PRIVATE ISRAELI COMPANY COLLECTS COUNTER-TERRORISM

S E C R E T TEL AVIV 000592

SIPDIS

SIPDIS

PLEASE PASS TO TREASURY FOR CONLON; S/CT FOR WORMAN; INR
FOR CHAMBERS

E.O. 12958: DECL: 03/11/2018
TAGS: PINR PTER KOGL KTFN IR IS
SUBJECT: PRIVATE ISRAELI COMPANY COLLECTS COUNTER-TERRORISM
INTELLIGENCE

Classified By: Ambassador Richard H. Jones for reasons 1.4 (b/d)


1. (S) On March 7, Econoff received a briefing from senior
executives at Hazard Threat Analysis, Ltd. (HTA),a private
company specializing in internet-based counter-terrorism (CT)
intelligence gathering. Founder and CEO Aviram Halevi
explained that all of HTA's research is based on open source
material gathered by collectors from shared platforms and
peer-to-peer programs on the internet and Web 2.0. Halevi
clarified that the company does not collect business
intelligence or use hackers. HTA has a staff of
approximately 25 researchers, of whom twenty are language
specialists, primarily in Farsi and Arabic. The researchers
are often recently discharged members of Israeli Defense
Intelligence's (IDI) elite Unit 8200, which is well known in
Israel as IDI's signal intelligence unit. The young staff is
employed by HTA to develop online identities (avatars) in
discussion groups used by potential terrorists to actively
solicit information useful to their clients. Some of these
identities have been maintained for as long as two years.
Halevi was quick to note that his employees are not involved
in terrorist planning online, limiting themselves to observer
status within the groups. A typical monthly report costs
between USD 2500-4500.


2. (S) Halevi, a former Lt. Colonel in IDI, said that other
companies and agencies engage in similar activities, but none
with the skill or experience of his team. Discharged
soldiers from IDI serve as a "bottomless well" of talent,
said Halevi, and new personnel can always be hired depending
on the needs of the client. Halevi explained that the
researchers and analysts understand the CT context in which
they are working from their army training, and their skills
are such that not one false identity has ever been identified
by other participants in discussion groups. Halevi noted
that HTA has a competitive edge in this sort of technical
analysis, and is currently providing similar reports to the
Joint Task Force in Iraq (this has not been independently
confirmed). In Halevi's view, this ability to analyze
technical capabilities is what differentiates HTA from others
in the field, such as the American Rita Katz and her Site
Institute. In a separate conversation, IDI Iran analyst Itai
Yonat told Econoff that HTA analysts often claim
responsibility for recent terrorist attacks as a means of
establishing credibility in online groups, using technical
knowledge of such events in the region. Yonat confessed that
the GOI was generally unwilling to outsource intelligence
work to HTA, but regularly made use of their information when
provided for free.


3. (S) Mickey Segall, Head of Political Analysis, noted that
HTA was different from traditional intelligence agencies in
that there is no wall between collection and analysis.
Instead, collectors and analysts work side-by-side to refine
the final product and bring it to market as quickly as
possible. This allows the staff to "reach across the aisle"
and change priorities if the customer makes a specific
request. Segall worked on Arab and Iranian issues for twenty
years in IDI where he also reached the rank of Lt. Colonel,
but said that when he joined HTA one year ago much of the
company's information was entirely new to him. It is
surprising, said Segall, how many high-ranking people keep
blogs, especially in Iran, which is a relatively techno-savvy
country. He offered the example of the Central Bank of Iran,
which maintains a public site where officials discuss the
bank's internal policies and comment on actions taken by the
U.S. Department of the Treasury.


4. (S) Segall said that outsourcing to HTA does not replace
traditional intelligence, but rather enhances it. "We can be
there fast, with high quality information tailored to the
customer," said Segall. HTA can do both pinpoint research
and broader situation reports, but is not able to provide the
sort of "point-to-point" specific information available
through more traditional intelligence gathering methods.
Instead, said Segall, the researchers focus on early phases
of CT when terrorists are often less cautious about their use
of technology. Halevi said that this type of information
could be particularly useful in tracking terrorism finance.
HTA's analysts often encounter fundraisers for terrorist
groups, credit card numbers, pin codes, and other identifying
information, but do not have any customers requesting this
information. Halevi also believes that when it comes to
Iran, there is considerable information that could be
obtained on the Islamic Revolutionary Guard Corps and other
groups through the use of link analysis connecting
individuals with support for terrorism and nuclear
proliferation.


5. (S) The company maintains a databank of private video and
photographs posted on blogs and discussion groups from target
countries. Halevi said that in many cases, the data is
removed by government censors within minutes, but the footage
remains accessible forever to HTA researchers. HTA analysts
recently used video footage posted on Hamas internet chat
groups to prepare a report for IDI Research on rocket
capacity in Gaza. He added that gaining the confidence of
U.S. clients is an arduous process, as HTA is not
incorporated in the United States. HTA shares contracts with
its sister company in the United Kingdom, Hazard Management
Solutions Ltd, which was recently acquired by the Canadian
company Allen-Vanguard.

********************************************* ********************
Visit Embassy Tel Aviv's Classified Website:
http://www.state.sgov.gov/p/nea/telaviv

You can also access this site through the State Department's
Classified SIPRNET website.
********************************************* ********************
JONES