Friday, November 25, 2011

Target Iran: Washington's Countdown to War



The Iranian people know what it means to earn the enmity of the global godfather.

As William Blum documented in Killing Hope: U.S. Military and CIA Interventions Since World War II, 1953's CIA-organized coup against Iranian Prime Minister Mohammed Mossadegh, guilty of the "crime" of nationalizing the Anglo-Iranian Oil Company, may have "saved" Iran from a nonexistent "Red Menace," but it left that oil-rich nation in proverbial "safe hands"--those of the brutal dictatorship of Mohammad Reza Shah Pahlavi.

Similarly today, a nonexistent "nuclear threat" is the pretext being used by Washington to install a "friendly" regime in Tehran and undercut geopolitical rivals China and Russia in the process, thereby "securing" the country's vast petrochemical wealth for American multinationals.

As the U.S. and Israel ramp-up covert operations against Iran, the Pentagon "has laid out its most explicit cyberwarfare policy to date, stating that if directed by the president, it will launch 'offensive cyber operations' in response to hostile acts," according to The Washington Post.

Citing "a long-overdue report to Congress released late Monday," we're informed that "hostile acts may include 'significant cyber attacks directed against the U.S. economy, government or military'," unnamed Defense Department officials stated.

However, Air Force General Robert Kehler, the commander of U.S. Strategic Command (USSTRATCOM) told Reuters, "I do not believe that we need new explicit authorities to conduct offensive operations of any kind."

The Pentagon report, which is still not publicly available, asserts: "We reserve the right to use all necessary means--diplomatic, informational, military and economic--to defend our nation, our allies, our partners and our interests."

Washington's "interests," which first and foremost include "securing its hegemony over the energy-rich regions of the Middle East and Central Asia" as the World Socialist Web Site observed, may lead the crisis-ridden U.S. Empire "to take another irresponsible gamble to shore up its interests in the Middle East ... as a means of diverting attention from the social devastation produced by its austerity agenda."

Recent media reports suggest however, that offensive cyber operations are only part of Washington's multipronged strategy to soften-up the Islamic Republic's defenses as a prelude to "regime change."

Terrorist Proxies

For the better part of six decades, terrorist proxies have done America's dirty work. Hardly relics of the Cold War past, U.S. and allied secret state agencies are using such forces to carry out attacks inside Iran today.

Asia Times Online reported that "deadly explosions at a military base about 60 kilometers southwest of Tehran, coinciding with the suspicious death of the son of a former commander of the Islamic Revolutionary Guards Corps (IRGC) in Dubai in the United Arab Emirates, have triggered speculation in Iran on whether or not these are connected to recent United States threats to resort to extrajudicial executions of IRGC leaders."

And Time Magazine, a frequent outlet for sanctioned leaks from the Pentagon, reported that the blast at the Iranian missile base west of Tehran, which killed upwards of 40 people according to the latest estimates, including Major General Hassan Moqqadam, a senior leader of Iran's missile program, was described as the work "of Israel's external intelligence service, Mossad."

An unnamed "Western intelligence source" told reporter Karl Vick: "'Don't believe the Iranians that it was an accident,' adding that other sabotage is being planned to impede the Iranian ability to develop and deliver a nuclear weapon. 'There are more bullets in the magazine,' the official says."

While Iranian officials insist that the huge blast was an "accident," multiple accounts in the corporate press and among independent analysts provide strong evidence for the claim that Israel and their terrorist cat's paw, the bizarre political cult, Mojahedin-e Khalq (MEK) were responsible for the attack.

Richard Silverstein, a left-wing analyst who writes for the Tikun Olam web site, said that the blast was a sign that "the face of the Israeli terror machine may have reared its ugly head in the world."

Citing "an Israeli source with extensive senior political and military experience," Silverstein's correspondent provided "an exclusive report that it was the work of the Mossad in collaboration with the MEK."

Hardly a stranger to controversial reporting, Silverstein published excerpts of secret FBI transcripts leaked to him by the heroic whistleblower Shamai Leibowitz. Those wiretapped conversations of Israeli diplomats caught spying on the U.S., "described an Israeli diplomatic campaign in this country to create a hostile environment for relations with Iran."

In a Truthout piece, Silverstein wrote that Leibowitz, a former IDF soldier who refused to serve in the Occupied Territories, "explained that he was convinced from his work on these recordings that the Israel foreign ministry and its officials in this country were responsible for a perception management campaign directed against Iran. He worried that such an effort might end with either Israel or the US attacking Iran and that this would be a disaster for both countries."

Unfortunately, while Leibowitz sits in a U.S. prison his warnings are all but ignored.

According to Silverstein's latest account, "it is widely known within intelligence circles that the Israelis use the MEK for varied acts of espionage and terror ranging from fraudulent Iranian memos alleging work on nuclear trigger devices to assassinations of nuclear scientists and bombings of sensitive military installations."

Silverstein noted that "a similar act of sabotage happened a little more than a year ago at another IRG missile base which killed nearly 20."

Terrorist attacks targeting defense installations coupled with the murder of Iranian scientist, five "targeted killings" have occurred since 2010, aren't the only aggressive actions underway.

On Friday, The Washington Post reported that "a series of mysterious incidents involving explosions at natural gas transport facilities, oil refineries and military bases ... have caused dozens of deaths and damage to key infrastructure in the past two years."

According to the Post, "suspicions have been raised in Iran by what industry experts say is a fivefold increase in explosions at refineries and gas pipelines since 2010."

With Iran's oil industry under a strict sanctions regime by the West, maintenance of this critical industrial sector has undoubtedly suffered neglect due to the lack of spare parts.

However, "suspicions that covert action might already be underway were raised when four key gas pipelines exploded simultaneously in different locations in Qom Province in April," the Post disclosed.

"Lawmaker Parviz Sorouri told the semiofficial Mehr News Agency that the blasts were the work of 'terrorists' and were 'organized by the enemies of the Islamic Republic'," hardly an exaggerated charge given present tensions.

Whether or not these attacks were the handiwork of Mossad, their MEK proxies or even CIA paramilitary officers and Pentagon Joint Special Operations Command (JSOC) commandos, as Seymour Hersh revealed more than three years ago in The New Yorker, it is clear that Washington and Tel Aviv are "preparing the battlespace" on multiple fronts.

'Collapse the Iranian Economy'

Along with covert operations and terrorist attacks inside the Islamic Republic, on the political front, a bipartisan consensus has clearly emerged in Washington in favor of strangling the Iranian economy.

Indeed, congressional grifters are threatening to crater Iran's Central Bank, an unvarnished act of war. IPS reported that neocon Senator Mark Kirk (R-IL), "a key pro-Israel senator," has offered legislation "that would effectively ban international financial companies that do business with the Central Bank of Iran (CBI) from participating in the U.S. economy."

"Dubbed the 'nuclear option' by its critics," Jim Lobe reported that "the measure, which was introduced Thursday in the form of an amendment to the 2012 defence authorisation bill, is designed to 'collapse the Iranian economy'... by making it virtually impossible for Tehran to sell its oil."

However, "independent experts," Lobe wrote, "including some officials in the administration of President Barack Obama, say the impact of such legislation, if it became law, could spark a major spike in global oil prices that would push Washington's allies in Europe even deeper into recession and destroy the dwindling chances for economic recovery here."

That amendment was introduced as tensions were brought to a boil over allegations by the International Atomic Energy Agency (IAEA) in its latest report that Iran may be seeking to develop nuclear weapons.

IAEA Director General Yukiya Amano claims the Agency has "identified outstanding issues related to possible military dimensions to Iran's nuclear programme and actions required of Iran to resolve these."

"Since 2002," Amano averred, "the Agency has become increasingly concerned about the possible existence in Iran of undisclosed nuclear related activities involving military related organizations, including activities related to the development of a nuclear payload for a missile, about which the Agency has regularly received new information."

However, despite the fact that the "Agency continues to verify the non-diversion of declared nuclear material at the nuclear facilities," to whit, that such materials have not been covertly channeled towards military programs, Amano, reprising former Defense Secretary Donald Rumsfeld's famous gaff that "the absence of evidence is not the evidence of absence," the IAEA "is unable to provide credible assurance about the absence of undeclared nuclear material and activities in Iran, and therefore to conclude that all nuclear material in Iran is in peaceful activities."

Far from being an independent "nuclear watchdog," the IAEA under Amano's stewardship has been transformed into highly-politicized and pliable organization eager to do Washington's bidding.

As a 2009 State Department cable released by WikiLeaks revealed, U.S. Ambassador Glyn Davies cheerily reported: "Yukiya Amano thanked the U.S. for having supported his candidacy and took pains to emphasize his support for U.S. strategic objectives for the Agency. Amano reminded Ambassador on several occasions that he would need to make concessions to the G-77, which correctly required him to be fair-minded and independent, but that he was solidly in the U.S. court on every key strategic decision, from high-level personnel appointments to the handling of Iran's alleged nuclear weapons program." (emphasis added)

Although the new report "offered little that was not already known by experts about Iran's nuclear programme" IPS averred, "it cited what it alleged was new evidence that 'Iran has carried out activities relevant to the development of a nuclear device' since 2003--the date when most analysts believe it abandoned a centralised effort to build a nuclear bomb'."

But as the United States, with the connivance of corporate media, bury the conclusions of not one, but two National Intelligence Estimates issued by the U.S. Director of National Intelligence, it is clear to any objective observer that "nonproliferation" is a cover for aggressive geopolitical machinations by Washington.

Both estimates, roundly denounced by U.S. neoconservatives and media commentators when they were published, insisted that "in fall of 2003, Tehran halted its nuclear weapons program," a finding intelligence analysts judged with "high confidence."

In contrast, the highly-politicized IAEA report is a provocative document whose timing neatly corresponds with the imposition of a new round of economic sanctions meant to crater the Iranian economy. Never mind that even according to the IAEA's own biased reporting, they could find no evidence that Iran had diverted nuclear materials from civilian programs (power generation, medical isotopes) to alleged military initiatives.

Indeed, with sinister allusions that hint darkly at "undeclared nuclear materials," the agency fails to provide a single scrap of evidence that diverted stockpiles even exist.

Another key allegation made by the Agency that Iran had constructed an "explosives chamber to test components of a nuclear weapon and carry out a simulated nuclear explosion," was denounced by former IAEA inspector Robert Kelley as "highly misleading," according to an IPS report filed by investigative journalist Gareth Porter.

With "information provided by Member States," presumably Israel and the United States, the IAEA said it "had 'confirmed' that a 'large cylindrical object' housed at the same complex had been 'designed to contain the detonation of up to 70 kilograms of high explosives'. That amount of explosives, it said, would be 'appropriate' for testing a detonation system to trigger a nuclear weapon."

"Kelley rejected the IAEA claim that the alleged cylindrical chamber was new evidence of an Iranian weapons programme," Porter wrote. "We've been led by the nose to believe that this container is important, when in fact it's not important at all," the former nuclear inspector said.

But as Mark Twain famously wrote, "A lie can travel half way around the world while the truth is putting on its shoes." This is certainly proving to be the case with the IAEA under Yukiya Amano.

Another player "solidly in the U.S. court" is David Albright, the director of the Institute for Science and International Security (ISIS), a Washington, D.C. "think tank" funded by the elitist Carnegie, Ford and Rockefeller Foundations.

In an earlier piece for IPS, Porter demolished Albright's "sensational claim previously reported by news media all over the world that a former Soviet nuclear weapons scientist had helped Iran construct a detonation system that could be used for a nuclear weapon."

"But it turns out that the foreign expert, who is not named in the IAEA report but was identified in news reports as Vyacheslav Danilenko, is not a nuclear weapons scientist but one of the top specialists in the world in the production of nanodiamonds by explosives," Porter wrote.

"In fact," Porter averred, "Danilenko, a Ukrainian, has worked solely on nanodiamonds from the beginning of his research career and is considered one of the pioneers in the development of nanodiamond technology, as published scientific papers confirm."

"It now appears that the IAEA and David Albright ... who was the source of the news reports about Danilenko, never bothered to check the accuracy of the original claim by an unnamed 'Member State' on which the IAEA based its assertion about his nuclear weapons background."

It is no small irony, that Albright, corporate media's go-to guy on all things nuclear, penned an alarmist screed in 2002 entitled, "Is the Activity at Al Qaim Related to Nuclear Efforts?", an article which lent "scientific" credence to false claims made by the Bush White House against Iraq.

As investigative journalist Robert Parry pointed out on the Consortium News web site, "Albright's nuclear warning about Iraq coincided with the start of the Bush administration's propaganda campaign to rally Congress and the American people to war with talk about 'the smoking gun in the form of a mushroom cloud'."

"Yet," Parry noted, "when the Washington Post cited Albright on Monday, as the key source of a front-page article about Iran's supposed progress toward reaching 'nuclear capability,' all the history of Albright's role in the Iraq fiasco disappeared."

History be damned. Congressional warmongers and corporate media who cite these fraudulent claims, are "spurred by Israel's whisper campaign to create a sense of urgency on Capitol Hill where the Israel lobby, acting mainly through the American Israel Public Affairs Committee, exerts its greatest influence," as IPS noted, and punish Iran for the "crime" of opening its nuclear facilities to international inspection!

That "whisper campaign" has now bloomed into a full court press for war by "liberal" Democrats and "conservative" Republicans alike, even as public approval of Congress's work by the American people tracks only slightly higher than the popularity enjoyed by child molesters or serial killers.

As tensions are dialed up, the United States is spearheading a relentless drive to throttle Iran's economy. The New York Times reported that "major Western powers took significant steps on Monday to cut Iran off from the international financial system, announcing coordinated sanctions aimed at its central bank and commercial banks."

A strict sanctions regime was also imposed on Iran's "petrochemical and oil industries, adding to existing measures that seek to weaken the Iranian government by depriving it of its ability to refine gasoline or invest in its petroleum industry," the Times reported.

In a move which signals that even-more stringent sanctions are on the horizon, the U.S. Treasury Department "named the Central Bank of Iran and the entire Iranian banking system as a 'primary money laundering concern'."

That's rather rich coming from an administration which slapped Wachovia Bank on the wrist after that corrupt financial institution, now owned by Wells Fargo Bank, pleaded guilty to laundering as much as $378 billion for Mexico's notorious drug cartels as Bloomberg Markets Magazine reported last year!

Going a step further, France's President Nicolas Sarkozy called on the major imperialist powers "to freeze the assets of the central bank and suspend purchases of Iranian oil."

The Guardian reported that Britain "went the furthest by, for the first time, cutting an entire country's banking system off from London's financial sector."

Playing catch-up with war-hungry Democrats and Republicans, President Obama stated that the "new sanctions target for the first time Iran's petrochemical sector, prohibiting the provision of goods, services and technology to this sector and authorizing penalties against any person or entity that engages in such activity."

"They expand energy sanctions, making it more difficult for Iran to operate, maintain, and modernize its oil and gas sector," Obama said.

"As long as Iran continues down this dangerous path, the United States will continue to find ways, both in concert with our partners and through our own actions, to isolate and increase the pressure upon the Iranian regime."

Last summer, Rep. Brad Sherman (D-CA), a strong backer of punishing sanctions, echoed Richard Nixon's vow to "make the economy scream" prior to the CIA's overthrow of Chile's democratically-elected socialist president, Salvador Allende, and wrote in The Hill that "critics ... argued that these measures will hurt the Iranian people. Quite frankly, we need to do just that."

With a new round of crippling economic sanctions on tap from the West, "liberal" Democrat Sherman might just get his wish.

Targeting Civilian Infrastructure

While the Obama administration claims that their aggressive stance towards Iran is meant to promote "peace" and "help" the Iranian people achieve a "democratic transformation," ubiquitous facts on the ground betray a far different, and uglier, reality.

Anonymous U.S. "intelligence officials" told The Daily Beast "that any Israeli attack on hardened nuclear sites in Iran would go far beyond airstrikes from F-15 and F-16 fighter planes and likely include electronic warfare against Iran's electric grid, Internet, cellphone network, and emergency frequencies for firemen and police officers."

According to Newsweek national security correspondent Eli Lake, "Israel has developed a weapon capable of mimicking a maintenance cellphone signal that commands a cell network to 'sleep,' effectively stopping transmissions, officials confirmed. The Israelis also have jammers capable of creating interference within Iran's emergency frequencies for first responders."

But Israel isn't the only nation capable of launching high-tech attacks or, borrowing the Pentagon's euphemistic language, conduct "Information Operations" (IO).

The U.S. Air Force Cyberspace & Information Operations Study Center (CIOSC) describe IO as "The integrated employment of the core capabilities of electronic warfare, computer network operations, psychological operations, military deception and operations security, in concert with specified supporting and related capabilities, to influence, disrupt, corrupt or usurp adversarial human and automated decision making while protecting our own."

In this light, The Daily Beast disclosed that "Israel also likely would exploit a vulnerability that U.S. officials detected two years ago in Iran's big-city electric grids, which are not 'air-gapped'--meaning they are connected to the Internet and therefore vulnerable to a Stuxnet-style cyberattack--officials say."

The anonymous officials cited by Lake informed us that "a highly secretive research lab attached to the U.S. joint staff and combatant commands, known as the Joint Warfare Analysis Center (JWAC), discovered the weakness in Iran's electrical grid in 2009," the same period when Stuxnet was launched, and that Israeli and Pentagon cyberwarriors "have the capability to bring a denial-of-service attack to nodes of Iran's command and control system that rely on the Internet."

But as Ralph Langer, the industrial controls systems expert who first identified the Stuxnet virus warned in an interview with The Christian Science Monitor, the deployment of military-grade malicious code is a "game changer" that has "opened Pandora's box."

Among a host of troubling questions posed by Stuxnet, Langer said: "It raises, for one, the question of how to apply cyberwar as a political decision. Is the US really willing to take down the power grid of another nation when that might mainly affect civilians?"

But as we have seen, most recently during the punishing air campaign that helped "liberate" Libya--from their petrochemical resources--the U.S. and their partners are capable of doing that and more.

Future targeting of Iran's civilian infrastructure may in fact have been one of the tasks of the recently-discovered Duqu Trojan, which Israeli and U.S. "boutique arms dealers" are suspected of designing for their respective governments.

And whom, pray tell, has the means, motives and expertise to design weaponized computer code?

As BusinessWeek disclosed in July, when one of America's cyber merchants of death, Endgame Systems, pitch their products they "bring up maps of airports, parliament buildings, and corporate offices. The executives then create a list of the computers running inside the facilities, including what software the computers run, and a menu of attacks that could work against those particular systems."

According to BusinessWeek, "Endgame weaponry comes customized by region--the Middle East, Russia, Latin America, and China--with manuals, testing software, and 'demo instructions'."

"A government or other entity," journalists Michael Riley and Ashlee Vance revealed, "could launch sophisticated attacks against just about any adversary anywhere in the world for a grand total of $6 million. Ease of use is a premium. It's cyber warfare in a box."

Kaspersky Lab analyst Ryan Naraine, writing on the Duqu FAQ blog averred that Duqu's "main purpose is to act as a backdoor into the system and facilitate the theft of private information. This is the main difference when compared to Stuxnet, which was created to conduct industrial sabotage."

In other words, unlike Stuxnet, Duqu is an espionage tool which can smooth the way for future attacks such as those described by The Daily Beast.

As The Washington Post disclosed last May, while the military "needs presidential authorization to penetrate a foreign computer network and leave a cyber-virus that can be activated later," it does not need such authorization "to penetrate foreign networks for a variety of other activities."

According to the Post, these activities include "studying the cyber-capabilities of adversaries or examining how power plants or other networks operate," and can "leave beacons to mark spots for later targeting by viruses."

Or more likely given escalating tensions, Iranian air defenses and that nation's power and electronic communications grid which include "emergency frequencies for firemen and police officers" who would respond to devastating air and missile attacks.

Countdown to War

We can conclude that Israel, NATO and the United States are doing far more than placing "all options on the table" with respect to the Islamic Republic of Iran.

Along with ratcheting-up bellicose rhetoric, moves to collapse the economy, an assassination and sabotage campaign targeting Iranian scientists and military installations, cyberwarriors are infecting computer networks with viruses and "beacons" that will be used to attack air defense systems and civilian infrastructure.

After all, as Dave Aitel, the founder of the computer security firm Immunity told BusinessWeek, "nothing says you've lost like a starving city."

As Global Research analyst Michel Chossudovsky warned last year, now confirmed by CIA and Pentagon leaks to corporate media: "It is highly unlikely that the bombings, if they were to be implemented, would be circumscribed to Iran's nuclear facilities as claimed by US-NATO official statements. What is more probable is an all out air attack on both military and civilian infrastructure, transport systems, factories, public buildings."

With the global economy in deep crisis as a result of capitalism's economic meltdown, and as the first, but certainly not the last political actions by the working class threaten the financial elite's stranglehold on power, the ruling class may very well gamble that a war with Iran is a risk worth taking.

As Chossudovsky warned in a subsequent Global Research report, "there are indications that Washington might envisage the option of an initial (US backed) attack by Israel rather than an outright US-led military operation directed against Iran."

"The Israeli attack--although led in close liaison with the Pentagon and NATO--would be presented to public opinion as a unilateral decision by Tel Aviv. It would then be used by Washington to justify, in the eyes of world opinion," Chossudovsky wrote, "a military intervention of the US and NATO with a view to 'defending Israel', rather than attacking Iran. Under existing military cooperation agreements, both the US and NATO would be 'obligated' to 'defend Israel' against Iran and Syria."

This prescient analysis has been borne out by events. As regional tensions escalate, the USS George H.W. Bush, "the Navy's newest aircraft carrier, has reportedly parked off the Syrian coast," The Daily Caller reported.

Earlier this week, the financial news service Zero Hedge disclosed that "the Arab League (with European and US support) are preparing to institute a no fly zone over Syria."

"But probably the most damning evidence that the 'western world' is about to do the unthinkable and invade Syria," analyst Tyler Durden wrote, "and in the process force Iran to retaliate, is the weekly naval update from Stratfor."

According to Zero Hedge, "CVN 77 George H.W. Bush has left its traditional theater of operations just off the Straits of Hormuz, a critical choke point, where it traditionally accompanies the Stennis, and has parked... right next to Syria."

In an earlier report, citing Kuwait's Al Rai daily, Zero Hedge warned that "Arab jet fighters, and possibly Turkish warplanes, backed by American logistic support will implement a no fly zone in Syria's skies, after the Arab League will issue a decision, under its Charter, calling for the protection of Syrian civilians."

The BBC reports that the Arab League "has warned Syria it has one day to sign a deal allowing the deployment of observers or it will face economic sanctions."

"Meanwhile," BBC averred, "France has suggested that some sort of humanitarian protection zones," à la Libya, "be created inside Syria."

American moves towards Syria are fraught with dangerous implications for international peace and stability. As analyst Pepe Escobar disclosed in Asia Times Online the Arab League, a wholly-owned subsidiary of Saudi Arabia and repressive Gulf emirates, dances to Washington's tune.

"Syria is Iran's undisputed key ally in the Arab world--while Russia, alongside China, are the key geopolitical allies. China, for the moment, is making it clear that any solution for Syria must be negotiated," Escobar wrote.

"Russia's one and only naval base in the Mediterranean is at the Syrian port of Tartus. Not by accident," Escobar notes, "Russia has installed its S-300 air defense system--one of the best all-altitude surface-to-air missile systems in the world, comparable to the American Patriot--in Tartus. The update to the even more sophisticated S-400 system is imminent."

"From Moscow's--as well as Tehran's--perspective, regime change in Damascus is a no-no. It will mean virtual expulsion of the Russian and Iranian navies from the Mediterranean."

"In other words," Zero Hedge warned, "if indeed Europe and the Western world is dead set upon an aerial campaign above Syria, then all eyes turn to the East, and specifically Russia and China, which have made it very clear they will not tolerate any intervention. And naturally the biggest unknown of all is Iran, which has said than any invasion of Syria will be dealt with swiftly and severely."

Despite, or possibly because no credible evidence exists that Iran is building a nuclear bomb as a hedge against "regime change," belligerent rhetoric and regional military moves targeting Syria and Iran simultaneously are danger signs that imperialism's manufactured "nuclear crisis" is a cynical pretext for war.

Sunday, November 13, 2011

Twitter Ordered to Hand Over WikiLeaks Info to Justice Department




In a further blow to online privacy rights and press freedom, the U.S. District Court in Alexandria, Va. ordered the microblogging site Twitter to hand over account information on three activists under investigation by the Justice Department for their links to the whistleblowing web site WikiLeaks.

Under "transparency president" Barack Obama, the U.S. government initiated a criminal probe of the organization after the site began releasing a virtual tsunami of confidential military and State Department files.

In the last two years alone, WikiLeaks revealed that the United States had committed grave war crimes in Afghanistan, Iraq and other global hot-spots of interest to America's resource-grabbing corporate masters.

This year's release of 779 classified dossiers on prisoners housed at the Guantánamo Bay prison gulag fleshed out the public's knowledge of ongoing torture programs run by the military and the CIA under cover of it's murderous "War on Terror."

But it was their publication of some 250,000 secret State Department cables which sparked a new round of hysterical denunciations in Washington culminating in the witchhunt against Julian Assange and WikiLeaks supporters, a demonization campaign aided and abetted by U.S. financial institutions such as Bank of America and Pentagon cyberwar contractors.

Cable after cable revealed "the extent of US spying on its allies and the UN; turning a blind eye to corruption and human rights abuse in 'client states'; backroom deals with supposedly neutral countries; lobbying for US corporations; and the measures US diplomats take to advance those who have access to them."

Leading politicians, including Vice President Joe Biden and Senate Minority leader Mitch McConnell have called the web site's founder a "high-tech terrorist," and commentators such as right-wing Washington Times columnist Jeffery Kuhner and others have demanded that Assange and his co-workers be treated "the same way as other high-value terrorist targets."

The Obama administration, loathe to pursue criminal probes of the previous regime's lawbreaking, the better to immunize themselves over their own contemporary lawless acts, including the torture of prisoners at Bagram Airbase, clandestine CIA drone killings and the due process-free assassination of an American citizen who was never charged, let alone convicted of a crime, was up to the challenge and empaneled a grand jury in Alexandria, Va.

And when Justice Department inquisitors first sought to seize the activist's information, in keeping with the new "Washington consensus" that constitutional rights are nothing more than empty platitudes duly trotted out on national holidays, they demanded that Twitter turn over the files without benefit of a warrant.

American Civil Liberties Union staff attorney Aden Fine denounced the ruling. "Internet users don't automatically give up their rights to privacy and free speech when they use services like Twitter," Fine said.

"The government shouldn't be able to get this kind of private information without a warrant, and they certainly shouldn't be able to do so in secret. An open court system is a fundamental part of our democracy, and the very existence of court documents should not be hidden from the public."

According to the ACLU, it wasn't only Twitter that was served with record demands by the Justice Department. "Based on the file numbers that have been created, it appears likely that there are additional orders whose existence remains secret."

The public first became aware of the government's fishing expedition only because Twitter informed the three activists, Jacob Appelbaum, a founding member of the online anonymity network, Tor Project, Rop Gonggrijp, a founder of the Dutch web portal XS4ALL and Birgitta Jónsdóttir, a left-wing member of Iceland's Parliament.

As Antifascist Calling reported in March, Jónsdóttir was specifically targeted for her role in helping WikiLeaks release the Collateral Murder video last year.

That scandalous video exposed the wanton slaughter of a dozen people in the Iraqi suburb of New Baghdad, including two Reuters photojournalists, by a U.S. military Apache helicopter crew. Two children were also seriously wounded in the unprovoked attack.

The Army's thrill-kill gun camera video wasn't concealed from the public because of any alleged threat to "national security" or to protect intelligence "sources and methods," standard boilerplate used to hide war crimes by the U.S. Empire, but precisely to cover-up imperialism's murderous rampage that helped "liberate" Iraqis of their lives.

Commenting on the ruling, Jónsdóttir told The Guardian, "This is a huge blow for everybody that uses social media. We have to have the same civil rights online as we have offline. Imagine if the US authorities wanted to do a house search at my home, go through my private papers. There would be a hell of a fight. It's absolutely unacceptable."

Unfortunately, under Section 213 of the oxymoronic USA Patriot Act, which was not subject to a "sunset" provision of the constitution-shredding legislation, FBI agents can do precisely that and obtain so-called "delayed notification" warrants for the search and seizure of evidence of any federal crime, not only those related to "terrorism" investigations.

Called "sneak and peek" searches, federal snoops are permitted to clandestinely seize property or conduct electronic searches on a home computer if a court deems such seizures "reasonably necessary." Indeed, notification of a covert FBI home invasion "may thereafter be extended by the court for good cause shown."

The sweeping ruling by Judge Liam O'Grady upheld demands by U.S. investigators that they should have virtual free-reign to pillage private records related to the users' IP address, the unique identifier used by a computer or hand-held device to log onto the internet.

According to the Electronic Frontier Foundation (EFF) who represent Jónsdóttir along with American Civil Liberties Union attorneys, O'Grady "also blocked the users' attempt to discover whether other Internet companies have been ordered to turn their data over to the government."

"When you use the Internet, you entrust your online conversations, thoughts, experiences, locations, photos, and more to dozens of companies who host or transfer your data," EFF Legal Director Cindy Cohn said.

"In light of that technological reality, we are gravely worried by the court's conclusion that records about you that are collected by Internet services like Twitter, Facebook, Skype and Google are fair game for warrantless searches by the government."

Among other things, O'Grady wrote in his 60-page decision that "the information sought was clearly material to establishing key facts related to an ongoing investigation and would have assisted a grand jury in conducting an inquiry into the particular matters under investigation."

O'Grady, appointed to the United States District Court for the Eastern District of Virginia in 2007 by President George W. Bush, argued that because Twitter users "voluntarily" turned over their IP addresses when they signed up for an account, they lost any expectation of privacy.

In other words, simply because users click through opaque "Terms of Service" agreements with Twitter, Google, Facebook or any other internet vendor, "petitioners knew or should have known that their I.P. information was subject to examination by Twitter, so they had a lessened expectation of privacy in that information, particularly in light of their apparent consent to the Twitter terms of service and privacy policy."

However, as security researcher Christopher Soghoian pointed out in Slight Paranoia, "The federal judge in the Wikileaks case cited in his order a version of Twitter's privacy policy from 2010, rather than the very different policy that existed when Appelbaum, Gonggrijp and Jonsdottir created their Twitter accounts back in 2008."

"That older policy," Soghoian wrote, "actually promised users that Twitter would keep their data private unless they violated the company's terms of service. It is unclear how the judge managed to miss this important detail."

"There is a slight problem with relying on a privacy policy created on November 16, 2010 to decide the reasonable expectation of privacy of these three individuals: They created their Twitter accounts several years before the document was written."

Indeed, as Soghoian observes, "not only is a federal judge ruling that 3 individuals have no reasonable expectation of privacy with regard to the government getting some of their Internet transaction data, but the judge isn't even citing the right version of a widely ignored privacy policy to do so."

"If the judge were to examine the privacy policy that existed when these three targets signed up for a Twitter account," Soghoian concludes, "he might decide that they do in fact have a reasonable expectation of privacy and that the government needs a warrant to get the data."

While true as far as it goes, and Soghoian should be commended for pointing out this glaring contradiction in the government's case, readers are well aware that the WikiLeaks Twitter case is about politics not process, that is, moves by the secret state to clamp-down on dissent and dissenters, and not whether someone has read and "voluntarily" signed-off on a vendor's "Terms of Service" agreement.

Among other things, O'Grady's ruling revealed that the government was seeking not only IP addresses but "1. subscriber names, user names, screen names, or other identities; 2. mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information; 3. connection records, or records of session times and durations; 4. length of service (including start date) and types of service utilized; 5. telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and 6. means and source of payment for such service (including any credit card or bank account number) and billing records."

It doesn't take a computer forensics expert to conclude that the government, in obtaining "connection records," will also get their hands on information about anyone else who corresponded or "followed" the activists on Twitter.

Kevin Bankston, a senior staff attorney with EFF told CNET News that the ruling means that "essentially any data about you collected by an Internet service is fair game for warrantless searches by the government."

The District Court's ruling can be situated within the wider context of the Obama administration's unprecedented drive to criminalize whistleblowing.

The persecution of Julian Assange and other WikiLeaks supporters is a shot across the bow not only against those who leak sensitive information to the public that expose egregious acts by the well-connected, but at investigative journalists and researchers who in their course of their work uncover high crimes and misdemeanors by powerful corporations and governments.

As the World Socialist Web Site pointed out, "Assange's real 'crime' is that, through its publication of a mass of secret US military documents, diplomatic cables and video footage, WikiLeaks has exposed the criminal character of the invasions and occupations of Afghanistan and Iraq and numerous other conspiracies carried out against the world's people by Washington and its allies."

Make no mistake, this ruling is a warning of further draconian moves to come.

Sunday, November 6, 2011

A Precursor to War? As Washington Renews Military Threats Against Iran, Cyber Attacks Escalate



As evidence mounts that the U.S. secret state is launching cyber weapons against official enemies, while carrying out wide-ranging spy ops against their "friends," Gen. Keith Alexander, the dual-hatted overlord of the National Security Agency and U.S. Cyber Command, says that the Obama administration is "working on a system" that will "help" ISPs thwart malicious attacks.

Speaking at the Security Innovation Network (SINET) "Showcase 2011" shindig at the National Press Club in Washington, Alexander told security grifters eager to gouge taxpayers for another piece of lucrative "cybersecurity" pie: "What I'm concerned about are the destructive attacks. Those are the things yet to come that cause us a lot of concern."

That's rather rich coming from the head of a secretive Pentagon satrapy suspected of designing and launching the destructive Stuxnet virus which targeted Iran's civilian nuclear program.

According to fresh evidence provided by IT security experts it now appears that the same constellation of shadowy forces which unleashed Stuxnet are at it again with the newly discovered Duqu spy Trojan.

In a follow-up analysis, Kaspersky Lab researcher Alex Gostev wrote that "the highest number of Duqu incidents have been recorded in Iran. This fact brings us back to the Stuxnet story and raises a number of issues."

Not least of which is the continuing demonization of the Islamic Republic by an unholy alliance of U.S. militarists, their Israeli pit bulls and congressional shills hyping the "Iran threat."

War Drums Beating

With the United States and the other capitalist powers incapable of digging the world economy out from under the slow-motion meltdown sparked by 2008's market collapse, and with tens of millions of enraged citizens rejecting austerity measures that will further enrich financial elites at their expense, will the Obama administration "go for broke" and set-off a new conflagration in the Middle East?

Ratcheting up bellicose rhetoric, John Keane, a retired four-star general, former Vice Chief of Staff of the U.S. Army now currently perched on the board of General Dynamics, a major purveyor of cyber attack tools for the government, told the House Homeland Security Committee October 26, "We've got to put our hand around their throat now. Why don't we kill them? We kill other people who are running terrorist operations against the United States."

AFP reported that "Iran made a formal protest" over Keane's remarks which urged "the targeted assassination of members of its elite Quds Force military special operations unit," over a fairy-tale plot allegedly cooked-up by Tehran, which employed a failed used-car salesman, a DEA snitch and members of the Zetas drug gang in a scheme to assassinate the Saudi ambassador in Washington.

While the plot lines are as preposterous as allegations prior to the 2003 Iraq invasion that Saddam Hussein's regime was involved in the 9/11 attacks, one cannot so easily dismiss the propaganda value of such reports by administration "information warriors." The same can be said of the series of controlled leaks emanating from London, Tel Aviv and Washington urging immediate air strikes against Iran's nuclear facilities.

The Guardian reported that "Britain's armed forces are stepping up their contingency planning for potential military action against Iran amid mounting concern about Tehran's nuclear enrichment programme."

Chillingly, the "Ministry of Defence believes the US may decide to fast-forward plans for targeted missile strikes at some key Iranian facilities. British officials say that if Washington presses ahead it will seek, and receive, UK military help for any mission, despite some deep reservations within the coalition government."

On the same day that MoD's sanctioned leak appeared in the British press, Haaretz disclosed that "Prime Minister Benjamin Netanyahu and Defense Minister Ehud Barak are trying to muster a majority in the cabinet in favor of military action against Iran, a senior Israeli official has said. According to the official, there is a 'small advantage' in the cabinet for the opponents of such an attack."

"Strategic Affairs Minister Moshe Ya'alon said he preferred an American military attack on Iran to an Israeli one. 'A military move is the last resort,' he said."

The Associated Press reported that as Netanyahu moved to persuade his cabinet to "authorize a military strike against Iran's suspected nuclear weapons program," Israel successfully test-fired "a missile believed capable of carrying a nuclear warhead to Iran."

Adding to the disinformational witch's brew, The Washington Post reported that "a new spike in anti-Iran rhetoric and military threats by Western powers is being fueled by fears that Iran is edging closer to the nuclear 'breakout' point, when it acquires all the skills and parts needed to quickly build an atomic bomb if it chooses to," anonymous "Western diplomats and nuclear experts said Friday."

Post stenographer Joby Warrick informed us that a "Western diplomat who had seen drafts of the report" told him "it will elaborate on secret intelligence collected since 2004 showing Iranian scientists struggling to overcome technical hurdles in designing and building nuclear warheads."

And late last week Reuters disclosed that "a senior U.S. military official said on Friday Iran had become the biggest threat to the United States and Israel's president said the military option to stop the Islamic republic from obtaining nuclear weapons was nearer."

"'The biggest threat to the United States and to our interests and to our friends ... has come into focus and it's Iran,' said the U.S. military official, addressing a forum in Washington." Conveniently, "reporters were allowed to cover the event on condition the official not be identified."

While some critics argue that Israel does not presently have the capacity to launch such an attack, and that "the volume of the war hysteria is being turned up with one purpose in mind: the Israelis want the US to do their dirty work for them," such reasoning is hardly reassuring.

Indeed, as the World Socialist Web Site points out, "the Israeli government has already made advanced preparations for an attack on Iran."

"On the military front," analyst Peter Symonds warned that "Israeli warplanes last week conducted a long-range exercise--of the type required to reach Iran--using a NATO airbase on the Italian island of Sardinia." In other words, the IDF drill was not a "rogue" exercise unilaterally conducted by Israel, but further evidence of Washington's "desperate bid to offset its economic decline by securing its hegemony over the energy-rich regions of the Middle East and Central Asia."

In the context of escalating tensions over Iran's nuclear enrichment program, seeded by manufactured "terror" plots, the imperialist powers may choose the "cyber" route prior to launching devastating missile and bomber strikes against Iranian military installations and civilian infrastructure.

Pentagon planners now believe that attack tools have reached the point where blinding Iran's air defenses while sowing chaos across population centers with power outages and the shutdown of financial services may now be a viable option.

This is not idle speculation. During the run-up to the 2003 Iraq invasion, the National Journal disclosed that Central Command "considered a computerized attack to disable the networks that controlled Iraq's banking system, but they backed off when they realized that those networks were global and connected to banks in France."

Facing growing opposition at home and abroad to endless wars and imperial adventures, would the Obama administration have such qualms today?

Attack Tools Already in Play

As Antifascist Calling previously reported, when the Duqu virus was discovered last month, analysts at Symantec believed that the remote access Trojan (RAT) "is essentially the precursor to a future Stuxnet-like attack."

"The threat was written by the same authors (or those who have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered," researchers averred.

Since their initial reporting, Symantec, drawing on research from CrySyS lab at the Budapest University of Technology and Economics in Hungary, the organization which discovered the malware, reported they located an installer file in the form of a Microsoft Word document which exploits a previously unknown zero-day vulnerability.

Like Stuxnet, Duqu's stealthiness is directly proportional to its uncanny ability to capitalize on what are called zero-day exploits hardwired into it's digital DNA; security holes that are unknown to everyone until the instant they're used in an attack.

Similar to other dubious commodities traded on our dystopian "free markets," zero-days are bits of tainted code sought by criminal hackers, financial and industrial spies and enterprising security agencies that can sell for up to $250,000 a pop on the black market.

When Stuxnet appeared in dozens of countries last year, targeting what are called programmable logic controllers (PLCs) on industrial computers manufactured by Siemens that control everything from water purification and food processing to oil refining and potentially deadly chemical processes, researchers found it was designed to harm only one specific target: PLCs processing uranium fuel at a nuclear facility in Iran.

As Wired Magazine reported, when Symantec analysts who had been picking Stuxnet apart convinced internet service providers who controlled "servers in Malaysia and Denmark" where the virus "phoned home" each time it infected a new machine, to reroute the virus to a secure "sinkhole," they were in for a shock.

"Out of the initial 38,000 infections," journalist Kim Zetter wrote, "about 22,000 were in Iran. Indonesia was a distant second, with about 6,700 infections, followed by India with about 3,700 infections. The United States had fewer than 400. Only a small number of machines had Siemens Step 7 software installed--just 217 machines reporting in from Iran and 16 in the United States."

"The sophistication of the code," Wired averred, "plus the fraudulent certificates, and now Iran at the center of the fallout made it look like Stuxnet could be the work of a government cyberarmy--maybe even a United States cyberarmy.

"This made Symantec's sinkhole an audacious move," Zetter wrote. "In intercepting data the attackers were expecting to receive, the researchers risked tampering with a covert U.S. government operation."

Writing in the Journal of Strategic Studies, Thomas Rid, a former RAND Corporation employee and "Reader in War Studies at Kings College in London," who has close ties to the Western military establishment, observed in relation to Stuxnet that network "sabotage, first, is a deliberate attempt to weaken or destroy an economic or military system. All sabotage is predominantly technical in nature, but of course may use social enablers."

"The resources and investment that went into Stuxnet could only be mustered by a 'cyber superpower', argued Ralph Langner, a German control system security consultant who first extracted and decompiled the attack code."

In an interview with National Public Radio, Langer said that the "level of expertise" behind Stuxnet "seemed almost alien. But that would be science fiction, and Stuxnet was a reality."

"Thinking about it for another minute, if it's not aliens, it's got to be the United States."

"For the time being it remains unclear how successful the Stuxnet attack against Iran's nuclear program actually was" Rid noted. "But it is clear that the operation has taken computer sabotage to an entirely new level."

Researcher Vikram Thakur, commenting on the latest Duqu discoveries reported: "The Word document was crafted in such a way as to definitively target the intended receiving organization." And whom, pray tell, was being targeted by Duqu? Why Iran, of course.

"Once Duqu is able to get a foothold in an organization through the zero-day exploit, the attackers can command it to spread to other computers."

Thakur wrote, "the Duqu configuration files on these computers," which did not have the ability to connect to the internet and the author's command and control (C&C) server, "were instead configured not to communicate directly with the C&C server, but to use a file-sharing C&C protocol with another compromised computer that had the ability to connect to the C&C server."

"Consequently," Thakur concluded, "Duqu creates a bridge between the network's internal servers and the C&C server. This allowed the attackers to access Duqu infections in secure zones with the help of computers outside the secure zone being used as proxies."

As Kaspersky Lab researchers pointed out, "in each of the four instances of Duqu infection a unique modification of the driver necessary for infection was used."

"More importantly," analysts averred, "regarding one of the Iranian infections there were also found to have been two network attack attempts exploiting the MS08-067 [MS Word] vulnerability. This vulnerability was used by Stuxnet too."

"If there had been just one such attempt, it could have been written off as typical Kido activity--but there were two consecutive attack attempts: this detail would suggest a targeted attack on an object in Iran." (emphasis added)

Simply put, before the Pentagon decides to "kill them" as Gen. Keane indelicately put it, battlefield preparations via directed cyber attacks and other forms of sabotage may be part of a preemptive strategy to decapitate Iranian defenses prior to more "kinetic" attacks.

'Boutique Arms Dealers'

Despite media hype about future cuts in the so-called "defense" budget, Defense Industry Daily disclosed that "the US military has announced plans to spend billions on technology to secure its networks."

According to the Defense Department's FY 2012 budget proposal, "the Pentagon said it plans to spend $2.3 billion on cybersecurity capabilities."

However, when NextGov "questioned why the Air Force's $4.6 billion 2012 budget request for cybersecurity was $2.3 billion more than Defense's servicewide spending proposal, Pentagon officials upped their total figure from $2.3 billion to $3.2 billion."

Why the discrepancy? A "Pentagon spokesperson explained that the service's estimate differed dramatically because the Air Force included 'things' that are not typically considered information assurance or cybersecurity."

What kind of "things" are we talking about here?

As BusinessWeek reported in July, firms such as Northrop Grumman, Raytheon, and General Dynamics, "the stalwarts of the traditional defense industry," are "helping the U.S. government develop a capacity to snoop on or disable other countries' computer networks."

Capitalizing on the Defense Department's desire to develop "hacker tools specifically as a means of conducting warfare," this "shift in defense policy gave rise to a flood of boutique arms dealers that trade in offensive cyber weapons."

Investigative journalists Mike Riley and Ashlee Vance averred that "most of these are 'black' companies that camouflage their government funding and work on classified projects."

As last winter's hack of HBGary Federal by Anonymous revealed, "black" firms, including those like Palantir which received millions of dollars in start-up funding from the CIA's venture capital arm In-Q-Tel, hacker tools, such as sophisticated Trojans and stealthy rootkits, believed to be the route used to introduce the Stuxnet virus, have also been used to target political activists and journalists in the United States at the behest of financial institutions such as the Bank of America and the right-wing U.S. Chamber of Commerce.

As researcher Barrett Brown revealed, "Team Themis was a consortium made up of HBGary, Palantir, and Berico (with Endgame Systems serving as a 'silent partner' and providing assistance from the sidelines) that was set up in order to provide offensive intelligence capabilities to private clients."

Although Endgame Systems "went dark" after Anonymous released thousands of HBGary files, The Register disclosed that the firm "helps US intelligence identify and hack into vulnerable networks, and is targeting a similar role in Britain's nascent national cyber security operations."

The Register noted that the "limited publicly information currently available on the firm hints at its further role assisting clandestine government cyber operations by identifying targets and developing exploits."

As BusinessWeek revealed, the firm is "a major supplier of digital weaponry for the Pentagon. It offers a smorgasbord of wares, from vulnerability assessments to customized attack technology, for a dizzying array of targets in any region of the world."

Unsurprisingly, this was a major draw for venture capital firms "Bessemer Venture Partners and Kleiner Perkins Caufield & Byers," who collectively fronted Endgame some $30 million. According to Riley and Vance, "what really whet the VCs' appetites, though, according to people close to the investors, is Endgame's shot at becoming the premier cyber-arms dealer."

While a client list has yet to emerge, it's safe to assume that secret state agencies on both sides of the Atlantic are lining up to purchase Endgame's toxic products.

Although no definitive answer has emerged as to whom might targeting Iran with Duqu, as BusinessWeek revealed Endgame "deals in zero-day exploits. Some of Endgame’s technology is developed in-house; some of it is acquired from the hacker underground. Either way, these zero days are militarized--they've undergone extensive testing and are nearly fail-safe."

"People who have seen the company pitch its technology--and who asked not to be named because the presentations were private--say Endgame executives will bring up maps of airports, parliament buildings, and corporate offices."

According to Riley and Vance, "the executives then create a list of the computers running inside the facilities, including what software the computers run, and a menu of attacks that could work against those particular systems."

Indeed, "Endgame weaponry comes customized by region--the Middle East, Russia, Latin America, and China--with manuals, testing software, and 'demo instructions.' There are even target packs for democratic countries in Europe and other U.S. allies."

"The quest in Washington, Silicon Valley, and around the globe is to develop digital tools both for spying and destroying," BusinessWeek observed. "The most enticing targets in this war are civilian--electrical grids, food distribution systems, any essential infrastructure that runs on computers."

"This stuff is more kinetic than nuclear weapons," Dave Aitel, the founder of a computer security company in Miami Beach called Immunity told Riley and Vance. "Nothing says you've lost like a starving city."

While Aitel and a host of other "little Eichmanns" who enrich themselves servicing the American secret state refused to discuss his firm's work for the government, a source told the publication that Immunity "makes weaponized 'rootkits': military-grade hacking systems used to bore into other countries' networks," and that Aitel's clients "include the U.S. military and intelligence agencies."

We do not know if, or when, the United States, NATO and Israel will opt for a military "solution" to the so-called "Iranian problem."

We do know however, as the World Socialist Web Site warned, "as global capitalism lurches from one economic and political crisis to the next, rivalry between the major powers for markets, resources and strategic advantage is plunging humanity towards a catastrophic conflict that would devastate the planet."

Sunday, October 23, 2011

Boomerang! Is the Pentagon Field-Testing 'Son of Stuxnet'?



When the cybersecurity firm Symantec announced they had discovered a sophisticated Trojan which shared many of the characteristics of the Stuxnet virus, I wondered: was the Pentagon and/or their Israeli partners in crime field-testing insidious new spyware?

According to researchers, the malicious program was dubbed "Duqu" because it creates files with the prefix "~DQ." It is a remote access Trojan (RAT) that "is essentially the precursor to a future Stuxnet-like attack." Mark that carefully.

In simple terms, a Trojan is malicious software that appears to perform a desirable function prior to its installation but in fact, steals information from users spoofed into installing it, oftentimes via viral email attachments.

In the hands of enterprising security agencies, or criminals (the two are functionally synonymous), Trojans are primarily deployed for data theft, industrial or financial espionage, keystroke logging (surveillance) or the capture of screenshots which may reveal proprietary information.

"The threat" Symantec averred, "was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered."

The malware, which began popping-up on the networks of several European firms, captured lists of running processes, account and domain information, network drives, user keystrokes and screenshots from active sessions and did so by using a valid, not a forged certificate, stolen from the Taipei-based firm, C-Media.

Whereas Stuxnet, believed to be a co-production of U.S. and Israeli cyber-saboteurs, was a weaponized virus programmed to destroy Iran's civilian nuclear power infrastructure by targeting centrifuges that enrich uranium, Duqu is a stealthy bit of spy kit that filches data from manufacturers who produce systems that control oil pipelines, water systems and other critical infrastructure.

Sergey Golovanov, a malware expert at Kaspersky Labs told Forbes that Duqu is "is likely the brainchild of a government security apparatus. And it's that government's best work yet."

Speaking from Moscow, Golovanov told Forbes in a telephone interview that "right now were are pretty sure that it is the next generation of Stuxnet."

"We are pretty sure that Duqu is a government cyber tool and are 70% sure it is coming from the same source as Stuxnet," Golovanov said.

"The victims' computer systems were infected several days ago. Whatever it is," Golovanov noted, "it is still in those systems, and still scanning for information. But what exactly it is scanning for, we don't know. It could be gathering internal information for encryption devices. We only know that it is data mining right now, but we don't know what kind of data and to what end it is collecting it."

Whom, pray tell, would have "access to Stuxnet source code"?

While no government has claimed ownership of Stuxnet, IT experts told Forbes "with 100% certainty it was a government agency who created it."

Suspects include cryptologists at the National Security Agency, or as is more likely given the outsourcing of intelligence work by the secret state, a combination of designers drawn from NSA, "black world" privateers from large defense firms along with specialists from Israel's cryptologic division, Unit 8200, operating from the Israeli nuclear weapons lab at the Dimona complex, as The New York Times disclosed.

Analyst George Smith noted: "Stuxnet was widely distributed to many computer security experts. Many of them do contract work for government agencies, labor that would perhaps require a variety of security clearances and which would involve doing what would be seen by others to be black hat in nature. When that happened all bets were off."

Smith averred, "once a thing is in world circulation it is not protected or proprietary property."

While one cannot demonstrably prove that Duqu is the product of one or another secret state satrapy, one can reasonably inquire: who has the means, motive and opportunity for launching this particular bit of nastiness into the wild?

"Duqu's purpose," Symantec researchers inform us, "is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party."

In other words, while Stuxnet was programmed to destroy industrial systems, Duqu is an espionage tool that will enable attackers "looking for information such as design documents that could help them mount a future attack on an industrial control facility."

Although it can be argued, as Smith does, that "source code for malware has never been secure," and "always becomes something coveted by many, often in direct proportion to its fame," it also can't be ruled out that military-intelligence agencies or corporate clones with more than a dog or two in the "cyberwar" hunt wouldn't be very interested in obtaining a Trojan that clips "industrial design" information from friend and foe alike.

Black Programs

The circulation of malicious code such as Duqu's is highly destabilizing. Considering that the U.S. Defense Department now considers computer sabotage originating in another country the equivalent to an act of war for which a military response is appropriate, the world is on dangerous new ground.

Speaking with MIT's Technology Review, Ronald Deibert, the director of Citizen Lab, a University of Toronto think tank that researches cyberwarfare, censorship and espionage, told the publication that "in the context of the militarization of cyberspace, policymakers around the world should be concerned."

Indeed, given the fact that it is the United States that is now the biggest proliferator in the so-called cyber "arms race," and that billions of dollars are being spent by Washington to secure such weapons, recent history is not encouraging.

With shades of 9/11, the anthrax mailings and the Iraq invasion as a backdrop, one cannot rule out that a provocative act assigned to an "official enemy" by ruling elites just might originate from inside the U.S. security complex itself and serve as a convenient pretext for some future war.

A hint of what the Pentagon is up to came in the form of a controlled leak to The Washington Post.

Last spring, we were informed that "the Pentagon has developed a list of cyber-weapons and -tools, including viruses that can sabotage an adversary's critical networks, to streamline how the United States engages in computer warfare."

The list of "approved weapons" or "fires" are indicative of the military's intention to integrate "cyberwar" capabilities into its overall military doctrine.

According to Ellen Nakashima, the "classified list of capabilities has been in use for several months and has been approved by other agencies, including the CIA."

The Post reported that the new "framework clarifies, for instance, that the military needs presidential authorization to penetrate a foreign computer network and leave a cyber-virus that can be activated later."

On the other hand, and here's where Duqu may enter the frame, the "military does not need such approval, however, to penetrate foreign networks for a variety of other activities. These include studying the cyber-capabilities of adversaries or examining how power plants or other networks operate."

Additionally, Nakashima wrote, Pentagon cyberwarriors "can also, without presidential authorization, leave beacons to mark spots for later targeting by viruses, the official said."

As part of Washington's on-going commitment to the rule of law and human rights, as the recent due process-free drone assassination of American citizen Anwar Al-Awlaki, followed by that of his teenage son and the revenge killing of former Libyan leader Muammar Qaddafi by--surprise!--Al Qaeda-linked militias funded by the CIA clearly demonstrate, the "use of any cyber-weapon would have to be proportional to the threat, not inflict undue collateral damage and avoid civilian casualties."

Try selling that to the more than 3,600 people killed or injured by CIA drone strikes, as Pakistan Body Count reported, since our Nobel laureate ascended to his Oval Office throne.

As George Mason University researchers Jerry Brito and Tate Watkins described in their recent paper, Loving the Cyber Bomb? The Dangers of Threat Inflation in Cybersecurity Policy, despite overheated "rhetoric of 'cyber doom' employed by proponents of increased federal intervention," there is a lack of "clear evidence of a serious threat that can be verified by the public."

However, as Brito and Watkins warned, "the United States may be witnessing a bout of threat inflation similar to that seen in the run-up to the Iraq War," one where "a cyber-industrial complex is emerging, much like the military-industrial complex of the Cold War. This complex may serve to not only supply cybersecurity solutions to the federal government, but to drum up demand for them as well."

A "demand" which will inevitably feed the production, proliferation and deployment of a host of viral attack tools (Stuxnet) and assorted spybots (Duqu) that can and will be used by America's shadow warriors and well-connected corporate spies seeking to get a leg-up on the competition.

While evidence of "a serious threat" may be lacking, and while proponents of increased "cybersecurity" spending advanced "no evidence ... that opponents have 'mapped vulnerabilities' and 'planned attacks'," Brito and Watkins noted there is growing evidence these are precisely the policies being pursued by Washington.

Why might that be the case?

As a declining imperialist Empire possessing formidable military and technological capabilities, researcher Stephen Graham has pointed out in Cities Under Siege: The New Military Urbanism, the United States has embarked on a multibillion dollar program "to militarize the world's global electronic infrastructures" with a stated aim to "gain access to, and control over, any and all networked computers, anywhere on Earth."

Graham writes that "the sorts of on-the-ground realities that result from attacks on ordinary civilian infrastructure are far from the abstract niceties portrayed in military theory."

Indeed, as "the experiences of Iraq and Gaza forcefully remind us," robotized drone attacks and already-existent cyberwar capabilities buried in CIA and Pentagon black programs demonstrate that "the euphemisms of theory distract from the hard fact that targeting essential infrastructure in highly urbanized societies kills the weak, the old and the ill just as surely as carpet bombing."

A Glimpse Inside the Complex

In the wake of the HBGary hack by Anonymous earlier this year, the secrecy-shredding web site Public Intelligence released a 2009 Defense Department contract proposal from the firm.

Among other things, it revealed that the Pentagon is standing-up offensive programs that "examine the architecture, engineering, functionality, interface and interoperability of Cyber Warfare systems, services and capabilities at the tactical, operational and strategic levels, to include all enabling technologies."

HBGary, and one can assume other juiced defense contractors, are planning "operations and requirements analysis, concept formulation and development, feasibility demonstrations and operational support."

"This will include," according to the leaked proposal, "efforts to analyze and engineer operational, functional and system requirements in order to establish national, theater and force level architecture and engineering plans, interface and systems specifications and definitions, implementation, including hardware acquisition for turnkey systems."

Indeed, the company will "perform analyses of existing and emerging Operational and Functional Requirements at the force, theater, Combatant Commands (COCOM) and national levels to support the formulation, development and assessment of doctrine, strategy, plans, concepts of operations, and tactics, techniques and procedures in order to provide the full spectrum of Cyber Warfare and enabling capabilities to the warfighter."

During the course of their analysis Symantec learned that Duqu "uses HTTP and HTTPS to communicate with a command-and-control (C&C) server that at the time of writing is still operational."

"The attackers were able to download additional executables through the C&C server, including an infostealer that can perform actions such as enumerating the network, recording keystrokes, and gathering system information. The information is logged to a lightly encrypted and compressed local file, which then must be exfiltrated out."

To where, and more importantly by whom was that information "exfiltrated" is of course, the $64,000 question.

A working hypothesis may be provided by additional documents published by Public Intelligence.

According to a cyberwar proposal to the Pentagon by General Dynamics and HBGary, "Project C" is described as a program for the development "of a software application targeting the Windows XP Operating System that, when executed, loads and enables a covert kernel-mode implant that will exfiltrate a file from disk (or other remotely called commands) over a connected serial port to a remote device."

We're informed that Project C's "primary objectives" was the design of an implant "that is clearly able to exfiltrate an on-disk file, opening of the CD tray, blinking of the keyboard lights, opening and deleting a file, and a memory buffer exfiltration over a connected serial line to a collection station."

"As part of the exploit delivery package," HBGary and General Dynamics told their prospective customers, presumably the NSA, that "a usermode trojan will assist in the loading of the implant, which will clearly demonstrate the full capability of the implant."

Duqu, according to Symantec researchers, "uses a custom C&C protocol, primarily downloading or uploading what appear to be JPG files. However, in addition to transferring dummy JPG files, additional data for exfiltration is encrypted and sent, and likewise received."

While we don't know which firms were involved in the design of Stuxnet and now, Duqu, we do know thanks to Anonymous that HBGary had a Stuxnet copy, shared it amongst themselves and quite plausibly, given what we've learned about Duqu, Stuxnet source code may have been related to the above-mentioned "Project C."

Kevin Haley, Symantec's director of product management told The Register that "the people behind Stuxnet are not done. They've continued to do different things. This was not a one-shot deal."

Sunday, October 16, 2011

Amid Calls for 'Less Democracy,' German Security Agencies Caught Planting Spyware on Private Computers



Revelations by the Chaos Computer Club (CCC) that German secret state agencies are installing spyware on personal computers capable of transforming a PC's webcam and microphone into a listening device, sparked outrage across the political spectrum.

It has since emerged that despite legal requirements that police do so only with a warrant and only if surveillance intercepts are used to prevent threats to "life, limb or liberty," authorities are not complying with strict limits laid down by Germany's Supreme Court.

And while these disclosures may have ignited a political firestorm in Berlin, they will come as no surprise to readers of Antifascist Calling.

Three years ago, I reported that Germany's foreign intelligence service, the Bundesnachrichtendienst or BND, was caught up in a major scandal after the whistleblowing web site WikiLeaks, published documents which revealed that the agency had extensively spied on, and even recruited, journalists for use in illicit intelligence operations.

Recalling the CIA's long-running Operation Mockingbird program that enrolled journalists as spies in what are now euphemistically called "influence operations," the covert manipulation of the domestic and foreign press according to WikiLeaks, showed "the extent to which the collaboration of journalists with intelligence agencies has become common and to what dimensions consent is manufactured in the interests of those involved."

BBC News reported that "Bavaria has admitted using the spyware, but claimed it had acted within the law." And Deutsche Welle disclosed that "several additional German states have admitted to deploying spyware," including "Baden-Württemberg, Brandenburg, Schleswig-Holstein and Lower Saxony," but like their counterparts in Bavaria, those officials also claimed they had operated "within the parameters of the law."

As I have written many times, the secret state is bound by their own set of "laws." Normal rules and procedures which are supposed to protect citizens from unwarranted government intrusions are deemed inoperative for reasons of "national security."

In the United States, constitutional protections designed to guarantee the right of citizens to protest, enjoy a modicum of privacy in their daily lives or, at the most basic level, have their day in court before being executed, have been overthrown by two successive administrations who assert the right to conduct the affairs of state in secret, according to a set of legal guidelines which are unreviewable by any court.

It would appear that similar moves are underway in Germany.

'Backdoor Functionality'

The Chaos Computer Club revealed in their analysis that when they reverse engineered the program, variously dubbed "0zapftis", "Bundestrojaner" or "R2D2," they discovered that the spyware "found in the wild" and "submitted to the CCC anonymously," can "not only siphon away intimate data but also offers a remote control or backdoor functionality for uploading and executing arbitrary other programs. Significant design and implementation flaws make all of the functionality available to anyone on the internet."

Club researchers learned that "the trojan's developers never even tried to put in technical safeguards to make sure the malware can exclusively be used for wiretapping internet telephony, as set forth by the constitution court. On the contrary, the design included functionality to clandestinely add more components over the network right from the start, making it a bridge-head to further infiltrate the computer."

"The government malware can," analysts noted, "unchecked by a judge, load extensions by remote control, to use the trojan for other functions, including but not limited to eavesdropping."

"This complete control over the infected PC, is open not just to the agency that put it there, but to everyone. It could even be used to upload falsified 'evidence' against the PC's owner, or to delete files, which puts the whole rationale for this method of investigation into question."

Their study also "revealed serious security holes that the trojan is tearing into infected systems. The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the trojan are even completely unencrypted. Neither the commands to the trojan nor its replies are authenticated or have their integrity protected."

"We were surprised and shocked by the lack of even elementary security in the code. Any attacker could assume control of a computer infiltrated by the German law enforcement authorities," a CCC spokesperson commented. "The security level this trojan leaves the infected systems in is comparable to it setting all passwords to '1234'."

Nothing 'Magical' about this 'Lantern'

There are glaring similarities between the "R2D2" package deployed by German police and "Magic Lantern" software used by the FBI. As with Bureau spyware, the German program is a keystroke logging virus installed via a malicious email attachment or by exploiting operating system vulnerabilities.

When news of the FBI program first broke back in 2000, the Electronic Privacy Information Center (EPIC) obtained documents under a Freedom of Information Act request relating to the system, which were part of a suite of surveillance tools then called Carnivore.

At the time, EPIC revealed that the FBI "had developed an Internet monitoring system that would be installed at the facilities of an Internet Service Provider (ISP) and would monitor all traffic moving through that ISP."

Once a user is spoofed into installing the malicious Trojan, it is activated when PGP encryption is used to enhance email security. When switched on, the Trojan will log the PGP password which will then allow the agents to read the encrypted communications unbeknownst to the sender. Since its first iteration in the 1990s, such programs are exponentially more sophisticated and are now capable of scooping-up virtually everything a user stores on a computer or handset.

A 2007 exposé by Wired Magazine revealed that Magic Lantern's "computer and internet protocol address verifier" or CIPAV, "gathers a wide range of information, including the computer's IP address; MAC address; open ports; a list of running programs; the operating system type, version and serial number; preferred internet browser and version; the computer's registered owner and registered company name; the current logged-in user name and the last-visited URL."

And once that data was obtained, it was siphoned-off to the Bureau's technology laboratory in Quantico, Virginia via fiber optic splitter cables.

As whistleblower Babak Pasdar revealed in 2008, following earlier disclosures by AT&T whistleblower Mark Klein, Verizon, and other giant telecommunications firms, including AT&T, maintained a high-speed DS-3 digital line that handed the Bureau and other security agencies "unfettered" access to the carrier's wireless network, including billing records and customer data "transmitted wirelessly."

Just after the scandal broke, Wired Magazine disclosed that "two years before the Bavarian state in Germany began using a controversial spy tool to gather evidence from suspect computers, German authorities approached the Federal Bureau of Investigation to discuss a similar tool the U.S. law enforcement agency was using."

"Bavarian authorities," Wired reported, "began using their spyware in 2009. It's not known if that spyware is based on the FBI's, but in July 2007, German authorities contacted the FBI seeking information about its tool."

The FBI's assistant legal attache in Frankfurt "sent an email to Bureau colleagues on July 24, 2007, writing, 'I am embarrassed to be approaching you again with a request from the Germans ... but they now have asked us about CIPAV (Computer Internet Protocol Address Verifier) software, allegedly used by the Bu[reau]'."

The email uncovered by Wired was part of a huge cache of files obtained by the Electronic Frontier Foundation (EFF) in response to their 2007 Freedom of Information Act request for data on CIPAV.

In the years since those disclosures, secret state surveillance is more pervasive than ever and and now includes the "lawful interception" of GPS locational data streamed automatically to their manufacturers or hosting services by smart phones.

It appears that German secret state officials are playing a similar game. According to Der Spiegel, at least two agencies, the Bundeskriminalamt, or BKA, the federal crime investigation agency equivalent to the FBI, and some 16 Landeskriminalamt or LKAs, regional investigative bureaus, may have deployed the malware during wide-ranging investigations unrelated to terrorism.

Following Chaos Computer Club revelations, it is clear that German authorities have been caught red-handed violating a landmark decision by the Supreme Court. "The court," Der Spiegel noted, "specified that online spying was only permissible if there was concrete evidence of danger to individuals or society."

In a follow-up piece, Der Spiegel disclosed that the firm DigiTask was the spyware's developer. Along with hundreds of similar firms, DigiTask is a niche security outfit that develops applications for the so-called "lawful interception" market.

In 2008, WikiLeaks released two documents concerning "interception technology for Skype and SSL in Bavaria, Germany. The first document is a communication by the Bavarian Ministry of Justice to the prosecutors office, relating to cost distribution for the interception licenses between police and prosecution. The second document allegedly presents the offer made by Digitask, the German company developing the technology, and holds information on pricing and license model, high-level technology descriptions and other detail."

According to the WikiLeaks analysis, the DigiTask offer "introduces a basic description of the cryptographic workings of Skype, and concludes that new systems are needed to spy on Skype calls."

We were informed in that letter that German police were interested in standing-up a "Skype Capture Unit."

"In a nutshell: malware is installed onto a target machine, to intercept Skype Voice and Chat. Another feature introduced is a recording proxy, that is not part of the offer, yet would allow for anonymous proxying of recorded information to a target recording station. Access to the recording station is possible via a multimedia streaming client, supposedly offering real-time interception."

"Another part of the offer," WikiLeaks noted, was related to "an interception method for SSL based communication, working on the same principle of establishing a man-in-the-middle attack on the key material on the client machine. According to the offer, this method works for Internet Explorer and Firefox web browsers. Digitask also recommends using overseas proxy servers, to cover the tracks of all activities."

As it turns out those proxy servers were conveniently located in the United States. This raises the distinct possibility that information captured by German secret state officials is also being shared with "partner agencies" of their close NATO ally, the CIA, FBI and NSA.

This was confirmed by CCC's analysis of R2D2's code. "To avoid the location of the command and control server, all data is redirected through a rented dedicated server in a data center in the USA. The control of this malware is only partially within the borders of its jurisdiction."

"Considering the incompetent encryption and the missing digital signatures on the command channel, this poses an unacceptable and incalculable risk. It also poses the question how a citizen is supposed to get their right of legal redress in the case the wiretapping data get lost outside Germany, or the command channel is misused."

The short answer is, they can't.

Aside from lining the pockets of DigiTask shareholders, there are more sinister uses for the malware. As the World Socialist Web Site noted "the remote-control function could be used to load and execute malicious software, and to plant bogus digital evidence on the computer, which can then be detected if the computer was seized. A suspect would have no way of proving that this had happened."

This would certainly be a convenient way to "neutralize" a troublesome politician, journalist or over-eager anticorporate campaigner.

'Less Democracy'

Following similar efforts in the United States, evidence that police are illegally spying on German citizens using sophisticated malware developed for the government are neither benign nor accidental events.

As a recent article in German Foreign Policy disclosed, leading voices in Europe's largest state are "pleading for a transition toward 'less democracy'." A recent book, published under the title, Dare Less Democracy, claims that the "voice of the people" and the "'emancipatory Zeitgeist, putting everything into question,' has a too 'paralyzing influence" on current governance'."

"The author," the critical online leftist magazine observes, "demands to 'correct the system' for 'more efficient policy making.' These 'corrections' must include the dismantlement of democratic participation."

Author Laszlo Trankovits, the bureau chief of the Deutsche Presse Agentur in South Africa, who had previously worked for the agency in Washington "as its White House correspondent," explained "it should never be suggested that a 'democratic society can do away with inequality and establish social justice'."

"Trankovits," German Foreign Policy notes, is "a member of the elitist Rotary-Club." He demands that "the elite clearly 'commits itself to capitalism and profit,' and that 'intelligent forms of public relations' be used to communicate policy measures to the population. However, the demand for more 'transparency' is 'counterproductive and paralyzing' for any 'governance efficiency' and must be rejected."

That drivel such as this was penned by a journalist for Germany's leading news agency, to whit, that the media should serve as a propaganda mouthpiece for casino capitalist interests, is one more sign that democratic norms, already seriously eroded in the West, are now being rapidly jettisoned by our political masters.

With the global capitalist system on the verge of a repeat performance of the 2008 meltdown, and with a worldwide resurgence of opposition to the one-sided costs of saving a system of financial plunder borne by the working class, elite calls for "less democracy" are warning signs that stern measures, including blanket surveillance and naked police violence, are in the offing.