DIPLOMATIC SECURITY DAILY

S E C R E T STATE 029816 NOFORN E.O. 12958: DECL: MR TAGS: ASEC SUBJECT: DIPLOMATIC SECURITY DAILY Classified By: Derived from Multiple Sources SECRET//NOFORN//MR Declassify on: Source marked 25X1-human, Date of source: March 26, 2009 ¶1. (U) Diplomatic Security Daily, March 27, 2009 ¶2. (U) Significant Events ) Paragraphs 6-10 ¶3. (U) Key Concerns ) Paragraphs 11-41 ¶4. (U) Cyber Threats ) Paragraphs 42-49 ¶5. (U) Suspicious Activity Incidents ) Paragraphs 50-56 ¶6. (U) Significant Events ¶7. (SBU) WHA - Chile - Chilean 911 received a call March 26 stating there was a bomb at U.S. Embassy Santiago. Carabineros dispatched to Post and informed the Regional Security Office. Appropriate searches were conducted, and no suspicious packages were found. The RSO noted host-nation law enforcement support to the Mission continues to be excellent. This was most likely a prank call. (RSO Santiago Spot Report) ¶8. (SBU) Mexico - The mother of a U.S. Consulate General Matamoros employee received a phone call March 26 at their official residence from a supposedly frantic woman who stated, &They are going to kill me; follow their instructions.8 A male then took over the call and demanded the equivalent of $700 in order to ensure the safety of her daughter (Mission employee). The mother hung up, called her son-in-law, and learned her daughter was safe and working in her office at Post. The RSO, foreign service national investigator, and Mobile Patrol, and an information programs officer telephone technician, responded immediately to the residence. The RSO filed a police report and will resend a Security Notice referencing express kidnapping scams. (RSO Matamoros Spot Report) ¶9. (S//NF) AF - Kenya - Emergency Action Committee (EAC) Nairobi convened on March 23 to discuss recent reports claiming Al-Shabaab terrorists were planning a possible attack on the Israeli Embassy in Nairobi and on an unnamed beach hotel in Mombasa. Committee members also discussed a recently released Usama Bin Ladin video that attacks the recent Somali elections and how the &American envoy in Kenya8 was placing undue influence on the new Somali president. The EAC agreed, at this time, the information requires only further monitoring. No adjustment to the current Travel Warning is warranted at this time. (Appendix source 1) ¶10. (S//NF) NEA - Egypt - EAC Cairo met March 25 to discuss current events and the general threat level, USG visits to the Rafah border region, and various communication systems available to the U.S. Embassy to assist in notifying and accounting for personnel in the event of an emergency. Despite an elevated state of concern in-country, there are currently no threats to U.S. or Western personnel or facilities. USG visits to the Rafah border region will be restricted. (Appendix source 2) ¶11. (U) Key Concerns ¶12. (S//NF) AF - Ethiopia - OLF extremists plotting attacks: As of late March, Eritrean and Oromo Liberation Front (OLF) elements planned to infiltrate the Ogaden region of Ethiopia to conduct attacks in the country. Approximately 250 to 500 militia and 30 officers from the OLF were currently fighting alongside 20 Eritrean officers and 150 Eritrean militia in the Bakool region of Somalia, but they planned to enter Ethiopia in Gode and Bare, according to a source whose access to the information cannot be determined. There is no further information on the exact timing, method, location, or target of the attack. ¶13. (S//NF) DS/TIA/ITA cannot immediately substantiate this threat and remains suspicious of the sourcing in the report. That being said, a body of recent tearline has suggested Somalia extremists are plotting attacks in the Ogaden region. Most recently, tearline stated, &Abdi, a suspected Somali extremist of unknown affiliation likely based in Borama, Somaliland, was involved in two suspicious instances related to travel facilitation into Ethiopia during early March. The first instance involved a group of individuals from Mogadishu who had interaction with Abdi en route to presumably Ethiopia. After meeting with Abdi to work on settling a financial dispute, the group encountered a road block, which inevitably compelled them to alter their route and travel to Djibouti. It is believed that the group may plan to cross into Ethiopia from Djibouti. The second instance involved a group of individuals known as children,, who recently traveled from Majir, Somalia, to Baidoa, Somalia. Abdi was eager to expedite the travel of this group from Baidoa into Ethiopia. He planned to obtain passports for all the members of this group and then escort them to Dire Dawa, Ethiopia. Abdi appears to be connected to an ongoing extremist plot, possibly incorporating al-Shabaab assistance, to conduct explosive attacks in Ethiopia. The Ethiopian cities of Dire Dawa, Jijiga, and Harar are the main targets of interest in this plot.8 (Appendix source 3-6) ¶14. (S//NF) Ethiopia/Somalia - Al-Shabaab allegedly planning attacks: As of late March, al-Shabaab planned to conduct attacks in Ethiopia and Somaliland, northern Somalia. Allegedly, three al-Shabaab members -- Ali Argafe, Abdullahi Harega, and Ahmed Isse -- were all involved in the planning and were currently located in Addis Ababa, according to information provided by the Ethiopian National Intelligence and Security Service (NISS). The three operatives used an Ethiopian mobile phone with the number 251913148645, which had been used previously to contact numbers in Somalia, Pakistan, the UK, U.S., and Kenya. ¶15. (S//NF) Allegedly, three U.S. nationals were also orchestrating the attack plans from Hargeysa, Somaliland. Two of the U.S. persons were originally from Somalia, while the third was of Greek origin. They all entered Somaliland from Kampala, Uganda. One of the U.S. Citizens, &Haron,8 was responsible for moving foreign fighters into Addis for the attack. Another operative, &Adil,8 prepared U.S. passports for the operatives. There is no further information on the exact timing, method, target, or location of the attack. ¶16. (S//NF) DS/TIA/ITA cannot immediately substantiate this threat. An intelligence and Terrorist Identities Datamart Environment (TIDE) search of Ahmed Isse (TIDE number 17223107) showed an al-Shabaab operative based in Somalia has the same name; although, it is unclear if they are indeed the same operative. The Ahmed Isse detailed in TIDE may also be known as Ahmed Bare Mohamoud (TIDE number 292043) and may hold connections to the Swiss-based al-Qa,ida &Owaiss8 network. Another intelligence result suggested an operative named Isse Ahmed Isse is linked to the U.S. Embassy bombings in Nairobi; there is no further intelligence available to suggest Ahmed Isse and Isse Ahmed Isse are the same person. Intelligence and TIDE searches of the other two operatives proved negative. Additionally, an intelligence search of the above-mentioned phone number provided no results. ¶17. (S//NF) DS/TIA/ITA notes a body of recent reporting, all of varying credibility, has highlighted the desire of extremists to attack in Ethiopia and Somaliland. According to intelligence provided by the NISS, in late 2008, Ethiopian authorities disrupted several cells of al-Shabaab operatives planning to conduct various attacks in Addis Ababa, including against the U.S. Embassy, UK Embassy, and Sheraton hotel. Meanwhile, Somali extremists, with the help of al-Shabaab, are allegedly plotting attacks in the Ogaden region of Ethiopia. (See the tearline in the above article on Ethiopia.) ¶18. (S//NF) Intelligence has also highlighted possible attacks in Somaliland. Tearline states, &Somaliland officials tracked intelligence in mid-March that linked the arrival of extremist sympathizers from the U.S. with a possible attack threat in Somaliland. The sympathizers were expected to leave the U.S. either on March 17 or 18 and meet up with other radicalized colleagues, also from the U.S., who were waiting in Mogadishu, having already traveled there from Somaliland. The group departing the U.S. may opt to sneak into Somalia with false passports from Kenya via khat plane traffic or from Djibouti via bus. It is believed that both groups have plans to travel to Somaliland sometime within the next week in preparation for their attack objectives, which are likely focused on the Somaliland capital of Hargeysa.8 Al-Shabaab has demonstrated its ability and willingness to conduct deadly attacks in Somaliland as evidenced in its October 29, 2008, suicide bombings that targeted the UN compound, the Ethiopian Consulate, and the Presidential Palace in Hargeysa. (Appendix sources 7-13) ¶19. (S//NF) Kenya - Somali tribesmen threaten suicide bombings: Tearline states, &Marehan tribesmen of Somalia demanded compensation in late March from the Kenyan Government for injuries suffered during a recent military operation in the Mandera East District. The Marehan tribesmen demanded payment for hospital bills of injured tribesmen. The Marehan tribesmen claimed that several locations in Kenya would be attacked using remote-control bombs and suicide bombers. The Kenyan Government reportedly had 24 hours to respond.8 ¶20. (S//NF) There is no further information on the exact timing, locations, method, or targets of the attacks. DS/TIA/ITA cannot immediately substantiate this threat, but opines that the tribesmen probably lack the capability to undertake suicide bombing or terrorist attacks inside of Kenya. Instead, the threats are likely an attempt to gain some concessions from the Kenyan Government. (Appendix source 14) ¶21. (SBU) EAP - Australia - Series of suspicious incidents: Since December 2008, U.S. Mission facilities in Australia have experienced several incidents of potentially hostile surveillance. Suspicious incidents recorded at U.S. facilities in Melbourne, Canberra, and Perth are described below. ¶22. (SBU) Melbourne: On January 21, an SUV drove past the building housing U.S. Consulate General Melbourne. The female passenger, who was wearing traditional Middle Eastern clothing, used a video recorder to film the building from the moving vehicle. Once they passed Post, the female stopped filming, implying her sole interest was in capturing footage of the building. ¶23. (SBU) On February 3, two Middle Eastern-appearing men were seen in a vehicle parked to the north of the Mission. Although the daytime temperature was approximately 90 degrees Fahrenheit, the occupants kept the windows rolled up and the car turned off. When they did roll down the windows, they video recorded the Consulate General. ¶24. (SBU) On February 4, a male of Indian descent (per Australian Federal Police) photographed Post. ¶25. (SBU) Canberra: On December 3, 2008, a vehicle slowly drove past U.S. Embassy Canberra while an occupant of possible South Asian descent pointed a video camera in the direction of the compound. ¶26. (SBU) On January 8, a man was observed walking near the Embassy compound. He took pictures of the compound as well as the compound,s Army Post Office gate. The following day, the same individual was seen again near the Mission compound. As the subject walked toward the city center, he abruptly reversed course, then turned around again, resuming his original direction. This may have been an attempt to employ basic countersurveillance measures. After reaching the city, the subject appeared to use the reflections in shop windows to see if anyone was following him. ¶27. (SBU) On February 19, a male of possible Chinese descent attempted to photograph a physical security upgrade project at the Embassy compound. ¶28. (SBU) On February 22, two males of possible Middle Eastern descent were observed near the Public Affairs Office, which is located in a building separate from the remainder of the Embassy facilities. The two individuals departed the area when approached by Local Guard Force (LGF) personnel. ¶29. (SBU) On March 9, a vehicle stopped in front of Post,s main gate, and its occupant(s) took pictures of the main gate area and the Chancery. ¶30. (SBU) Perth - On December 20, 2008, according to an off-duty Western Australia Police officer, a man of possible Middle Eastern descent was observed on a public transport bus using a cell phone to video record sites along the route. The subject appeared to be focusing on sites that typically would not be of interest to a tourist, such as the Parliament House, Governor Stirling Towers (location of the government minister offices),as well as bus stops and the general bus route. The same individual was also observed by another Western Australia Police officer near U.S. Consulate General Perth with another male individual sometime during the week of December 29, 2008, to January 2. ¶31. (C) If considered individually, these suspicious incidents may not initially appear significant. However, the overall increase in detected/reported surveillance is a cause for concern. And while there is currently no HUMINT or SIGINT reporting to indicate terrorist groups are engaged in attack planning against USG facilities in-country, several recent homegrown plots have been disrupted by Australian authorities, and a number of Islamic extremists have been convicted of or are on trial for terrorism-related charges. The majority of individuals involved in suspect groups had been &self-radicalized.8 This type of local threat may not produce indications of operational planning in traditional HUMINT or SIGINT channels. ¶32. (C) The Australian Security and Intelligence Organization (ASIO) recently published threat levels for foreign visitors in Australia. ASIO assessed the U.S. and Israel were at &high8 threat of terrorist attack, and further defined &high8 as &credible intelligence indicates an intention and capability to attack. An attack is likely.8 ASIO likely based its assessment on the presence of &self-radicalized8 elements in Australia and that some of these individuals are known to harbor anti-American views. ¶33. (C) Two further rationales may have driven ASIO,s assessment of the threat against U.S. interests in Australia. First, while there is no current threat reporting to indicate any such attack is likely or imminent, the possibility cannot be dismissed. Second, the report may reflect an attempt by ASIO to influence policy and maintain funding for high-risk diplomatic protection efforts, such as those affecting U.S. Mission Australia. ¶34. (C//NF) Recent communication with RSO Canberra reflects the U.S. Mission,s intention to further review suspicious incidents with Australian authorities. It should be noted, however, that due to strict Australian privacy laws, Post is not always able to obtain substantive information that may further an investigation. Typically, the RSO is informed when an investigation yields no derogatory information, but, citing privacy laws, host-nation authorities will not divulge anything beyond these findings. When or if additional information concerning these incidents becomes available, the RSO will update SIMAS accordingly. (SIMAS Events: Melbourne-00048-2009, 00049-2009, 00050-2009; Canberra-00107-2008, 00115-2009, 00118-2009, 00121-2009, 00122-2009, 00125-2009; Perth-00132-2008; Appendix source 15) ¶35. (S//NF) SCA - India - Kashmiri terrorists to try Mumbai-style attacks in Himachal Pradesh and Punjab: Tearline intelligence reports, &India learned in late March that up to three or more teams of terrorists, at least some of whom are Kashmiris, are planning to set off explosions and carry out terrorist attacks in the states of Himachal Pradesh and Punjab. At least one terrorist team might already have arrived in Himachal Pradesh. The terrorists allegedly intend to carry out attacks seminal to those in Mumbai on November 26, 2008.8 ¶36. (S//NF) While this threat cannot be verified, DS/TIA/ITA assesses Lashkar-e-Tayyiba (LT),the architect of the November 2008 attack on Mumbai, likely remains capable of carrying out additional attacks in mainland India; although, the timing, targets, and location of future operations remain opaque and difficult to discern. Indeed, there is little reporting to suggest counterterrorism efforts by the Pakistanis have done anything to encumber LT,s operational network in South Asia (Himachal Pradesh and Punjab located in northwest India). In mainland India, LT has conducted approximately three or four operations per year. ¶37. (S//NF) Reporting in the weeks following the Mumbai attacks echoed concern of renewed LT activity in and around Kashmir, possibly targeting high-profile infrastructure. Tearline from early December 2008 reported, < terrorists may be planning attacks against civilian infrastructure sites in the state of Jammu and Kashmir. Possible attack locations include several dams, power stations, and three airports: Leh, Kargil, and Jammu Satwari.8 Mid-December intelligence noted, &India claimed in mid-December that officers of Pakistan,s Inter-Services Intelligence had met with terrorist leaders in Pakistani Kashmir to plan attempts to infiltrate terrorists and/or militants into the Jammu region of India,s state of Jammu and Kashmir. It was also reported that at least Hizbul Mujahideen terrorists were planning to carry out attacks in Jammu and Kashmir on occasion of India,s Republic Day celebrations on January 26. In addition, a warning was issued that increasing numbers of foreign tourists visiting the Ladakh region of Jammu and Kashmir each year may tempt terrorists to attack, and police security in this region is weak. The annual tourist influx includes thousands of Israelis and Westerners.8 Indian press reporting has also speculated on potential terrorist plots against politicians during upcoming elections. (Appendix sources 16-19) ¶38. (S//NF) Pakistan - Al-Qa,ida militants may attack U.S. personnel and government officials: Tearline notes, &Al-Qa,ida militants may attack U.S. personnel in Peshawar and Pakistani politicians, government officials, and law enforcement officials in Islamabad and Peshawar as of March 25.8 ¶39. (S//NF) DS/TIA/ITA assesses this is likely at least the third iteration of early-March reporting detailing concerns of al-Qa,ida plotting attacks against Western targets in Peshawar and possibly Islamabad. Despite likely circularity in this reporting, DS/TIA/ITA continues to be concerned that al-Qa,ida aims to conduct unspecified attacks in Islamabad or Peshawar in the coming months, particularly following two suicide operations in Islamabad/Rawalpindi in the third week of March. Likewise, a growing body of reporting suggests a variety of extremist elements are collaborating to execute another kidnapping, sniper attack, or assassination operation against Americans in Peshawar. (Appendix sources 20-25) ¶40. (S//NF) Pakistan - Explosive-laden vehicle possibly headed to targets: Tearline indicates, &A car packed with explosives for possible use as a VBIED (vehicle-borne improvised explosive device) was in route toward Peshawar, Jamrud, or Landi Kotal on March 24.8 ¶41. (SBU) A variety of attacks has occurred in the Peshawar-Khyber area leading to Afghanistan, which includes both Jamrud and Landi Kotal. DS/TIA/ITA surmises likely targets of this alleged VBIED include Pakistani security forces and Frontier Corps/paramilitary camps involved in counterinsurgency operations in Khyber Agency, as well as trucks and convoys ferrying supplies to Coalition forces in Afghanistan. (Appendix source 26) ¶42. (U) Cyber Threats ¶43. (S//NF) Worldwide - Further evidence links Javaphile leader to Byzantine Anchor: ¶44. (S//NF) Key highlights: Javaphile and BA have been previously linked due to use of the eRACS tool. An e-mail message originating from a known BA IP address was sent to Javaphile,s leader. The same IP has been identified in incidents impacting the Pentagon and DoS. E-mail addresses linked to Yinan Peng used in the message may implicate him as a BA actor. ¶45. (S//NF) Source paragraph: &A March 17, 2008, e-mail communication sent to the e-mail address of Javaphile,s leader Yinan Peng was from Internet Protocol (IP) address 203.81.177.121, previously used in Byzantine Anchor (BA) intrusion activity.8 ¶46. (S//NF) CTAD comment: Since late 2003, BA actors have targeted and compromised USG and cleared defense contractor computer networks in attempts to conduct computer network exploitation (CNE). BA, a subset of Byzantine Hades, refers to a group of associated computer network intrusions with an apparent nexus to China. Numerous sensitive reports have identified an apparent relationship between the Chinese hacker group Javaphile and BA intrusion activity based on overlapping characteristics. IP addresses that have been involved in BA CNE attempts have also hosted the Javaphile.org webpage and been the source of Javaphile-linked bulletin board postings. Furthermore, Javaphile and BA have been associated due to the use of the customized command-and-control tool dubbed eRACS developed by Javaphile member &Ericool8 -- one of many aliases used by Javaphile,s leader Yinan Peng. Though there does not appear to be conclusive evidence, recent sensitive reporting presents additional strong indicators linking Peng to BA. ¶47. (S//NF) CTAD comment: On March 17, 2008, an e-mail message sent from the address panchen@portala.org.cn was transmitted to a second individual using the address caoyiming2002@hotmail.com. The address ynpeng@gmail.com, previously associated with Yinan Peng, was carbon copied on the message. Of note, FBI reporting asserts the address panchen@portala.org.cn is also believed to be associated with Peng. A detail of particular significance is the e-mail,s origination from IP address 203.81.177.121. This IP has been detected during previous BA intrusion activity, to include an incident impacting the DoS. ¶48. (S//NF) CTAD comment: On July 30, 2008, an incident was attributed to BA wherein a compromised system located at the Pentagon downloaded and installed the eRACS tool from IP 203.81.177.121. One week later on August 6, the DoS, Computer Incident Response Team (CIRT) was notified of a DoS system beaconing to the same malicious IP (see CTAD report US-DoS-245). ¶49. (S//NF) CTAD comment: Though the Intelligence Community has long suspected affiliation between the Javaphile hacker organization and BA, the recent discovery of Peng,s receipt of correspondence from a known hostile IP presents a more significant basis for this hypothesis. Additionally, the link between the e-mail address panchen@portala.org.cn and Peng is also significant, as it may imply he was in fact the sender of the message only copying a secondary e-mail address. If this is so, these events may serve to assist in identifying Peng as a BA actor. (Appendix sources 27-30) ¶50. (U) Suspicious Activity Incidents ¶51. (SBU) WHA - Argentina - Surveillance Detection Team (SDT) Buenos Aires observed a man photographing the U.S. Embassy March 19. When the subject saw an LGF supervisor coming to talk to him, he attempted to keep from being noticed by going to a nearby children,s playground and sitting on a swing set. A police officer interviewed the man, who departed the area approximately 20 minutes later. Police did not provide any biographical data regarding the subject to Post. ¶52. (SBU) RSO Action/Assessment: The SDT has been instructed to notify the RSO immediately if this individual is observed in the vicinity of the Embassy. (SIMAS Event: Buenos Aires-00179-2009) ¶53. (SBU) EUR - Armenia - A vehicle with Iranian license plates pulled up to the Admiral Isakov Monument, which is located near U.S. Embassy Yerevan, on March 22. A family of four got out of the car and walked to the monument. The father, mother, and two children started photographing each other with the monument in the background. It is possible they also photographed Post. A policeman stopped and interviewed the man, who indicated they arrived from IRAN and were in-country as tourists. The subject refused to hand over his camera because he had taken a lot of photos he did not want destroyed. He presented his driver,s license and then was allowed to leave. ¶54. (SBU) Record Check/Investigation: Subject: Seifi Alireza. Driver,s license number: T8210802. Vehicle: Red Peugeot; License plate: IR-36126 (Iran). (SIMAS Event: Yerevan-00646-2009) ¶55. (SBU) Germany - An LGF Frankfurt member noticed a vehicle pass the U.S. Consulate General on two separate occasions on March 25. Each time the vehicle drove by, a passenger filmed Post. As this was happening, the Consul General,s motorcade was driving into the Mission. The SDT and police were notified, but the vehicle was not seen again in the area. The SDT and LGF were briefed to be on the lookout for the vehicle. ¶56. (SBU) Record Check/Investigation: Police conducted a license plate check. The vehicle belongs to a 56-year-old German who has no police record. (SIMAS Event: Frankfurt-00728-2009) SECRET//NOFORN//MR Full Appendix with sourcing available upon request. CLINTON