PRIVATE ISRAELI COMPANY COLLECTS COUNTER-TERRORISM

S E C R E T TEL AVIV 000592 SIPDIS SIPDIS PLEASE PASS TO TREASURY FOR CONLON; S/CT FOR WORMAN; INR FOR CHAMBERS E.O. 12958: DECL: 03/11/2018 TAGS: PINR PTER KOGL KTFN IR IS SUBJECT: PRIVATE ISRAELI COMPANY COLLECTS COUNTER-TERRORISM INTELLIGENCE Classified By: Ambassador Richard H. Jones for reasons 1.4 (b/d) ¶1. (S) On March 7, Econoff received a briefing from senior executives at Hazard Threat Analysis, Ltd. (HTA),a private company specializing in internet-based counter-terrorism (CT) intelligence gathering. Founder and CEO Aviram Halevi explained that all of HTA's research is based on open source material gathered by collectors from shared platforms and peer-to-peer programs on the internet and Web 2.0. Halevi clarified that the company does not collect business intelligence or use hackers. HTA has a staff of approximately 25 researchers, of whom twenty are language specialists, primarily in Farsi and Arabic. The researchers are often recently discharged members of Israeli Defense Intelligence's (IDI) elite Unit 8200, which is well known in Israel as IDI's signal intelligence unit. The young staff is employed by HTA to develop online identities (avatars) in discussion groups used by potential terrorists to actively solicit information useful to their clients. Some of these identities have been maintained for as long as two years. Halevi was quick to note that his employees are not involved in terrorist planning online, limiting themselves to observer status within the groups. A typical monthly report costs between USD 2500-4500. ¶2. (S) Halevi, a former Lt. Colonel in IDI, said that other companies and agencies engage in similar activities, but none with the skill or experience of his team. Discharged soldiers from IDI serve as a "bottomless well" of talent, said Halevi, and new personnel can always be hired depending on the needs of the client. Halevi explained that the researchers and analysts understand the CT context in which they are working from their army training, and their skills are such that not one false identity has ever been identified by other participants in discussion groups. Halevi noted that HTA has a competitive edge in this sort of technical analysis, and is currently providing similar reports to the Joint Task Force in Iraq (this has not been independently confirmed). In Halevi's view, this ability to analyze technical capabilities is what differentiates HTA from others in the field, such as the American Rita Katz and her Site Institute. In a separate conversation, IDI Iran analyst Itai Yonat told Econoff that HTA analysts often claim responsibility for recent terrorist attacks as a means of establishing credibility in online groups, using technical knowledge of such events in the region. Yonat confessed that the GOI was generally unwilling to outsource intelligence work to HTA, but regularly made use of their information when provided for free. ¶3. (S) Mickey Segall, Head of Political Analysis, noted that HTA was different from traditional intelligence agencies in that there is no wall between collection and analysis. Instead, collectors and analysts work side-by-side to refine the final product and bring it to market as quickly as possible. This allows the staff to "reach across the aisle" and change priorities if the customer makes a specific request. Segall worked on Arab and Iranian issues for twenty years in IDI where he also reached the rank of Lt. Colonel, but said that when he joined HTA one year ago much of the company's information was entirely new to him. It is surprising, said Segall, how many high-ranking people keep blogs, especially in Iran, which is a relatively techno-savvy country. He offered the example of the Central Bank of Iran, which maintains a public site where officials discuss the bank's internal policies and comment on actions taken by the U.S. Department of the Treasury. ¶4. (S) Segall said that outsourcing to HTA does not replace traditional intelligence, but rather enhances it. "We can be there fast, with high quality information tailored to the customer," said Segall. HTA can do both pinpoint research and broader situation reports, but is not able to provide the sort of "point-to-point" specific information available through more traditional intelligence gathering methods. Instead, said Segall, the researchers focus on early phases of CT when terrorists are often less cautious about their use of technology. Halevi said that this type of information could be particularly useful in tracking terrorism finance. HTA's analysts often encounter fundraisers for terrorist groups, credit card numbers, pin codes, and other identifying information, but do not have any customers requesting this information. Halevi also believes that when it comes to Iran, there is considerable information that could be obtained on the Islamic Revolutionary Guard Corps and other groups through the use of link analysis connecting individuals with support for terrorism and nuclear proliferation. ¶5. (S) The company maintains a databank of private video and photographs posted on blogs and discussion groups from target countries. Halevi said that in many cases, the data is removed by government censors within minutes, but the footage remains accessible forever to HTA researchers. HTA analysts recently used video footage posted on Hamas internet chat groups to prepare a report for IDI Research on rocket capacity in Gaza. He added that gaining the confidence of U.S. clients is an arduous process, as HTA is not incorporated in the United States. HTA shares contracts with its sister company in the United Kingdom, Hazard Management Solutions Ltd, which was recently acquired by the Canadian company Allen-Vanguard. ********************************************* ******************** Visit Embassy Tel Aviv's Classified Website: http://www.state.sgov.gov/p/nea/telaviv You can also access this site through the State Department's Classified SIPRNET website. ********************************************* ******************** JONES