TERROGENCE PRODUCTS & CAPABILITIES. Expert Web Intelligence for Counter-Terrorism.

Size: px

Start display at page:

Download "TERROGENCE PRODUCTS & CAPABILITIES. Expert Web Intelligence for Counter-Terrorism."

Audra Rogers
5 years ago
Views:

1 TERROGENCE Expert Web Intelligence for Counter-Terrorism PRODUCTS & CAPABILITIES

2 2 Open Source Web Intelligence for Counter-Terrorism Founded in 2004, Terrogence is a private open source web intelligence company dedicated to exposing terrorist capabilities and intent. Staffed with experienced intelligence professionals, the company has pioneered powerful, web-specific methodologies and tools for collection, analysis and research, enabling us to provide counter-terrorism intelligence of the highest caliber to governments and organizations worldwide. Based on these proven methodologies, the company employs a cutting-edge web intelligence system called HIWIRE, to drive the entire OSINT production lifecycle end-to-end. Ten years at the forefront of OSINT Highly trained linguists: Arabic, Persian, Russian, French, Spanish, Chinese, Turkish etc. Intelligence products by renowned SMEs Unparalleled in-house C-IED and HME expertise Flexible collection for tailored time-sensitive intelligence Expert Virtual HUMINT operations and deep web and Darknet research Our unique intelligence capabilities, coupled with the commercial nature of our company, enable us to accommodate the intelligence and security needs of organizations worldwide.

3 3 Table of Contents Intelligence Reports...4 AL- KHEMIA Forensic Chemical Analysis of Authentic Terrorist HME Recipes...6 MÖBIUS Deep C-IED Intelligence & Terrorist TTPs Exposed...9 TGALERTS Near Real-Time Tactical Alerts with Contextual Analysis...12 HYDRA Tracking Terrorist Trends & Strategic Developments in the World of Jihad...15 Tailored Services...18 Customized Intelligence Reports...19 Corporate Intelligence...19 Training & Workshops...20

4 INTELLIGENCE REPORTS 34

35 Covering Terrorism from all Angles Terrogence intelligence reports combat the inherent nature of modern-day terrorism by exposing every facet of online terror activities; from the websites and

5 35 Covering Terrorism from all Angles Terrogence intelligence reports combat the inherent nature of modern-day terrorism by exposing every facet of online terror activities; from the websites and forums they operate in, to the emerging developments in TTP s and weapons technologies being disseminated and deployed in conflict zones and home-fronts around the world. Today s web-based terror backbone is inherently without geographic boundaries. An untrained terrorist in Spain can download an explosives manufacturing tutorial video posted by a Hezbollah IED expert from Lebanon, and learn how best to conceal it onboard an aircraft by participating in a jihadist forum registered to a server in the Canary HMEs Al - Khemia TTPs TGAlertS Service Islands, with participants from Egypt, Somalia, Algeria and Denmark assessing his methods and plans and offering lessons-learned tips from previous failed attacks. This scenario has played itself out in every major terrorist attack or attempt over the past few years. IEDs Hydra NETWORKS Möbius Terrogence understands that global terrorism is exactly that: global. Terror capabilities and know-how are no longer limited to specific geographies once they reach the web. Terrogence s expert reports provide tactical, technical and strategic insight into terrorist activities worldwide.

7 6 AL-KHEMIA Forensic Chemical Analysis of Authentic Terrorist HME Recipes Al-Khemia reports expose and analyze authentic terrorist home-made explosives (HMEs) as they emerge on terrorist forums and knowledge bases. The Al-Khemia Recipe Bank is an unparalleled repository of forensic HME analysis, aimed at rooting out the IED threat at its HME source.

7 Overview The rapid dissemination of explosives recipes and manufacture know-how via the web means that as soon as a home-made explosive recipe is perfected and disseminated in one part of the

8 7 Overview The rapid dissemination of explosives recipes and manufacture know-how via the web means that as soon as a home-made explosive recipe is perfected and disseminated in one part of the world, the threat becomes real in conflict zones and combat theaters everywhere. In each Al-Khemia report, a real-life HME recipe, harvested from within online forums and websites used by global terrorists and local insurgents, is meticulously synthesized step-by-step in a controlled laboratory setting and analyzed in perfect detail by forensic chemists and explosives experts. Authentic terrorist HME s analyzed include: Nitroglycerin Gelatin Dynamite HDN Astrolite Sorbitol Hexanitrate Mercury Fulminate DDNP C4 More Methyl Ethyl Ketone Peroxide (MEKP)

9 8 Inside Al-Khemia TM A typical Al-Khemia TM report comprises two parts: Authentic Terrorist HME Recipe in Full translation Al-Khemia reports provide full translation of the original terrorist HME recipe (video, image, document attachment, textual explanation etc.), including all stages and instructions, with preliminary notes on how the HME recipe measures up against scientific synthesis of the same explosive, and what it might be used for. Our synthesis reconstruction yielded a highly pure compound that will definitely detonate Laboratory Synthesis Reconstruction Terrogence forensic chemical experts deliver the results of a meticulous step-by-step laboratory re-synthesis of the material, along with an exhaustive assessment of its physical and chemical properties in the context of counter-terrorism efforts.

11 9 MÖBIUS Deep C-IED Intelligence & Terrorist TTPs Exposed Möbius exposes current and developing IED capabilities and operational TTPs of terrorists and insurgents worldwide, featuring rigorous technical analysis and expert assessment of real-world terrorist MOs as they develop deep within online terrorist networks.

10 Overview As the internet morphs into one vast social network, terrorists work keenly to harness global online collaboration and social networking platforms to share knowledge and improve

12 10 Overview As the internet morphs into one vast social network, terrorists work keenly to harness global online collaboration and social networking platforms to share knowledge and improve technological and operational capabilities. Yesterday s jihadi bomb tutorial from Lebanon becomes today s bomb in a radical Londoner s basement, and tomorrow s disaster in Mumbai. Researched and written by expert WTI and C-IED specialists, Möbius reports apprise subscribers of the latest trends in terrorist IEDs and TTPs, as they emerge in online sources including password protected social media platforms where global terrorists seek to recruit, radicalize and plot their next attack. `

11 Inside Möbius The typical Möbius digest includes eight individual reports per month, each assigned to one of two categories: The last parcel IED was different to the others a fire bomb without

13 11 Inside Möbius The typical Möbius digest includes eight individual reports per month, each assigned to one of two categories: The last parcel IED was different to the others a fire bomb without fragmentation Knowledge Base The latest IED developments, instructional materials and technical discussions extracted from terrorist web forums and social networks worldwide. Case Studies Techno-tactical assessments of the most recent IED applications by terrorists globally, often based on videos taken by insurgents on the ground. Each individual CLI is further marked off against six salient categories of tactical intelligence. IED construction Initiation systems Modus operandi Concealment/camouflage Countermeasure awareness Standard weapon utilization

15 12 TGALERTS Near Real-Time Tactical Alerts with Contextual Analysis Upon uncovering new and emerging terrorist activities of imminent interest on the web, Terrogence circulates a techno-tactical intelligence alert containing preliminary WTI analysis alongside tactical and contextual relevancy.

13 Overview During the course of our strategic web-intelligence operations, Terrogence collection professionals often encounter outright threats or terror-capability developments of imminent interest.

16 13 Overview During the course of our strategic web-intelligence operations, Terrogence collection professionals often encounter outright threats or terror-capability developments of imminent interest. These items immediately enter a techno-tactical analysis fast track to be disseminated in near realtime via the TGAlert Service (TGAlertS ). In order to avoid inundating subscribers with the low threshold of just news, TGAlertS digs a level deeper, providing context and interpretation. Though strictly dictated by events, TGAlertS subscribers receive one alert per week. As the events that inspire near real-time TGAlertS develop further, some alerts grow into full-blown intelligence reports worthy of inclusion in our Möbius product.

14 Inside the TG Alert Service (TGAlertS ) A typical TGAlertS is structured as follows: Comm.

nce source (platfrom type, affiliation, areas of interest etc.) followed by a summary of the intellige

Tactical Assessment & Notes WTI SMEs at Terrogence elaborate on the harvested material, adding expert notes that paint a fuller intelligence picture of the terror activity detected.

TGAlertS Key Benefits: Near real-time delivery upon detection Brief analysis of context and background Assessment of tactical relevancy Due to the availability of erythritol as a natural sweetener

2013 and into 2014 we have witnessed an expanding al-qaeda (AQ) "fashion statement" of waist-strapped person-borne IEDs (PBIEDs), now not only General Notes sported by suicide bombers.

commanders in Iraq and Syria. These compact belts have recently surfaced in Egypt.

also employed by field operatives exposed to risk of capture or engaging in close quarters combat (CQC) SVBIED drivers documented using such PBIEDs as a contingency plan No.: TGA0295 HIWIRE II.

: Waist-Belted PBIEDs Page 1 of 5 Abu Omar al-shishani (left) and tribal sheikhs in al-raqqah (right) wearing waist-belted PBIEDs (red arrows) and wristwatches (yellow arrows) on their right arms

17 14 Inside the TG Alert Service (TGAlertS ) A typical TGAlertS is structured as follows: Comm. Info & Summary of Intel Brief overview of the intelligence source (platfrom type, affiliation, areas of interest etc.) followed by a summary of the intelligence (e.g. Jihadists on a password-protected forum discuss in detail the synthesis of a unique explosive for the express purpose of downing passenger aircraft). Tactical Assessment & Notes WTI SMEs at Terrogence elaborate on the harvested material, adding expert notes that paint a fuller intelligence picture of the terror activity detected. A brief assessment follows, shedding light on the tactical relevancy of the Intel. TGAlertS Key Benefits: Near real-time delivery upon detection Brief analysis of context and background Assessment of tactical relevancy Due to the availability of erythritol as a natural sweetener and its relative ease of production compared Terrogence Alert Service to PETN, ETN is well suited to terrorist activity Al-Qaeda "Fashion Statement : Waist-Belted PBIEDs Incident Summary Throughout 2013 and into 2014 we have witnessed an expanding al-qaeda (AQ) "fashion statement" of waist-strapped person-borne IEDs (PBIEDs), now not only General Notes sported by suicide bombers. These "personal-use" devices, previously attested to as the traditional garb of Caucasus-based militants, are now frequently documented around the waists of AQ operatives, including high-ranking commanders in Iraq and Syria. These compact belts have recently surfaced in Egypt. Key points Personal waist-strapped PBIED previously seen in the Caucasus now appearing in Syria, Iraq and Egypt PBIED sported by ISIS commanders as both a status symbol and "insurance policy" TTP also employed by field operatives exposed to risk of capture or engaging in close quarters combat (CQC) SVBIED drivers documented using such PBIEDs as a contingency plan No.: TGA0295 HIWIRE II.ID: Publication Date: 14 February 2014 Appeared on the Web: Author: Isaac (Tzachi) Ganor Source: Jihadist social networks Terrogence Alert Service TGA0295 Al-Qaeda "Fashion Statement : Waist-Belted PBIEDs Page 1 of 5 Abu Omar al-shishani (left) and tribal sheikhs in al-raqqah (right) wearing waist-belted PBIEDs (red arrows) and wristwatches (yellow arrows) on their right arms Terrogence Alert Service The Syrian-Iraqi arena has demonstrated an evolution in the personal waiststrapped PBIED fashion among ISIS commanders, who are now seen sporting the belts as: A status symbol Inspiration for others by indicating their willingness to sacrifice their lives A deterrent "insurance policy" in case of capture This trend also appears to be popular among those field operatives wearing the also evidenced in Egypt by the Sinai-based Ansar Bayt al-maqdis in the October 7, 2013 SVBIED Attack against the South Sinai Security Directorate (cf. Möbius report South Sinai Security Directorate Targeted in SVBIED Attack HIWIRE II.ID 13763). There is evidence of the appearance of this compact PBIED in Egypt, as documented on February 9, 2013, in Ismailiyyah, where a militant wearing a PBIED in a fanny-pack was killed during a raid on an IED workshop. Australian suicide bomber standing on his truck SVBIED wearing a waist-belted PBIED, Deir ez-zor, Syria compact waist-belted PBIED who may choose to initiate the device as a last resort when cornered and thus take out their adversaries with them. Iraqi militants have even exhibited the use of thin-layered PBIEDs concealed in compact belts, presumably for the same purpose (cf. Terrogence Alert TGA0285 Low-Signature PBIED Concealed inside Belt - Growing Trend among Iraqi Militants HIWIRE II.ID 13244). In general, these devices are more effective in close proximity targeted killings than mass-casualty terror attacks. Tagged: Waist-belted PBIED, Caucasus, Syria, Iraq, Egypt, AQ, ISIS, Wristwatch worn on right arm, CQC It is worth noting that some SVBIED drivers in Syria were also documented wearing these PBIEDs (cf. Möbius report Australian Suicide-Bomber Initiates Truck SVBIED in Deir ez-zor, Syria HIWIRE II.ID 13353). This suggests that the PBIEDs were intended to be used as a contingency plan for targeting enemy forces in case of SVBIED initiation malfunction. A similar TTP of an SVBIED driver with a PBIED was Abu Wahib with bandolierstyle PBIED (red arrow) and wristwatch (yellow arrow) on his right arm TGA0295 Al-Qaeda "Fashion Statement : Waist-Belted PBIEDs Page 3 of 5 Fanny pack PBIED recovered from a militant in Ismailiyyah, Egypt TGA0295 Al-Qaeda "Fashion Statement : Waist-Belted PBIEDs Page 4 of 5

19 15 HYDRA Tracking Terrorist Trends & Strategic Developments in the World of Jihad At the very forefront of the online war against global jihad, Hydra explores the nature, scope and dynamics of extremists use of the Internet, focusing on hardcore jihadist forums and terror activities on social media platforms.

16 Overview Hydra -Terrogence s most wide-ranging web intelligence report, monitors terrorist trends and developments as they come to light on the web, where terrorists seek to radicalize, recruit,

20 16 Overview Hydra -Terrogence s most wide-ranging web intelligence report, monitors terrorist trends and developments as they come to light on the web, where terrorists seek to radicalize, recruit, or plot attacks against religious, cultural and political targets. The report evaluates extremist Islamic propaganda, recruitment and radicalization efforts, deep trends within the evolving world of jihad, while providing strategic WEBINT insights to hard-core global jihadists. Hydra paints a rich picture of extremists use of the Internet, with particular focus on hardcore jihadi peer-to-peer platforms. Each month, the report examines the latest publications, potential targets and underlying motivations of Internet terrorist activists around the world.

21 17 Inside Hydra A typical Hydra report comprises two parts: Highlights of the Jihadi Web Diverse assessments of important technical and non-technical developments within active jihadi networks, e.g. tactics and operational issues, politics & ideology, propaganda, and web communications infrastructure...al-qaeda and al-shabab have come to appreciate the potential benefits of humanitarian aid as a tool for winning public support In Focus A robust dive into trends of special interest in the jihadi world, including tectonic shifts in jihadist politics, deep trends in jihadist tactics and overlooked aspects of jihadist organizations.

23 18 TAILORED SERVICES Tailored Intelligence Reports Training & Workshops Corporate Intelligence Terrogence offers a diverse range of intelligence services specializing in all facets of Open Source Web Intelligence (WEBINT). Our service lines are managed by seasoned intelligence and counter-terror experts, delivering the highest quality results to our customers.

24 19 Tailored Intelligence Reports Corporate Intelligence Terrogence has two virtues that place it above all others: The highest caliber intelligence professionals, linguists and SMEs A powerful Web Intelligence system designed to maximize the impact that those professionals, linguists & SMEs have on every Terrogence product. This set-up is highly flexible and very powerful when focused on filling specific customer intelligence gaps. Collection efforts can be trained on a specific geography (e.g. Iraq, Afghanistan, Pakistan, Chechnya, West/East Africa), or on a particular subject (e.g. IEDs, VBIEDs, aviation/maritime threats, cyber-terror, homegrown terror etc.). Terrogence can also hone in on individuals, organizations, corporations, specific activities and more. We often navigate multiple verticals on a single project. Information and timing are everything in business. The Internet represents the greatest collection of information in the history of mankind, and companies that are quick to leverage this mass of information secure a competitive edge on the corporate battlefield. The advanced technology and methods that lend superiority to Terrogence web intelligence operations against terrorists are equally powerful and timely in the realm of corporate OSINT. Provide detailed reports of the political/corporate terrain in veiled territories. Expose hidden agendas, undisclosed assets. Shed light on existing partnerships or potential partnership deals. Reveal public perception of your business. Expose organizations and individuals that harbor ill-will toward your business.

20 Training & Workshops Terrogence offers a selection of workshops & training sessions to first responders, military, intelligence and counter-terror professionals covering WEBINT practices,

25 20 Training & Workshops Terrogence offers a selection of workshops & training sessions to first responders, military, intelligence and counter-terror professionals covering WEBINT practices, methodologies and terrorism subject-matter in varying levels of depth and scope. The trainers for our Web Intelligence workshops and training sessions come from rich intelligence and operational backgrounds in SIGINT, HUMINT, OSINT and HLS strategy. Introduction to WEBINT (2 days) This course introduces the world of open-source, web-based intelligence, covering the structure of information on the web, WEBINT search practices and terrorist utilization of the web. Virtual HUMINT & Web Intelligence Collection (5 days) Designed for law enforcement and security professionals, this course communicates advanced methods and tools for gathering actionable Web Intelligence from active terrorist sources on the web. Open Source Web Intelligence Operator (3 weeks) A comprehensive training course designed to train an Open Source Web Intelligence operator to fully conduct WEBINT collection, processing and analysis operations. The course includes theoretical training and real-life collection exercises.

(U) Terrorist Attack Planning Cycle A Homeland Case Study

(U) Terrorist Attack Planning Cycle A Homeland Case Study (U) INTRODUCTION (U) This case study is an examination of behaviors that resulted in a disrupted terrorist attack, revealing a cycle of planning