DIPLOMATIC SECURITY DAILY

S E C R E T STATE 017313 NOFORN E.O. 12958: DECL: MR TAGS: ASEC SUBJECT: DIPLOMATIC SECURITY DAILY Classified By: Derived from Multiple Sources SECRET//NOFORN//MR Declassify on: Source marked 25X1-human, Date of source: February 24, 2009 ¶1. (U) Diplomatic Security Daily, February 25, 2009 ¶2. (U) Iraq - Paragraphs 7-9 ¶3. (U) Significant Events - Paragraphs 10-13 ¶4. (U) Key Concerns - Paragraphs 14-31 ¶5. (U) Cyber Threats - Paragraphs 32-40 ¶6. (U) Suspicious Activity Incidents - Paragraphs 41-52 ¶7. (U) Iraq ¶8. (S//REL TO USA, AUS, CAN, GBR) ISI plans attacks against Asiacell buildings and employees in Mosul: As of late February, the Islamic State of Iraq (ISI) was distributing flyers stating Asiacell buildings in al Wahda neighborhood, east Mosul, and Islah al Zira'I neighborhood in west Mosul, Ninawa Governorate, would be attacked, according to multiple sources and subsources, including a senior police official in Mosul and an Iraqi Kurd who worked for Asiacell in Mosul. ISI also stated the main Asiacell warehouse in the al-Falah area would be attacked and that Asiacell employee vehicles would be burned. The stated reason for the attack was that ISI wanted to force the closure of Asiacell due to the group's perception that the company provided voice recordings to Multi-National Forces in Iraq, which led to the capture of many ISI members. ISI also claimed it would destroy Asiacell towers and kill its employees for their participation in assisting "the crusaders." There was no further information regarding the timing, location, or means of attack. ¶9. (S//NF) Asiacell has been described in recent open source reports as the largest private Iraqi company and the first mobile telecommunications company to provide coverage for all of Iraq. ISI, as the political group most closely associated with al-Qa'ida in Iraq, has a history of threatening Asiacell, and DS/TIA/ITA assesses its overriding objective probably is to destroy any favorable economic conditions for enterprises seeking to capitalize on the emerging Iraqi market. As of early February, Asiacell had not paid monthly extortion fees to ISI groups in Mosul for December 2008 and January, according to a source who claimed access to ISI leadership in Mosul. As of early January, ISI in west Mosul sabotaged and burned nine Asiacell towers, according to a source who claimed secondhand access to information from a technical officer affiliated with Asiacell. An Asiacell statement issued last November, according to an open source, stated an armed group in Mosul targeted the company's main office with a bomb that partially disabled the network's service in the city. The report further stated that less than a year earlier, Asiacell in Mosul was targeted by a similar operation that destroyed bases and locations, costing the company millions of dollars in losses. (Appendix sources 1-5) ¶10. (U) Significant Events ¶11. (SBU) WHA Mexico - On February 20, RSO Tijuana assisted the local police with the arrest of a local national wanted in the United States. The fugitive had an outstanding warrant issued out of San Diego County, CA, for assault with a deadly weapon on a police officer. Police are in communication with the San Diego District Attorney's Office on possible extradition. (RSO Tijuana Spot Report) ¶12. (SBU) AF Chad - A group comprised of around 1,000 students rioted one block south from the main gate of U.S. Embassy N'Djamena on February 23. Apparently, Chadian students had issues at their local schools. Police responded and dispersed the crowd with tear gas. The ARSO ordered a Missionwide standfast; Post's security posture was relaxed after the riot was brought under control. The RSO will continue to monitor the situation. (RSO N'Djamena Spot Report) ¶13. (SBU) Domestic California - On February 23, approximately 60 individuals gathered at the Azerbaijani Consulate in Los Angeles (LA) to commemorate recent Armenian advances in the disputed border region between Armenia and Azerbaijan. Two Diplomatic Security agents from the LA Field Office (FO) and five LA Police Department units monitored this event, which ended without incident. (LAFO Spot Report) ¶14. (U) Key Concerns ¶15. (S//NF) EUR Turkey - Reporting released February 23 noted, in November 2008, during the Kongra-Gel (KGK) 10th Congressional Meeting, KGK leaders agreed that if the Turkish Government (GoT) did not comply with its list of concessions after the March elections, KGK would resume its violent activities in Turkey. The group confirmed its military wing, the Peoples' Defense Forces, was ready to resume attacks in-country. KGK had planned to defer attacks until after elections, as it considered them to be a referendum on prevailing attitudes among the GoT, Turkish voters, and the Kurdish population. KGK articulated a list of desired concessions, including political and criminal amnesty, recognition and increased civil rights for Kurds, and official discourse between the GoT and either KGK or its political wing. ¶16. (S//NF) DS/TIA/ITA notes there has been no KGK-declared cease-fire in operation since these demands were allegedly made, as has been the norm in recent years. Additionally, KGK attacks and threats have continued to occur since November, most notably in the lead-up to the recent 10th anniversary of the capture of KGK's founder Abdullah calan; so it is unclear what is meant by "resuming attacks in Turkey" following the election. Regardless, given the increasingly negative image of KGK among the GoT and general population as a whole over the past few months, it is likely any election viewed as a referendum by KGK will produce unsatisfactory results in the opinion of KGK, "forcing" the terrorist group to "resume attacks in Turkey." DS/TIA/ITA notes KGK has never targeted American or Western interests; although, Westerners in Turkey could suffer collateral damage in an attack aimed at its usual targets -- GoT facilities and/or personnel. (Appendix source 6) ¶17. (S//NF) AF Sudan - Government blames U.S. for air strikes: The Sudanese Government has accused the U.S. of conducting two recent air strikes in Sudanese territory, adding to an already delicate security situation in Khartoum. The air strikes, which occurred in eastern Sudan on January 11 and February 20, targeted convoys possibly carrying weapons into the Palestinian territories and killed approximately 90 people. Although it is unclear who is directly responsible for the incidents, a body of tearline/intelligence has monitored the movement of Israeli jets over Sudan at the same time the air strikes occurred. It is probable the jets launched bombing raids against convoys carrying weapons into Gaza and a boat smuggling weapons to the area. ¶18. (S//REL TO USA, FVEY//RELIDO) A report from February 21 reads, "Israeli Air Force fighters conducted unidentified nighttime operations over Sudan on February 20. An Israeli F-16 was first noted active over Sudan near 190441N 0360255E at 2257Z. The aircraft then departed Sudan heading north and was noted active over the Red Sea near 222955N 0382152E at 2329Z. The F-16 was last active over the Sinai Peninsula near 293324N 0330440E at 0028Z on February 21." ¶19. (S//REL TO USA, FVEY//RELIDO) Tearline from January 15 reads, "At 2357Z on January 11, probable Israeli Air Force F-151 associated AN/APG-70 radars were noted over northeastern Sudan. They were then noted over the Red Sea, off northern Sudanese coast, during the early 0000Zhours of January 12." ¶20. (S//REL TO USA, FVEY) Tearline from January 16 asserts, "Smugglers reportedly believed that Egyptian or Israeli aircraft carried out the January 12 attack on either the weapons convoy or the smugglers' vessel." ¶21. (S//NF) According to a U.S. Embassy Khartoum report from February 24, the Sudanese Government's Americas Department head Ambassador Nasreddin Wali stated they were operating on the assumption that American fighter jets were responsible for the attacks. Rumors about the attacks are also circulating amongst the political elite; however, they have yet to seep into the Sudanese press. ¶22. (S//NF) Although there is no immediate threat to U.S. interests stemming from these air strikes, an impending International Criminal Court warrant against President Omar al-Bashir, an upcoming verdict in the John Granville trial, and recent demonstrations in front of the U.S. Embassy against the Israeli-Gaza conflict in January have created a precarious environment. In fact, there is a significant presence of HAMAS supporters in Sudan, many of whom led the protests. U.S. Embassy Khartoum will discuss all these events and the Mission's security posture during a February 24 Emergency Action Committee meeting. (Appendix sources 7-13) ¶23. (S//NF) EAP Thailand - According to the Australian Secret Intelligence Service, a detained Thai insurgency operational leader, Muhammad Hambali Masa, had confessed to involvement in a plan to use car- and motorcycle-borne improvised explosive devices (IEDs) during the Association of Southeast Asian Nations (ASEAN) Summit to be held in Hua Hin from February 26 to March 1. It was unclear whether Hambali and his group were planning for bombings in Hua Hin or elsewhere during the summit. Thai authorities had not indicated to what extent they had disrupted the planned activity, or if a threat remained. The 2009 ASEAN Summit is scheduled to be held at the Dusit Thani Hua Hin Hotel, Cha-am, Phetchaburi, approximately 50 miles southeast of Bangkok. ¶24. (S//NF) DS/TIA/ITA notes that southern insurgents have avoided attacks outside the four southern provinces of Narathiwat, Pattani, Yala, and Songkhla, and increased security during the ASEAN Summit will further reduce the chance of an attack in Hua Hin. However, the likelihood of attacks in populated areas of the southern provinces will increase as insurgents seek to capitalize on increased media attention during the summit. (Appendix source 14) ¶25. (S//REL TO USA, FVEY) SCA Afghanistan - Group to attack UN facilities in Kabul: Tearline states, "The group responsible for the terrorist attacks in Kabul on February 11 is allegedly planning additional attacks against the UN in Kabul. As of late February, this threat is considered credible given recent Taliban statements criticizing the UN in Afghanistan, according to informed sources. Potential targets for an attack have not been specified." ¶26. (S//NF) DS/TIA/ITA notes, while Zabiullah Mujahid, the Taliban spokesman, claimed responsible for the February 11 attack in Kabul, evidence suggests it was a Haqqani network, or a joint Haqqani network-Taliban, operation. The network does not normally claim responsibility for attacks in Kabul. There is no current reporting to indicate the Taliban or Haqqani network are planning attacks against the UN in Kabul. However, the Taliban recently expressed anger at the UN in reaction to the recent report which stated the Taliban was responsible for 1,168 of the 2,118 civilians killed in Afghanistan in 2008. Similarly, the latest video released by al-Qa'ida's number two, Ayman al-Zawahiri, once again noted Muslims should reject the UN because adherence to UN principles would prevent the building of an Islamic caliphate. ¶27. (S//NF) The United Nations Assistance Mission in Afghanistan (UNAMA) personnel, assets, and installations received regular threats throughout 2008. Most recently, as of late February, Hezb-e-Islami Khalis commander Aqil Khan (a.k.a. Haji Sadiq, Nawroz) planned to conduct attacks against the UNAMA in Nangarhar Province in an effort to disrupt the upcoming Afghan elections. Within Kabul, UN compounds on Pol-e Charki Road or Jalalabad Road (likely the United Nations High Commissioner for Refugees (UNHCR) encashment center) have been mentioned repeatedly as potential targets and are likely to be more accessible than UN headquarters in central Kabul city. However, in mid-August 2008, a sensitive source indicated militants were planning to bomb and infiltrate the UN headquarters compound in Kabul. ¶28. (S//NF) While UNAMA has been targeted by militants and criminals dating back to as early as October 2004, when three UN personnel were kidnapped in Kabul, the increase in threat reporting in 2008 indicates insurgents increasingly appear to no longer accord the UN, as a humanitarian actor, immunity from attacks. Actual attacks on UNAMA this year have largely been confined to operations against World Food Program (WFP) convoys in rural areas. At least 22 WFP convoys were attacked by militants, a slight increase from the previous two years. In Kabul, the last attack was in mid-January 2007, when rockets landed near the UN headquarters compound. (Appendix sources 15-18) ¶29. (S//NF) Afghanistan - Insurgents in Lowgar Province housing three suicide bombers: In mid-February, Taliban commander for Mohammad Agha District, Lowgar Province, Maulawi Abdullah (a.k.a. Toor Abdullah),informed local commanders at a meeting that there were three suicide bombers being housed in Mohammad Agha District who would perform suicide attacks on Coalition forces in Kabul or Lowgar Province. The sensitive source with secondhand access to Taliban commanders in Lowgar Province stated the bombers had purchased one Town Ace Toyota vehicle and one Toyota Corolla to use in the attacks. The three suicide bombers were being moved between Hezb-e-Islami Gulbuddin (HIG) commanders Haji Ghafar, Mamoor Babrak, Haji Hassan, Zabet Khalil, and Mullah Sher. Other commanders at the meeting included Mullah Satar, Mullah Allah Muhammad, and Mullah Naeem Kharotai. Abdullah claimed he held many meetings with HIG commanders in the winter and that they were now supporting the Taliban. ¶30. (S//NF) DS/TIA/ITA cannot corroborate this information but notes this source and subsource have good information about Taliban commanders active in Lowgar Province. Most of the commanders mentioned in the report are reported to be active commanders in Lowgar Province. Maulawi Abdullah (a.k.a. Qari Abdullah, Maulawi Atiqullah, Black Abdullah) is a senior insurgent commander for Lowgar Province. Abdullah reports to Mir Ahmad Gul, the senior Taliban commander/governor for Lowgar Province. However, uncorroborated information from a developing source in late January indicated Abdullah may have become a subcommander in the Haqqani network in October 2008 following a financial dispute with Mir Ahmad Gul. ¶31. (S//NF) While none of the commanders mentioned in the report has been linked to specific attacks in Kabul city, any of them could have played an important facilitator role for attacks in the city, similar to what is being described in the report. An Afghan National Directorate of Security assessment noted Mohammad Agha District is a key gateway to Kabul. Further expansion of Taliban control in the district could facilitate attacks into Kabul. During the Afghan-Soviet war, the mujahedeen (particularly Hezb-e-Islami) recruited heavily from the Mohammad Agha District. The Taliban is also suspected of recruiting heavily from this area. (Appendix sources 19-21) ¶32. (U) Cyber Threats ¶33. (U) Kazakhstan - Website comes under "cyber attack:" ¶34. (SBU) Key highlights: o A popular Kazakhstani news site was inaccessible for two days during a cyber attack. o The website and its owners have been under pressure from the GoK. o The GoK has drafted laws to gain greater control of the Internet. o It is possible the GoK or its sympathizers were behind a DDOS attack which took the website offline. ¶35. (U) Source paragraph: "A popular news website in Kazakhstan came under cyber attack on February 13 and was unavailable for two days, RFE/RL's (Radio Free Europe/Radio Liberty) Kazakh Service reports." ¶36. (SBU) CTAD comment: Reporting by RFE/RL indicates that Zonakz.net, a popular U.S.-hosted Kazakhstani news site, was inaccessible from February 13 to 15. The outage, which is being referred to as "cyber attack" by the media, was most likely a distributed denial-of-service (DDOS) attack. In the past, Zonakz and its management have been under considerable pressure from the Government of Kazakhstan (GoK),causing the site to eventually move its servers outside of Kazakhstan. The aforementioned attacks follow the drafting of a highly contested law that would regulate the Internet in-country, actions the management of Zonakz are speaking out against. ¶37. (U) CTAD comment: A recently drafted bill, introduced in February, would impose stricter control over Internet traffic, specifically that of Web loggers (bloggers),and would allow the government to block websites. Yuriy Mizinov, the founder and editor of Zonakz.net, has publicly claimed the law is specifically designed to target Rakhat Aliev, the former son-in-law of Kazakhstani President Nursultan Nazarbayev. Aliev, an outspoken political opponent of the president, lives in exile in Austria and is wanted on dubious charges in Kazakhstan. Mizinov claims the government intends to block Aliev, who according to RFE/RL reporting, routinely posts embarrassing or compromising documents and audio about GoK officials on the Internet. The popular blog LiveJournal.com, which allegedly was once a forum for Aliev's activity, has already been blocked throughout Kazakhstan. ¶38. (U) CTAD comment: In what appears to be an effort to counter dissidents' use of the Internet, and take advantage of the growing popularity of blogs, the GoK also adopted their use. The country's Prime Minister Karim Masimov now maintains a blog and has ordered all ministers to do the same. GoK-run blogs are intended to evoke a spirit of open communication, although critics point out that leaders are careful to dodge many questions and selectively answer others that promote the issues of their choice. ¶39. (SBU) CTAD comment: The GoK is under considerable pressure to adopt liberal policies as it bids for chairmanship of the Organization for Security and Cooperation in Europe in 2010. Two weeks prior to the introduction of the recent bill on Internet control, the parliament amended the country's media law in a move that appeared to be intended to shore up its democratic credentials. However, the country remains a dangerous place for journalists. On December 30, 2008, a reporter was stabbed to death in front of his home in Almaty, and another was beaten mercilessly in January 2009. An opposition newspaper was recently fined for libeling a member of parliament. A worsening economy caused by decreasing oil revenues is predicted to increase tensions, and the GoK will likely implement greater regulation to control dissension. ¶40. (SBU) CTAD comment: Although available reporting has not specifically described this recent "cyber attack," it is most likely that a DDOS attack took the website offline. This methodology has been increasingly adopted as a means of silencing dissenting opinions online throughout the former Soviet Union. Because Zonakz.net is hosted in the U.S., a DDOS attack would have been one of the few methods available for those seeking to silence the site. Given past efforts by the GoK to take actions against the site, as well as a growing consciousness within the GoK of the Internet's importance as a public affairs tool, it is probable the government or its sympathizers participated in the attack. (Source: Radio Free Europe/Radio Liberty (http://www.rferl.org),"Cyberattack Brings Down Kazakh Website," February 17, 2009) ¶41. (U) Suspicious Activity Incidents ¶42. (SBU) EUR Germany - A suspicious vehicle parked next to the U.S. Consulate General Frankfurt housing area on February ¶23. The same vehicle was seen in the area January 15, but with different, temporary license plates. ¶43. (SBU) Record Check/Investigation: More information will be reported as it becomes available. (SIMAS Event: Frankfurt-00687-2009) ¶44. (SBU) Moldova - A U.S. Embassy Chisinau employee departed his residence on February 4 en route to Post. While walking down the street, the employee passed a group of men, and one began to follow him. The subject followed the employee for approximately 15 minutes, staying 7 to 10 meters behind, and periodically looking over his shoulder. A Surveillance Detection Team (SDT) member posted near the residence notified the Local Guard Force (LGF) Mobile Patrol and SDT supervisor. The LGF stopped and questioned the subject, who indicated he was looking for the Ukrainian Embassy. The subject is an Israeli citizen. He had several visas in his passport, including one from the U.S. received in Israel. ¶45. (SBU) RSO Action/Assessment: The RSO was aware of some unusual circumstances in the area and was conducting counter-surveillance detection on a few Embassy residences and personnel. ¶46. (SBU) Record Check/Investigation: Subject: Alexander Kleinerman. Passport number: 12550862 (Israel). (SIMAS Event: Chisinau-00338-2009) ¶47. (SBU) Moldova - A man walked in the park behind U.S. Embassy Chisinau on January 14, and he appeared to be measuring distance. After 5 to 10 minutes, he departed the area. A minute later, another man appeared and walked up and down the same area of the park as the first subject. He departed the area after 5 minutes. ¶48. (SBU) RSO Action/Assessment: Regional Security Office personnel were informed of this incident. The LGF, with police assistance, will stop and question the subject(s) if they are seen in the area again. (SIMAS Event: Chisinau-00332-2009) ¶49. (SBU) AF Guinea - Two young men photographed U.S. Embassy Conakry on February 22. Police stopped and questioned the pair; both admitted to photographing Post and were instructed to report to the police station for further questioning. More information will be reported as it becomes available. ¶50. (SBU) Record Check/Investigation: Subject 1: Aly Cisse. DPOB: 1985, Guinea. Identification card number: 1739128. Subject 2: Saliou Fofana. DPOB: 1987, Guinea. (SIMAS Event: Conakry-01400-2009) ¶51. (SBU) Kenya - On February 6 and 10, a shoe-shine vendor worked about 50 meters from U.N. Avenue in Nairobi, a road frequented by U.S. Embassy employees going to/from Post. On February 10, the subject focused on Mission personnel driving past his location. The subject first appeared in the area in June 2008. The individual rarely interacts with other vendors, and, when he receives a cell phone call, he walks away for privacy. (Note: The subject is the least expensive vendor in the area, which is deemed strange, since he has no competition.) At times, he has visitors who appear to be "intelligence undercover personnel." When stopped by local authorities checking vendor licenses, the subject shows some papers, and they walk away. The SDT supervisor notes the local city council authority does not give vendor licenses to temporary roadside businesses in the area, and, furthermore, the shoe-shine vendor is able to work in the area because he has a letter of authorization from former Kenyan Vice-President Moody Awori. A member of the local city council found this unusual and uttered some words to the effect that "the shoe-shine vendor must be doing other work for the Government." ¶52. (SBU) RSO Action/Assessment: Information on the subject and his activities was forwarded to the Diplomatic Police Unit. The RSO and foreign service national investigator are following up on this report. (SIMAS Event: Nairobi-02236-2009) SECRET//NOFORN//MR Full Appendix with sourcing available upon request. CLINTON