OSINT Nuggets - Allsource Global Management

I N S I D E T H I S I S S U E :
Critical Infrastructure 1
Border Patrol 2
Law Enforcement 3
IEDs/EFPs 4
Arizona/Southwest Border 5
Northern Border 8
Drones 9
Punch, Counterpunch 13
Steganography 13
OSINT 15
The Criminal Mind 18
Russia 18
China/Russia 22
China 23
News For Parents 24
Nuclear Terrorism 25
Open Source Intelligence
(OSINT): Open source
intelligence refers to intelligence
based on information gathered
from open sources, i.e.
information available to the
general public. This includes
newspapers, the internet, books,
phone books, scientific journals,
radio broadcasts, television, and
others. Collection of information
in OSINT format is a very
different process in comparison
to the collection of other
intelligence disciplines because,
by definition, the information
sources are publicly available
versus covertly collected.
In the second issue I talked
about what critical
infrastructure (CI) is and how
it may not be seen the same
by any two individuals. What
may be seen as CI by one is
not necessarily seen as CI by
another. Here are two
examples.
On or about June 22, 2012,
a vandal or vandals shot
holes into a 165,000 gallon
water tank that serves the
Golden Acres subdivision in
Sierra Vista, AZ. This
affected approximately 600
residents in the area.
Security cameras were also
shot out, and the damage to
the tank was about a foot
from the bottom. This clearly
illustrates that the intent was
to render the tank unusable.
To the residents of this
area this is truly CI to them
since it is the only source of
water. They cannot wash
clothes, flush the toilet,
practice personal hygiene,
and they need to get to work
in the morning. To help out,
all the residents did their part
by conserving so that all
would benefit equally for the
days they were without total
OSINT Nuggets
Volume 1, Issue 4 Wednesday, August 1, 2012
You Tell Them It’s Not Critical Infrastructure
service.
The rest of the city would
not consider this CI since it
did not affect the city as a
whole and it was business
as usual.
Another incident took
place in a different part of
the city which involved
electrical power. A
mechanical failure at an
electrical substation
resulted in power loss
to 8-10,000 people. The
mechanical failure also
sparked a small fire, further
damaging the substation
equipment.
It was approximately 2
hours before power was
restored which affected an
area that extended about a
mile from the substation.
The substation is also not
equipped for a backup
system.
As in the first case, the
city would not consider this
as CI, however, you try
telling that to the residents.
It is also safe to say that if
the substation had affected
areas like the police, city
hall or the fire department
then it would be a different
Publisher & Layout Design: Mr. E. Ben Benavides, bbenavides@agmaz.com
Chief Editor: Mr. Brad Branderhorst, bbranderhorst@agmaz.com
story and it would be
classified as CI for the city
to continue functioning and
then perhaps a backup
system would be in place.
There are several areas
around practically any city
in the U.S. that affect only a
small portion of the
population, but to classify
each and every one CI and
provide countermeasures is
way too expensive.
You may recall the major
outage that knocked out
power to almost 5M people
in the Southwest and
Mexico on Sept. 8, 2011,
when a worker doing
simple maintenance in a
Yuma, AZ, substation
accidentally tripped a
power line. The outage
knocked out power all the
way to San Diego, CA. and
two nuclear reactors went
offline after losing
electricity.
CI definition: the basic
facilities, services, and
installations needed for the
functioning of a community
or society. Now, out of the
three incidents where do
you think the focus is going
to be?
The views expressed in this Newsletter are those of the authors and do not reflect policy or
position of AllSource Global Management.
All input is based on open source harvesting and should not be considered open source
intelligence, but more specifically should not be considered as actionable intelligence.
Anyone wishing to contribute an item for publication is highly encouraged and should contact Mr.
Benavides at the above email.

OSINT Nuggets
Border Patrol News
Page 2 of 25
July 10, 2012, Closure of Border Patrol stations across four states triggers alarm. The Obama
administration is moving to shut down nine Border Patrol stations across four states, triggering a
backlash from local law enforcement, members of Congress and Border Patrol agents
themselves.
Critics of the move warn the closures will undercut efforts to intercept drug and human
traffickers in well-traveled corridors north of the U.S.-Mexico border. Though the affected stations are scattered throughout
northern and central Texas, and three other states, the coverage areas still see plenty of illegal immigrant activity -- one
soon-to-be-shuttered station in Amarillo, Texas, is right in the middle of the I-40 corridor; another in Riverside, Calif., is
outside Los Angeles.
U.S. Customs and Border Protection says it's closing the stations in order to reassign agents to high-priority areas
closer to the border.
"These deactivations are consistent with the strategic goal of securing America's borders, and our objective of
increasing and sustaining the certainty of arrest of those trying to enter our country illegally," CBP spokesman Bill Brooks
said in a statement. "By redeploying and reallocating resources at or near the border, CBP will maximize the effectiveness
of its enforcement mandate and align our investments with our mission."
But at least one Border Patrol supervisor in Texas has called on local officers to "voice your concerns" to elected
officials, warning that the "deactivation" will remove agents from the Texas Panhandle, among other places. Several
members of Congress have asked Border Patrol Chief Michael Fisher to reconsider the plan. Local officials are also getting
worried about what will happen once the Border Patrol leaves town, since they rely on those federal officials to assist in
making immigration arrests.
"It could impact us tremendously since we've only got two agents up here now for 26 counties," Potter County
Sheriff Brian Thomas told FoxNews.com.
Potter County, in the Texas Panhandle, would be affected by the planned closure of the Amarillo station.
Thomas said that while his area is far from the border, it's still a major "corridor" for illegal immigrants -- and he said
his office depends on Border Patrol to respond to their calls.
"I can't hold a carload of people out there on I-40 for eight hours while somebody comes from El Paso," he said. "I
mean, that's just crazy."
Border Patrol's resident agent in charge in Amarillo expressed similar worries, in a recent memo to local law
enforcement alerting them to the planned closure. The official, Robert Green, warned that the "entire complement" of two
agents would be reassigned from Amarillo to somewhere closer to the border. He said "there is no active plan" right now for
Immigration and Customs Enforcement to fill the void on assisting local officials with stops.
Empathizing with local officials, he wrote: "As a former deputy I found myself on the other end of the radio hoping to
contact USBP to assist me with a vehicle full of undocumented foreign nationals on the side of the road."
And in an unusual plea, he urged the recipients of his memo to contact elected officials about the change. "I would
encourage you, if you have found USBP assistance valuable in the past, to contact your political representatives and voice
your concerns," Green wrote.
The letter was first posted online by the Lubbock Avalanche-Journal. Thomas confirmed to FoxNews.com that he
received it. Bob Dane, communications director with the Federation for American Immigration Reform, also said he's
confirmed the letter's authenticity with ICE. CBP later acknowledged the memo, but said in its statement that Green was
expressing his "personal opinion."
Lawmakers have started to get involved. Republican Rep. Mac Thornberry, who represents Amarillo, joined two
other Texas lawmakers whose districts would be affected in asking the Border Patrol chief to "reconsider the proposal."
A letter sent Tuesday to Fisher warned the plan would "leave our area vulnerable." They noted that the Amarillo and
Lubbock stations alone, two of those affected, accounted for 638 apprehensions of illegal immigrants just this year.
FAIR also blasted the Obama administration for the plans.
"It's part of the systematic dismantling of both border and interior enforcement," Dane told FoxNews.com. "It
complements the non-enforcement policy of this administration."
He warned that local officials in those areas will have a hard time summoning far-away Border Patrol agents to
assist, and said the tone of Green's memo was a "not-so-subtle shout-out" that the agency feels "outmanned, outgunned ...
by their own government."
The stations set for closure in about six months include six in Texas. They are in: Lubbock, Amarillo, Dallas, San
Angelo, Abilene and San Antonio. The other three are in Billings, Mont.; Twin Falls, Idaho; and Riverside, Calif.
f 25

OSINT Nuggets
Page 3 of 25
Brooks said that the closures do not mean agents will be out of contact.
"Though Border Patrol agents would no longer be located in these areas, the Border Patrol intends to maintain
strong and meaningful law enforcement partnerships with Immigration and Customs Enforcement and local law enforcement
f 25
agencies in these areas through continuing to actively share intelligence and information" and other avenues, he said.
Detractors, though, say the changes are part of a pattern. The administration recently announced it would stop
deporting young illegal immigrants who came to the U.S. as children and have not committed a serious crime. Additionally,
after the Supreme Court upheld one plank of Arizona's controversial immigration enforcement law last month, federal
officials said ICE would be selective in responding to calls about immigration status - prioritizing cases that meet certain
criteria, like whether the suspect is wanted for a felony.
Rep. Randy Neugebauer, R-Texas, who signed the Thornberry letter, also voiced concern about the latest
announcement on station closings in a written statement.
"The Department of Homeland Security hasn't demonstrated that sending additional resources to the border will be
a more efficient use of resources than maintaining a presence further north," Neugebauer said. "I'd like to see numbers that
reassure me that this strategy change won't ultimately result in fewer arrests."
http://www.foxnews.com/politics/2012/07/10/closure-border-patrol-stations-across-four-states-triggers-alarm/
Comment/Analysis: Sometime in 2011, NPR (National Public Radio), published an
interactive map of just how far into the United States drug trafficking
organizations (DTOs) had extended their reach
(https://www.npr.org/templates/story/story.php?storyId=124703094 ).
Another article stated that Mexican cartels have long operated in the US
and forged ties on a smaller level with American gangs, using them to
sell drugs on street corners. A report by the National Drug Intelligence
Center said that Mexican cartels already operate in more than 1,000
US cities, or almost every urban area in the US. That was in 2011 so I
am sure that in 2012 the number of cities having been infiltrated is
now more. See the attached interactive map for a feeling of just how
far the DTOs have extended their influence. After superimposing the
interactive map atop Google earth and then studying the terrain,
national parks, East-West and North-South corridors, transportation
routes, etc., my conclusion would be to only close two stations and
modify another. Close San Angelo and Lubbock in Texas; and close the
Billings, Montana but open it up in more of a North-South corridor.
http://www.globalpost.com/dispatch/news/regions/americas/unitedstates/111102/mexican-cartels-mexico-drug-war
Related: http://test.dailycaller.com/2011/09/30/drug-war-mexican-cartels-us-reach-expands-over-400-percent-in-two-years/
Law Enforcement
July 3, 2012, ATN Introduces PS7 Night Vision Goggle. American Technologies Network has
introduced the ATN PS7 night vision goggle for law enforcement, according to the company.
The ATN PS7 is a lightweight, high-performance night vision goggle that produces
optical images in great clarity and detail even in unfavorable conditions, according to ATN.

OSINT Nuggets
Page 4 of 25
The ATN PS7 can be used as a hand-held goggle or head-mounted with the hands-free, flip-up head mount
assembly that comes standard with the goggle. It can also be used as a helmet-mounted model with an optional MICH or
PAGST helmet mount kit.
The multi-coated, all-glass optics also feature a "sacrificial window" that shields the optics from sand or debris that
may scratch the lens. The ATN PS7 is available with several different high-resolution image intensifier tubes. The ATN PS7
also has a built-in Infrared dual-focus and wide-angle Illuminator that enables vision in darkness.
The goggle is available in 3x, 5x and 8x lenses. It requires one 3-volt lithium CR123A battery or one 1.5 AA battery.
http://www.policemag.com/Channel/Technology/News/2012/07/03/ATN-Introduces-PS-7-Night-Vision-
Goggle.aspx?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+POLICE-
All+%28POLICE+Magazine%29
July 6, 2012, Pelican Introduces Multi-Color LED Flashlight. Pelican Products has
introduced the 2370 multi-color LED flashlight, which works in a variety of
environments, according to the company. The light has four operating modes (high
and low white as well as night-vision-friendly red and blue) that can be easily changed
with a magnetically actuated selector switch.
Powered by two included AA batteries, its powerful LED provides clean,
brilliant light for nearly four hours of usable light with a peak output of 106 lumens in
high mode. Its low mode (great for close quarter use and battery life extension) shines
13 lumens and runs for more than 41 hours.
The 2370 LED is weather resistant and features a CNC-machined,
aerospace-grade aluminum body with a knurled "no slip" grip pattern and a tough, matte black, Type II anodized finish.
Weighing in at 6.5 ounces with batteries, the flashlight includes a removable clip for easy pocket transport.
Also available is an optional holster and nylon lanyard for more transportation choices. The 2370 LED retails for $59.95.
http://www.policemag.com/Channel/Patrol/News/2012/07/06/Pelican-Introduces-Multi-Color-LED-
Flashlight.aspx?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+POLICE-
All+%28POLICE+Magazine%29
IEDs/EFPs
What is an Improvised Explosive Device (IED)? An IED is an improvised delivery system to deliver an explosive charge. It
includes nearly any common object from a pipe to a vehicle, an empty coke can or light bulb. The types of IEDs are only
limited by the imagination of the bomber.
(U//FOUO) Cold Pack Chemicals: Potential Use in Improvised Explosives. Cold packs,
packaged and sold commercially, contain chemicals—usually 30 to 85 grams of ammonium
nitrate or urea—that, when extracted in sufficient quantity, can be used as precursors for
improvised explosives. The chemicals are packaged in prill (pelletized) form, and can be
used directly or ground into powder when being used in homemade explosive production.
Five hundred packs would yield 30 to 90 pounds of precursor material for use in an
improvised explosive device (IED). https://info.publicintelligence.net/DHS-ColdPacks.pdf
July 14, 2012, BARRIE, ONT.—Police have found at least 50 improvised explosive devices at a Barrie home in a search
that has forced the evacuation of the neighbourhood.
Nine of the homemade bombs were exploded Sunday afternoon in a controlled detonation on the edge of the city.
Const. Angela Butler of Barrie police said the roughly 60 people who have been kept from their homes since Thursday won’t
be able to go home yet.
“It will be a few more days at least,” said Butler. “The total of what we’re doing seems to heighten every day . . . As
the officers go through the home, they’re finding more and more improvised explosives.”
The house at 30 Virgilwood Cres. seemed just like any other on a quiet street in Barrie’s suburbs, said residents of
the neighbourhood, until police arrested a father and son in connection to a 1978 murder of 26-year-old Michael Traynor last
week.
f 25

OSINT Nuggets
Page 5 of 25
The explosives were found after the arrests of Donald Feldhoff, 54, who has been charged with murder, and his
father William Feldhoff, 75, charged with being an accessory after the fact.
Police said further charges are pending.
Residents who have been evacuated are staying with friends, at hotels or in accommodations arranged by the Red
Cross.
f 25
“I’m majorly upset,” said one resident who didn’t want her name used for fear of retaliation. “This could have blown
up at any time.”
John Picken, who lives nearby, said he’d never noticed anything strange about the house where members of the
bomb squad are now combing through the property.
“I take my kids trick-or-treating there every year,” said Picken. “This is totally off the wall for this neighbourhood.
“It’s a total shock.” http://www.thestar.com/news/ontario/article/1226748--barrie-bombs-police-uncover-50-explosivedevices-in-home-of-accused-killer
Related: Police continue to uncover homemade bombs at Barrie home.
http://www.thestar.com/news/gta/crime/article/1226576--barrie-bomb-house-evacuation-to-last-into-sunday
Comment/Analysis: Looks like your typical neighborhood doesn’t it? But yet there was something going on and neighbors
failed to note anything. Surely the indicators were there waiting to be discovered. What about the activities of the tenants?
Were they up late at night or did they take care of business early in the
morning? What about visitors? What about strange odors? What I’m trying to
drive home is that IEDs are real and sooner or later we are going to be
confronted with that threat in our own areas. Now is the time to start looking
for the indicators that say something is amiss. Start paying attention to your
surroundings and see how they change from day-to-day. Can you spot
abnormal activity? It’s all there; it’s just a matter of interpreting the
information.
Arizona, The Southwest Border and Beyond
July 7, 2012, Bust of 20 Mexican drug cartel members by Arizona police recovers THREE-TONS of marijuana and $2.4M
cash.
The arrest of 20 suspected members of the deadly Mexican Sinaloa drug cartel in Arizona has turned over three
tons of marijuana, 30lbs of Methamphetamine drugs and $2.4 million dollars in cash.
Tempe Police Narcotics Detectives announced the six-month investigation's conclusion on Friday that also includes
the confiscation of an airplane, 10 vehicles and 14 firearms.
The cartel often described as the largest and most powerful in the Western Hemisphere is headed by Leonel
Galvez Leal, Norberto Meza Montoya, and Jose Alonzo Rodriguez Rosas.
"Operation Nayarit Stampede” marks an end to an extensive poly drug trafficking organization that stretched across
the Mexico border and into Arizona and beyond,' said DEA Special Agent in Charge Doug Coleman in a release.
Police named New York, Alabama, and California as being recipient states of the cartel's delivery.
The drugs were transported through hidden compartments in commercial tractor-trailers crossing the Mexican
border according to police.
'DEA and our partners have taken large quantities of drugs, millions of dollars in drug trafficker assets, and powerful
weapons off our streets.
We will continue to do everything in our power to bring to justice those who try to poison our communities,' Coleman
said.
Police reported tip-offs of possible drop houses in Tempe leading to the discovery by detectives with state and
federal law enforcement agencies.
Fifteen search warrants have since also been filed.

OSINT Nuggets
http://www.dailymail.co.uk/news/article-2170304/Bust-20-Mexican-drug-cartel-members-
Arizona-police-recovers-THREE-TONS-marijuana-2-4M-cash.html#ixzz20Ab0NrLN
Page 6 of 25
Comment/Analysis: This is a picture of a home used as a drop-off house. It sort of reminds us
of a typical home in a typical neighborhood in a typical city (Tempe, AZ in this case). However,
there are always indicators (open source information) that one home is different from the others
either from human or vehicle traffic, and also the appearance of the home. In other words, it
just doesn’t blend in. A word of caution. Do not walk over and innocently start a casual conversation to try and glean
information. These people are not stupid, they will see right through you and it is dangerous!
July 15, 2012, Sinaloa Cartel, the Threat to Arizona. The Sinaloa cartel is the largest drug trafficking criminal organization
that threatens more counties in Arizona that traditionally have large problems with drug trafficking. This has been the case
through their continued dominance in and through the region, according to a Justice Department report of the United States.
The U.S. Drug Enforcement Agency (DEA) estimated that drug trafficking organizations that have allied with the
"Sinaloa Cartel" belonging to cells of "El Chapo" Guzman Loera, and "EL Mayo" Zambada Garcia, are currently responsible
for approximately 90% of all drugs crossing the border into Arizona and recently there have been a series of arrests in that
state that have connections to the powerful cartel.
On Friday, July 6, Arizona authorities dismantled a network that was smuggling different types of drugs from
Tempe, Arizona, to the rest of America, and the operation arrested 20 people, some of whom had many years working
within the U.S. for the Sinaloa cartel.
Some of those arrested were responsible for the coordination and distribution of drug shipments coming into
Arizona from Mexico through hidden compartments in commercial trailers," said Ramona Sanchez, a spokeswoman for the
DEA.
In contrast, she added, the organization used aircraft to send currency from profits of drug sales in the United
States to Mexico, Central and South America. Property seized in raids included a Cessna 421 that was found in a hangar
located south of Tucson.
In addition to the 20 people arrested and the Cessna, Arizona authorities executed search warrants in several safe
houses in the cities of Phoenix, Tucson, and Tempe where they confiscated about $2.4 million in U.S. currency, three tons
of marijuana, methamphetamine, 14 weapons, 10 vehicles, and large amounts of cocaine.
The Sinaloa cartel uses the control of brokers on both sides of the U.S.-Mexico border to extend their dominance in
Arizona and controls most of the illicit money and weapons that are trafficked across the border and areas of high level of
drug trafficking in that state.
Throughout 2011, the Sinaloa Cartel dominated the trafficking routes of drug trafficking in Sonora in northern
Mexico and has controlled the drug routes that are connected to the Arizona and Sonora border. "The numerous
organizations that make up the Sinaloa cartel control most of the corridor that includes the Indian Reservation of Tohono
O'Odham and the Nogales port of entry," she went on to say. http://www.borderlandbeat.com/2012/07/sinaloa-cartel-threatto-arizona.html
June 26, 2012, The Colombian Navy has found a semi-submersible vessel used to traffic drugs on the Pacific coast, thought
to belong to the Rastrojos drug gang, in the second such finding this year.
On Sunday, the Colombian Navy, with the help of the U.S. Drug Enforcement Administration (DEA) and the
Colombian Attorney General's Office, discovered a semi-submersible vessel believed to be used in
the drug trade. It was found in a jungle river near the town of Mosquera in the western department of
Nariño, according to a navy announcement.
The craft is reported to be 20 meters long and capable of carrying up to four people and eight
tons of cocaine. Its two engines would allow it to travel easily to the Central American coast,
according to estimates provided to El Espectador.
Vice Admiral Rodolfo Amaya stated that the semi-submersible was used by the Rastrojos
gang. The vessel has an estimated worth of $1 million.
f 25

OSINT Nuggets
InSight Crime Analysis
Page 7 of 25
Seventy-seven drug trafficking vessels that were capable of traveling at least partly submerged beneath the surface of the
ocean have been found in the region in the past decade -- 60 of those within Colombian waters, El Mundo reported.
According to the Navy, only two of the devices f were 25 fully submersible.
In February 2011, Colombian authorities seized their first fully submersible vessel, which constituted “a huge
technological leap” for traffickers, according to Admiral Hernando Willis of Colombia’s Pacific Joint Command.
The vessel is the second semi-submersible to be seized this year by Colombian police. Most such “narco-subs” lack
the technology to travel completely underwater, but still allow drug traffickers to transport their goods to countries like Costa
Rica and Guatemala without detection. The Rastrojos, one of the most powerful transnational crime syndicates in Colombia,
is believed to have a fleet of drug submarines at its disposal.
The recent discovery is further evidence of narcotraffickers’ growing reliance on sophisticated technology to
outmaneuver authorities. As drug enforcement agencies increasingly target routes used by traffickers, smugglers must find
less conspicuous ways to transport their goods. Colombian drug trafficking organizations like the Rastrojos have long used
coastal routes to smuggle drugs up to Central America and Mexico, from where they are shipped to the United States.
http://www.insightcrime.org/insight-latest-news/item/2821-colombia-seizes-one-of-rastrojos-drug-sub-fleet
November 4, 2009, Colombian drug dealers sick of getting busted by law enforcement have come up with numerous ways
to transport their contraband to foreign shores. They used automobiles with secret compartments, human drug “mules,”
high-speed aircraft and boats. Now, they’re trying their luck with submarines. http://declubz.com/blog/2009/11/04/cocainebust-drug-dealers-smuggle-using-submarines-for-transport/
Comment/Analysis: It obviously must be profitable if three years later submarines are still in use. I have no idea how many
loads the cartels are willing to sacrifice to get one through but I imagine the profits more than make up for the losses.
Note: Pictures are hyperlinked to their web pages.
June 29, 2012, US Treasury Points to Hezbollah Presence in Latin America.
The US Treasury Department has blacklisted four Venezuelan and Lebanese men under the Kingpin Act for supporting an
international drug trafficking and money laundering network linked to Hezbollah, revealing some of the group's activities in
the Americas.
One of the designees, Abbas Hussein Harb, a Venezuelan and Lebanese dual citizen, runs a Colombia and
Venezuela-based organization that has laundered millions of dollars for Lebanese drug lord and previous Kingpin Act
designee, the Lebanese drug lord Ayman Joumaa, who was indicted by a US court in late 2011. Another designee

OSINT Nuggets
Page 8 of 25
reportedly used his position as a bank branch manager in Lebanon to help move money for Harb and Joumaa. Harb's and
Saleh's brothers were both also designated under the Kingpin act.
Ali Mohamed Saleh, a Lebanese Colombian national and former Hezbollah fighter who was designated under the
Kingpin Act in December 2011, is accused of leading a cell to raise money for Hezbollah in Maicao, Colombia. He was
designated under the Treasury's anti-terror authority, Executive Order 13224. Saleh, according to a Treasury press release,
solicited donations for the group and coordinated cash and check transfers using couriers who traveled to Lebanon through
Venezuela. He was previously blacklisted for laundering money for a criminal group linked to the drug lord Ayman Joumaa.
A Treasury official told InSight Crime the terrorism designation for Saleh changes his legal status and puts him on
terrorist watchlists, in addition to the secondary effect of publicizing his status as a supporter of terrorism. The Kingpin
designation blocks US citizens and businesses from working with the four men and freezes any US assets they own.
The department also sanctioned three businesses owned by Harb and Saleh, two of them in Colombia and one in
Venezuela.
InSight Crime Analysis
The designation follows a report by an Italian newspaper alleging that Iran and Hezbollah were plotting a terror
attack in Latin America, which seemingly has not come to fruition, despite some voices who insist on Hezbollah's terrorist
ambitions in the region.
These latest Kingpin Act designations highlight Hezbollah's presence in Latin America, but the threat that the
militant group presents to the region should not be overhyped. Hezbollah does receive a substantial amount of money in the
form of remittances from South America, especially Paraguay's tri-border area shared with Brazil and Argentina, a hub for
all varieties of smuggling and counterfeiting. The tri-border area has a large Lebanese population, some elements of which
are thought to provide financial support to the group. But there is little evidence that Hezbollah is actively involved in
directing criminal enterprises in the region.
http://www.insightcrime.org/insight-latest-news/item/2839-us-treasury-points-to-hezbollah-presence-in-latam
Comment/Analysis: The presence of Hezbollah should not come as a surprise since as early as 2008 Hugo Chavez was
already hosting the group and suspicion was that Venezuela was being used as a base of operations. Hezbollah was also
linked to deadly attacks on Jewish targets in Argentina in the early 1990s. The group has had plenty of time to incubate and
become familiar with Latin America, and should be viewed as an immediate threat. Iran would not have any problems
funding ant-U.S. operations under plausible deniability. However, they are terrible when it comes to such adventures.
The Northern Border and Beyond
July 13, 2012, Graphic: Mexican drug cartels’ spreading influence. Invasion of the Drug Cartels.
The Mexican drug trade has left more than 50,000 bodies in its wake since 2006, and the
cartels appear to be looking to expand their networks. With this in mind, the National Post’s
graphics team takes a look at the flow of drugs across the continent.
https://nationalpostnews.files.wordpress.com/2012/07/fo0714_mexicoweb1500.jpg
Comment/Analysis: This map/graphic should be studied with some caution. Although it does
not give a true representation of all the cartels it does still provide some useful information that
can be used in analysis. The important thing is not to take everything at face value, but do
some background checks to avoid embarrassing briefings or analysis. Compare this graphic to
others and point out the differences, but do not disregard it entirely. Why does the graphic only
shows 4 cartels and 1 unknown, and it does not show any linkages to the Sinaloa Cartel. We
know that the Sinaloa Cartel has already made encroachment into the U.S. The graphic is linked to the web page for better
viewing and reading. I have placed this article under the northern border since we are all too familiar with the southern
border but have not heard too much about the drug cartels being fully operational in Canada. The other reason is that you
will notice the flow of cartel influence arrows stop at the U.S./Canadian border. Well, we know it doesn’t actually stop there
but continues northward, but where exactly? Perhaps with more study the arrows can be extended to their final destination
in Canada. The graphic does serve a purpose, but should not be used as factual representation.
f 25

OSINT Nuggets
Page 9 of 25
Could That Musca Domestica Be A Drone?
f 25
July 5, 2012, Maple Seed Drones Will Swarm The Future. Imagine a cheap, tiny, hovering aerial drone capable of being
launched with the flick of a person’s wrist and able to provide 360-degree surveillance views that
the user can manipulate.
It’s real, it’s inspired by maple seeds, and the company behind it, Lockheed Martin,
envisions a future in which swarms of the new drones can be deployed at a fraction of the cost
and with greater capabilities than drones being used today by the military and other agencies.
“Think about dropping a thousand of these out of an aircraft,” said Bill Borgia, head of
Lockheed Martin’s Intelligent Robotics Lab, in a phone interview with TPM, “Think about the wide area
over which one collect imagery. Instead of sending one or two expensive, highly valuable aircraft like
we do today, you could send thousands of these inexpensive aircraft, and they are almost expendable.”
The new drone which looks like very similar to a maple seed, with a small pod-like body
attached a single whirring blade, is called the Samarai. The name is derived from the Latin word “samara,” which means a
winged seed, just like the one that inspired its physical design, flight pattern and construction.
In June, Lockheed Martin released a video demo of the drone’s capabilities, and it is clearly impressive, launched
by hand and piloted using a tablet computer, which also displays the drone’s live surveillance feed.
“You can literally pull this out of your pocket, throw it into the air, and it can start flying,” Borgia told TPM. “It can
take off and land vertically indoors.”
Borgia said that the drone, or unmanned aerial vehicle (UAV), was designed to be deployed in confined settings,
such as urban environments or even inside buildings, where it could be piloted into different rooms and hover outside of
windows, collecting surveillance footage with ease.
The technology behind the drone is even more sophisticated than it looks. There are only two moving mechanical
parts in the entire tiny 30-cm aircraft: The piece that makes the propeller rotate and a flap on the large wing that comprises
most of the drone’s form.
Then there’s the Samarai’s realtime video feed, which an operator can pan and tilt in a full 360 degrees, a capability
not found on any other drone of its class, this despite the fact that the drone only contains one camera which is constantly
being whipped around by the rotating motion of the aircraft itself.
In order to obtain a steady video feed with the ability to virtually pan and tilt, Lockheed relies on a series of image
processing algorithms, Borgia told TPM.
“The algorithms sort of de-rotate the video and turn it back into a frame-by-frame view, similar to what you would
see on any basic TV,” Borgia said. “All of the image processing is done onboard.”
That means that even if disconnected from the cloud or a control server, the Samarai would still be able to provide
its operators with constant surveillance capabilities.
Borgia declined to specify the drone’s range or endurance, that is, the time it’s able to stay aloft in the air.
However, he did note that the Lockheed researchers behind Samarai had experimented with battery-powered and
carbon-based fuel versions (the battery powered version is the one demonstrated in the video). Borgia further said that the
researchers had “developed simulation tools that allow us to scale the vehicle to meet specific applications,” asked for by
customers.
Lockheed Martin has not revealed any of its customers or potential partners on the Samarai yet, but Borgia said the
company would make announcements “when the customers were ready.”
Besides the 30-cm (11.8 inches) version shown in the June demo video, Lockheed also has field-tested a 17-cm
(6.7 inches) version and is working now to scale down the Samarai even further, to the size of an actual maple seed.
Asked about any potential privacy concerns presented by the Samarai, especially in light of the recent release of a
voluntary industry “code of conduct” from drone manufacturers, Borgia said that “customers will have to work through the
hurdles.”
Lockheed Martin began work on the Samarai in 2007 under a Defense Department program called “nano air,”
designed to produce “an extremely small, ultra lightweight air vehicle system.”
http://idealab.talkingpointsmemo.com/2012/07/maple-seed-drones-will-swarm-the-future.php
June 27, 2012, China has reportedly developed unmanned aerial vehicles (UAVs) capable of interfering with the navigation
of U.S. aircraft carriers in the Taiwan Strait and the South China Sea, according to foreign reports.

OSINT Nuggets
Page 10 of 25
China Briefing, a news website sponsored by the Washington-based Jamestown Foundation, said China’s
continued investment in UAV research will make it the second UAV country after the U.S., and its rapidly developed UAVs
25
will enable Beijing to interfere with the situation in the two bodies of water.
The UAV has become an important tool for the Chinese navy to carry out “anti-intervention and regional isolation
operations,” and the vehicles will be used particularly in anti-aircraft carrier combat, it said.
Jane’s Defense Weekly reported that the Japan Maritime Self-Defense Force
displayed two pictures captured by its surveillance aircraft that show three People’s
Liberation Army Navy vessels crossing the Miyako waterway into the western Pacific on
April 29.
One of the pictures shows three UAVs practicing vertical take-offs and landings on
the rear deck of China’s Type 054A frigate “Zhoushan.”
Based on the picture, analysts speculated that the UAVs have good stealth
capability and can carry 34 kilograms for six hours.
When performing reconnaissance missions, the UAVs have different types of
sensors mounted on their bellies. Target images recorded by the UAVs will be transferred to
frigates at sea using data link carriers, the weekly reported.
Jane’s Defense Weekly reported that the UAVs spotted by Japan’s defense ministry are similar to the Camcopter S-
100s built by Austria-based Schiebel Corp.
The weekly magazine suspected that the Austrian company breached the European Union’s arms embargo to
China.
But Schiebel Corp. said its sale of civil S-100 UAVs to China in 2010 was in line with European Union regulations
and stressed that the UAVs shown in the photos were not S-100s. The company suspected they might be products
developed independently by the Chinese army.
Whatever the origin of the UAVs, James C. Bussert, editor at the U.S.-based Signal Magazine, said in an article that
simply having UAVs would not be enough for the People’s Liberation Army to attack U.S. aircraft carriers.
The army will need to have a comprehensive operational support system for search, identification, track, locks,
combat and assessments against the “sources of threats,” before it can complete a “kill chain,” Bussert said.
He added, however, that the UAVs will be the integral part of the “kill chain.”
CAMCOPTER S-100 by Schiebel Aircraft GmbH, Austria.
Surveillance and reconnaissance, target acquisition and designation, communications
relay, precision delivery, aerial mapping, traffic control, disaster monitoring, harbor patrol,
pipeline monitoring – land and sea operations by day and night.
Dimensions:
Length: 3.11m
Height: 1.12m
Rotor diameter: 3.4m
Weight: empty: 243lb
MTOW: 440lb
Max payload: 110lb
Performance:
Speed: 120kt
Endurance: 6hr (with 75lb payload) plus optional external fuel tank – extending endurance up to 10hrs
Ceiling: 18,000ft
Mission radius: 150km
Endurance speed: 55kt
Payload: universal mount allows for a wide variety of payloads – EO/IR laser, designation and various radars
Data Link: C-band Guidance/Tracking: DGPS/INS
Launch: VTOL Recovery: VTOL Structure Material: carbon fibre.
System Components: two aerial vehicles, one GCS Electrical Power: 500W at 28V DC GCS: two network-based mission
planning/control and payload workstations, tracking antenna, UHF backup antenna, GPS reference module, pilot control
unit.
f

OSINT Nuggets
Page 11 of 25
Comment/Analysis: The more the U.S. pushes into China’s backyard, the more the Chinese will develop and experiment
with technology to counter systems based around carrier battle groups. The Chinese are well aware that an aircraft carrier,
even with all that firepower on board, is extremely vulnerable if they can negate some or all of its accompanying protection.
My guess is that they will go after the supporting protection f 25 first. Expect to see more emphasis on isolating the carrier’s
tentacles.
July 1, 2012, Despite concerns about U.S.-made drones ending up in enemy hands, American military contractors are
lobbying the government to loosen export restrictions and open up foreign markets to the unmanned aircraft that have
reshaped modern warfare.
Companies such as Northrop Grumman Corp. and other arms makers are eager to tap a growing foreign appetite
for high-tech — and relatively cheap — drones, already being sold on the world market by countries such as Israel and
China.
Comment/Analysis: There was a time when the U.S. had really cornered the market on drone technology, and to some
extent we still have the upper hand, however, we must admit that even countries like Iran are fast catching up. Might as well
get in on the action and bring in some revenue. I see the day when the U.S. will actually acquire drones from other countries
because of superior capabilities. I’m wondering if we haven’t already done so. Hint, hint.
August 16, 2010, Bomb Kills Iran's Military Drone Program Chief. On Aug. 1, Reza Baruni, the father of Iran's military UAV
program, died in a mighty explosion that destroyed his closely secured villa, debkafile's military and intelligence sources
reveal. He lived in the high-scale neighborhood secluded for high Iranian officials in the southern town of Ahwaz in oil-rich
Khuzestan.
Very few people in the country outside the top leaders and air force knew about his job and so his death was not
generally appreciated as fatally stalling Iran's military drone program for many years.
The official version produced the old standby of an exploding gas canister as the cause of the blast.
However, DEBKA-Net-Weekly's intelligence source report that bombs were planted in at least three corners of the building
and expertly rigged to explode simultaneously and bring the ceilings crashing down on its occupants. The bomber must
therefore have had access to the Baruni home.
The authorities tended to fix the blame on underground organizations representing the local Arab-speaking
Ahwazis' fight for self-rule against the repressive regime. Some suspect certain Gulf Arab emirates' intelligence services
commissioned the Baruni murder.
Hiding behind his public face as a retired army major, the dead man created Iran's program for manufacturing
military drones from scratch and trained a new generation of engineers and planners to take over. But despite his efforts
and the hefty sums Iran invested in the industry, the product never really came up to the advanced standards achieved by a
very few countries.
Five months ago, U.S. Defense Security Robert Gates told the Senate Appropriations Committee. "Countries like
Iran are developing their own UAVs and already have a UAV capability. That is a concern because it is one of these areas
where, if they chose to - in Iraq, in Afghanistan - they could create difficulties for us."
There is also a growing concern that drone technology could be sold to terrorist groups.
Gates was responding to a statement last February by the Iranian Air Force's coordination deputy, Brigadier General Aziz
Nasirzadeh, that Iran had successfully tested the prototype of its first domestically-built "stealth drone" calling it Sofeh Mahi
(Manta Ray)."
He boasted that the drone, "due to its physical attributes and the material used in its body, cannot be detected by
any radar." But he also introduced a cautious note by explaining that the production process would not be rushed, as such
complex systems need thorough analysis and exhaustive testing. http://rense.com/general91/drone.htm
Comment/Analysis: This article is 2 years old but I’m wondering how much progress has been made since that time. The
death of Reza Baruni brings to mind the deaths of Iran’s nuclear physicists and blamed on Israel. Is there a pattern here?
July 1, 2012, Gray Eagle Gets Down. The U.S. Army began moving platoons (each with four aircraft) of its new MQ-1C
Gray Eagle UAV (unmanned aerial vehicle) to Afghanistan late last year. Two months ago it sent the first MQ-1C company
to Afghanistan, where it has completed over 200 sorties. An MQ-1C aviation company has 115 troops, 12 MQ-1Cs, and five
ground stations. The army has been adding a lot of new electronics to the MQ-1Cs and this has caused some reliability

OSINT Nuggets
problems. This has lowered the rate of available (for flying) MQ-1Cs, but the army believes it will
overcome all the software problems and that the MQ-1Cs that do get into the air are doing
outstanding work at tracking and attacking the enemy.
In addition to the usual surveillance and attack chores, some MQ-1Cs are assigned to
QRC (Quick Reaction Capability) platoons of four aircraft. These QRC units are kept in
readiness, especially during large operations against the Taliban, to quickly get into the air and
pursue new information (or fleeing Taliban believed to be leaders or other key personnel). With
their night vision and SAR (Synthetic Aperture Radar), the MQ-1Cs rarely lose anyone they spot
on the ground. Since an MQ-1C can stay in the air over 20 hours at a time, they can work in
shifts if they have to until hidden Taliban fugitives eventually come out again. This use of Gray
Eagles has greatly increased the losses among the Taliban leadership.
The first MQ-1C aviation company was formed three years ago and was assigned to the
U.S. Army 160th SOAR (Special Operations Aviation Regiment), which belongs to SOCOM
(Special Operations Command). The army plans to eventually equip each combat brigade with an
MQ-1C company and establish over three dozen of these companies.
The Gray Eagle is joining a large existing UAV fleet. At its peak two years ago, the army
had 87 RQ-7 Shadow UAV systems (with several UAVs each), six MQ-5 Hunter systems, nine
MQ-1Cs, 12 Sky Warrior Alphas, over 4,000 Ravens (in 1,300 systems, assigned to infantry
companies, convoys, and base defense), and 16 RQ-18 MAV (helicopter type) systems. Army
UAVs spent over 25,000 hours a month in the air. It took army UAVs 13 years to achieve their
first 100,000 air hours and 8.5 years to get their next 900,000 hours. With the withdrawal of troops
from Iraq and the reduction of forces in Afghanistan, many of the older UAVs are being retired.
The MQ-1C weighs 1.5 tons, carries 135.4 kg (300 pounds) of sensors internally, and
up to 227.3 kg (500 pounds) of sensors or weapons externally. It has an endurance of up to 36
hours and a top speed of 270 kilometers an hour. MQ-1C has a wingspan of 18 meters (56 feet)
and is 9 meters (28 feet) long. The MQ-1C can carry four Hellfire missiles (compared to two on
the Predator), or a dozen smaller 70mm guided missiles. Each MQ-1C costs about $10 million.
Page 12 of 25
The army uses warrant officers as operators. The MQ-1C has automated takeoff and
landing software and is equipped with a full array of electronics (target designators and digital
communications so troops on the ground can see what the UAV sees).
The original MQ-1 Predator is a one ton aircraft that is 8.7 meters (27 feet) long with a
wingspan of 15.8 meters (49 feet). It has two hard points, which usually carry one (47 kg/107
pound) Hellfire each. Max speed of the Predator is 215 kilometers an hour while max cruising
speed is 160 kilometers an hour. Max altitude is 8,000 meters (25,000 feet). Typical sorties are
12-20 hours each.
The 159 kg (350 pound) Shadow 200s carry day and night cameras and laser designators but usually no weapons.
Most of the new army heavy UAVs delivered over the next five years will carry missiles, and by 2015, the army wants to
have over 500 MQ-1Cs.
The army has been quietly building its new force of larger UAVs for a while. Six years ago the army quietly bought
twenty Predator type UAVs (called Sky Warrior Alpha) from the same firm that manufactures the Predator and Gray Eagle.
These were in Iraq for over two years, mainly for counter-IED work with Task Force Odin. The one ton Sky Warrior Alpha
can carry 204.5 kg (450 pounds) of sensors and 134.5 kg (300 pounds) of weapons, and a few of them have fired Hellfire
missiles. Sky Warrior Alpha is, officially, the I-Gnat ER, which is based on a predecessor design of the Predator, the Gnat-
750, and an improved model, the I-Gnat (which has been in use since 1989). The I-Gnat ER/ Sky Warrior Alpha looks like a
Predator but isn't. In terms of design and capabilities, they are cousins.
As its model number (MQ-1C) indicates, this UAV is a Predator (MQ-1) replacement. The U.S. Air Force had
planned to replace its MQ-1s with MQ-1Cs but later decided to buy only larger Reapers. The MQ-1C was developed by the
Army. The third member of the Predator family is the MQ-9 Reaper. This is a 4.7 ton, 11 meter (36 foot) long aircraft with a
20 meter (66 foot) wingspan that looks like the MQ-1. It has six hard points and can carry about a ton (2,400 pounds) of
weapons. These include Hellfire missiles (up to eight), two Sidewinder or two AMRAAM air-to-air missiles, two Maverick
missiles, or two 227 kg (500) pound smart bombs (laser or GPS guided). Max speed is 400 kilometers an hour, and max
endurance is 15 hours. The Reaper is considered a combat aircraft, to replace F-16s or A-10s in ground support missions.
http://www.strategypage.com/htmw/htairfo/articles/20120701.aspx
25
f

OSINT Nuggets
Page 13 of 25
Punch, Counterpunch
f 25
The Cyber Punch: June 19, 2012, U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say.
The United States and Israel jointly developed a sophisticated computer virus nicknamed Flame that collected intelligence in
preparation for cyber-sabotage aimed at slowing Iran’s ability to develop a nuclear weapon, according to Western officials
with knowledge of the effort.
The Global Cyber Counterpunch: June 11, 2012, India to greenlight state-sponsored cyber attacks. The Indian
government is stepping up its cyber security capabilities with plans to protect critical national infrastructure from a Stuxnetlike
attack and to authorise two agencies to carry out state-sponsored attacks if necessary.
Sources told the Times of India that the government’s National Security Council, headed by prime minister
Manmohan Singh, is currently finalising plans which would give the Defence Intelligence Agency (DIA) and National
Technical Research Organisation (NTRO) the power to carry out unspecified offensive operations.
India is also hoping to co-ordinate its defensive capabilities better, in the event of an attack which could debilitate its
critical infrastructure.
The country was reportedly hit by Stuxnet, although it doesn’t appear to have caused any serious damage and was
unlikely to have been a deliberately targeted attack.
With this in mind, the NTRO is likely to be called on to create a 24-hour National Critical Information Infrastructure
Protection Centre (NCIPC) to monitor threats, while sector-specific Computer Emergency Response Teams (CERTs) will
also be recommended, the report said.
The NTRO and Intelligence Bureau (IB) will be given responsibility for the security of various government networks,
it added.
The Indian government is some way behind the US and UK in its formulation of a coherent national cyber security
policy, and has been criticised in the past for its slow response to denial of service and web defacement attacks.
Most recently it has been under fire from hacktivist collective Anonymous in retaliation for its stance on illegal file
sharing, while hackers from neighbouring rival Pakistan are thought to represent a constant threat.
Last month Symantec warned that the lack of security know-how among the country's growing urban population and
small and medium sized businesses is being exploited with increasing ruthlessness by criminals.
Comment/Analysis: Expect for more countries to follow India’s example with tacit government approval. The realization
should be that other countries are beginning to see the U.S. as a cyber cowboy that gives them the right to act in the same
fashion. Too much has already been made public about U.S. cyber capabilities and is sure to make other countries
suspicious about the U.S.. One has to consider, based on previous reporting, that our critical infrastructure is vulnerable to
attack.
Steganograhy
Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and
intended recipient, suspects the existence of the message. The idea is to hide information inside information.
Jul 21, 2012, Every picture tells a (secret) story. The image is simple: a photograph of a fierce tiger leaping across a field of
clean snow.
But there is more. What you don't see is the two embedded images - a wide-eyed kitten and a handwritten
message.
They are deeply embedded in the digital information of the photograph, hidden in such a way that they only slightly,
almost imperceptibly alter the photo's appearance. But to a viewer armed with the message's unique algorithm decoder,
they are simple to unpick.
Using a new technique developed by a Dubai researcher, hiding those images may have just become easier to do,
and more difficult to detect if intercepted. Steganography, a data-hiding method that aims to ensure that only the message's

OSINT Nuggets
Page 14 of 25
sender and receiver know there is secret content, has typically used an approach that manipulates the image's pixels or
data.
25
Chief among the field's uses is the desire of those involved in covert intelligence work to transmit messages without
being snooped upon by others. Beyond that, it has potential for use in digital "watermarking" - embedding copyright
information in an image in a way that's hard to spot, and therefore hard for a potential plagiariser to remove, but that the
original owner can hold up as evidence that the image is theirs.
Now a pioneering new method by Dr Tamer Rabie, a computer science professor at the Canadian University of
Dubai, claims to embed more information that is harder to spot and is less susceptible to tampering.
"The idea is, if the tiger image is intercepted, they shouldn't notice a change or notice anything odd about this
ordinary-looking photograph," Dr Rabie said.
"Then the hidden messages need to be recovered without too much degradation."
Dr Rabie revealed his algorithm, which effectively scatters the hidden image three times across all the pixels of the
"host" image, at a conference in Dubai in April.
This threefold scattering, he says, makes the hidden image secure enough that it can be sent with confidence
across an insecure network.
Starting with a standard JPEG - the most common type of image on the internet - the method first identifies the part
of the image that will be least affected visually by the addition of the secret data.
"You hide information in the insignificant parts of the image," said Dr Rabie. "It could be anything - another image,
sound. You could do it on a small laptop. Anybody could do it."
The method uses fast fourier transform (FFT) to break pictures down into their constituent elements of frequency,
magnitude and phase. The phase part describes how the objects in the picture are positioned in relation to each other, a
valuable component of the way eyes perceive images.
Tampering with that would be easily seen in the picture. So in inserting the secret image, it is left unaltered. But the
magnitude can be modified with barely any effect on the overall appearance of a picture. And the magnitude element can be
further broken down into two parts - colour and brightness - allowing two images to be hidden within a single picture.
Of those, we are more sensitive to changes in brightness than colour, making messages hidden in the colour
channel much harder to spot.
In his paper, Dr Rabie notes that FFT "promises high fidelity, double the capacity of previous methods, higher
security and robustness to tampering".
Older "stego" techniques allowed images to be hidden within only about 12 per cent of the area of the "host" image.
The FFT method increases that to as much as half the area. And it is more robust, with images retaining their secrets under
heavier manipulation than previous methods. With the new method, up to 60 per cent of the information in the "host" image
can be destroyed before the hidden message becomes unreadable.
Even with extreme tampering on the image, including repainting and rotating the image 90 degrees, the hidden
message remains intact.
This is because the secret information is embedded - not in individual pixels - but spread across all of them. And the
algorithm makes hiding a picture easy.
Dr Rabie says he has taught students how to unlock a hidden messages in just one lecture There are, however,
concerns about the technique's practical use.
"The paper does not study what is called 'steganographic security', which is a serious drawback," said Jessica
Fridrich, a professor at the State University of New York at Binghamton and author of Steganography in Digital Media.
"It belongs to a category that I call 'data stuffing' - hide as much as you can so that the visual quality does not
degrade ... I can apply computer algorithms and prove beyond doubt that there is a hidden message in the image."
If that is the case, she says, anyone looking for a hidden message within a picture could do the same. And knowing
a hidden image is there is a good step towards working out what it is. Dr Rabie admits his work does not address the
additional security needed to ensure a computer algorithm could not pick up on hidden messages.
"Full steganography means the information also has to be very secure, but my research is a new idea for
information hiding," he said.
"If someone wanted to use it, they would have to add an extra layer of security to make it more secure, but that's not
part of my research."
But he says the possibilities for further steganography research using the FFT approach are far from exhausted. It
could be applied to other types of media - audio and video, for example. http://www.thenational.ae/news/uae-news/everypicture-tells-a-secret-story#full
Comment/Analysis: In 2010 there were approximately 294 billion emails sent per day, and it is estimated there are
somewhere between 500 billion to 1 trillion photos from all sources on the internet. I have no idea if these figures are
f

OSINT Nuggets
Page 15 of 25
accurate as there is really no way to come up with a precise number. Trying to determine which have secret information
embedded in them is not an easy task. I suspect the advantage would have to go to the criminal.
f 25
OSINT
June 28, 2012, Covering your digital footprints. Scanning the Internet for open source intelligence can leave a trail back to
U.S. government networks. Cybersecurity expert Andrea L. Hlosek explains the risks of OSINT and how analysts can cover
their tracks.
The average citizen's Internet activity is easily tracked, information that in the hands of tech-savvy marketers may
be helpful or merely annoying. But in the hands of cyber adversaries, it's downright dangerous.
The Internet delivers so much information to our fingertips that it's no surprise the “Google it” phenomenon has
expanded to our professional lives. Government employees, particularly in the fields of intelligence, law enforcement,
national security and defense, make highly effective use of the Internet as a research tool, but more emphasis needs to be
placed on ensuring cyber adversaries can't follow someone's online and open source searches back to sensitive
government networks.
Even the U.S. intelligence community may not be doing a good enough job in helping Web-surfing analysts hide
their open source research, and some government agencies don't attempt to hide their research tracks at all.
A perfect storm of conditions has brought this danger to the forefront: Overstretched intelligence collection
resources have spurred the growth of open source intelligence, or OSINT, now referred to as the “source of first resort”; the
digital information explosion has made open source research highly lucrative; the high operations tempo of intelligence
analysts has cut severely into training time and tradecraft development; and cyber adversaries have grown tremendously in
sophistication.
For intelligence analysts competing for scarce traditional collection resources, the growth of the Internet provides
ample new digital information that can help meet information requirements. A recent Cisco Visual Networking Index found
that about one-quarter of all Internet traffic consists of published reports, documents, website content, comments and other
postings on accessible Web pages, including social networking sites. The law enforcement community also benefits from
open source research, particularly publicly shared information on social networking sites.
The danger is that not everyone is adequately informed of the threats such Internet activity can pose. While
professional intelligence analysts (those conducting first-level analysis) are usually well-trained with strict oversight and
control of their research methods, all-source, fusion or “ops intel” analysts at the unit level frequently don't have the same
access to training or emphasis on open source tradecraft. They often use open source research to plug intelligence gaps in
support of operational planning or assessment, and sometimes even operational staff planners are tempted to Google their
way through intelligence gaps when intel support lags.
Internet users must understand that unprotected open source research, conducted from attributable network
domains (those that reveal the type of organization you are affiliated with, for example a .gov or .mil network), invites
operational and cybersecurity risks. Today's cyber-savvy adversaries can easily determine that they are the subjects of
online research from government Internet proxies. Not only does this create an operations security threat, tipping off
operational focus areas, but it opens the door for malicious actors to adopt cyber countermeasures or mount exploitation
campaigns against government networks to gain access to unclassified sensitive information.
Widely deployed network defense tools such as anti-virus software and firewalls protect networks from incoming
threats, but they do nothing to mask an organization's IP address when users venture onto the Internet. Government users
(particularly OSINT novices) operating on the Internet in an unprotected manner leave a trail that can lead cyber
adversaries back to high-payoff, data-rich government networks.
One of the best ways to mitigate this vulnerability is to use non-attributable Internet connections, a solution many
workers in the intelligence community have used for years. However, existing non-attribution measures may not stand up
well to sophisticated cyber adversaries, and they need to be upgraded or modified to meet current cybersecurity needs.
Non-attributable access allows government users to conduct open source research and Internet operations in an
environment where their government affiliation is obscured. There are many reasons why government personnel should not
reveal their analytic interest in particular topics and subjects on the Internet. The cover of anonymity is essential for
intelligence analysts conducting open source foreign intelligence, or homeland security and law enforcement officials
investigating hacking activity or monitoring an extremist Web forum.

OSINT Nuggets
Page 16 of 25
Non-attributable networks are critical to conducting cyber reconnaissance of adversary networks or tracking
criminals via their social media posts. Analysts supporting diplomatic or information operation missions may need quick and
25
reliable access to foreign websites when developing sociocultural understanding in support of strategic communication,
humanitarian or crisis operations.
Beyond national security, organizations such as the Department of Agriculture may need to research foreign crop or
livestock conditions, trade markets, etc., but their users don't know they might be stumbling onto malicious websites or can
be tracked by foreign intelligence services through their own digital footprint.
Not only can visited websites be a source of malware, but browsing activity alone reveals sensitive information — a
digital footprint — about your computer and network, particularly if the research activity is persistent or repetitive. Every time
a user visits an Internet site, their Internet Protocol (IP) address is recorded in that site's Web server log. Basic analysis of
such logs enables administrators to establish cyber personas of their frequent visitors.
In addition to your IP address, US-CERT, in its “How Anonymous Are You?” security guide, explains that the
following specific information is revealed every time you visit a website:
• Date and time of visit.
• Domain name, such as .mil or .gov
• Software details, including which browser and operating systems you use.
• Pages visited.
“If a website uses cookies, the organization may be able to collect even more information, such as your browsing
patterns, which include other sites you've visited,” US-CERT notes.
When aggregated, organizational users who reside on common network IP addresses, with a characteristic network
configuration and similar data handling practices, leave a highly targetable digital footprint for adversaries to pursue.
Once a cyber-savvy adversary is tipped off to “suspicious” monitoring of their websites, a little further cyber
exploitation of suspect IP addresses can reveal even more computer and network details that contribute to the cyber profile
of a government user. Once adversaries identify a suspicious “footprint,” a quick search of the IT systems and suites
purchased, installed or maintained by U.S. government organizations completes the puzzle, and a particular IP address is
tagged as government or law enforcement affiliated.
Think this is hard? Check out the “Careers & Employment” sections on corporate websites of vendors who provide
IT support to your organization. High turnover in the IT field means frequent job advertising, and those employment ads list
required skills specific to IT products and services affiliated with your organization's networks — valuable details used in
compiling a digital footprint.
Adversary Countermeasures
Once a digital footprint is established, critical information about your organization's mission sets and operational
focus is revealed through the analysis of visited websites, and analysts can become victims of cyber countermeasures.
At a minimum, research subjects alerted to government interest can block access to their websites from incoming
.gov or .mil addresses, or they can move or take down their site altogether. Going a step further, adversaries can spoof
government research efforts by re-directing “suspicious” IP addresses to fake websites that provide minimal or even false
information. Worst case: Cyber adversaries introduce malware on the spoofed website, ensuring that unwanted visitors
download malicious code upon accessing the page. The malware might be spyware that facilitates further reconnaissance,
or worse, delivers malicious code that exploits unpatched vulnerabilities in network systems.
The government user's network now becomes a target for intelligence collection and social engineering. This can
take the form of well-crafted spear phishing campaigns, using reference terms from your own browsing history to gain your
trust and penetrate your network.
Protection Shortfalls
So what has traditionally been done to protect government networks from dangerous Internet practices? The
simplest measure involves local base network administrators blocking access to foreign or other “dangerous” websites;
government users get an “Error: your firewall blocked access” message when trying to browse certain sites. While this is a
sound network defense measure, it can severely impair research efforts.
More often, one or two government computer terminals are connected directly to a commercial Internet service
provider. Users are then allowed access to the Internet through a virtual local area network on the government domain.
These open access terminals tend to be located in common areas or near the IT Help Desk, sometimes a considerable
distance from analyst workspaces, making them rather inconvenient to use. Depending on the configuration of the VLAN,
performance and connection reliability may also be affected, hampering research efforts.
Furthermore, the associated IT equipment and network configurations in use usually conform to government
standards because the ISP-connected computers come from regular IT stock and therefore match the profiles of known
“government” boxes.
f

OSINT Nuggets
Page 17 of 25
Finally, the commercial Internet connection in use resolves to a single IP address in a particular city. A cyber
adversary who sees an IP address whose computer and network details match established government profiles simply
Googles known government facilities and organizations hosted within that geographic area, and develops a list of possible
matches.
f 25
More robust legacy non-attribution measures were implemented by the IC to “anonymize” Internet activity through
the use of proxy or anonymizing servers or virtual private networks. In the case of anonymous network proxy servers or
software, several limitations exist: The proxy can be slow in loading desired information, browser add-ons can still be used
to reveal the source IP address, and websites being researched can choose to block access from users browsing via
anonymous proxy servers.
Furthermore, if anonymizing services make use of U.S.-based servers for their connection, users still divulge a U.S.centric
digital footprint — problematic when researching foreign websites. VPNs also reveal information about the user's
cyber profile, namely the browser, the operating system and the language-related character set in use, all of which can
reveal a U.S.-centric cyber presence.
Other more exotic solutions such as Tor, which combines encryption and multiple proxy server hops, may
unknowingly compromise users by routing them through rogue exit nodes. These nodes are hosted by adversaries who act
as members of the Tor network, all the while intercepting and logging your Web traffic.
A final consideration is: “How do I want my cyber profile to appear on the Web?” Yes, a user may appear
“anonymous,” but guess who else uses anonymization measures: cyber criminals, traffickers and child pornographers. The
effort to achieve anonymity can itself draw unwanted attention to online activities — users begin to look suspicious in their
effort to “not look suspicious.”
Today's cyber adversaries are complex and sophisticated professionals with access to funds and resources. They
freelance and rent their services and tools to international criminal networks, foreign intelligence services and extremist
groups, and understand anonymization far better than users do.
Users need to find different and more effective non-attributable Internet solutions that are also agile enough to keep
up with evolving cyber threats. Contrary to most current approaches, the goal of today's open source researchers shouldn't
be an anonymous profile but rather an inconspicuous one.
Effective non-attribution can be achieved when Internet users apply a multipronged approach that helps them to
inconspicuously blend in to, rather than try to hide in, the World Wide Web. Any government agency that has a need for
open source Internet research should implement a secure and comprehensive non-attribution program to minimize cyber
vulnerabilities and maximize open source research opportunities.
http://www.defensenews.com/article/20120628/C4ISR02/306280008/Covering-your-digital-footprints?odyssey=nav|head
Comment/Analysis: What really surprises me is that no matter how many times analysts are warned about leaving digital
footprints, it just doesn’t seem to sink in. This article will be read by many analysts, but by the time they read the last line it is
business as usual. There are many branches of government that make it quite simple to get non attributable access to
conduct safe searches. I have met analysts who try to mask their searches to try and mislead, however, the vast majority
are not trained in the unique tradecraft.
Naval War College Review, Spring 2012, Vol. 65, No. 2, TAKING MINES SERIOUSLY. Mine Warfare in China’s Near Seas.
We have recently completed a two-year-long study of over 1,000 Chinese language articles concerning naval mine warfare.
Our three most important findings are: (1) China has a large inventory of naval mines, many of which are obsolete but still
deadly, and somewhat more limited numbers of sophisticated modern mines, some of which are optimized to destroy
enemy submarines. (2) We think that China would rely heavily on offensive mining in any Taiwan scenario. (3) If China were
able to employ these mines (and we think that they could), it would greatly hinder operations, for an extended time, in
waters where the mines were thought to have been laid. The obvious means of employing mines are through submarines
and surface ships. Use of civilian assets should not be discounted. But we also see signs of Chinese recognition of the fact
that aircraft offer the best means of quickly laying mines in significant quantity. These aircraft would be useless, however,
without air superiority. http://www.usnwc.edu/getattachment/19669a3b-6795-406c-8924-106d7a5adb93/Taking-Mines-
Seriously--Mine-Warfare-in-China-s-Ne
Comment/Analysis: I include the Military Intelligence publication and Naval War College Review under OSINT because of
the examples given in using open source information. A two-year review of over 1,000 Chinese articles is a good example of
bringing together information to give a clear picture of capabilities and intentions of an adversary. This also complements
my comments in the July issue of applying asymmetric warfare to a superior force. Chinese mine warfare in conjunction with
fast-attack boat strategy gives China a tremendous defensive capability against ships operating close to the mainland.

OSINT Nuggets
The Criminal Mind in Motion
Page 18 of 25
July 9, 2012, Cops bust man with cocaine-saturated clothes. Dubai Police foiled a bid to smuggle clothes saturated with
cocaine, announced anti-narcotics sources on Sunday.
An Arab businessman identified as MA, 28, with a university education qualification, was intercepted carrying the
illegal items on his way from Sao Paulo in Brazil to Damascus via Dubai International Airport.
Major General Abdul Jalil Mahdi Mohammed Director General of the Drug Enforcement Department of Dubai police
said the antinarcotics airport section managed to foil the smuggling bid while he was heading to the departure gate.
The police had received a tip that MA possessed narcotic drugs. He arrived on June 1. As he was preparing to
depart — believing that he had succeeded — an officer stopped him.
He had two bags on the baggage handling conveyer belt and a small one in his hand. The officer ordered him to
unzip his bags to examine the contents.
They turned out to be containing only clothing supposedly belonging to him. However, the persistent smell of
cocaine emanating from them drew suspicion.
He was referred to the anti-narcotics department where the bags were proved to weigh 56.750kg.
Upon questioning, he confessed that it was a consignment he received from a compatriot, HZ, who promised to
reward him with $5,000. MA was heading to see a person in Damascus who was supposed to meet him at the airport.
However, the police did not disclose the amount of cocaine the clothes were saturated with.
http://www.emirates247.com/news/emirates/cops-bust-man-with-cocaine-saturated-clothes-2012-07-09-1.466412
Comment/Analysis: What next? Entire clothing made out of marijuana. Don’t laugh, take a peek at
this web sites. While hemp will not get you stoned as marijuana does, the day is sure to come when
someone is stopped for wearing shoes made out of marijuana.
http://www.nepalartshop.com/hemphats/9.php
http://shareholidayinfo.wordpress.com/category/vietnam/
Hat description: Made out of green Cannabis (Hemp) plant. Cannabis Sativa one of the most useful
species, grows naturally Nepal’s Himalayan climate. Nepal’s Cannabis Sativa is famous among marijuana users worldwide
for its natural high and unique flavor.
Russia
June 26, 2012, The Bear at the Door. Russian strategic nuclear bombers threatened U.S. airspace near Alaska earlier this
month and F-15 jets responded by intercepting the aircraft taking part in large-scale arctic war games, according to defense
officials.
The Russian war games began the same day President Obama and Russian President Vladimir Putin held a frosty
summit meeting in Mexico June 18.
U.S. officials said the arctic exercises over the Russian Far East and Pacific appeared to be a further sign of
Russia’s hardening posture toward the United States.
The Obama administration made no protest of the bomber intrusions, according to the officials, in line with its
conciliatory “reset” policy of seeking warmer ties with Moscow.
About 30 strategic nuclear bombers and support aircraft took part in the war games that continued through June 25.
The aircraft included Tu-95MS Bear H and Tu-160 Blackjack nuclear-capable bombers, along with Il-76 refueling tankers, A-
50 airborne warning and control aircraft, and Su-27 and MiG-31 jet fighters. Some 200 troops also took part in the Russian
Strategic Aviation forces exercise.
A spokesman for the joint U.S. Northern Command and North American Aerospace Defense command in Colorado
Springs, which monitors air defense intrusions, had no immediate comment. A Pentagon spokesman declined to comment.
25
f

OSINT Nuggets
Page 19 of 25
U.S. and Canadian F-15 and F-16 jets were involved in the intercepts that took place near the Air Identification
Zone surrounding Alaskan airspace over the northern Pacific.
The exercises are part of increasingly aggressive Russian military activities in the arctic region in both the eastern
f 25
and western hemispheres, which have created security worries among governments in northern Europe and Canada.
One official said the failure to publicize the threatening bomber maneuvers might have been related to Obama’s
overheard promise in March to Russian President Dmitri Medvedev of “more flexibility.”
According to the defense officials, the arctic bomber exercises are part of Russian efforts to assert control over vast
areas of the arctic circle that are said to contain large mineral and oil deposits.
Retired Air Force Lt. Gen. Thomas McInerney, a former Alaska North American Aerospace Defense commander,
said the Russian exercises should be a concern.
“The Russians continue to exercise our air defense identification zone, which shows Mr. Putin loves to let President
Obama know that they still have global capability,” McInerney said in an interview. “So much for reset.”
McInerney also said the Obama administration kept the encounter between the bombers and U.S. fighters secret
because “they obviously don’t want the world to know that the exercise was done deliberately to coincide with the Obama-
Putin summit.”
Obama and Putin met in Los Cabos, Mexico June 18 in what aides described later as a “businesslike” encounter.
The two leaders, however, were shown in video and photos as unsmiling and displaying a cool demeanor toward each
other.
Russia’s government and military have threatened preemptive military attacks on future U.S. missile defense sites
in Europe as part of a Russian propaganda campaign against those defenses. Moscow views U.S. and NATO missile
defenses as threatening its strategic missiles.
Defense officials said Russian bomber exercises highlight Moscow’s targeting of the U.S. missile defense base at
Fort Greely, Alaska, one of two major ground-based interceptor bases that are part of a limited integrated missile defense
system against North Korean and possibly future Chinese or Russian missiles.
Additionally, the bomber exercises raised concerns that Russia was simulating cruise missile strikes aimed at
disrupting U.S. oil pipelines in Alaska. Currently, the state’s Trans-Alaska pipeline delivers more than 11 percent of U.S. oil.
The Russian bombers involved in the exercises are equipped with long-range precision-guided cruise missiles,
including nuclear and conventional missiles.
A similar bomber exercise in 2007 involved Bear H and Blackjack bombers that conducted simulated cruise missile
attacks on the United States. Those bombers operated from strategic bomber bases at Anadyr, Vorkuta, and Tiksi.
Military reference books state that Bear H bombers are deployed with six Kh-55 or Kh-55SM cruise missiles that
can hit targets up to 1,800 miles away with either a high-explosive warhead or a 200-kiloton nuclear warhead.
Russian Air Force Lt. Col. Vladimir Deryabin, a Defense Ministry spokesman, told Russian state-controlled news
agencies that the main purpose of the war games was to provide practice for strategic, fighter, and special aviation aircrews.
The first phase involved the dispersal of aviation groups to air bases in the northern and eastern region. A second phase
deployed aircraft that flew in groups with fighter cover, he said.
Deryabin said that the mission of the exercise was to “practice destruction of enemy air defenses and strategic
facilities,” according to a June 25 dispatch by the Russian news agency Interfax.
State Department documents made public by Wikileaks have revealed that Russian offensive military exercises in
the arctic during the past several years have been aimed at Moscow’s efforts to “emerge as the dominant arctic power by
default.”
Such exercises have alarmed Norway’s government since many of the exercises took place near Norway’s coast.
International discussions on Russian military exercises in the arctic have been highlighted by Moscow’s failure to
provide pre-flight notification of bomber exercise flights.
It could not be learned if the Russians notified the United States of the recent bomber exercises near Alaska.
Canada has complained that earlier Russian bomber flights were conducted without Russia notifying the Canadian
government.
A classified 2009 cable from the U.S. Embassy Moscow said Russia in May 2009 outlined its policy toward the
arctic for 2020 and beyond, and said Moscow adopted a “cold peace” policy against Europe and the United States. It stated
that the region will be used for strategic resources and that Moscow is seeking to claim exclusive control over an emerging
northern sea route passage.
“The Arctic region, both within Russia’s legally clarified borders and in areas beyond, likely holds vast untapped
resources of oil and gas,” the cable states. “While many Russian analysts are skeptical that any of these resources will be
economically exploitable in the near future, the Russian leadership wants to secure sovereignty over these ‘strategic’
resources.”

OSINT Nuggets
Page 20 of 25
As part of the arctic military expansion, Russia announced May 30 it was re-opening arctic air bases that had been
closed after the Soviet Union collapsed in 1991.
25
Russian officials have said the strategic air bases will be used for arctic operations and include airfields in the far
north at Naryan-Mar, on Novaya Zemlya, and Franz Josef Land.
Naryan-Mar is a mainland strategic air base and Novaya Zemlya and Franz Josef Land
are islands.
Additionally, Russia has announced it is setting up an 8,000-troop Arctic Brigade that
will be deployed on the Kola Peninsula, near Finland and Norway.
In 2010, Adm. James A. Winnefeld, then-commander of the Colorado-based U.S.
North Command, said in an interview that Russia has continued to fly its strategic nuclear
bombers near U.S. airspace as part of Moscow’s efforts to maintain what he termed the illusion
of power.
“In some cases, this is about the illusion of power, where power is not quite there,”
Winnefeld said from the Colorado Springs-based command known as Northcom. “They are
trying to show the world that they are a powerful nation, and we’re not giving them the
satisfaction.” http://freebeacon.com/the-bear-at-the-door/
July 6, 2012, Russian Nuclear-Capable Bombers Intercepted Near West Coast in Second U.S. Air Defense Zone Intrusion
in Two Weeks.
Two Russian strategic nuclear bombers entered the U.S. air defense zone near the Pacific coast on Wednesday
and were met by U.S. interceptor jets, defense officials told the Free Beacon.
It was the second time Moscow dispatched nuclear-capable bombers into the 200-mile zone surrounding U.S.
territory in the past two weeks.
An earlier intrusion by two Tu-95 Bear H bombers took place near Alaska as part of arctic war games that a
Russian military spokesman said included simulated attacks on “enemy” air defenses and strategic facilities.
A defense official said the Pacific coast intrusion came close to the U.S. coast but did not enter the 12-mile area
that the U.S. military considers sovereign airspace.
The bomber flights near the Pacific and earlier flights near Alaska appear to be signs Moscow is practicing the
targeting of its long-range air-launched cruise missiles on two strategic missile defense sites, one at Fort Greely, Alaska and
a second site at Vandenberg Air Force Base, Calif.
In May, Russian Gen. Nikolai Makarov, the chief of the Russian General Staff, said during a Moscow conference
that because missile defense systems are destabilizing, “A decision on pre-emptive use of the attack weapons available will
be made when the situation worsens.” The comments highlighted Russian opposition to planned deployments of U.S.
missile defense interceptors and sensors in Europe.
The U.S. defense official called the latest Bear H incident near the U.S. West Coast “Putin’s Fourth of July Bear
greeting to Obama.”
Retired Air Force Lt. Gen. Thomas McInerney, a former Alaska commander for the North American Aerospace
Defense Command, said the latest Bear H intrusion appears to be Russian military testing.
“It’s becoming very obvious that Putin is testing Obama and his national security team,” McInerney told the Free
Beacon. “These long-range aviation excursions are duplicating exercises I experienced during the height of the Cold War
when I command the Alaska NORAD region.
McInerney said the Bear H flights are an effort by the Russians to challenge U.S. resolve, something he noted is
“somewhat surprising as Obama is about to make a unilateral reduction of our nuclear forces as well as major reductions in
our air defense forces.”
“Actions by Russia in Syria and Iran demonstrate that Cold War strategy may be resurrected,” he said.
“These are not good indications of future U.S. Russian relations.”
Pentagon spokesman Capt. John Kirby said the incident occurred July 4. He said the “out-of-area patrol by two
Russian long range bombers … entered the outer [Air Defense Identification Zone]” and the bombers “were visually
identified by NORAD fighters.”
Kirby said the bombers did not enter “sovereign airspace.” He declined to identify the specific distance the aircraft
flew from the United States due to operational security concerns. He also declined to identify the types of aircraft used to
intercept the bombers.
In last month’s intercept of two Russian Tu-95 bombers, U.S. F-15s and Canadian CF-18s were used. The most
likely aircraft used in Wednesday’s intercept were U.S. F-15 jets based at Elmendorf Air Force Base, Alaska.
Kirby and U.S. Northern Command spokesmen, apparently in line with the Obama administration’s conciliatory reset policy
toward Russia, sought to play down both bomber intrusions.
f

OSINT Nuggets
Page 21 of 25
The Pentagon spokesman said the latest Pacific intrusion was “assessed as another training activity.”
Rather than using traditional military terminology common during the Cold War to describe the meeting of the
violating bombers as an “intercept,” Kirby said that the bombers were “visually identified” by jets described only as joint
f 25
U.S.-Canadian North American Aerospace Defense Command (NORAD) jets.
“NORAD is postured to ensure air warning and control for the continental United States, Canada, and Alaska,” Kirby
said. “NORAD maintains an extensive radar system around North America and has aircraft located throughout the United
States and Canada that can respond quickly to any unidentified flights approaching the Air Defense Identification Zone
(ADIZ).”
Kirby said the ADIZ extends about 200 miles from the coast and is “mainly within international airspace.”
“The outer limits of the ADIZ goes well beyond U.S. sovereign air space which only extends 12 nautical miles from
land,” he said. “As part of its mission, NORAD tracks and identifies all aircraft flying in the ADIZ in advance of any aircraft
entering sovereign airspace.”
The Free Beacon reported June 28 that two Bear H’s intruded into the Alaska ADIZ during war games that ended
June 27.
A Northern Command spokesman later disputed the Free Beacon’s assertion that the bombers violated U.S.
airspace and said the air defense zone is not the same as sovereign airspace since it includes international airspace.
However, the ADIZ is defined by the military as a nation’s declared area within which “the ready identification, the
location, and the control of aircraft are required in the interest of national security.”
Canadian Navy Lt. Al Blondin also said in an email that the Russian bombers during the air defense intrusion last
month did not violate U.S. airspace.
“NORAD will track and identify all aircraft flying in the ADIZ prior to those aircraft entering sovereign airspace,”
Blondin said.
“It is important to note the Russian flights followed international flight rules and conducted their flight in a
professional manner,” Blondin said. “As is their right, the Russian Air Force continues to fly in international airspace.”
Earlier, in response to questions about the Alaska Bear H intrusion, Marine Corps Col. Frank H. Simonds, Jr.,
deputy chief of staff for NORAD-U.S. Northcom, also defended the Russian bomber intrusion as nonthreatening.
“NORAD does not consider these flights a threat,” Simonds said, noting “Russia and NORAD routinely exercise
their capability to operate in the North.”
Simonds identified the Alaska defense zone intruders as Tu-95MS bombers that were met by U.S. F-15s and
Canadian CF-18s.
“Interaction between NORAD fighters with these types of aircraft are carried out routinely,” Simonds said. “As part of
its responsibilities to identify all aircraft in its area of operation, which includes the ADIZ, NORAD has visually identified
more than 50 Russian long range bomber aircraft over the last 5 years and NORAD fighters have been interacting with
Russian aviation for over 50 years.”
Simonds said NORAD and Russian aircraft since 2010 take part in an exercise called Vigilant Eagle aimed at
building cooperation on identifying and intercepting hijacked aircraft that cross international boundaries.
Last week, Rep. Michael R. Turner (R., Ohio), chairman of the House Armed Services Strategic Forces
Subcommittee, said the Bear H intrusions near Alaska showed Russia’s response to the administration’s reset policy. He
said air incursions, along with threats to attack U.S. missile defense sites preemptively, were signs of Putin’s aggression in
the face of President Obama’s promised flexibility in talks with Moscow.
The Alaska bomber flights coincided with a summit between Obama and Putin in Mexico June 18.
According to U.S. officials, some 30 bombers and support aircraft took part in the war games, including the Bear Hs
and Tu-160 Blackjack bombers.
Russian Air Force spokesman Lt. Col. Vladimir Deryabin, told reporters in Moscow last month that the arctic
strategic war games “practice destruction of enemy air defenses and strategic facilities.” http://freebeacon.com/putins-july-
4th-message/
Comment/Analysis: It is a known fact that during the Cold War, the U.S. would conduct flights as close as possible to the
Soviet Union borders to see how the Soviets would react and what equipment, mostly air defenses, would come on line
which was a great opportunity to conduct SIGINT operations. Assume that the Russians are now doing the same. In my
opinion the U.S. still has and will have for a long time the best electronic order of battle in the world. There is no system that
can possibly be turned on that we don’t have a database on. The signal will identify the type of equipment along with its
capabilities and vulnerabilities.

China/Russia
OSINT Nuggets
Page 22 of 25
Jul 6, 2012, U.S. Courts Uzbekistan as Afghan Drawdown Nears.
The bloodiest massacre of protesters since Tiananmen Square turned Uzbekistan into a pariah state. Now, the
United States needs its help over Afghanistan — and has launched a flurry of overtures while putting aside concerns over
human rights.
Top U.S. officials, including Secretary of State Hillary Clinton, have paid courtesy calls over the past year, while
General Motors and other major U.S. companies look determined to deepen their involvement in the Central Asian nation.
Meanwhile, Uzbekistan has withdrawn from a Russian-led military alliance, signaling a downturn in its relations with
the former overlords in Moscow. This has fed speculation that the nation, hoping to benefit from the transit of U.S. troops
and hardware, could invite the United States to set up a military base on its soil — a development that would infuriate
Russia and raise tensions in the volatile region.
Uzbekistan has been run with unflinching severity by 74-year-old former Soviet party boss Islam Karimov since
before the country gained independence in 1991.
After the 9/11 terrorist attacks, Western leaders overcame their scruples in dealing with Karimov’s government and
the United States secured a lease for the Karshi-Khanabad air base in Uzbekistan.
That all ended when government troops indiscriminately gunned down hundreds of protesters in the eastern city of
Andijan in 2005.
Uzbek authorities expelled U.S. troops from the country in anger over Washington’s criticism and accused Western
powers of complicity in the Andijan protests, which they said formed part of efforts to foment revolutions across the former
Soviet Union. Uzbekistan has also been the subject of persistent allegations of torture of political prisoners and other human
rights abuses.
With access to the country barred to almost all foreign reporters, verifying claims by some State Department officials
that the rights situation has improved marginally is virtually impossible.
When NATO convoys through Pakistan began coming under sustained militant attack in 2009, U.S. military
planners looked north and saw the makings of a route snaking thousands of miles through Central Asia and perennial
strategic foe Russia.
Trucks carrying NATO goods are rolling across Pakistan’s border into Afghanistan again this week after the U.S.
apologized to Pakistan for the deaths of 24 Pakistani troops last fall. But despite the additional expense, the safety of the
northern route makes it a more attractive option.
Until now, the traffic through Uzbekistan has mainly gone in the direction of Afghanistan, but the priority in coming
years will be shifted to reverse transit along the Northern Distribution Network.
The most reliable route starts on a recently completed railroad that crosses the Amu-Darya River, which marks
Uzbekistan’s 82-mile border with Afghanistan, and provides the speediest and simplest transportation northward.
In an apparent effort to soothe concerns that the United States will abandon Central Asian as soon as its
engagements in Afghanistan are wound down, investments enthusiastically backed by Washington are trickling in.
General Motors stepped up its local presence in November by opening a new engine plant. The GM Uzbekistan
joint venture, in which the U.S. company controls a 25 percent stake, provides work for around 6,600 people and turns out
200,000 Chevrolet passenger vehicles annually.
In June, U.S. engineering giant KBR said it will provide its technology to develop a chemical plant in Uzbekistan that
will seek to better exploit the country’s substantial natural gas reserves.
Still, U.S. officials hope to build on those types of achievements and a large congressional delegation is due soon
for another round of diplomatic cordiality aimed at cementing business ties.
There are also increasing hints that the U.S. will intensify military ties with Uzbekistan. That development would
dismay the advocacy community, which has for years been drawing attention to the country’s egregious rights record.
The U.S. in January waived a ban on providing military assistance to Uzbekistan, although the State Department
insisted it would only be eligible to receive non-lethal equipment, including night vision goggles, uniforms, GPS devices and
other defensive equipment.
Last week, Uzbekistan announced it had suspended its participation in the Russia-dominated Collective Security
Treaty Organization security pact.
25
f

OSINT Nuggets
Page 23 of 25
“Dropping out of the CSTO means that something deemed more desirable by Karimov’s regime is available
elsewhere. That’s highly likely to be material benefits and international respect garnered by being a partner on the
drawdown in Afghanistan,” said Deirdre Tynan, Central Asia project director for the International Crisis Group.
f 25
Analysts across the former Soviet space have read the CSTO pullout as a prelude to closer cooperation with the
United States.
“We will soon hear about how Uzbekistan has entered into a new strategic alliance and granted its territory for U.S.
military bases,” said Vadim Kozyulin, Central Asia expert at the Moscow-based Russian Center for Policy Studies, in a
research note.
A U.S. diplomat said on condition of anonymity that the United States has made no request to open a military base
in Uzbekistan.
Such a base would deeply antagonize Moscow, which has historically tried to assert its say on what foreign military
presence is permitted in a region it considers its geopolitical backyard. The United States already has an air base in
neighboring Kyrgyzstan that it uses for ferrying troops in and out of Afghanistan and staging airborne refueling mission.
It looks possible that Central Asian governments could become recipients of U.S. military hardware as the Pentagon
looks to limit the expense of hauling the materiel out of Afghanistan. The U.S diplomat said the process for the transfer of
excess defense equipment would require approval from the State Department.
Russian daily Kommersant in June cited an unnamed government source in Kyrgyzstan as saying talks on a plan
over exchanging military hardware for Afghan access were held during a March visit by Secretary of Defense Leon Panetta.
The newspaper suggested similar agreements were in place with other governments, including Uzbekistan’s.
The centrality of Uzbekistan’s role in the Afghan drawdown means they will be in a strong bargaining position for
obtaining as much as possible in return, however.
“There is a significant, even likely, chance that the Uzbeks get their hands on some lethal stuff that originally was
not planned,” said Alexander Cooley, political science professor at Columbia University. “If the Uzbeks ask for some specific
pieces of equipment and are at first denied, they’ll keep trying and bargaining until they get them.”
http://militarytimes.com/news/2012/07/ap-military-us-courts-uzbekistan-afghanistan-drawdown-nears-070612/
Comment/Analysis: I have placed this under the Russia/China banner because if the U.S. does manage to obtain an
agreement to open a military base within the country it will only bring China and Russia that much closer together. President
Vladimir Putin has already made it quite clear and has shown that he will respond to stop U.S. expansionism. The word
nuclear appears to be part of his vocabulary and uses it quite loosely. The Chinese on the other hand are also not pleased
with the U.S. so close to its border in Kyrgyzstan and the word nuclear appears quite often in their language as shown in the
following article under the China banner. The U.S. also would have to tone down its criticism of China and its human rights
record to avoid a Chinese backlash, sure to include Russia, that it courts other countries with their own human rights
violations in order to advance American influence. In my opinion President Putin will never warm up to the U.S. and will
always view the U.S. with suspicion. This is dangerous because Putin still views Russia as a superpower with its nuclear
weapons. Chinese President Hu Jintao is not as verbal as Putin, but appears to have a hidden agenda and deserves close
scrutiny. Then there’s the Iranian issue which effectively surrounds any American bases in the Stan’s area. President
Mahmoud Ahmadinejad is a nut and will side with anyone as long as it hurts America.
China
July 18, 2012, Chinese general warns that new missile shield may spark China nuclear upgrade. From Fredrik Dahl,
Reuters: China may need to modernize its nuclear arsenal to respond to the destabilizing effect of a planned U.S.-backed
missile defense system, a senior Chinese military officer said on Wednesday.
"It undermines the strategic stability," said Major General Zhu Chenghu of China's National Defense University
about the U.S.-led development of a missile shield, which has also alarmed Russia.
The United States is spending about $10 billion a year to develop, test and deploy missile defenses, which would
include a European shield as part of a layered system.
The defenses would also include ship-based interceptors that could be deployed in the Middle East and Asia-Pacific
- for instance as a hedge against North Korea - plus ground-based missile interceptors in silos in Alaska and California.
Moscow says the interceptors that the United States and NATO are deploying will be able to destroy its own
warheads in flight by about 2018, upsetting the post-Cold War balance of power.

OSINT Nuggets
Page 24 of 25
The comments by Zhu - who stirred controversy in 2005 by suggesting China could use nuclear weapons if the
United States intervened militarily in a conflict over Taiwan - indicated this is an argument that also resonates in China.
25
China "will have to modernize its nuclear arsenal" because the deployment of a missile defense system "may
reduce the credibility of its nuclear deterrence," Zhu told the seminar. . . .
China closely guards information about its nuclear weapons. However, the U.S. Department of Defense has said
that China has about 130-195 deployed nuclear-capable ballistic missiles.
Comment/Analysis: The Chinese and Russians realize all too well the U.S. is no pushover for one country to handle and
will merge to counter and expel the U.S. encroachment into their backyards while at the same time continuing to develop
and upgrade their weapon systems.
Jul 4, 2012, Cuba's Raul Castro visiting trading partner China. Cuban leader Raul Castro is in China for talks with President
Hu Jintao and other leaders, his first visit to his country's key trading partner since taking office as president.
Castro arrived Wednesday for a four-day visit. Cuban state media said he was accompanied by senior Cabinet
official Ricardo Cabrisas Ruiz and Foreign Minister Bruno Rodriguez. Neither side has said what issues are to be discussed.
Castro visited Vietnam and China while defense minister, a post he held from 1959 until he replaced his older
brother Fidel as president in 2008. He is to visit Vietnam again after leaving China.
While the three nations are among the last Communist-ruled countries in the world, China has opened broadly to
private business and has thrived economically while Cuba remains largely poor. During a 1997 trip to China, Raul Castro
spoke approvingly of its mixture of socialism and market liberalization.
Cuba is China's biggest commercial partner in the Caribbean. Beijing helped prop up the Cuban economy after the
withdrawal of Russian aid in the 1990s. Bilateral trade totaled $1.8 billion in 2010, state-run website Cubadebate said.
http://hosted.ap.org/dynamic/stories/A/AS_CHINA_CUBA?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2
012-07-04-10-46-44
Jul 4, 2012, Argentina signs deals with China's military. Argentina's defense minister is visiting China, signing military
agreements and praising the weapons on display during a six-day tour.
Defense minister Arturo Puricelli says cooperation agreements that he signed with Chinese Defense Minister Liang
Guanglie will strengthen ties between the Asian giant and Argentina.
He calls China an economic, political and military partner and says the two countries' strategic positions in terms of
international security are almost entirely consistent.
Argentina's defense ministry says in a Wednesday statement that Puricelli also has visited Chinese defense
contractors, viewing helicopters at one and guided weapon systems and anti-aircraft artillery at another.
Chinese state-run media in Beijing have reported on the visit and say China wants to expand military cooperation
with Argentina.
Comment/Analysis: Could this be China’s answer to the American presence in their backyard? The Russians are already
in our backyard just across the water from Alaska.
Related News. July 27, 2012, Russia wants naval bases abroad. Russia hopes to establish its first naval base abroad since
the 1991 collapse of the Soviet Union and is looking at Cuba, Vietnam and the Seychelles as possible locations, state-run
RIA news agency quoted the navy chief as saying on Friday. http://news.yahoo.com/russia-wants-naval-bases-abroadreport-114011895.html?_esi=1
Comment/Analysis: The related news came in after my initial analysis on the previous articles. I rest my case.
News for Parents: Protecting Our Children
World Drug Report for 2012. About 230 million people, or 5 per cent of the world’s adult population,
are estimated to have used an illicit drug at least once in 2010. Problem drug users number about
27 million, which is 0.6 per cent of the world adult population. Throughout the world, illicit drug use
appears to be generally stable, though it continues to be rising in several developing countries.
f

OSINT Nuggets
Page 25 of 25
Heroin, cocaine and other drugs kill around 0.2 million people each year, shattering families and bringing misery to
thousands of other people. Illicit drugs undermine economic and social development and contribute to crime,
instability, insecurity and the spread of HIV. https://www.unodc.org/documents/data-andanalysis/WDR2012/WDR_2012_web_small.pdf
f 25
Nuclear Terrorism
Of the the original National Planning Scenarios developed in the mid-2000s, the first involved the threat of terrorists
employing a 10-kiloton improvised nuclear device in a large metropolitan area. Using highly enriched uranium stolen from
another country, an unnamed group builds its own nuclear weapon and drives to the center of a city to detonate the device.
In addition to wrecking havoc on the city, the nuclear weapons effects — heat, blast, radiation, and EMP — create
significant challenges to the immediate area around the explosion. The scenario depicts hundreds of thousands of injured
people and more than a million displaced persons. This scenario is offered to state and local emergency managers as a
basis to plan for how they are going to deal with this possibility — a scenario that
mandates involvement by the federal government because of the catastrophic
scope of the damage. http://www.hsaj.org/?fullarticle=8.1.9
Interactive Blast Maps
Have you ever wondered what would happen if a nuclear bomb goes off in your
city? With Google’s Maps framework and a bit of Javascript, you can see the
outcome. And it doesn’t look good. Utilize this map and key to determine the
survivability of a blast in the city or address of your
choice. http://www.truthistreason.net/ground-zero-ii-interactive-nuclear-blastcalculator-and-fallout-map
http://www.carloslabs.com/node/16/
The threat of nuclear terrorism is not limited to New York City or Washington, DC. While New York is widely seen as the
most likely target, it is clear that Al Qaeda is not only capable, but also interested in mounting attacks on other American
cities, where people may be less prepared. Imagine the consequences of a 10-kiloton weapon exploding in San Francisco,
Houston, Chicago, Los Angeles, Charlotte, or any other city Americans call home. From the epicenter of the blast to a
distance of approximately one-third mile, every structure will be destroyed and no one would be left alive. A second circle of
destruction extending three-quarters of a mile from ground zero would leave buildings looking like the Federal Office
Building in Oklahoma City. A third circle reaching out 1 mile would be ravaged by fires and radiation.
http://www.nuclearterror.org/blastmaps.html