, reporting indicates some of these attackers came from Mogadishu. Correspondingly, Somaliland authorities have identified the license plate numbers of the vehicles involved in the attacks in Hargeysa, and recent intelligence gathered by the Ethiopian National Intelligence and Security Service indicates the attacks in Hargeysa were undertaken by three teams of suicide bombers who were driving three Toyota Surf SUVs. Each team allegedly had two members; the six operatives were reportedly all Somalis. They originated from southern/central Somalia and were members of the Hawiye clan. Varied reports also note security officials in Hargeysa have located three houses that were used in preparation for the operation. While no group has publicly claimed ownership for the well-timed attacks, Somaliland officials suspect al-Shabaab al-Islamiya as being responsible for the deadly detonations. Recent special intelligence (tearline) indicates al-Shabaab leader Mukhtar Robow is likely involved. ¶41. (U) Aftermath of the attacks ¶42. (S//NF) Immediately after the attacks, the Somaliland Government imposed a 9 p.m. to 5 a.m. curfew; increased the number of police patrols on the streets; closed the region,s land borders; enhanced security at key buildings throughout the capital; and tightened airport security (NFI). The Somaliland administration has also requested assistance with its investigation from U.S. Embassy Nairobi, and the FBI has opened a foreign assistance case in order to help with laboratory analysis of any evidence that might be passed to it. Unfortunately, these detonations have also resulted in a ground swelling of xenophobia being exhibited among Somalilanders who are seeking revenge against southerners living in the north. ¶43. (S//NF) Specifically, Hargeysa is currently home to a large population of southern Somalis -- those predominantly from the Hawiye/Haber Gedir/Ayr clan -- who fled Mogadishu due to attacks from armed forces/militias aligned with the Darood-led Transitional Federal Government. According to a well-known East Africa expert based in Nairobi who has extensive experience working throughout Somalia, a large segment of Somaliland,s population currently views these displaced southerners as being supportive of/linked to extremist elements in southern Somalia; in particular, the violent al-Shabaab terrorist organization. Such perceived linkages have created an atmosphere in Hargeysa that is encouraging extrajudicial violence and killings. According to an employee of a named humanitarian organization recently based in Hargeysa and current U.S. Embassy reporting, there are indications that mobs were threatening revenge against southern Somalis in Hargeysa, blaming them for the car bomb attacks. ¶44. (S//NF) DS/TIA/ITA notes it is not surprising al-Shabaab leader Robow has claimed -- in special intelligence reporting -- responsibility for the late-October suicide attacks in Hargeysa and Bossasso. Ethiopian interests have been and will remain an attractive target for al-Shabaab fighters and extremist elements in Somalia, to include parts of the north. However, the recent attacks in the north will hopefully energize the local authorities to not only redouble their efforts in rooting out extremist elements, but they may have also resulted in al-Shabaab losing the &hearts and minds8 of the local populace who previously resented Ethiopia,s presence in their country; the majority of those killed or injured in the bombings were not Ethiopian. (Open sources; Nairobi 2519; 2513; Appendix sources 37-43) ¶45. (S//NF) EAP - Indonesia: As of October 26, individuals from the Poso Kayamanya Mujahidin allegedly planned to carry out revenge attacks against Balinese people living in what was described as the transmigration area located approximately 15 miles from Poso, Central Sulawesi. The attacks were to take place after the planned executions of the three individuals convicted for their roles in the October 2002 bombings in Bali. The Indonesian Armed Forces Strategic Intelligence Agency (BAIS) information indicated similar attacks were also planned against Christian churches in Central Java. The Indonesian Government has publicly announced its intention to execute the Bali bombers in early November. There is no additional information on the Poso Kayamanya Mujahidin group, but &Kayamanya8 was one of the names used by recently arrested terrorist suspect Wahyu, whose arrest by the Indonesian National Police (POLRI) Detachment 88 has been widely reported in the open press. It is also not clear whether the group is associated or identifiable with a militant group known as the Poso Mujahidin Group. ¶46. (S//NF) According to BAIS, several ex-Afghan mujahedeen safehouses in the greater Jakarta area were vacated immediately after the arrest of Wahyu on October 21. Explosives found in Wahyu,s house were believed to be from Maluku. BAIS officials assessed there would be attempts to set off similar explosives through Christmas and New Year ¶2009. Separate information from late October indicates the pending execution of the Bali bombers had raised concerns within POLRI regarding possible retaliatory actions, and there was widespread concern among senior POLRI officers that the Indonesian Christian community would be targeted for such retaliation. Acting upon this concern, POLRI had increased the presence of plainclothes police in Bali, as well as throughout various Christian communities in Java in the hope of preventing violent actions and controlling any demonstrations following the executions. In late October, POLRI Chief General Bambang Hendarso Danuri had issued instructions for the bombers to be executed sometime between November 2 and 15, but he had not yet issued a specific time or date for the execution due to fear that the information would leak to the media. ¶47. (S//NF) Despite the government,s concerns, DS/TIA/ITA assesses demonstrations -- some potentially violent -- against the government and possibly Western interests are the most likely reaction to the executions. Such demonstrations would probably be most prevalent during and after the funerals of the three Bali bombers. The likelihood of a terrorist attack conducted against U.S. or other Western interests in direct response to the executions is low. Although some elements in Jemaah Islamiyah (JI) -- the traditional threat in the region -- would not pass on an opportunity to attack U.S. interests, the organization is in a state of disarray and does not currently possess the capability to conduct a successful attack timed to coincide soon after the executions. Nonetheless, the possibility exists that individuals or small cells outside JI,s central structure could use the executions or funerals as an opportunity to conduct a smaller-scale attack against a soft target. (Appendix sources 44-45) ¶48. (S//NF) SCA - Pakistan - Weekend attacks in NWFP: A suspected rocket attack within 2,000 meters of U.S. Consulate Peshawar residential areas and official annexes on November 1, another suspected rocket attack against the Peshawar International Airport on November 3, and a suicide assassination operation against the Pakistani deputy inspector general of police in a neighboring district on October 31 underscore the continued capacity of extremists to operate in and around Peshawar using distinct tactics to effectively attack a variety of targets. Troublingly, sensitive reporting from late October suggested al-Qa,ida-linked militants aimed to use car bombs, mortars, and suicide operations against four targets, including mortar attacks against the U.S. Consulate. Indeed, the operational pace in and around Peshawar suggests militants are able to conduct a series of attacks in a remarkably short period of time; although, there is little visibility into whether extremists have organized a coordinated system for operations or maintain various cells launching attacks on their own. ¶49. (S//NF) Thus far, rocket attacks in Peshawar have been generally inaccurate and have caused little in the way of significant damage. The November 1 incident occurred at a police substation located 1,500 to 2,000 meters from Consulate residences and annexes, killing one and wounding several. The second suspected rocket strike against Peshawar International Airport caused no injuries or significant damage. Regardless, the suspected extremists who are orchestrating these attacks have noticeably increased the frequency of their attempts. In 2007, two rocket attacks occurred in Peshawar, and one was disrupted. In 2008, including these two incidents in November, militants have launched six rocket attacks. According to available reporting detailing the nine total incidents, six utilized between two to four rockets, while the three most recent attacks have ostensibly utilized a single rocket. ¶50. (SBU) The October 31 suicide operative attack against the deputy inspector general,s motorcade as he left his residence in Mardan, located about an hour north of Peshawar, proved much more deadly. The blast wounded at least 21 and killed nine. Previous suicide operations in Pakistan, including Peshawar, have similarly demonstrated a willingness to inflict mass casualties in pursuit of a specific target. In the first week of October, three other prominent Pakistani officials have been the targets of assassination attempts in NWFP. On October 6, a suicide bomber killed 26 and injured over 90 at an attack at the home of a Pakistan Muslim League-Nawaz National Assembly member in Bhakkar, Punjab, which borders Dera Ismail Khan, NWFP. On October 5, two rockets targeted the home of Chief Minister NWFP Amir Haider Hoti in Mardan District, NWFP. On October 2, another suicide bomber attempted to kill the leader of the secular Awami National Party at his residence in Charsadda, NWFP. (Open sources; Appendix sources 46-59) ¶51. (U) Cyber Threats ¶52. (U) India - Separatist groups seek support online: ¶53. (SBU) Key highlights: Many Indian insurgent and other anti-government groups are continuing operations online. Maoist insurgents petition for recruits through e-mail solicitation and forum participation. Pro-Sikh and Kashmir separatists, online presences are also steadily growing. These and similar groups are establishing cyber capabilities to supplement other programs. ¶54. (SBU) Source paragraph: &Since January, the OSC (Open Source Center) has observed an increased presence of Indian separatist groups on the Internet. Groups such as the Maoists and Kashmir separatists are using the Internet to propagate their views and recruit followers. Sikh separatists, who have a considerable Internet presence, have been observed to be lobbying for independence in addition to highlighting human rights violations, by the Indian Government. Supporters of these groups have also been running an ever-growing number of blogs (Web logs) and discussion forums. According to media reports, ULFA (United Liberation Front of Asom) and other northeastern insurgent groups have unleashed a virtual blitzkrieg, against the Indian Army on the Internet.8 ¶55. (SBU) CTAD comment: Many groups are increasingly turning to the Internet in order to take advantage of its efficient outreach and to fill gaps from the lack of access to or influence by other media platforms. Much like the growing number of Islamic extremist organizations (e.g., al-Qa,ida) that are developing cyber capabilities and espousing online campaigns against Western targets (see CTAD Daily Read Files (DRFs) dated October 20 and May 8),several Indian anti-government groups are beginning to realize the Internet is a valuable resource for advancing their causes, spreading propaganda, and recruiting members to further enhance their viability and technical capacity. Some militant Indian organizations are possibly employing the tactics of the Indian Mujahideen and are steadily arming themselves with sophisticated cyber attack programs to use in conjunction with physical operations. This shift in strategy will likely provide a regeneration and intensity that will enable Indian separatists and insurgents to strengthen and extend their battlefield online. ¶56. (U) CTAD comment: India,s Maoist insurgent groups have increased recruitment via the Internet in addition to larger-scale physical attacks. Despite reports of the decline of the Maoist insurgency,s resources and capabilities, enrollment efforts seem to have renewed online. The group,s extensive propaganda campaign includes the use of a growing number of websites and blogs targeting potential recruits for new diversified roles (e.g., within an &intelligence wing8) in order to increase their area of influence. Additionally, officials have noted the use of e-mail messages sent to various groups of students and other candidates, especially tech-savvy individuals, in order to solicit specific qualifications and abilities. These acquired capabilities could provide Maoist insurgent organizations throughout India and Nepal with added resources to facilitate further growth and use of the Internet in conjunction with kinetic operations. Internet outreach also allows Indian Maoists to efficiently and securely coordinate with activists around the world. ¶57. (U) CTAD comment: Pro-Sikh websites and blogs are continuing to grow in size and intensity, discussing their overall initiatives and attempting to garner additional support for the &Sikh freedom movement.8 Likewise, pro-Kashmir sites are steadily emerging in order to bring attention to the group,s separatist endeavors as well as to the overall issue of human rights throughout Southern Asia. The ULFA is also using social-networking sites and online forums such as Orkut and Facebook to promote its efforts and attract prospective members or sponsorship. Due in part to the relatively low cost of establishing online programs, these groups are able to rapidly disseminate information and better organize their campaigns through Internet campaigns against larger, more capable institutions (e.g., state-sponsored intelligence agencies and other government organizations). In addition, increased global collaboration offers a level of anonymity and diversification that could add longevity and sophistication to these groups, technological advancement. ¶58. (SBU) CTAD comment: The steady rise of extremist and activist use of the Internet to disseminate various groups, messages and foster coordination also raises concern for system security of those who oppose or do not support their causes. While some of the groups seem to currently have rudimentary capabilities, many are likely to continue to recruit technically adept personnel in order to broaden the scope and potency of their overall initiatives as well as to expand their targeting efforts. The efficiency and privacy afforded by blogs, forums, and other Web-based outlets help to provide these ambitious organizations with a tremendous resource for accessing significant numbers of new users and tools, as well as financial assistance. As has been observed with other groups, such as al-Qa,ida and the Indian Mujahideen, Indian hackers and extremists are quickly becoming aware of the advantages available through Internet campaigns and other online operations (see CTAD DRF dated September 9). These examples have also illustrated the progression of resource development and allocation from simple information sharing to the integration of cyber activities into large-scale virtual and physical attacks. (OSC, &Indian Separatist Groups Seen Increasing Presence on Internet,8 October 31, 2008) ¶59. (U) Suspicious Activity Incidents ¶60. (SBU) EUR - Azerbaijan - An Iranian national photographed the Landmark building (houses U.S. Embassy) and government guesthouse, which is adjacent to the Landmark building, in Baku on November 1. The subject held the camera at waist level. Police stopped and questioned the man, who indicated he is a journalist and came to Baku as a tourist. He went on to say that he was photographing people and Baku sights. Police erased the photographs of the Landmark building. The subject was later interviewed by a member of the Ministry of National Security in the police station before being released. ¶61. (SBU) RSO Action/Assessment: Subject: Mohsen Karim Mosiehl. Passport number: Z1661972. (SIMAS Event: Baku-00508-2008) ¶62. (SBU) Romania - Surveillance Detection Team Bucharest noticed a suspicious vehicle with two Arab male occupants drive past the U.S. Embassy October 31. This vehicle was seen on two previous occasions. The vehicle followed the Ambassador,s vehicle back to Post on October 7. A few weeks later, on October 23, it drove slowly past the Embassy. ¶63. (SBU) Record Check/Investigation: More information will be reported as it becomes available. (SIMAS Event: Bucharest-01019-2008) ¶64. (SBU) Slovakia - Three Middle Eastern-appearing men walked around Bratislava October 28. When they reached the square in front of the U.S. Embassy, they photographed Post and its surroundings. After 5 minutes, they departed the area on foot. (SIMAS Event: Bratislava-00292-2008) ¶65. (SBU) NEA - Yemen - Two men walked near the guard,s booth at the Sheraton Hotel in Sana,a October 29. The subjects asked the guard about a party that was taking place in the hotel and wrote down the license plate numbers of diplomatic vehicles. The U.S. Embassy Mobile Patrol unit responded to the hotel and noted that the two men are Political Security Organization (PSO) soldiers. The PSO officer assigned to the hotel told the two men to leave the area. (SIMAS Event: Sana,a-00973-2008) ¶66. (SBU) Yemen - Three Middle Eastern-appearing men loitered about 40 meters from U.S. Embassy Sana,a November 1 observing Post and vehicles entering the compound. When stopped and questioned by the Mission,s Mobile Patrol unit, they indicated they were waiting for their families who were inside the Embassy (NFI). ¶67. (SBU) Record Check/Investigation: Subject 1: Mrwan Mohamed Absullah Al-Refai. Identification number: 73671. Subject 2: Adel Ahmed Yahya. Passport number: 1528725. Subject 3: Aziz Ail Al-Doabi. Passport number: 57241899. Identification number: 22092. (SIMAS Event: Sana,a-00974-2008) ¶68. (SBU) EAP - Indonesia - A man with a camera sat on a park bench across the street from the U.S. Ambassador,s residence in Jakarta November 1. The subject aimed his camera at various sites in the park and the residence. By the time a LGF member could respond, the man got in a car and departed the area. (SIMAS Event: Jakarta-01900-2008) SECRET//FGI//NOFORN//MR Full Appendix with sourcing available upon request. RICE