5:30 PM ET, Wednesday, November 29, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines:
THE TOP STORIES
U.S. Alleges Indian Official Ordered Assassination of Sikh Separatist in New York. U.S. prosecutors allege that an Indian official, who described himself as a “senior field officer” responsible for intelligence,” ordered the assassination of a Sikh separatist leader in New York City in May. Federal prosecutors said the official recruited Nikhil Gupta, an Indian national, to orchestrate the murder. The Department of Justice said the official agreed to pay $100,000 to a hit man to carry out the assassination in a plot organized by Gupta. The indictment did not name the target, but senior Biden administration officials have said it was Gurpatwant Singh Pannun, general counsel for the New York-based Sikhs for Justice. The group advocates for the creation of an independent Sikh state called Khalistan in India. U.S. prosecutors said Gupta ordered the hit man to carry out the murder on June 19, but U.S. authorities foiled the plot. Czech authorities arrested Gupta on June 30. It is unclear when he will be extradited to the U.S.
Indian Foreign Ministry spokesman, Arindam Bagchi, said on Wednesday that India has set up a “high-level inquiry committee” to investigate the plot after the U.S. raised concerns about the matter. President Joe Biden and other top administration officials have raised the issue with the Indian government at the highest levels.
The New York killing would have taken place a day after the assassination of Hardeep Singh Nijjar, another Sikh separatist leader, in Canada. Canadian Prime Minister Justin Trudeau has said there were “credible allegations” that the Indian government was involved in the killing of Nijjar. India has denied the accusations as “absurd.” Canada expelled the station chief for India’s foreign intelligence service, and India retaliated by expelling a Canadian intelligence officer and dozens of Canadian diplomats. Gupta said that Nijjar and the Sikh separatist in New York were on the same list of targets. Axios New York Times Wall Street Journal Washington Post
Biden Attempts to Show How U.S. Industry is Benefiting from Funding for Ukraine Aid. The Biden administration is urging Congress members to back further aid for Ukraine by showing how U.S. military aid for Kyiv is creating jobs for Americans. The administration has emphasized that funds for products that aid Ukraine or replace equipment sent to Kyiv have been invested in manufacturing facilities across the U.S. In recent days, the administration has circulated documents to Congress members detailing what funding states have received. Topping the list, Pennsylvania has received $2.364 billion — the most of any state — for arms production, Arizona has received $2.196 billion, and Texas has received $1.45 billion to produce 155 millimeter shells and other weapons. The administration has also circulated maps on Capitol Hill with a state-by-state breakdown of $27 billion of spending on “munitions and tactical vehicle procurements” to help Ukraine. The map shows that companies in Arizona, Pennsylvania, Arkansas, and Wisconsin are collectively receiving over $1 billion in contracts related to Ukraine aid. Another $18 billion in contracts is spread across industry over two dozen other states. Efforts to spread information on how U.S. funding in Ukraine is spent in the U.S. comes amid pushback by some lawmakers who say spending should go towards domestic issues rather than support for Kyiv. Reuters
NATO Foreign Ministers Vow to Maintain Support for Ukraine. NATO foreign ministers meeting in Brussels vowed to maintain support for Ukraine and its bid to eventually join the alliance despite concerns about future deliveries of Western military supplies and the competing crisis in the Middle East. U.S. Secretary of State Antony Blinken asserted at the meeting that while some doubt NATO backing of Ukraine, the alliance is “unwavering” and “will continue to support ensuring that Russia’s war of aggression remains a strategic failure.” Blinken also expressed confidence that President Joe Biden’s request for $61.4 billion in additional military and economic assistance for Ukraine will likely be approved by Congress, maintaining that there is “strong bipartisan support” for the additional aid. New York Times Politico Reuters
U.S.-Iran Miscalculation Could Trigger Broader Regional War. National security officials are raising concerns that a miscalculation in the tit-for-tat attacks between U.S. forces in the Middle East and Iranian-backed groups in the region could trigger a wider regional war, even as Washington and Tehran say they don’t want the Israel-Hamas conflict to spread. Iranian-backed militias have launched over 70 rocket and drone assaults against U.S. troops in Iraq and Syria since the Hamas attacks against Israel on October 7. Analysts say these Iran-backed attacks may be a warning to the U.S. of what would happen if Israel broadens its conflict with Hamas to include Iran and its other proxies. The U.S. has launched four reprisal attacks that have killed as many as 15 people. U.S. officials have said the targeted U.S. response is aimed at deterring Iran and its proxies to contain the conflict in Gaza. Officials say this is mostly working, but escalation could still happen if fighting increases between Israel and Iran-backed groups, namely Hezbollah, or if attacks by an Iranian proxy cause significant U.S. casualties, which they have yet to do so far. New York Times
ISRAEL AND HAMAS WAR
Hamas Releases Additional Hostages as Ceasefire Nears End. The Israeli military said Hamas released 10 Israeli women and children and four Thai nationals to the Red Cross in Gaza and that they are headed for Israel. Israel also confirmed that Hamas released two Russian-Israeli citizens earlier. Israel is expected to free 30 Palestinian female prisoners being held at Ofer prison in the occupied West Bank in exchange. The Palestinian Islamic Jihad (PIJ) said earlier that it handed over several hostages as part of the exchange deal, apparently confirming that Hamas was not the only group to take hostages during its attacks against Israel on October 7. It was not immediately clear whether the PIJ handed over hostages to Hamas or directly to the Red Cross. Hamas also separately told Israeli authorities that three hostages — including a 10-month-old-baby — were killed in an Israeli air strike in Gaza. The Israeli military said it is investigating the claim. The U.N. reports that Israel has released 180 Palestinian prisoners and Hamas has released 63 Israelis and 20 foreign nationals during the ceasefire, which started last week and is set to expire on Thursday. The U.S., E.U. and others are pressing for another extension of the ceasefire to allow for more hostage releases and further distribution of aid in Gaza. Associated Press The Guardian Reuters Washington Post
Israeli Military Raids Jenin in West Bank. The Israel Defense Forces (IDF) said it conducted an operation in the Jenin refugee camp in the occupied West Bank on Wednesday. Two boys, aged 8 and 14, were shot dead during the raid. The Palestinian Ministry of Health said the pair were killed by the Israeli military. Israel’s army did not directly comment on the boys, but said it killed two “senior terror operatives” during the raid, including a key Islamic Jihad leader. It also said that suspects throwing explosive devices at Israeli troops were shot by live fire. The Israeli military also said it arrested 17 Palestinians in the raid. Al Jazeera BBC Reuters
France says E.U. Should Consider Israeli Settler Sanctions. France has said that the E.U. should consider sanctions on Israeli settlers who have targeted Palestinians in the occupied West Bank. A French foreign ministry spokesperson said that the sanctions would be in line with the international community’s role in ending such violence in the West Bank that is “extremely destabilizing” and also harms the prospects for a two-state solution. The U.S. has previously said it is prepared to issue visa bans against “extremists” who are attacking civilians in the West Bank. The U.N. reports that there have been at least 287 settler attacks against Palestinians in the West Bank since October 7. Separately, the French foreign ministry spokesperson said there are ongoing talks in Brussels to impose sanctions and freeze assets of Hamas commanders. Reuters Washington Post
THE UKRAINE UPDATE
Ukraine Accuses Russia of Poisoning Military Intelligence Chief’s Wife. Ukraine has accused Russia of poisoning Marianna Budanova, the wife of Kyrylo Budanov, the head of Ukraine’s military intelligence agency GUR. A Ukrainian military intelligence agency spokesman said Ukrainian investigators’ “main hypothesis” is that Russia was involved in a poisoning attempt. The spokesman added that mercury and arsenic were used in the attack, which may indicate a “deliberate poisoning attempt.” Russian authorities did not immediately comment on the matter. France 24
U.S. Official says Putin Won’t Decide on Peace in Ukraine Until After 2024 U.S. Election. A senior State Department official speaking on condition of anonymity said on Tuesday that he expects Russian President Vladimir Putin will not make peace with Ukraine before knowing the outcome of the 2024 U.S. presidential election. The official said this is a “widely shared premise” within the U.S. government. The official did not explicitly say how the election could impact the conflict, though his comments come amid concern that a victory by former President Donald Trump, who has been critical of U.S. aid for Ukraine, could alter U.S. policy on support for Kyiv. Reuters
Russia Warns Against Polish Troop Deployment to Finnish-Russian Border. The Kremlin has warned Finland that any “concentration” of troops on their border will be seen as a threat. The warning comes after Poland offered to send military advisors to help Finland police its eastern border with Russia. The head of the Polish National Security Bureau, Jacek Siewiera, said the advisors would help counter the “hybrid attack” on the border, referencing Finland’s accusation that Russia is sending asylum seekers to the border in an artificial migrant crisis to pressure Helsinki for its military cooperation with the U.S. Kremlin spokesman Dmitry Peskov said the Polish offer is a “redundant measure” since “there is no threat” at the border, adding that any deployment would be unprovoked and unjustified. Reuters
Russia Preparing ‘Loyalty Agreement’ for Foreigners. Russia's interior ministry has reportedly prepared draft legislation that would compel foreigners entering Russia to sign a "loyalty agreement.” The agreement would restrict what they could say in public, forbidding them from criticizing Russian policy or discrediting Soviet history. It would also forbid them from disrespecting traditional family values, requiring them to obey clauses about morality, family, and “"propaganda about non-traditional sexual relations.” Since the start of Russia’s invasion of Ukraine in February 2022, Russia has introduced tough laws prohibiting the discrediting of the military. Russian courts have likewise handed lengthy jail sentences to opposition activists. Foreign diplomats and opposition activists say authorities will further tighten restrictions ahead of the 2024 presidential election. Al Jazeera Reuters
THE CYBER AND TECH RUNDOWN
Additional Details Emerge on Iran-Linked Targeting of Pennsylvania Water Facility. “Cyber Av3ngers,” a hacking group linked to Tehran’s Islamic Revolutionary Guard Corps (IRGC), was behind a cyber incident at a Pennsylvania water utility last week that allowed remote control of at least one device. CISA Executive Assistant Director Eric Goldstein said in a statement that the agency is “closely engaged with sector and interagency partners to understand this evolving situation and provide any necessary support or guidance.” Robert Bible, the general manager of the Municipal Water Authority in Aliquippa, there was never any threat to water availability, and the utility transitioned to manual operations when the hack was discovered. Another utility executive noted that the hackers did not access “anything in our actual water treatment plant — or other parts of our system — other than a pump that regulates pressure to elevated areas of our system.” A cyber threat analyst told CyberScoop that the “Cyber Aveng3rs” persona is “without a doubt IRGC.” He added that the group shows links to another IRGC-linked persona active in the wake of Hamas’ Oct. 7 attack, Soldiers of Solomon. The hackers apparently targeted a programmable logic controller software produced by the Israeli company, Unitronics. The group left a message that read, “You have been hacked. Down with Israel. Every equipment ‘made in Israel’ is a Cyber Av3ngers legal target.” A CISA alert reported that the agency is responding to “active exploitation” of Unitronics PLCs used in the water sector, implying that there may be more than one incident. The agency said poor security practices at the Aliquippa station allowed the hackers to exploit the Unitronics device. CyberScoop CNN
DHS Secretary Outlines AI Use Cases for Investigations, Defense Against Cyber Threats. DHS Secretary Alejandro Mayorkas told the Axios AI+ summit in Washington on Tuesday that the department’s work related to AI has gone into “hyperdrive” in the face of increasing hacker use of the technology. Mayorkas said the department is juggling several AI priorities, which include the use of AI in criminal investigations and devising defenses against the inevitable use of “adversarial” AI by threat actors. Public-private collaboration continues to be key to DHS’ approach to AI and other national security issues, with Mayorkas noting "we are on a right path of a private-public partnership." Mayorkas also said the department is employing AI in investigations dealing with the fentanyl crisis and missing children. DHS also has embraced AI-powered algorithms to collect, process and analyze huge data volumes in a wide variety of fields. A specific AI application is report processing, which Mayorkas explained enables staff to review interviews and other documentation to identify patterns and linkages and “do that in a matter of seconds” to uncover connections we “previously would not have been aware of.” Axios NextGov
Otka System Breach Exposed Data of All Users of Client Support System. A much larger number of Okta customers than previously reported potentially had information exposed in a network breach two months ago. The company, which manages user authentication services for thousands of organizations, notified customers this week that hackers extracted a file containing the names, email addresses, and other data of all clients in its customer support system. Okta warned affected customers to be wary of an increased risk of phishing and social engineering attacks and advised them to to implement multifactor authentication. Otka also urged users with administrative authority over client systems to use phishing resistant authenticators, such as a Yubikey, or smartcards like the PIV and CAC cards used by federal and defense customers. Otka government customers include dozens of federal agencies including the Pentagon, Treasury, NASA, and the Centers for Medicare and Medicaid Services. The company’s commercial clients include FedEx, Zoom, and JetBlue. Bloomberg NextGov The Record
Chinese Firm Announces Country’s First Advanced DRAM Chip for Mobile Devices. A Chinese semiconductor firm, ChangXin Memory Technologies, has produced the country’s first advanced dynamic random access memory (DRAM) chip in a development that will allow China to reduce dependence on foreign suppliers. ChangXin posted an announcement to its website on Wednesday that Chinese smartphone manufacturers have validated the company’s 12-gigabyte (GB) version that packs 8 dies each with a capacity of 12 gigabits (Gb). ChangXin described a 50 percent improvement in data transfer speed and capacity in its latest product, which also reduces power consumption by 30 percent. The company said the chip will “diversify its product offerings and further expand its presence” in the mobile devices market. According to Brady Wang, associate director with the Counterpoint research firm, ChangXin “still faces an uphill battle in ramping up production yields and being competitive in both price and quality compared to similar products on the market made by South Korean DRAM makers.” South China Morning Post
Japan Space Agency Network Server Hacked, No Sensitive Information Exposed. A network server operated by the Japan Aerospace Exploration Agency (JAXA) apparently was breached in a cyberattack several months ago although no sensitive information on rockets or satellites was compromised. The government and other authorities are conducting an investigation to identify the attacker, the scope of the intrusion, and any lingering vulnerabilities in the space agency’s systems. JAXA said in a statement, "there was a possibility of unauthorized access by exploiting the vulnerability of network equipment.” The Japanese newspaper Yomiuri Shimbun reported that the hackers gained unauthorized access to the central Active Directory server that manages employee IDs and passwords as well as viewing privileges. Another Japanese media outlet said the hackers exploited a vulnerability that was identified in June. Currently, the JAXA website is operational. Reuters The Record Nikkei Asia
ELSEWHERE IN THE WORLD
Europe
German Authorities Arrest Two Teenagers Suspected of Planning Attack. German authorities said on Wednesday that they arrested two teensagers — one in North Rhine-Westphalia and the other in Brandenburg — on suspicion of planning an attack on a Christmas market. Brandenburg Interior Minister Michael Stuebegen said one of the teenagers who was arrested is a “Russian youth.” A source close to the matter said that the teenager was a 16-year-old Russian citizen from Chechnya. Reuters
German Intelligence Heightens Terror Threat. Germany’s Federal Office for the Protection of the Constitution (BfV), its domestic intelligence agency, warned that the threat of an Islamist terror attack is “higher than it has been for a long time” following the Hamas attacks against Israel on October 7. The BfV’s threat assessment highlighted that groups like Islamic State and al Qaeda are being motivated to make “expressions of support (for Hamas) that previously seemed hardly conceivable,” noting that antisemitism is a “common denominator” between the groups. BfV leader Thomas Haldenwang described this as an increase in calls for violence across the “jihadist spectrum.” The BfV said other E.U. members have already experienced terror attacks in recent weeks and are also raising their national terror alert levels. Deutsche Welle Reuters
ANALYSIS – German Military Revitalization Falling Flat. German Chancellor Olaf Scholz’s promise to commit 100 billion euros, or nearly $110 billion, to raise military spending after the start of the Ukraine war has largely not materialized. Much of the funds have yet to be allocated or are going to weapons that will not be delivered for years due to procurement delays and the slow revitalization of long-dormant production lines. Doubts about the military push have further increased as the German economy slows. Officials say bureaucracy delays and low military supplies are key issues for the revamp. New York Times
ANALYSIS- NATO Grappling with Crises in Ukraine, Middle East. NATO is facing pressure as it deals with simultaneous crises in the Middle East and Ukraine. NATO has been focused on supporting Ukraine in countering Russia, and NATO Secretary-General Jens Stoltenberg affirmed at a meeting of NATO foreign ministers in Brussels that Europe is the alliance’s main area of responsibility. However, delegations to the meeting stressed that NATO cannot ignore the security implications of the Israel-Hamas conflict, with officials discussing issues like the security of NATO forces in Iraq, turmoil for NATO’s Middle East partners, and related security concerns for NATO’s southernmost members. There are also issues, like rising tensions in the Balkans between Serbia and Kosovo, that NATO officials said the alliance must address. Wall Street Journal
Asia and Oceania
ANALYSIS- The U.S. Courts the Philippines to Counter China. The Biden administration has rushed to reset relations with the Philippines after President Ferdinand Marcos Jr.'s election last year. Since Marcos took office, the U.S. has sent patrol boats and surveillance aircraft and committed deliveries of coastal and air defense systems, drones, and other military equipment over the coming years. Marcos has reciprocated by expanding U.S. military access in the Philippines. The “unprecedented love-bombing,” as one analyst described it, is part of U.S. efforts to strengthen Indo-Pacific alliances as part of efforts to counter China. The Philippines is a key military ally for the U.S. and is strategically significantly important since it is near both Taiwan and the South China Sea. The U.S. moves to bolster ties with the Marcos administration come after a period of tensions with his predecessor President Rodrigo Duterte, who had a pro-Beijing stance. The Philippines has been quick to move from Duterte’s approach to China since it was unpopular with the Filipino public, failed to generate as much Chinese investment as promised, and did not stop escalating territorial disputes between the two nations. In a sign of this, Philippine officials told Reuters that the Philippine military establishment pushed back against Duterte’s moves to curb the U.S. alliance as they recognized the importance of strong U.S.-Philippine security ties. Reuters
The data cutoff for this product was 4:00p.m. E.T.
Brad Christian, Ethan Masucol, Ken Hughes, and Ryan Simons contributed to this report.
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
