INFO  LOG-00   MFA-00   AF-00    CIAE-00  DNI-00   DODE-00  WHA-00
      PERC-00  EAP-00   DHSE-00  EUR-00   OIGO-00  TEDE-00  INR-00
      IO-00    MOFM-00  MOF-00   NEA-00   DCP-00   ISN-00   OIC-00
      OIG-00   MA-00    P-00     ISNE-00  DOHS-00  FMPC-00  SP-00
      IRM-00   SSO-00   SS-00    DPM-00   USSS-00  NCTC-00  CBP-00
      DSCC-00  SCA-00   SAS-00   FA-00    SRAP-00  GSWA-00
(TEDE) /000R


063860
SOURCE: CBLEXCLS.000423
DRAFTED BY: DS/DSS/CC:JBACIGALUPO -- 06/19/2009  571-345-3132
APPROVED BY: DS/DSS/CC:JBACIGALUPO
                  ------------------7CAAD7  191822Z /38
P 191717Z JUN 09
FM SECSTATE WASHDC
TO SECURITY OFFICER COLLECTIVE PRIORITY
AMEMBASSY TRIPOLI PRIORITY
INFO AMCONSUL CASABLANCA PRIORITY
XMT AMCONSUL JOHANNESBURG
AMCONSUL JOHANNESBURG

S E C R E T STATE 063860

NOFORN

E.O. 12958: DECL: MR

TAGS: ASEC

SUBJECT: DIPLOMATIC SECURITY DAILY

Classified By: Derived from Multiple Sources

SECRET//FGI//NOFORN

Declassify on: Source marked 25X1-human, Date of source: June 18, 2009

¶1. (U) Diplomatic Security Daily, June 19, 2009

¶2. (U) Significant Events ) Paragraphs 6-10

¶3. (U) Key Concerns ) Paragraphs 11-19

¶4. (U) Cyber Threats ) Paragraphs 20-27

¶5. (U) Suspicious Activity Incidents ) Paragraphs 28-31

¶6. (U) Significant Events

¶7. (S) EUR - Bosnia-Herzegovina - Emergency Action Committee (EAC) Sarajevo met June 17 to discuss a large protest by veterans groups scheduled for June 18 at the Bosnian Government building adjacent to the U.S. Embassy,s Chancery building. The RSO made a number of recommendations, to which the EAC concurred. The protest began at 10 a.m. on June 18 with over 2,000 war veterans and supporters disputing reductions in pensions. Local law enforcement blocked the street in front of the Embassy at 9:30 a.m., and the Mission was placed on essential personnel status. At one point, 20 to 30 protesters tried to storm the government building, breaking some windows. Host-nation media reported two people were injured in an altercation with local police in this attempt. The demonstrators maintained their distance from Post, which will be open for normal operations today, June 19. (Appendix source 1)

¶8. (C) AF - Eritrea - The UN security officer in Asmara reported to the U.S. Embassy,s Regional Security Office that he has recently instructed all UN personnel to avoid walking in Asmara and is upgrading residential security at all houses to include around-the-clock guard coverage in response to the rise in crime in the capital. Post continues to see an increase in crime as economic conditions in Asmara continue to deteriorate, water/food/fuel shortages persist, and unemployment increases. Although the Embassy is still able to purchase water for Mission use, it is becoming increasingly more difficult. (Appendix source 2)

¶9. (SBU) Mali - At 12:30 p.m. on June 18, RSO Bamako was notified by the Surveillance Detection Team that a man was closely observing the Chief of Mission,s (COM,s) residence. The man then walked over to the guard post and questioned the guards about the COM and why so much security was needed. An investigator interviewed the man and discovered that he is an Indian national with an Indian passport that displayed extensive travel to West Africa. (RSO Bamako Spot Report)

¶10. (SBU) Zimbabwe - Jocelyn Chiwenga, wife of Defense Forces Chief Constantine Chiwenga, called the U.S. Ambassador to Zimbabwe June 18 and insulted and threatened him. On other occasions, she has spoken with Embassy staff and criticized the U.S. with profanity and abusive language. Post does not believe Chiwenga poses a physical threat; however, the RSO has been briefed and is scheduled to meet with contacts at the Zimbabwe Republic Police. This incident will be addressed in a diplomatic note to the Ministry of Foreign Affairs. (Harare 0502)

¶11. (U) Key Concerns

¶12. (S//NF) AF - Somalia - TFG minister of national security killed in suicide bombing: On the afternoon of June 18, Transitional Federal Government (TFG) Minister of National Security Omar Hashi was killed by a suicide vehicle-borne improvised explosive device while in the Medina Hotel in Beletweyne. Former Somali Ambassador to Ethiopia Abdikarim Farah was also reported to be dead. Initial open source reports from a local hospital indicate the attack resulted in 20 casualties; later reporting shows more than 50 dead and 100 injured. No group has publicly claimed responsibility for the attack, but an intelligence report of limited credibility alleges al-Shabaab operatives are to blame.

¶13. (S//NF) DS/TIA/ITA notes this is first suicide attack in Beletweyne, and, if al-Shabaab operatives are indeed responsible, it further suggests the group is altering tactics in its fight against the TFG, specifically to incorporate the use of suicide operations. Recently received Ethiopian intelligence suggested al-Shabaab operatives were preparing to use a number of car bombs in suicide attacks against various targets in Mogadishu in late June.

¶14. (S//NF) Suicide bombs are increasingly common in Somalia. According to press reports, 30 lethal suicide bombings have occurred since five went off in October in Somaliland. Tearline from May 26 stated, &The Somali extremist group al-Shabaab employed the use of a suicide bomber against TFG soldiers in Mogadishu on May 24, resulting in at least six soldiers and one civilian killed. The attack was the first suicide attack against supporters of moderate Islamist President Sheikh Sharif Sheikh Ahmed.8 The death of Hashi in addition to the June 17 killing of Bandadir Region Police Chief Ali Said will likely demoralize and impair the struggling TFG in the near term, as could al-Shabaab,s possible increasing willingness and ability to utilize suicide attacks on TFG leadership in Somalia. (Open sources; Nairobi 1237; Appendix sources 3-6)

¶15. (S//NF) NEA - Persian Gulf - Possible fabricator warns of Iranian threat: According to information provided during a liaison exchange by an Emirati Government service originating from a suspected fabricator, as of mid-June, the Iranian Revolutionary Guard Corps (IRGC) was planning an unspecified attack in the United Arab Emirates. Iranian agents allegedly shipped four weapons to the port at Jebel Ali circa March, with a final destination to the emirate of Ajman. Additionally, the IRGC planned to conduct attacks in Saudi Arabia, Kuwait, and Bahrain using different teams. No further information was provided regarding these alleged operations.

¶16. (S//NF) DS/TIA/ITA agrees with the CIA assessment included in the full report, which states the information is likely fabricated. Concern over possible Iranian sleeper cells is nothing new for Gulf governments; a volume of reporting illustrates the mistrust of Sunni regimes in the region regarding their Shi,a communities. However, DS/TIA/ITA assesses it is unlikely Tehran will conduct a major (or attributable) operation against U.S., Western, or Gulf-nation interests lacking a significant regional event such as a military strike against Iran. (Appendix source 7)

¶17. (S//NF) SCA - India - LT member Shafiq Khafa possibly preparing for operations: Tearline reports, &Hussein, an India-based Lashkar-e-Tayyiba (LT) member, continued operational planning on three tasks in early June. The tasks were associated with a possible operation against Gujarat Chief Minister Narendar Modi, the establishment of a training camp, and unspecified work involving a car. Hussein would coordinate his activities with an India-based colleague identified as Sameer.8

¶18. (S//REL TO USA, FVEY) Separate tearline indicates, &Pakistan-based Shafiq Khafa prepared in mid-June with India-based associate S J for possible operations in India. Khafa was looking for information on possible training sites in the Indian states of Tamil Nadu, Karnataka, and Kerala.8

¶19. (S//NF) DS/TIA/ITA notes earlier credible tearline suggests Khafa,s network is striving to stand up two teams in southern India that rely on the support of LT members based in India, Sri Lanka, Pakistan, and Nepal. Although specific details of planned LT attacks remain unknown, late-May intelligence indicates Khafa,s cells were engaged in surveillance activities of potential targets, likely in southern India. Early-May reporting further suggests Kerala or Tamil Nadu may be used as a base of operations following the establishment of a facilitation team in Sri Lanka, with the estimated time of completion for setting up the facilitation route and camps to be two to three months. (Appendix sources 8-18)

¶20. (U) Cyber Threats

¶21. (SBU) Domestic - DoS staff targeted by spear phishing as climate change talks are underway:

¶22. (C//NF) Key highlights:  The UNFCCC aims to commit developed nations to a plan for reducing GHG emissions.  U.S.-PRC talks are in progress to reach consensus on new GHG emission requirements.  DoS personnel have been targeted with socially engineered climate change-related e-mail.  It is probable that receipt of climate change-themed socially engineered messages will persist as negotiations continue.

¶23. (U) Source paragraph: &China and the U.S. failed to achieve a breakthrough at their latest round of climate talks on Wednesday (June 10), raising the stakes in the global effort to fight global climate change. The two countries responsible for almost half of the world,s greenhouse gas (GHG) emissions ended three days of negotiations in Beijing.8

¶24. (SBU) CTAD comment: In June 1992, a United Nations Conference on Environment and Development -- informally known as the Earth Summit -- was held in Rio de Janeiro, Brazil. During this conference, the United Nations Framework Convention on Climate Change (UNFCCC) -- a treaty intended to &achieve stabilization of GHG concentrations in the atmosphere at a low enough level to prevent dangerous anthropogenic interference with the climate system8 -- was produced. The UNFCCC, primarily focused on the voluntary stabilization of GHG emissions by industrialized countries, was ratified and put into effect March 21, 1994. In order to evaluate the progress of UNFCCC signatories, the parties involved gather annually in meetings dubbed Conferences of the Parties (COPs). At COP-3 held in Kyoto, Japan, in December 2007, a protocol to the UNFCCC called the &Kyoto Protocol8 was adopted, outlining in part legally binding commitments for the reduction of GHG emissions for developed nations. The terms of this protocol are set to expire in 2012, and the goal of this year,s COP-15, which will be held December 1 to 18 in Copenhagen, Denmark, is to establish a new agreement among concerned nations prior to the Kyoto Protocol,s end.

¶25. (S//NF) CTAD comment: Currently, the U.S. and People,s Republic of China (PRC) -- two of the world,s largest contributors of GHGs -- are conducting specific negotiations on the topic in attempts to come to an agreement on what level of cuts in GHG emissions should be attained. As these negotiations have been underway, evidence of an attempt to gain unauthorized entry to computer systems operated by DoS personnel involved with climate issues has surfaced. Though the incident has not been attributed to any known hostile actor, the event appears to be a targeted spear-phishing attempt and may be indicative of efforts to gather intelligence on the U.S.,s position on climate change issues.

¶26. (SBU) CTAD comment: On June 1, CTAD,s Technical Analysis/Special Operations monitoring detected a malicious e-mail massage targeting five DoS individuals employed within the Division of Ocean Affairs, Office of the Special Envoy for Climate Change. The socially engineered message had the subject line &China and Climate Change8 and was spoofed to appear as if it were from a legitimate international economics columnist at the National Journal. In addition, the body of the e-mail contained comments designed to appeal to the recipients as it was specifically aligned with their job function, and a signature block with contact information for the spoofed sender was present. Attached to the message was a PDF file, also titled &China and Climate Change,8 which harbored malicious code designed to exploit the Adobe Collab  getIcon(), JavaScript vulnerability (CVE-2009-0927). This vulnerability, if executed successfully, would have allowed malicious actors to remotely execute arbitrary code on a victim computer. The PDF document also contained the Poison Ivy Remote Administration Tool -- a malicious software program that provides a remote user with nearly complete control over a comprised system. However, since the DoS users targeted in this intrusion attempt were operating with currently patched versions of Adobe software, there was neither compromise nor data lost as a result of this incident (for technical information about the incident, see CTAD Report TR-09-034).

¶27. (C//NF) CTAD comment: DoS employees dealing with sensitive diplomatic matters are often targets of social-engineering schemes conducted by actors seeking to harvest sensitive information from DoS computer systems and networks. As negotiations on the subject of climate change continue, it is probable intrusion attempts such as this will persist. CTAD recommends personnel involved with climate change issues or topics relating to the upcoming COP-15 continue to remain aware of the elevated risk of targeted socially engineered e-mail and report any suspicious messages to their information systems security officer (ISSO). (Financial Times (http://www.ft.com), &Biggest emitters fail to show the way forward,8 June 10, 2009; Appendix source 19)

¶28. (U) Suspicious Activity Incidents

¶29. (SBU) SCA - Uzbekistan - A vehicle with two occupants was parked across the street from U.S. Embassy Tashkent June 2. During the cited period, VIP visitors arrived at Post for a meeting with the Ambassador. The diplomatic police were asked to check the vehicle, but they did not act. Five minutes later, the vehicle moved about 80 meters from the Embassy and parked. After several more requests, the police finally walked over to the car and spoke to the driver. He indicated he was waiting for his friend who was &visiting8 the Consular Section. Shortly afterward, the vehicle departed the area without picking anyone up.

¶30. (SBU) RSO Action/Assessment: It is possible this was some sort of surveillance activity by the host government or others. All relevant information was passed to the police; however, it is highly unlikely the Embassy will hear anything. The Uzbeks do not share information or reveal the results of their investigations.

¶31. XXXXXXXXXXXX SECRET//FGI//NOFORN
Full Appendix with sourcing available upon request. CLINTON
NNNN
End Cable Text
 XXXXXXXXXXXX