10:00 AM ET, Wednesday, August 9, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:
In the Americas
Pentagon Maintains Confidence in Japan Intelligence Sharing Despite Chinese Hacking Reports. The US Department of Defense said Tuesday that it is still confident about sharing intelligence with Japan despite a report from the Washington Post alleging that military hackers from China had gained access to sensitive Japanese defense networks in 2020. In the article, the Washington Post cited anonymous American and Japanese sources, who alleged that Chinese hackers gathered info on Tokyo’s military plans, capabilities, and evaluations of shortcomings. The article quoted a former US military official as saying the leak was not only “shockingly bad,” but that the chief of the US National Security Agency traveled to Tokyo to brief the Japanese defense minister. On Tuesday, Japanese Chief Cabinet Secretary Hirokazu Matsuno told reporters “I am unable to provide further details of the communication but we haven’t confirmed the fact that security information has been leaked due to cyber attacks.” Pentagon spokesperson Sabrina Singh declined to say if any confidential information had been exposed, instead reaffirming that “we feel confident in our relationship and the intelligence sharing that we do with Japan and we’re confident that we will continue that.” Neither Beijing nor the NSA has responded to a request for comment. Al Jazeera Reuters
White House Expected to Announce New Executive Order Restricting US Investment to China. The White House is expected to announce details today on its plans to limit some US investments into China according to a senior government official. The restrictions, which have been reported on previously, will be narrowly focused and designed to prohibit US investments in certain sensitive technologies such as quantum computing, artificial intelligence and semiconductors. The measures will apply to private-equity, venture capital and joint venture investments. The Executive Order, which is expected today, will reportedly allow for a period of time for comments from industry before going into full effect. Reuters
Biden Announces He Will Travel to Vietnam 'Shortly'. US President Joe Biden said Tuesday that he would visit Vietnam “shortly,” as the Southeast Asian nation seeks to elevate its ties with the US, become major partners, and “change our relationship.” A closer relationship between the two countries may involve US weapons supplies or military cooperation, experts say. When asked about Biden’s statements, a White House spokesperson said they had "nothing further to share at this time." At a fundraiser last month, Biden said he received a call from the “head of Vietnam” who requested they meet at the G20 summit in New Delhi in September, and who “wants to elevate us to a major partner, along with Russia and China." Reuters CNN
1,000 Migrants Gather at U.S. Border in Mexico’s Ciudad Juarez Due to False Rumors. Due to false rumors that the U.S. would allow entry to a mass group, hundreds of migrants eagerly massed along the border in the Mexican city of Ciudad Juarez, just opposite El Paso, on Monday evening. Around 1,000 people, many of whom had spent many days there, gathered expectantly after waiting weeks to obtain appointments to request asylum on the US mobile app CBP One. Reuters
U.S. Army Set to Expand Patriot Missile Force. Lt. Gen. Daniel Karbler, head of the U.S. Space and Missile Defense Command, told reporters that the Army plans to grow its Patriot air and missile defense force structure. He said that “the Army senior leaders - from the secretary [to] the chief - they recognize the demands on the Patriot force” and said the Army plans to increase the size of the Patriot units. Karbler did not specify the exact number of Patriot units the Army intends to deploy. Currently, the Army has 15 Patriot battalions and funding authorized to create one more. Defense News
Pentagon’s Counter-Drone Office to Demo Swarm Destruction in 2024. In a demonstration planned for June of 2024, the Pentagon’s counter drone-office will focus on neutralizing the destruction of swarms of unmanned aircraft, according to a presentation by the office’s director. As displayed in the Russian invasion of Ukraine, the proliferation of drones on the battlefield is on the rise. The British Royal United Services Institute (RUSI) think tank currently estimates that Ukraine is losing 10,000 drones per month in its defense. Extensive swarms of drones are still a threat the U.S. military is attempting to counter. Maj. Gen. Sean Gainey, chief of the Joint Counter-Small Unmanned Aircraft Systems Office, emphasized that the military must take on a multi-layered approach in order to counter the growing threat of drones. He said to reporters “To get after a large amount of UAS [unmanned aerial systems], because you won’t have enough interceptors ... you have to leverage the [electronic warfare] capability, the high-powered microwave,” as well as kinetic means such as 30-millimeter guns. The Pentagon created its counter-drone office in 2019 and tasked the Army with heading the organization. The office has since conducted four other demonstrations with each testing different capabilities. Two of the demonstrations occurred in the fall of 2021, one in the spring of 2022, and one this summer. Defense News
Western Europe
UK, Turkey Sign Deal to Manage Surge of Illegal Migrants. The UK said Tuesday that it has made a deal with Turkey in an effort to slow the surge of illegal migrants traveling through the nation on their way to Europe, involving the trade of boat equipment and parts as well as joint police operations against smugglers and gangs. The British government announced it would aid a Turkish police center that would expand on existing collaboration over law enforcement, and a new memorandum of understanding would allow customs data to be traded more swiftly. Interior minister Suella Braverman said, “our partnership with Turkey, a close friend and ally, will enable our law enforcement agencies to work together on this international problem and tackle the small boat supply chain." Reuters The Times
Central and Eastern Europe
Russia Downs Combat Drones Headed Towards Moscow. Moscow Mayor Sergei Sobyanin said Wednesday that Russian air defenses intercepted and downed two armed drones targeting the Russian capital. Sobyanin reported that one drone was shot down in the Domodedovo zone on the southern fringes of the city, while the second was downed west of Moscow in the Minsk highway area. He said that “two combat drones’ attempt to fly into the city was recorded. Both were shot down by air defense . . . at the moment, there is no information about victims of the fall of the wreckage.” Emergency services were also deployed. The Kremlin’s state-backed new agency TASS reported the attack on Wednesday, quoting the Russian defense ministry as saying that armed drones launched from Ukraine were destroyed. This raid was the third attempted assault on Moscow within a week, as the capital has become a target. Al Jazeera Deutsche Welle
Russian Defense Minister Calls for Strengthening of Forces on Western Border. Russian Defense Minister Sergei Shoigu on Wednesday said Russia will bolster its forces on its western borders amid threats from NATO. Speaking to the governing board of the ministry, Shoigu cited Poland’s plans to strengthen its military, calling Warsaw the “main instrument of the anti-Russian policy of the U.S.”. He also noted new member Finland and future member Sweden, highlighting the expected deployment of NATO assets to Finland, which shares a border with Russia, as a key concern. Shoigu also claimed NATO military units from outside the region stationed in Eastern Europe have increased two-and-a-half times since Russia’s invasion of Ukraine last February, growing to a 30,000-strong force. Shoigu suggested a Russian response to the NATO military buildup would be focused on the Leningrad and Moscow military districts and groupings of Russian forces on the western frontier. Reuters
Factory Explosion Northeast of Moscow Injures 45. Russian emergency services said that a blast at an optical-mechanical factory in Sergiev Posad, a town 30 miles northeast of Moscow, wounded at least 45 people on Wednesday. Footage from the scene shows a sky full of smoke and high-rise buildings with destroyed windows. TASS reported that the explosion appeared to have happened in a warehouse storing pyrotechnic equipment. Russian security forces are among clients of the factory, though emergency services said they did not believe that Ukrainian drones had targeted the site. Reuters
Poland Sending 2,000 Soldiers to Belarusian Border. Poland is sending 2,000 troops to its border with Belarus, twice the number requested by the Polish Border Guard. Polish deputy interior minister Maciej Wasik said the deployment aims to secure the border and stem the increase in migrant crossings. Warsaw has blamed Belarus for facilitating the crossings to pressure and destabilize Poland. The Belarusian embassy in Warsaw did not comment on the matter. Reuters
Asia and Oceania
Taiwan Reports Incursion of 10 Chinese Warplanes. Taiwan’s defense ministry reports that 10 Chinese warplanes crossed the median line of the Taiwan Strait or entered the southwestern part of the island’s air defense identification zone on Wednesday. The ministry said the aircraft accompanied five Chinese warships conducting “combat readiness” patrols in the area and added that it deployed ships and aircraft to monitor the situation. It was the second large scale Chinese Air Force incursion this week following similar activity by Chinese warplanes and naval vessels on Sunday. Reuters
Philippine President Denies Promise Made to Remove Grounded Warship at Disputed Shoal. Philippine President Ferdinand Marcos Jr. said on Wednesday that Manila has not agreed to remove a grounded World War Two-era warship that serves as a military post from the disputed Second Thomas Shoal in the South China Sea. China on Monday said the Philippines was not fulfilling a promise made “explicitly” to remove the ship. Marcos said he is “not aware” of any such deal and that if there was such an agreement, it should be considered rescinded. Jonathan Malaya, Philippine National Security Council assistant director general, earlier called on China to provide evidence of the promise, which he called a figment of their [China’s] imagination.” Malaya added that Manila is “committed to maintain” the grounded vessel as a “symbol of sovereignty” over the shoal, which is within the Philippine exclusive economic zone. The rhetoric comes after the Philippines said Chinese Coast Guard ships used water cannons to impede supply vessels traveling to Philippine troops stationed on the grounded vessel. The Chinese Embassy in Manila did not respond to Marcos’s latest comments. Reuters
Pakistani Court Rejects Former PM Khan’s Appeal for Suspension of Conviction. A Pakistani high court on Wednesday rejected an appeal by former Prime Minister Imran Khan that his conviction on corruption charges be suspended. Khan started a three-year prison sentence on Saturday on charges of illegally selling state gifts while he was premier. He has also been barred from holding public office for five years. Khan, who is currently in a prison near Islamabad, denies any wrongdoing. Reuters
Middle East and Northern Africa
Iran Says it Has Supersonic Cruise Missile Technology. Iranian state media reported on Wednesday that Tehran has the technology to create supersonic cruise missiles and that it is currently testing the new weapon. Iran maintains its missile program is for defensive purposes. The announcement comes after the U.S. deployed more military assets to the Middle East following Iran’s harassment and seizure of commercial vessels in the Gulf. The U.S. deployment included fighter jets and 3,000 sailors and Marines on two warships in the Red Sea. Iran said it would equip its navy with drones and missiles in response. Analysts warn that the military buildup in the area risks escalation. Al Jazeera Reuters
Sub Saharan Africa
Sign of Internal Struggle: Niger Politician Establishes Anti-Coup Movement. Former Niger rebel leader and politician Rhissa Ag Boula has launched an anti-junta movement in the first sign of internal opposition to military rule. Boula said in a statement on Wednesday that the movement, the Council of Resistance for the Republic (CRR), seeks to return ousted President Mohamed Bazoum to power and supports not only the Economic Community of West African States (ECOWAS), but also any international powers aiming to reinstate the elected leader and civilian government, and restore order to the Sahel nation. A source and member of the CRR said that a few Nigerien political actors had joined the resistance but cannot reveal themselves for safety reasons. Reuters
Fighting in Sudan Intensifies. The Sudanese army has intensified its effort to regain control of the country’s capital, the location of some of the most intense fighting in Sudan’s civil war. Khartoum, the capital, and its sister city Omdurman have been the main theater of battle between the military and the paramilitary Rapid Support Forces (RSF) since the conflict began. Since Monday, the army has launched artillery and air attacks in an attempt to take control of a bridge that crosses the Nile River which has been utilized by the RSF to move reinforcements and weapons from Omdurman and other areas to Khartoum. On Tuesday, Sudan’s health authorities said that at least 20 people had died and that the country’s healthcare system is close to a complete collapse. The United Nations has reported at least 53 attacks on healthcare facilities since the conflict began. Al Jazeera
Cyber and Tech
China-linked Cyberespionage Group Active Against Asian Government, Commercial Targets. RedHotel, a hacking group linked to China’s Ministry of State Security, has targeted government, telecommunications, and research organizations in 17 countries since 2021, a Recorded Future report has revealed. Jon Condra, one of the report’s authors, described RedHotel as “one of the most active [and] prolific Chinese state-sponsored groups that we track and they target organizations globally across a wide range of industry verticals.” The group’s operations are seen as “a specific threat to governments within the Southeast Asia region,” but its targeting also includes aerospace, media, and research and development sectors. According to Condra, RedHotel likely is based in Chengdu and operates like other groups associated with the Ministry of State Security.” The group employs sophisticated malware strains also used by other Chinese threat actors like APT41. The report identifies RedHotel’s primary objectives as intelligence gathering and economic espionage. The Record
More Details Emerge on Russian Hacker Plan To Penetrate Ukrainian Military System. The Ukrainian Security Service (SBU) has thwarted an attempt by Russian state-controlled hackers to breach the Ukrainian military’s battlefield management system. An SBU technical report noted that the Russian Sandworm hacking group intended to deploy at least seven new malware variants in their penetration attempts. SBU reportedly was able to stop the campaign in the planning phase. Sandworm has been linked to multiple attacks on Ukrainian critical infrastructure, but the latest attempt sought to gain access to sensitive military information, including operational details, locations, equipment, and troop movements. The Sandworm operation focused initially on Ukrainian military Android tablets used to plan and carry out combat missions. The ultimate goal was to gain access to connected devices in order to implant malware. According to the SBU, Russia took strong steps to conceal the malware by disguising some as legitimate programs, including apps used by visually impaired individuals. Among the malware variants was a strain called STL designed to gain access to devices connected to Starlink, the satellite communications network on which Ukrainian military units are heavily dependent with many conventional communications networks knocked out of service. The Record
Nvidia Announces 2024 Release of Superchip To Boost AI Processing Capabilities. Nvidia has announced the 2024 release of an updated AI processor, called the Grace Hopper Superchip, which will boost capacity and speed for AI applications. Nvidia CEO Jensen Huang said in a talk at the Siggraph conference in Los Angeles on Tuesday, “this processor is designed for the scale-out of the world’s data centers.” He added, “you can take pretty much any large language model you want and put it in this and it will inference like crazy. The inference cost of large language models will drop significantly.” The new device is a combined graphics chip and processor and will benefit from high-bandwidth memory 3, which can access information at 5 terabytes per second. According Nvidia vice president Ian Buck, the new chip increases the amount of high-bandwidth memory, which will give the design the capacity to power larger AI models. The configuration is optimized for AI inference functions that effectively power generative AI applications such as ChatGPT. The GH200 Superchip will begin production in the second quarter of 2024 as part of a new lineup of hardware and software. According to Bloomberg, the latest Nvidia processor signals that the company aims to make it hard for competitors like Advanced Micro Devices and Intel to catch up. The Superchip will be the core of a new server computer design capable of handling more information and accessing it more quickly, a crucial advance with the masses of data used in AI models. Reuters Bloomberg CNBC
Billions of Intel Processors at Risk Due to ‘Downfall’ Vulnerability. New research to be presented at the Black Hat cybersecurity conference in Las Vegas will show that generation of Intel’s x86 processors – billions of which are in use – rely on a performance-enhancing technique that introduces a vulnerability, dubbed Downfall, that could easily be exploited to steal sensitive data, including encryption keys. The study out of the University of California at San Diego, and Google, describes how the x86 architecture relies on a “register buffer” to store data. Since different applications share the buffer, when a CPU executes a “gather” command, it can read data left in the register from a previous application and forward it to a threat actor. By exploiting the Downfall vulnerability, an attacker running one application can easily steal passwords, encryption keys and other sensitive data from another. Daniel Moghimi, a University of California computer security expert and the author of the research, said that a vulnerability like Downfall, in effect, breaks the “software-hardware contract” and allows software to access physical memory in hardware that should have been deleted from the user program. The flaw impacts both personal and cloud computers and likely can be used to defeat the isolation that should exist between data on a cloud computing device. An attacker could use Downfall to steal administrative credentials and use them to gain access that otherwise would not be possible. An Intel spokesperson said the flaw was discovered in a controlled research environment and an actual attack “would be very complex to pull off outside of such controlled conditions.” Moreover, more recent Intel processor generations, such as Alder Lake, Raptor Lake and Sapphire Rapids, would not be affected by Downfall. Moghimi discovered the flaw in 2022 and reported it to Intel, which validated the issue and asked Moghimi to agree to a year-long embargo while the problem was addressed. With Moghimi’s research now public, Intel is rolling out a microcode fix, requiring an operating system update that will result in a performance penalty. CyberScoop Wired
Finland, Norway Block Transfer of Yandex Customer Data to Russia. Regulators in Finland and Norway announced Tuesday they have banned the Russian search engine and web portal, Yandex, along with its Netherlands-based partner, Ridetech, from transferring personal data of customers of Yandex’s ride-hailing app, Yango. The move comes in response to Russian legislation that comes into force in September and allows Moscow security services to collect data from taxi operations. Norway’s Data Protection Authority said in a statement that the Russian action poses "an acute risk to privacy as Russian authorities could potentially monitor the movements of Norwegian citizens via Yango." Yango operates in 14 countries, including Finland and Norway. Yango said it intends to comply with new requirements from the Norwegian and Finnish regulators and added that it processes data in strict compliance with General Data Protection Regulation (GDPR) and EU legislation. Yango explained that Russia’s legal regulations “have no jurisdiction over the international ride-hailing business of Yango and do not apply to Yango users as they make trips and use the app outside of Russia.” That policy will not change after September 1, Yango said. In June, a Moscow court fined Yandex $21,000 for repeatedly refusing to provide customer information to Russia's Federal Security Service (FSB). The Finnish and Norwegian regulators noted that their decisions would be in force initially for three months as they had been exercised under an urgent procedure set out by the EU General Data Protection Regulation. Reuters
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
