Monday, June 12, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:
In the Americas
Former President Trump Faces Charges Under the Espionage Act in Unprecedented Legal Case. Former President Donald Trump is expected to appear in federal court in Miami on Tuesday to be arraigned on charges related to the Espionage Act. Prosecutors unsealed an indictment on Friday listing 37 counts of alleged improper handling of classified material following Trump’s Presidency and departure from the White House. The Espionage Act was enacted by Congress shortly after the start of World War I (WWI) in an effort to control activity related to the handling of classified information. High-profile individuals that have been targeted by the act include Daniel Ellsberg, who leaked the Pentagon Papers, former NSA contractor Edward Snowden and former Army intelligence analysts Chelsea Manning. While the specifics of each case can vary, the section of the act that prosecutors are using to target the former President relates to the unauthorized possession of information, which prosecutors have to prove beyond a reasonable doubt that Trump willfully retained the information and failed to properly turn it over to the government. Security for Tuesday’s unprecedented indictment of a former US President will be handled by the US Marshals Service and the Secret Service and media reports say that officials are bracing for the possibility of unrest. Reuters Wall Street Journal
U.S. Official Weighs in on China’s Espionage Operations in Cuba.China has been spying from Cuba “for some time” and in 2019 scaled up its intel gathering capabilities according to a Biden administration official who spoke on the condition of anonymity. The statement follows last week’s report by the Wall Street Journal that claimed China and Cuba had recently reached a deal for Beijing to establish a new electronic spying station on the island. Cuban Vice Foreign Minister Carlos Fernandez de Cossio called the report "totally mendacious” and the Biden official said the report "does not comport with our understanding," but admitted that Chinese espionage activities in Cuba are “ongoing,” as well as the fact that China “conducted an upgrade of its intelligence collection facilities in Cuba in 2019”. A Chinese official at the embassy in Washington suggested that the reports further defame Beijing, pointing to a Friday statement from the foreign ministry’s spokesperson that accused the United States of “spreading rumors and slanders.” The official from the Biden admin said that the Trump administration was aware of the spying and did attempt to confront the issue, but more direct action involving diplomatic effort was required. Reuters Wall Street Journal
Canada Announces Seizure of Russian Cargo Plane. Canadian Foreign Minister Melanie Joly announced on Saturday that Canadian authorities formally seized a Russian-registered Antonov-124 cargo plane at Toronto's airport. The aircraft, one of the world’s largest cargo planes, has been grounded in Toronto since the start of Russia’s February 2022 invasion of Ukraine. Holy said Canada plans to give the plane to Ukraine as part of compensation for Russia’s invasion. The move marks Canada’s first seizure of a Russian asset amid the Ukraine war. Joly says the seizure sends a message to Moscow that there is “nowhere to hide” for those who support Russia’s war in Ukraine. The announcement was timed with Canadian Prime Minister Justin Trudeau’s surprise visit to Kyiv on Saturday. Wall Street Journal
Honduras Opens China Embassy After Ending Taiwan Relations. Honduras has officially opened an embassy in Beijing according to a report from Chinese state media. This comes after Honduras formally switched diplomatic recognition from Taiwan to Beijing in March. The embassy was opened by the foreign ministers from Honduras and China. Honduran President Xiomara Castro is also in China for a state visit, where she is expected to meet with Chinese President Xi Jinping. Reuters
Ceasefire Announced Between Colombian Government and ELN Rebels. The Colombian government and the left-wing guerrilla group ELN reached a ceasefire agreement as the third round of peace talks ended in Havana on June 9. The ceasefire is scheduled to come into full effect on August 3 and last 180 days. At the closing ceremony in Havana, Colombian President Gustavo Petro stated “Here ends a phase of armed insurgency in Latin America, the world of arms, and of killing one another must cease”. The conflict in Colombia has lasted for nearly six decades and has killed at least 650,000 people. Petro, an ex-member of the now demobilized M-19 guerilla organization, has promised an ambitious plan for total peace in Colombia, a nation that has been plagued by domestic violence. Reuters
Western Europe
Nord Stream Investigation Looks to Poland for Clues. The Wall Street Journal is out with an extensive report that says German investigators are looking into the possibility that Polish territory was used to support a sabotage team that blew up portions of the Nord Stream pipeline. In a move that some analysts say could worsen tensions between Poland and Germany, the investigation is reportedly focusing on the path of the yacht Andromeda, a vessel that investigators believe was rented in Germany and used to transport the sabotage team. German investigators claim to have recreated the entire two-week journey of the Andromeda. Reuters says that German and Polish officials did not respond to a request for comment on the story, but added that a Polish official, Stanislaw Zaryn, deputy to Poland's Minister Coordinator of Special Services said on Twitter that information about Polish or Ukrainian involvement in the destruction of the Nord Stream pipeline “is consistently used by the Russian apparatus of influence to create the impression/presumption among the recipients that Warsaw and Kiev were behind this incident," Wall Street Journal Reuters
Iceland Suspends Diplomatic Operations in Russia. Iceland has suspended its embassy operations in Moscow and says it has asked Russia to scale back operations in Iceland. Iceland’s foreign ministry cites deteriorating relations between the two countries as the reason for the move. Though embassy operations have been shut down, Reykjavik stated that relations between the two countries have not been severed. In response, the Russian Foreign Minister stated on Saturday that Iceland’s decision would negatively impact bilateral relations between the two countries in the future and that Moscow would follow with a corresponding action. Reuters
German Chancellor Scholz Plans to Speak with Putin Soon. German Chancellor Olaf Scholz said on Saturday that he plans on speaking soon with Russian President Vladimir Putin by phone, to urge a withdrawal of forces from Ukraine. Scholz, who has spoken with Putin previously since the start of the Ukraine war, stated that it is “not reasonable to force Ukraine to approve and accept the raid that Putin has perpetrated and that parts of Ukraine become Russian just like that." He also asserted that he would try to prevent NATO’s involvement in the conflict. Dmitry Peskov, spokesperson for the Kremlin, informed the TASS news agency that no conversation between the two leaders were currently organized. Reuters
Former Italian PM Berlusconi Dies at 86. Former Italian Prime Minister Silvio Berlusconi died on Monday. He was 86. Berlusconi was Italy’s longest serving premier, and his Forza Italia party is part of Prime Minister Giorgia Meloni's right-wing coalition. Reuters
Central and Eastern Europe
Ukraine Announces Modest Gains in Counteroffensive Amid Reports of Heavy Fighting. Ukrainian officials have announced the “first results” in its counteroffensive to liberate Russian-occupied territories. Ukrainian Deputy Defence Minister Hanna Maliar said on Sunday that Russian forces “de-occupied” the town of Makarivka in the Donetsk region, and unverified footage on social media shows Ukrainian troops retaking the nearby villages of Blahodatne and Neskuchne. Malian added that Ukrainian forces continue assaults towards the city of Bakhmut, and other Ukrainian military officials say there have been advances around the city of Avdiivka. Ukrainian President Volodymyr Zelensky said Saturday that “counteroffensive and defensive operations” are underway, but has not referred to any specific developments. Associated Press New York Times Reuters CNN ISW
Canada’s Trudeau Visits Kyiv, Meets Zelensky. Canadian Prime Minister Justin Trudeau made a previously unannounced trip to Kyiv on Saturday in a show of support. In talks with Ukrainian President Volodymyr Zelensky, Trudeau reiterated Canada’s backing for Ukraine, saying, "we will be there with (you) as much as it takes, for as long as it takes.” He also said in a joint declaration with Zelensky that Canada backs Ukraine’s eventual membership in NATO. Later, Trudeau added in an address to the Ukrainian parliament that Canada is committing $500 million in new military aid for Ukraine. Politico Reuters
Russia Says it Destroyed Leopard Tanks, U.S. Bradley Vehicles in Ukraine. Russia claimed Sunday to have destroyed five U.S.-made Bradley vehicles and seven German-made Leopard tanks over two days while defending against Ukrainian assaults. Russian military bloggers reported that Ukrainian forces penetrated Russian lines south of Velyka Novosilka and took several villages during a retreat that were later reclaimed. The Russian Defense Ministry reported that it had destroyed armored vehicles of the 128th Mountain Assault Brigade and staved off more than twelve assaults. The ministry also said that “during the past day, the armed forces of Ukraine continued unsuccessful attempts of offensive actions in the Donetsk, southern Donetsk and Zaporizhzhia directions.” Russia has released several photos and videos recently showing assaults on Ukrainian tanks and vehicles from drones and Ka-52 attack helicopters. Reuters
Russian Strikes Kill Three in Odesa and Target Ukrainian Air Base. Ukrainian officials report that Russia launched drones and missiles across Ukraine on Saturday morning, targeting and striking a military airbase in central Poltava and killing three civilians in Odesa and one man in the northeastern Kharkiv region. The Ukrainian Air Force says the barrage involved 35 strike drones and eight ground-launched missiles and that Ukrainian air defenses shot down 20 of the drones and two cruise missiles. Debris from the destroyed objects rained onto a high-rise apartment in Odesa and started a fire, according to Ukraine’s southern military command's spokesperson Natalia Humeniuk. A couple living on the eighth floor of the building and a man who had been standing outside during the attack were killed, while 24 adults and three children were wounded. The Myrhorod airbase in Poltava was also damaged by drones and ballistic and cruise missiles. According to Governor Oleh Synehubov, ten drones struck two areas of Kharkiv, killing one person and injuring a 39-year-old man, while separately, Dnipropetrovsk governor Serhiy Lysak said that forces also downed two drones over the region. Reuters Wall Street Journal
Prigozhin Refuses to Sign Contract With Russian Defense Minister. The head of Russia’s Wagner Group, Yevgeny Prigozhin, said on Sunday he will not sign any contract with Russian Defense Minister Sergei Shoigu. The Russian defense ministry had said on Saturday that Shoigu is ordering all “volunteer detachments” to sign contracts to formally be brought under the Russian army. While Shoigu did not specifically mention Wagner, it is understood to be included in the order. Prigozhin said that Wagner fights for Russian interests and that it would be damaged if it was forced to report to Shoigu, who he said “cannot properly manage military formations.” Prigozhin added that Wagner’s refusal to comply with the contract order may be used as an excuse by the Russian defense ministry to deprive the group of weapons and supplies, but he asserted that “when the thunder breaks, they will come running and bring weapons and ammunition with a request to help." Prigozhin’s comments add to his long-standing friction with Russian military leadership. The Russian defense ministry did not comment on his latest remarks. CNN Reuters
Iran Helping Build Drone Factory in Russia, White House Says. National Security Council spokesman John Kirby on Friday said that U.S. intelligence shows that Iran is helping build a drone factory east of Moscow. He said that the factory will likely be built in the Alabuga special economic zone in Russia’s Republic of Tatarstan and could be operational by early next year. The factory would bolster Iran’s military support for Russia, which the U.S. has previously warned Tehran would do by establishing a drone assembly line within Russia. Kirby added that in the meantime, Iran continues its “full-scale defense partnership” with Moscow by shipping drones via the Caspian Sea directly to Russia for use in its invasion of Ukraine. Associated Press CNN New York Times
Russia Arrests US Citizen on Drug Dealing Charges. An American citizen has been arrested in Russia on drug charges. The US State Department confirmed that Michael Travis Leake, a musician and former paratrooper has been detained by Russian authorities. Leake, 51, appeared on Russian state television on June 10th in a Moscow court arraignment after being arrested four days earlier for allegedly running a drug dealing operation. The US State Department said that US officials attended the arraignment on the 10th, though it is unclear if Leake has a lawyer. Russian media claims police found suspicious substances at Leake’s home. According to Moscow’s court of general jurisdiction, Leake, who could face up to 12 years in prison, will remain in custody until the 6th of August. Since Moscow invaded Ukraine in 2022, the United States has repeatedly instructed Americans to leave Russia due to the chances of unjust arrest and persecution. Wall Street Journal reporter Evan Gershkovich and former marine Paul Whelan both remain imprisoned in Russia for espionage charges that each have denied. CNN Reuters
Russia Accuses Ex Defense Worker Of Spying For Germany. Moscow’s FSB Security Service has detained a former defense industry worker on charges of high treason. According to the FSB, the suspect worked for a military contractor in the region of Omsk and had allegedly met with a German official where he agreed to spy for the German government in exchange for citizenship. The FSB alleges that the individual had gathered information on important military facilities prior to his apprehension. The arrest of this suspect comes on the heels of a similar arrest on Wednesday in which a resident of the Primorsky Krai region was accused of spying for the Ukrainian government. Reuters
Serbia's Vucic Demands Kosovo Concessions On Serb Autonomy Before New Vote. Serbian President Aleksandar Vucic urged Kosovo Prime Minister Albin Kurti to not hold elections for new mayors in its northern territories until more autonomy has been granted to the majority holding ethnic Serbs. Prime Minister Kurti has rejected the notion stating that if greater autonomy is given to these areas, the Serb majority could organize a referendum and rejoin Serbia. Both the European Union and the United States have urged Kurti to organize new elections in these areas to defuse tensions while encouraging Serbia to drop its combat alert and to move troops away from the boundary with Kosovo. Reuters
Asia
Taiwan Reports 10 Chinese Warplanes across Taiwan Strait Median Line. Taiwan’s defense ministry said it detected 24 Chinese bombers and fighter jets flying near the island’s airspace on Sunday and that 10 of them crossed the unofficial median line dividing the Taiwan Strait. The ministry added that four Chinese naval warships were also in the area for “joint combat readiness patrols.” The ministry said Taiwan’s military scrambled jets, deployed ships and missile defenses to monitor the Chinese forces in response. The action came after Taiwan reported on Thursday that 37 Chinese military aircraft entered the island’s air defense identification zone. China did not comment on either Thursday or Sunday’s reported flights. Reuters
China and Thailand to Strengthen Military Partnership. Chinese Defense Minister Li Shangfu met with the Royal Thai Army’s commander-in-Chief, Narongphan Jitkaewtae on Saturday where the two sides signaled their intent to expand military cooperation between Bangkok and Beijing. This has been the latest of agreements between Thailand and China, following Chinese President Xi Jinping and Thai Prime Minister Prayuth Chan-o-Cha signing a cooperation plan to jointly promote the Belt and Road initiative in November of 2022. South China Morning Post
South Korean Police Make Arrests in Corporate Spying Probe. South Korean police arrested 77 people involved in 35 cases of suspected industrial espionage, according to South Korea’s Yonhap news agency. Most cases involved domestic companies, but eight dealt with technology leaks to other countries, including China. Reuters
Middle East and Northern Africa
Iran’s Supreme Leader Says Nuclear Deal With West is Possible. Iran’s Supreme Leader Ayatollah Ali Kahmenei on Sunday said that there is “nothing wrong” with a nuclear agreement with the West and that it is possible if Iran’s nuclear infrastructure remains untouched. Despite this, Khamenei asserted that the West cannot stop Iran from building weapons if it sought to. He added that Iran should continue to work with the IAEA, but said that Tehran should not yield to the nuclear watchdog’s “excessive and false demands,” referring to past Iranian legislation that allows for the suspension of IAEA inspections if sanctions are not lifted. His comments come after both the U.S. and Iran denied reports that they are close to striking an interim nuclear deal. The U.S. State Department did not comment on Khamenei’s remarks, only reiterating that the U.S. “is committed to never allowing Iran to acquire a nuclear weapon” and will use diplomacy as the primary method to achieve this. Al Jazeera Reuters RFE/RL
EU Mulls $1 Billion in Aid for Tunisia for Tighter Border Control. The EU is considering offering Tunisia 900 million euros ($967 million) in economic support and 150 million euros ($161 million) in immediate budget support in return for the north African country implementing stronger border controls to help deal with an ongoing migrant and refugee crisis. Italian Prime Minister Giorgia Meloni, Dutch Prime Minister Mark Rutte and European Commission President Ursula von der Leyen announced the proposed aid package during a visit to the Tunisian capital Tunis on Sunday. Beyond the immediate aid, von der Leyen said that the EU will work with Tunisia on a “comprehensive five-pillar package” to boost trade and energy cooperation, as well as offer $100 million in support for Tunisian border management, search and rescue operations and anti-smuggling measures. Tunisian President Kais Saied said ahead of the meeting that his country will not become a border guard for Europe. Tunisian rights groups were also skeptical towards EU offers, saying the proposed aid package is “blackmail” that will worsen abuses of migrants and make it harder for those in need to reach Europe. Al Jazeera Associated Press Politico
Sub Saharan Africa
Sudan Fighting Resumes After 24-Hour Ceasefire. Fighting resumed between Sudan’s army and paramilitary Rapid Support Forces after a 24-hour ceasefire on Saturday. Reporters and witnesses say that within minutes of the ceasefire ending on Sunday, air raids and shelling attacks started again in the capital of Khartoum and other parts of Sudan. The ceasefire aimed to facilitate desperately needed shipments of humanitarian aid across the country. While some shipments made it to areas in southern Khartoum, aid was not able to reach those in the north of the capital. Militia violence has also continued in West Darfur. Al Jazeera France 24
Al Shabaab Claims Attack on Mogadishu Restaurant. A bombing and shooting attack at a restaurant in the Somali capital of Mogadishu killed six civilians and three soldiers on Friday. Al Qaeda-linked al Shabaab claimed responsibility for the attack. Somali security forces said they “successfully neutralized” all militants involved in the attack and that the area is secure. Reuters
Attack in Mali Kills UN Peacekeeper. One UN peacekeeper was killed and four others were seriously injured when their patrol was attacked near the town of Ber in northern Mali on Friday. The UN Multidimensional Integrated Stabilization Mission in Mali (MINUSMA) has not yet named the attackers but stated it was a “complex attack,” saying that the patrol encountered an improvised explosive device before being hit with a direct fire attack. Reuters
South African President, China’s Xi Discuss African Proposal for Ukraine Peace Plan. Ahead of an upcoming visit by African leaders to Russia and Ukraine, South African president Cyril Ramaphosa has briefed Chinese President Xi Jinping on the group’s proposal to end the Ukraine war. Chinese state media reported that the two leaders had a phone call on Friday, while South Africa’s Presidential office stated that Xi showed support for the plan, as well as commented on how the conflict has resulted in food security issues in Africa. Reuters
Cyber and Tech
Wall Street Journal Details Tactics, Aims of North Korean Crypto Hackers. In what has now become a familiar North Korean ploy, an engineer for the Sky Mavis blockchain gaming company was approached by a recruiter representing what the engineer thought was a lucrative career opportunity. Reached through LinkedIn, the Sky Mavis employee filled out an interview document that turned out to contain Trojan Horse malware that allowed North Korean hackers to access the engineer’s computer, which led to the theft of more than $600 million from players on Sky Mavis’ game, Axie Infinity. According to analytics firm Chainanalysis, the deception proved to be North Korea’s largest theft in five years, during which North Korean hackers have stolen an estimated $3 billion for Pyongyang’s ballistic missile and nuclear programs. According to U.S. officials, North Korea has thousands of IT workers around the world, including in Russia and China, who often are collaborators in the rogue country’s cybercrime campaigns. This “shadow workforce” even goes as far as to hire Westerners to pose as prospective employees, essentially fronting for the North Korean technical specialists who ultimately hope to be hired. Once employed, the technicians introduce small changes that make products vulnerable to hacking. Anne Neuberger, deputy national security advisor for cyber and emerging technologies, summed up what distinguishes North Koreans from other cybercriminals: “Most nation-state cyber programs are focused on espionage or attack capabilities for traditional geopolitical purposes. The North Koreans are focused on theft, on hard currency to get around the rigor of international sanctions.” Wall Street Journal
OpenAI CEO Calls Into Beijing Tech Conference, Urges Collaboration on AI Research. OpenAI CEO Sam Altman addressed a Beijing technology conference by video link to express his support for collaboration of Chinese and U.S. scientists in order to reduce risks associated with AI systems. Speaking to participants in the Beijing AI conference hosted by the Beijing Academy of Artificial Intelligence, Altman said, “China has some of the best AI talent in the world.” OpenAI’s flagship product, ChatGPT, is not available in China. In addition to the OpenAI chief, AI pioneer Geoffrey Hinton and more than a dozen U.S. and British executives and senior AI researchers spoke at the conference representing companies such as Nvidia and Anthropic. Top Chinese companies and universities sent speakers to the conference as well, including Huawei, Baidu, and iFlytek, a speech-recognition company. Huawei and iFlytek are among the Chinese companies blacklisted or sanctioned by the U.S. Jenny Xiao, a partner in an AI venture capital firm, Leonis Capital, pointed to the uniqueness of the Beijing conference, adding, “it’s important to bring together leading voices in the U.S. and China to avoid issues such as AI arms racing, competition between labs and to help establish international standards,” she added. Wall Street Journal
Pro-Ukraine Hackers Disrupt Russian Telecom Service to Central, Local Banks. A Russian telecommunications company used by banks and online stores has been hit by a “massive” cyberattack apparently conducted by pro-Ukrainian hacktivists. The company, Infotel, posted a notice on its website acknowledging that part of its network was damaged as the result of a “massive hacker attack.” A pro-Ukrainian group calling itself the Cyber Anarchy Squad posted a claim of responsibility on its Telegram channel, adding “there is nothing left alive. Let them try to restore it now, but their chances are as slim as finding an easy life in Russia." Infotel, which is based in Moscow, services Russia’s Central Bank with connections to local banks, financial institutions, and online vendors. A spokesperson for a confederation of Ukrainian hacktivists told CyberScoop that he believed “Infotel was wiped, including servers (backups too) and core routers (configs reset, firmware erased).” To provide proof of their attack, the hacktivists posted screenshots of an Infotel network diagram and what appears to be a compromised email account. TheRecord CyberScoop BleepingComputer
Microsoft Plans Move of Leading AI Experts from China to Canadian Research Facility. Microsoft is said to be planning a transfer of leading AI researchers from its Microsoft Research Asia (MRSA) facility in Beijing to its institute in Vancouver. According to reports, 20 to 40 staff members could be affected. Observers say the proposed move is prompted by the heightened tensions between the U.S. and China and as a way of fending off efforts by Chinese technology firms to recruit Microsoft expert staff. Responding to reports of the staff move, Microsoft issued a statement saying “the number reported is not accurate. There is no ‘so-called Vancouver Plan.’” Microsoft acknowledged the establishment of a new Vancouver lab, which it said would be “organizationally aligned with MSRA and designed to better engage with the engineering teams in Vancouver.” The company clarified that the Vancouver facility “will be staffed with people from other MSR labs around the world, to include China.” MRSA researchers has confirmed receiving job offers from Chinese companies. One of them commented that “there is a risk of talent being poached by Chinese companies or employees being harassed by authorities. We have discussed these risks in internal meetings.” MRSA is recognized as having a key role in the training of Chinese technology experts, with former staff including Alibaba’s chief technology officer, Wang Jian. Financial Times
German Finance Minister Opposes Intel Request for Larger Chip Plant Subsidy. German Finance Minister Christian Lindner has declined an Intel demand for increased subsidies for a chip factory valued at $18.2 billion. Intel already was scheduled to receive $7.3 billion in subsidies but requested an additional outlay due to higher energy and construction costs. Lindner said an increase is not possible as “we are trying to consolidate the budget…not expand it.” The Intel project represents the largest foreign investment since the end of WWII and is a key to the EU’s ambitions to increase the community’s share of the international market for semiconductors. German Chancellor Olaf Scholz has been reported to be receptive to larger funding for the project amid indications that Intel might increase its investment. There also have been suggestions that the German government could reduce Intel’s costs by providing the planned chip plant in Magdeburg with inexpensive electricity. The finance minister acknowledged there were “several options under consideration” but underscored that “in term of the budget, we have reached our limits.” Financial Times
Hackers Drain $3 Million in Cryptocurrency Through Journalist-Impersonation Scheme. A hacking group dubbed “Pink Drainer” is mounting attacks to steal cryptocurrency through a tactic of impersonating journalists in phishing attacks. Security analysts report that Pink Drainer has drained almost $3 million from digital assets on Mainnet and Arbitrum with this method. The threat actor works by impersonating journalists conducting bogus interviews with targets. Once they have gained a victim’s trust, the hackers request validation on websites using malicious code to steal user credentials. The security analysts have observed Pink Drainer seizing $327,000 in NFT’s from a single target. BleepingComputer
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
