DIPLOMATIC SECURITY DAILY

S E C R E T STATE 074939 NOFORN E.O. 12958: DECL: MR TAGS: ASEC SUBJECT: DIPLOMATIC SECURITY DAILY Classified By: Derived from Multiple Sources SECRET//FGI//NOFORN Declassify on: Source marked 25X1-human, Date of source: July 16, 2009 ¶1. (U) Diplomatic Security Daily, July 17, 2009 ¶2. (U) Iraq - Paragraphs 7-10 ¶3. (U) Significant Events - Paragraphs 11-15 ¶4. (U) Key Concerns - Paragraphs 16-42 ¶5. (U) Cyber Threats - Paragraphs 43-50 ¶6. (U) Suspicious Activity Incidents - Paragraphs 51-62 ¶7. (U) Iraq ¶8. (S//NF) Plans by Jaysh al-Islami to launch mortars at BIAP: According to a source who obtained the information from social contacts, Jaysh al-Islami leaders planned from July 14 to 15 to attack the Baghdad International Airport (BIAP) utilizing three 80 mm mortars. Allegedly, the attack has been postponed to an unspecified date, as the group concluded there was a high concentration of Iraqi Army presence in the area. ¶9. (S//NF) The report is consistent with other reports from insurgent groups desiring to attack the BIAP. DS/TIA/ITA cannot corroborate the veracity of the report; however, it cannot be dismissed as the targeting of any U.S. interests in Iraq is plausible, and the BIAP has been mentioned in previous intelligence as a venue of interest for indirect fire. (Appendix sources 1-2) ¶10. (SBU) At approximately 11:58 p.m. on July 13, two Chief of Mission (COM) personnel traveling from Forward Operating Base Hunter, Maysan Province, to Contingency Operating Base Adder, Dhi-Qar Province. In route, an armored military wrecker vehicle immediately behind their vehicle was struck with an explosive device, causing several injuries to its occupants. Regional Security Office air assets picked up the two COM employees July 14 and safely transported them to Tallil. (RSO Tallil Spot Report) ¶11. (U) Significant Events ¶12. (S//NF) AF Mauritania - Emergency Action Committee (EAC) Nouakchott met July 16 to assess the security situation for the upcoming election period. The first round of elections will be held July 18, and a run-off, if needed, will be held on August 1. Committee members agreed the elections will probably take place in a generally orderly fashion. There is a risk of large crowds gathering, and some past demonstrations have turned violent. A Warden Message was issued alerting U.S. Citizens to the risk of spontaneous unrest during the elections and advising them to avoid crowds and remain particularly alert. The EAC determined that the present security posture for the U.S. Embassy is adequate. (Appendix source 3) ¶13. (SBU) EAP Indonesia - Two explosions -- one at the J.W. Marriott hotel and one at the Ritz-Carlton -- occurred in Jakarta between 7:40 and 8 a.m. this morning, July 17. U.S. Embassy personnel responded to the scene. Initial reporting lists one individual killed at the Ritz-Carlton and possibly two at the J.W. Marriott. Embassy officials are working diligently to determine if any AmCits were staying at the hotels and if any Embassy personnel or TDY staff were present. Post will provide further information as it becomes available. (RSO Jakarta Spot Report) ¶14. (SBU) Malaysia - ARSO Kuala Lumpur was notified on July 16 that the U.S. Embassy had received an e-mail outlining vague threat information, stating Post was going to be destroyed on the following day. No specific information was mentioned. The ARSO notified the host-nation police and intelligence service, as well as the police contingent assigned to the Embassy. The Mission's surveillance and security teams will continue to remain on alert. (RSO Kuala Lumpur Spot Report) ¶15. (SBU) DOMESTIC Illinois - On July 16, the deputy consul general notified the Chicago Field Office (CFO) of 50 protesters inside the Honduran Consulate waiting area; she was fearful the protesters would damage the consulate. The CFO duty agent instructed the deputy consul general to call 911 and request the police. The Chicago Police Department and two CFO agents responded, but the crowd had dispersed. CFO agents interviewed consulate employees, and it appears the group "Chicago Religious Leadership Network on Latin American" was protesting the recent coup in Honduras. (CFO Spot Report) ¶16. (U) Key Concerns ¶17. (S//NF) AF Kenya - Al-Shabaab allegedly to blow up Kenyan bridge: (S//REL TO USA, FVEY) An intelligence tearline states, "Al-Shabaab militia have positioned four fighters in Garissa, with orders to be ready to blow up the bridge joining the coast and northeastern provinces, after al-Shabaab inflicted heavy losses on the forces of the Somali Transitional Federal Government (TFG),according to information from late June. Farah Maalim, deputy speaker of the Kenyan National Assembly and member of Parliament for Lagdera District, an unidentified al-Shabaab sympathizer reportedly influenced the withdrawal of police officers manning the bridge and later deployed a roadblock along the Mororo-Bangale junction. Meanwhile, Hassan Muhumed Madhobe, an al-Shabaab trainer and former captain with the Somali National Army, was reportedly in the Somali border town of Dhoble, and contemplating entering Kenya, on July 15. He is driving a Mitsubishi Pajero, registration number SOM 66314. He reportedly is using his unidentified relatives in the Eastleigh neighborhood of Nairobi to facilitate his entry." ¶18. (S//NF) DS/TIA/ITA has no information on any U.S. presence in Garissa -- located approximately 100 miles west of the Somalia border -- but notes this report is the latest in a steady stream indicating al-Shabaab elements intend to attack key Kenyan targets. It is doubtful a large number are pursuing this goal but acknowledged that some Somali extremists or their sympathizers could be seeking opportunities to retaliate for Kenya's support of the TFG. In this case, a powerful Kenyan politician appears to facilitate the alleged al-Shabaab plot to blow up the Garissa bridge. It is unclear if the prospective travel to Kenya by the al-Shabaab trainer in Dhoble is related to the Garissa or another plot, but it is noteworthy that his relatives in the Eastleigh neighborhood of Nairobi allegedly are assisting him. Open sources describe Eastleigh generally as a congested enclave of Somali refugees marked by lawlessness and thriving business enterprises -- in short, Somalia in Kenya. In many ways, it appears nearly the perfect location for Somali extremists to network for terrorist plotting or fundraising undisturbed by the battles of their homeland. For at least the past many months, some Somali extremists have credibly spent time in Eastleigh, probably to conduct business. (Appendix source 4) ¶19. (SBU) Nigeria - On July 16, RSO Lagos and DS/TIA/OSAC coordinated and passed the following tearline to a named company: "Allegedly, an attack is possibly being planned against the (named company) in Owaza in the Ukwa West Local Government Area unless certain demands are met. There is no further information on the exact timing, method, location, or target of attacks." The company point of contact appreciated the information. (DS/TIA/OSAC) ¶20. (C) EAP The Philippines - Activities and capabilities of key terrorist figure Abdul Basit Usman: ¶21. (S//NF) Recent uncorroborated intelligence alleges Philippines-based Moro Islamic Liberation Front-Special Operations Group (MILF-SOG) member and Jemaah Islamiyah (JI) associate Abdul Basit Usman (Terrorist Identities Datamart Environment number 12913195) is planning to attack multiple large cities in the Philippines using improvised explosive devices (IEDs). Basit, along with several unidentified JI members, ostensibly intends operations for urban centers in Cebu, Mindanao, and Metro Manila. While DS/TIA/ITA cannot speak to the specific intentions of Basit, a substantial chronology of credible reporting outlines his activities and operating environment, neither of which supports the implementation of such a broad target set. In March, the DoS' Rewards for Justice program would pay up to a $1-million reward for Abdul Basit Usman. ¶22. (S//NF) No doubt, Basit is among the most capable and prolific IED builders in the southern Philippines. His operational history and notoriety as an asset to the rogue MILF 105th Base Command is well documented in tearline intelligence, debriefings of detained MILF-SOG operatives, and other credible HUMINT reporting. Despite past close involvement in IED attacks against cities in Mindanao, there is little evidence of Basit taking part in attacks outside of the conflict-affected areas of the island. DS/TIA/ITA is unaware of any current credible reports that indicate Basit may have dispatched MILF-SOG operatives to Manila, Cebu, Cagayan de Oro, Iligan, Davao, or General Santos cities. More likely, MILF members recently trained in the employment of IEDs would test their skills against civilian or Philippine military targets in and around Central Mindanao, such as the July 5 explosion in Cotabato City suggests. ¶23. (S//NF) Examination of the past year's reporting reveals Basit's activities and movements have been confined to the Liguasan Marsh and the border areas of Maguindanao and North Cotabato Province. Like his counterparts in the MILF 105th Base Command, Basit has been hemmed in by pressure from the Armed Forces of the Philippines (AFP). Paradoxically, Basit's location places him in relative proximity to the MILF 105th Base Command and its fugitive leader, Ameril Umbra Kato, with whom he has a long association. Basit's situation allows him to support the MILF 105th with IED attacks against AFP personnel; it also finds him on home turf, where he has opportunities for egress and access to a local support network. ¶24. (S//NF) Basit's IED methodology has changed little in the past three years, but the construction of his "signature" devices is relatively simple, easing the transfer of knowledge to MILF trainees. His IEDs are also transportable, reasonably reliable, and effective. Basit continues to assemble IEDs using unexploded ordnance, primarily from 60 and 81 mm mortar rounds. More recently, Basit and his associates have employed 105 mm artillery projectiles as improvised land mines for use against AFP vehicles. Since the summer of 2008, it appears Basit is using more of these high-order IEDs to better effect against AFP assets, especially along convoy routes. Typically, Basit's IEDs are detonated via cell phone; in some instances, he and his associates have used handheld radios to trigger their devices. ¶25. (S//NF) According to a routine intelligence exchange, as of late June, the Philippine National Intelligence Coordinating Agency proposed a multi-agency plan to capture Abdul Basit Usman. Under the plan, a combination of human and technical sources would pinpoint his location, and a contingent of the AFP's Light Reaction Battalion would affect his capture. If Philippine security forces are unable to neutralize Basit, there is little doubt he will continue to pose a threat to U.S. and Philippine citizens and interests. (Appendix sources 5-10) ¶26. (S//NF) SCA Afghanistan - Plans to attack Camp Blessing in Konar Province: Three separate reports, possibly from the same source, suggest militants have been planning a possible mortar attack on Camp Blessing in Konar Province, possibly with the assistance of informants operating from within the camp who purportedly provided information on the camp's daily operations, including visits by U.S officials. ¶27. (S//NF) As of July 16, two groups totaling 15 fighters led by Maulawi Sayed planned a mortar attack on Camp Blessing to take place before that evening. According to a sensitive source with secondhand access, the groups were armed with a total of 15 rounds of mortars between them and planned to attack Camp Blessing from two positions: one to the north at Nowaly Kandow and the other from the northwest at Wardesh Tangash, Landay Kandow. ¶28. (S//NF) In a separate but possibly related report, a sensitive source with secondhand access claimed that as of July 12, Taliban commanders planned to launch rocket and mortar attacks at Camp Blessing on July 13. The militants were aware that a named senior U.S. official planned to visit the base on July 13 and planned to conduct their attacks to coincide with this visit and the assumed presence of senior Government of Afghanistan officials. Militants were positioned in three elevated locations (Wardesh Tangay, Landay Kandow, and Nowalay Kandow) around Camp Blessing with an unspecified number of mortars and rockets. Commanders Nura and Maulawi Azizullah obtained information on the activities at Camp Blessing, including the arrival of the named senior U.S. officials from several informants working in and near the base. ¶29. (S//NF) Additionally, in another possibly related report, as of July 8, an individual named Qari Azimullah planned to conduct a rocket and missile attack against Camp Blessing. According to a sensitive source with secondhand access, eight fighters in Azimullah's group had four rockets and 15 large Russian-made mortars, and were positioned west of Camp Blessing near Wardesh Tangay. The group was planning an attack on July 8. ¶30. (S//NF) DS/TIA/ITA cannot corroborate this report, but notes the three separate attack dates specified by the source passed without incident. Although it is unclear if this reflects lack of access on the part of the source or operational delays on the part of the militants, it is possible an attack could occur. There have been 10 rocket/mortar attacks in Konar Province since 2008 (four such attacks this year thus far). Previous attacks include: o On May 27 in Asadabad, Konar, armed assailants fired mortars at an unknown target, killing seven civilians and injuring four others. o On July 7, 2008, in Naray, Konar, armed assailants fired rockets at a NATO facility but hit a playground instead, injuring five children and damaging the playground. The Taliban claimed responsibility. o On July 2, 2008, assailants fired mortars at a NATO-International Security Assistance Forces Coalition base, killing one civilian and wounding three others. No group claimed responsibility. (Appendix sources 11-13) ¶31. (S//NF) India - LT associate involved in plot to assassinate Gujarat chief minister: Tearline intelligence reports, "Lashkar-e-Tayyiba (LT) member Hussein was involved in a plot to assassinate the Gujarat chief minister in late June. Hussein may have met with two men regarding the targeting of Gujarat Chief Minister Narendra Modi. Hussein was also involved with operations involving a truck, but, in order to begin the operation, he needed 30 days to avoid suspicion. Hussein may have to travel to Pakistan and to either southern India or Sri Lanka by late August." ¶32. (S//FGI//NF) As of late June, at least two LT cells continued to pursue operational activities; although, separate intelligence citing mid-June information suggests recent arrests and counterterrorism operations involving India-based LT member Hussein and S J may be taking a toll on parts of the network, namely the movement of LT operatives, procurement of material, and establishment of training camps. At this time, it is unclear if these pressures will cause a delay or result in the disruption of ongoing attack planning. ¶33. (S//NF) Tearline notes, "LT associate S J was unwilling to begin operations in West Bengal on June 13 because of increased security in response to the arrest of Shanawaz. S J was to gather information on the security forces there and to send their comrades to Sri Lanka for training. The arrest of LT associate Mohammad Umar Madni concerned S J. S J believed that Madni's arrest could place many of their associates in danger." Separate tearline reports, "LT member Sultan may have left the organization in early July because of his displeasure with the way leadership dealt with his group." (Appendix sources 14-20) ¶34. (S//NF) Pakistan - Government knowledge of threat of Taliban attacks in Lahore: As of mid-July, Pakistan's security services had acquired information indicating unspecified Taliban elements intended to launch attacks in July in Lahore or other cities in Punjab. Pakistan's security services alerted police and other agencies to the threat to increase security around sensitive facilities, according to a sensitive source claiming firsthand access to information available to Pakistani security services. ¶35. (S//FGI//NF) Although the vague nature of the information provided in this report precludes thorough vetting, DS/TIA/ITA suspects heightened security concerns in Punjab Province are linked to a large July 13 explosion that occurred in Mian Channu, Khanewal District, in southern Punjab. Press reporting speculated the explosion stemmed from an unsuccessful attempt to fabricate an explosive device and resulted in the arrest of a number of suspected extremists. Law enforcement also reportedly seized a truck containing 100 kg of explosives, two machine guns, grenades, ammunition, and several suicide jackets. Subsequent press reporting indicated Riaz Kamboh -- the owner of the house where the blast occurred who is currently in custody -- planned to attack Prime Minister Yousuf Raza Gilani during a visit to Multan, Punjab. ¶36. (S//FGI//NF) Indeed, possible kidnapping plots, assassination attempts, suicide operations, and vehicle bombs continue to circulate in threat reporting for Punjab and Lahore, coinciding with recurrent attacks such as the July 2 suicide operation against a shuttle carrying nuclear facility personnel in Rawalpindi. Although the targets of future attacks remain uncertain, a body of reporting indicates extremists are seeking to strike against high-profile individuals, public events such as religious celebrations or political rallies, and venues popular with foreigners and Pakistani elite. (Appendix sources 21-36) ¶37. (S//NF) Uzbekistan/Kyrgyzstan - IJU plans for September 1 bombings: Islamic Jihad Union (IJU) operative Bekbolotzhan Akmatzhanovich Tashmatov (a.k.a. Abu Usman) claimed he was involved in an operation, along with deceased IJU area commander Hasan Suleymanov (a.k.a. Fara) and an unspecified number of foreign fighters, to conduct a large number of attacks throughout Uzbekistan on September 1, the Uzbekistani National Day. The Kyrgyzstani State Committee for National Security (GKNB) reported Usman also claimed the late-May attacks in Khanabad, Uzbekistan, were not part of the operation for which he had been prepared prior to his return to Kyrgyzstan from Pakistan and that the attacks were carried out by a separate cell altogether. As of mid-July, IJU operatives Abu Usman, Abdulhadi, Ermatov, and Ilyos were in GKNB detention. IJU operatives Fara and Khusnidin Abduganiyevich Sobirov (a.k.a. Sodiq or Sodik) were both killed in late-June counterterrorist operations in Kyrgyzstan. As of mid-July, IJU operatives Abdusamat, Abdurahman, and Tuychiyev remained at large. The GKNB further commented it remains unclear whether the IJU individuals detained and killed in these counterterrorism raids between June 23 and 27 in Jalalabad and Osh Oblasts had actually participated in the Khanabad attacks. ¶38. (S//NF) DS/TIA/ITA notes the deaths of Hasan Suleymanov (killed in a June 27 counterterrorism operation in Osh Oblast) and Khusnidin A. Sobirov (killed in a June 23 counterterrorism operation in Jalalabad Oblast) are likely to have disrupted the planned attacks for September 1 in Uzbekistan. Fara and Sodiq appear to have been the senior IJU operatives in Kyrgyzstan. Additionally, along with the four IJU operatives in GKNB detention mentioned in this report, GKNB also claims to have killed seven other IJU operatives in these and other raids, along with seizing weapons, ammunition, explosives, and other supplies. Furthermore, contrary to the information in this report, the GKNB indicated in a separate report that Abdusamat Abduhmithovich Satyvaldiyev (likely the same Abdusamat mentioned here) was killed on June 29 in Osh Oblast. Of the other two IJU reported to be at large, Abduraham is likely not to lead an attack, and there is no information on Tuychiyev. ¶39. (S//NF) Reporting suggests Abu Usman may have been in an IJU Bishkek cell, while Sodiq was in a Jalalabad/Osh cell, with Fara as a lead operative for the IJU in Kyrgyzstan in general. However, it is unclear how independent these cells were, as Usman claims. Nevertheless, it is likely IJU operatives in Jalalabad and/or Osh conducted the May 26 attack in Khanabad and the suicide attack in Andijon. In fact, previous reporting indicates a suicide bomber, who was likely involved in the May 26 suicide bombing in Andijon, was reportedly to have been under Sodiq's care. ¶40. (S//REL TO FVEY) A tearline from March 30 notes, "The IJU has assembled a cell of operatives in the Jalalabad area of Kyrgyzstan. Information from mid-2008 through February indicates that one of these operatives may be used for a suicide mission in an undisclosed location outside of Kyrgyzstan, possibly in Uzbekistan. Two members of the cell known as Sodiq and Ali were trained in Pakistan by the IJU in 2007 and have been charged with the safekeeping of this operative. The operative arrived in Kyrgyzstan sometime in late July or early August 2008 and has been isolated in a mountainous area nearby, where he apparently still remains awaiting further instructions from the IJU leadership in Pakistan." ¶41. (S//NF) If there were two IJU cells in Kyrgyzstan that were planning separate attacks (the May 26 attacks in Khanabad and Andijon, and the September 1 attacks in Uzbekistan),it posits that the IJU had made significant advances in establishing multiple operational cells in Central Asia. However, with the arrest and deaths of these operatives, the IJU is likely to have lost most of its capacity to conduct high-profile attacks in the short term. ¶42. (S//NF) While IJU operations in Kyrgyzstan appear to have been disrupted, it is of note that reporting, of various credibility, over the last several months indicates an increase in IJU (and Islamic Movement of Uzbekistan) presence in northern Afghanistan, from which these Uzbekistan-focused groups may be able to launch attacks. o For example, as of late May, the IJU had placed seven teams, each consisting of 11 individuals, on the Uzbek border. The Turkish National Intelligence Organization reported two of the seven teams were preparing for suicide missions, while the other five had been directed to attack Uzbek-Afghan border police stations. An IJU intelligence official codenamed Hamidullah had an image of a shopping center in Tashkent. (DS/TIA/ITA identified the shopping center as the popular, and foreigner-frequented, Chorsu Bazaar.) (Appendix sources 37-40) ¶43. (U) Cyber Threats ¶44. (U) Worldwide After Patch Tuesday, one critical Microsoft vulnerability still open for exploit: ¶45. (S//REL TO USA, FVEY) Key highlights: o Microsoft Corp. did not release a patch for a critical ActiveX component vulnerability. o ActiveX control vulnerabilities are frequent targets of malicious actors. o The unpatched vulnerability affects Microsoft Office XP and ¶2003. o Available information suggests DoS OpenNet users may be vulnerable to this exploit. ¶46. (U) Source paragraph: "Microsoft Corp. today delivered six security updates that patched nine vulnerabilities. The patches fix two bugs now being used by hackers but leave one hole still open to exploit. ... Six of the nine bugs were ranked critical, Microsoft's highest ranking in its four-step scoring system, while three were tagged as 'important,' the second-highest label." ¶47. (U) CTAD comment: According to open source reporting, Microsoft released several patches this week to address vulnerabilities plaguing its Windows operating system and software. However, there was no patch for an ActiveX vulnerability being actively exploited by hackers; the company has already addressed it twice this week. ActiveX is a Microsoft customized add-on (a.k.a. a plug-in) designed to assist the Internet Explorer (IE) Web browser in rendering interactive multimedia webpages. ¶48. (U) CTAD comment: Though ActiveX is designed to enhance the Web-browsing experience, malformed ActiveX controls can be easily compromised by malicious actors. The majority of ActiveX components packaged with software programs allow scripting, which means they do not require user intervention to run, but will do so when requested via code. Subsequently, this grants any webpage the ability to access ActiveX controls on a visiting computer, increasing the potential for download of malicious code. According to open source reporting, this feature has made ActiveX an attractive target for malicious actors and has ultimately resulted in ActiveX becoming one of the most widespread Web browser vulnerabilities. ¶49. (U) CTAD comment: According to a bulletin released by the company, the ActiveX vulnerability exists in Microsoft Office Web Components, which run as IE plug-ins. These plug-ins assist in viewing and embedding Office documents on the Web. Microsoft asserts it is likely a malicious actor would take advantage of this vulnerability by hosting a website containing a page that serves hostile code to visiting computers. Microsoft also stated, "in addition, compromised websites and websites that accept or host user-provided content or advertisements (i.e., social-networking sites) could contain specially crafted content that could exploit this vulnerability." If exploitation is successful, the actor could acquire privileges assigned to the local user. ¶50. (S//REL TO USA, FVEY) CTAD comment: Unpatched and previously unseen vulnerabilities have been consistently exploited by national-level intrusion set actors that regularly target DoS personnel. As the aforementioned ActiveX vulnerability is known to affect multiple versions of Microsoft Office XP and 2003, preliminary analysis suggests DoS OpenNet users may be susceptible to this exploit due to the presence of Microsoft Office 2003 Web Components on DoS systems. CTAD continues to analyze and monitor the vulnerability in support of efforts to determine what mitigating strategies will best protect DoS networks and systems prior to the release by Microsoft of a patch. (Computerworld (www.computerworld.com),"Microsoft delivers 9 patches, but leaves one hole open for hackers," July 14, 2009; Appendix source 41) ¶51. (U) Suspicious Activity Incidents ¶52. (SBU) EUR The Netherlands - A Middle Eastern-appearing man observed and photographed the area around U.S. Embassy The Hague July 1. The subject was in the area for 20 minutes. He first observed the Dutch Ministry of Finance and then walked to Post and photographed the surroundings. He eventually departed the area on foot. (SIMAS Event: The Hague-00903-2009) ¶53. (SBU) AF Democratic Republic of the Congo - As two men in a Mercedes Benz drove past U.S. Embassy Kinshasa July 15, one of the occupants video recorded Post and the surrounding area. Police stopped the car. One of the individuals stated he is Congolese and living in Nigeria. The police erased the film footage of the Embassy and then allowed the men to leave. (SIMAS Event: Kinshasa-00597-2009) ¶54. (SBU) Ethiopia - A man loitered near the USAID building in Addis Ababa July 14. The subject had a bag, appeared listless, and made a number of phone calls. The police and guard supervisor stopped and questioned the man, who indicated he is a painter and was waiting for his employer to do some painting in a nearby building. Inside the bag, police found some painting materials. They then released the subject. ¶55. (SBU) Record Check/Investigation: Subject: Bizuayehu Molla Faris (NFI). (SIMAS Event: Addis Ababa-01006-2009) ¶56. (SBU) Zimbabwe - A man loitered near the visa entry point of U.S. Embassy Harare July 15. The subject was in the area for 35 minutes observing Post's entrance. Guards challenged him, and he finally departed the area on foot. (SIMAS Event: Harare-00437-2009) ¶57. (SBU) SCA Afghanistan - A suspicious man was seen at Massoud Circle in Kabul writing notes and making numerous cell phone calls. The subject departed the area before Ministry of Interior personnel arrived. ¶58. (SBU) RSO Action/Assessment: The subject's picture and description are on file for future reference and/or investigation, should the situation warrant. (SIMAS Event: Kabul-00900-2009) ¶59. (SBU) Pakistan - An unidentified man loitered near the Red Zone of U.S. Consulate Peshawar July 14. The subject was in the area for 35 minutes for no apparent reason. When stopped and questioned, he indicated he was a house painter (NFI). He then left the area. ¶60. (SBU) Record Check/Investigation: Subject: Muhammad Ashiq. National Identification Card number: 35404-9057587-5. (SIMAS Event: Peshawar-00997-2009) ¶61. (SBU) Uzbekistan - A woman was seen around the area of U.S. Embassy Tashkent July 15. She used her cell phone camera to photograph Post. When stopped and questioned, the subject claimed she came to visit the Information Resource Center (IRC). According to Local Guard Force records, the woman has visited the IRC on a regular basis since October 4, 2007. She indicated she did not take any photos, but she admitted taking some pictures about a week ago. A check of her cell phone showed one photo of the Embassy taken July 2. The photo was deleted, and the subject was not allowed to enter the IRC. ¶62. (SBU) Record Check/Investigation: Subject: Hulkaroy Khadjibaevna Karimova. Identification card number: CR ¶1292782. (SIMAS Event: Tashkent-00341-2009) SECRET//FGI//NOFORN Full Appendix with sourcing available upon request. CLINTON