Wednesday, April 12, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:
In the Americas
Defense Secretary Austin Says U.S. Will Investigate Leak until Source is Found. Secretary of Defense Lloyd Austin said on Tuesday that the U.S. will “turn over every rock” until the source of the recent leak of classified documents is found and the government is able to determine the extent of the damage caused. He is the first senior U.S. official to officially comment on the leak. Austin said that the Pentagon is aware that documents dated to February 28 and March 1 had been posted online, but was not sure if other documents had been online before those. Central Intelligence Agency Director William Burns called the leaks “deeply unfortunate” but did not give details on the ongoing Pentagon and Justice Department investigations. The Pentagon’s review of the potential impact of the leak is being led by Milancy Harris, who serves as the Deputy Undersecretary of Defense for Intelligence and Security. Reuters
Congress Demands Answers In Response to Intelligence Leak. Congress returned from the holiday weekend demanding answers after the leak of highly-sensitive documents that included information on Ukraine’s war against Russia. On Tuesday, Senate Majority Leader Chuck Schumer said that he has requested classified briefings on the leak for members once Congress returns to Washington next week. Leaders of both the Senate and House intelligence panels separately said they’d been briefed on the leak. House Intelligence Committee Chair Rep. Mike Turner, who recently returned from a visit to Kyiv, has said the leak could amount to espionage. Rep. Jim Himes, ranking member of the House Intelligence Committee, called the leak “not remotely acceptable” and warned of potential real-time consequences due to the nature of the leak. He also said that the leak, which follows repeated discoveries of classified information at properties associated with senior U.S. officials over the last several years, is indicative of broader problems with classified information handling and predicted there would be bipartisan interest in revamping the process associated with the handling of classified materials. Politico
Biden Calls Family of Reporter Arrested in Russia, Says Imprisonment is 'Totally Illegal.' President Biden spoke to the parents of detained Wall Street Journal reporter Evan Gershkovich on Tuesday, who continues to be held by Russian security services and is charged with espionage. Biden once again condemned the journalist’s wrongful detention; both the U.S. government and Wall Street Journal have vehemently denied Russia’s accusation that Mr. Gershkovich is a spy. Separately, White House National Security spokesman John Kirby said that the Russian government still has not yet granted U.S. consular access to Gershkovich. Al Jazeera PBS
Ukrainian Hackers Claim to Find Russian Spy Behind 2016 Hacks of U.S. Democrats. A Ukrainian hacking group that calls itself Cyber Resistance claims to have hacked the emails of Lt. Col. Sergey Morgachev, a top Russian military spy charged in 2018 by the FBI with hacking and leaking the emails of the Hilary Clinton campaign and Democratic National Convention (DNC) in 2016. Although Reuters has been unable to corroborate the claim, and it is unclear what exact information the hackers allegedly stole, some of Morgachev’s personal information that the hackers shared with Ukrainian publication InformNapalm aligns with previously leaked data preserved by Constella Intelligence, a cybersecurity research platform. InformNapalm said that it had confirmed Morgachev’s identity by combing through documents provided by the hackers, including one that identified him as a department head in Unit 26165, the same position the FBI accused him of holding in 2018. Morgachev did not respond to requests for comment. Reuters InformNapalm
Canadian Government Websites Hacked Amid Visit by Ukrainian PM. Ukrainian Prime Minister Denys Shmyhal met with Canadian Prime Minister Justin Trudeau in Toronto on Tuesday. During Shymal’s visit, Trudeau announced new Canadian military support for Ukraine — including 21,000 assault rifles, 38 machine guns and 2.4 million rounds of ammunition — as well as new sanctions on individuals and entities in Russia and the Belarusian financial sector. Trudeau and Shymal also discussed reconstruction efforts and assigned a joint declaration to modernize trade in their meeting. As the two met, Trudeau’s official website and other Canadian government websites were temporarily taken offline in an apparent attack later claimed by pro-Russian hackers. Trudeau said the attacks were “unsurprising” and would not move Ottawa from backing Kyiv. Canada’s government maintained that the incidents had “very little impact.” CBC Reuters
US, Cuba to Hold Migration Talks. U.S. State Department officials announced that the U.S. and Cuba will hold another round of migration talks starting on Wednesday, in the hopes of ending COVID-era border restrictions that have prevented Cubans from entering the US from Mexico. This meeting follows another meeting held in Havana last November, as both countries seek to resume conversations following the hiatus under former President Donald Trump. The US embassy in Havana resumed immigrant visa processing and began providing consular services this year for the first time since 2017. Reuters
US, Colombia, Panama Drive to Halt Migration at Darien Gap Route. The United States, Colombia, and Panama announced on Tuesday a trilateral, 60-day campaign aimed at stopping illegal migration through the Darien Gap. This announcement comes after the flow of migrants through the area has grown significantly in the past year, with 90,000 passing through in the first three months of 2023 alone. Details on the deal were not provided in the statement. Associated Press Fox News
Mexico Charges 4 Soldiers for Murder of 5 Unarmed Civilians in Cartel-Controlled City. Mexican prosecutors formally presented homicide charges against four soldiers implicated in the February 26 shooting deaths of five unarmed men in the cartel-dominated border city of Nuevo Laredo. The civilian court said the soldiers would be held in pretrial detention at an army base in Mexico City that has a military prison, and would also face attempted homicide charges because a sixth man was wounded in the attack. Mexico’s governmental human rights agency called the shooting unjustified in March, and issued a report stating that four of the 21 soldiers on patrol that morning had opened fire, firing a total of 117 shots at a vehicle that had, until then, been followed based on “suspicion”. The commission said the soldiers did not follow proper procedure when they later engaged the vehicle. New York Times
Western Europe
Pipe Bombs Discovered in Northern Ireland Ahead of Biden’s Arrival. Four suspected pipe bombs were recovered from a cemetery near Londonderry in Northern Ireland on Tuesday, according to police. This comes just several hours before US President Joe Biden expected arrival in Belfast to help mark the 25-year anniversary of the Good Friday Agreement. On Monday, several masked people attacked a police vehicle with petrol bombs in Londonderry during a parade against the Good Friday peace accord. According to police, the bomb threat has been neutralized, but comes as there is growing concern in Northern Ireland, with MI5 raising the threat level in the country to “severe.” Reuters
Macron’s Opinions on Russian War, U.S., and China Perplex Taiwan Authority. Taiwan reacted with confusion over French President Emmanuel Macron’s recent comments during his trip to China, where he called on Europe to act independently of the U.S. in navigating tensions over Taiwan. Taiwanese parliament speaker You Si-kun said Tuesday that Macron’s remarks left him “puzzled” and questioning France’s constitutional commitment to freedom and democracy. This reaction in Taipei adds to fallout in Europe over Macron’s visit to China. France’s foreign ministry on Tuesday moved to downplay Macron’s remarks, saying that France has “noted” criticism and remains in support of peace and stability in the Taiwan Strait. Reuters
Germany Ousts Chad Ambassador in Reprisal. Germany’s foreign ministry has instructed Chad’s ambassador in Berlin to leave the country within 48 hours. The expulsion appears to be a retaliatory move for Chad’s decision last week to expel the German ambassador to Chad over his reported poor behavior. Al Jazeera Deutsche Welle
Central and Eastern Europe
Ukraine Compares Moscow to Islamic State Following Beheading Video. A video has emerged online purportedly showing Russian troops filming themselves using a knife to behead an Ukrainian prisoner of war. Ukrainian President Volodymyr Zelenskyy said the world cannot ignore “how these beasts kill” and called for the “defeat of terror” that is Russia. Ukrainian Foreign Minister Dmytro Kuleba added that the video shows that Russia “is worse than ISIS” and that it makes no sense that Moscow is currently holding the rotating presidency of the UN Security Council. Kremlin spokesman Dmitry Peskov responded to the video by saying it is “awful” but that the veracity of the footage needs to be checked. CNN Deutsche Welle France 24 Reuters
Russia Asserts It Holds 80% of Bakhmut, Ukraine Claims Control. The head of Russia’s Wagner Group, Yevgeny Prigozhin, on Tuesday claimed that his mercenaries are in control of 80 percent of Bakhmut, including all of its key administrative buildings and industrial facilities. Prigozhin added that the Wagner Group has “handed over” left and right flanks near Bakhmut to the Russian military. Ukraine has denied Prigozhin’s claim and maintains that its forces control more of the embattled city. Kyiv Independent Reuters
Russia Test Launches ICBM. Russia’s Defense Ministry said it successfully test-launched an “advanced” intercontinental ballistic missile on Wednesday. The ministry said the ICBM was launched from a mobile ground-based system in the Kapustin Yar testing ground in the southern Astrakhan region and hit a mock target in Kazakhstan. ABC Deutsche Welle
Moscow Lawmakers Plan to End Draft Dodging. In a new law expected to come into force this week, Russia will allow military officials to issue online draft notices and increase punishment for suspected draft-dodgers, limiting the ability of would-be-conscripts to evade being called to fight in Ukraine. When Russia launched its last nationwide mobilization of 300,000 reservists in September, many men stayed home and did not answer the door to avoid the summons. While the Kremlin has denied that it’s planning another mass mobilization, a digital draft system could stymie similar efforts to evade conscription. The law also makes it impossible for a person named in a summons notice to leave the country, likely in response to tens of thousands of Russian men who fled into neighboring countries last Fall. Physical summons will continue to be handed out at workplaces and homes as well. New York Times Reuters Wall Street Journal
Serbia Allegedly Agreed to Send Weapons to Ukraine, U.S. Intelligence Leak Says. According to one assessment from the trove of leaked classified Pentagon briefings, Serbia agreed to supply weapons to Kyiv or has sent them already. Serbia’s Defense Minister Milos Vucevic dismissed the document, stating that it was “untrue” and that Serbia would not sell weapons to either Ukraine or Russia. Serbia is the only country in Europe that has not sanctioned Russia for its invasion of Ukraine, and has professed neutrality in the conflict despite deep historic, economic, and cultural ties with Russia. Serbia has tried to balance its ties with Moscow with Serbia’s goal of joining the EU. The disclosure comes just over a month after documents posted on Telegram purportedly showed the shipment of 122mm Grad ground-to-ground rockets by a Serbian arms maker to Kyiv in November. Those documents included a shipment manifest and a Ukrainian government end-user certificate. Reuters
Asia
Myanmar Regime Bombs Civilian Celebration in Rebel-Controlled Area, Kills 100. Multiple media reports say that military airstrikes in Myanmar on Tuesday reportedly killed as many as 100 people who were attending a ceremony held by opponents of army rule, including many children. A military government spokesperson acknowledged that the ceremony had been attacked but accused anti-government forces in the area of terrorizing local residents into supporting them. The UN, U.S., and others strongly condemned the attack and pledged to work to hold the military accountable. The military is increasingly using airstrikes to counter the widespread armed struggle against its rule, which has been ongoing since its coup in February 2021. Tuesday’s death toll, if confirmed, could be the highest since the conflict re-erupted. More than 3000 civilians are estimated to have been killed by security forces. New York Times Al Jazeera Associated Press
China to Close Airspace North of Taiwan. China is reportedly planning to close the airspace north of Taiwan from April 16 to April 18, according to Reuters citing four anonymous sources. The move would disrupt Taiwan's northern flight information region (FIR). One source added that the closure would impact a significant number of flights in the region, including 60 to 70 percent of flights between Northeast Asia and Southeast Asia. The sources said they did not know the reason behind the potential closure, though it may be part of China’s retaliation for Taiwanese President Tsai Ing-wen’s meeting with U.S. House Speaker Kevin McCarthy during her visit to the U.S. and Central America. Neither China or Taiwan has commented on the report. Reuters
South Korea Lending Artillery to U.S. to Avoid Transfers to Ukraine. South Korean newspaper DongA Ilbo reported on Wednesday that the US and South Korea reached a deal for South Korea to lend the 500,000 rounds of artillery shells to the U.S. According to a South Korean government source cited in the report, Seoul decided it would be better to lend the ammunition to the US, instead of selling it, to minimize the potential of the U.S. of transferring the South Korean shells to Ukraine. The report added that the U.S. would primarily use the shells to fill up its stockpile. The report comes after documents in the U.S. intelligence leak suggested South Korea has been pressured by the U.S. and Western allies to supply military aid to Kyiv, despite South Korean law preventing it from sending arms to countries engaged in conflict. Reuters
Japan to Spend $2.8 Billion on Long-Range Missiles. On Tuesday, Japan’s Defense Ministry announced that it had signed a $2.8 billion contract with the country’s defense contractor Mitsubishi Heavy Industries to develop long-range missiles. The contract, which includes advanced versions of Mitsubishi’s Type 12 missiles and a hypersonic ballistic missile, is set to be executed by as early as 2026. Japan will hold tests of these missiles at US military bases. Japan also signed a contract with Mitsubishi to develop a submarine-launched long range anti-ship missile that is expected to be completed by 2027. Associated Press DefenseNews France24
Middle East and Northern Africa
Israeli Spyware Used in Hacks in At Least 10 Countries. Microsoft and Citizen Lab released a report on Tuesday that says that spyware from Israeli firm QuaDream has been used in hacks in at least 10 countries. The report asserts with “high confidence” that QuaDream hacking and surveillance tools compromised the iPhones of journalists, opposition figures and civil society groups. QuaDream has not commented on the report. Microsoft and Citizen Lab said that publicly outing companies like QuaDream in this way is essential in tackling the mercenary spyware industry as governments develop regulations on commercial spyware. BleepingComputer Reuters TechCrunch
China and Russia in Secret Talks with Iran About Sanctioned Missile Fuel. Iran is reportedly in advanced secret talks with Russia and China to replenish its supply of a sanctioned chemical compound that is used to propel ballistic missiles, according to a Politico investigation. Approval of such a request would mark a clear violation of UN sanctions, and might also help Moscow to replenish its depleted stock of rockets for use in its war against Ukraine. Iranian diplomat Sajjad Ahadzadeh, who serves as Tehran’s “technology counselor” in China, has led the talks to acquire ammonium perchlorate, or AP, the main ingredient in solid propellants used to power missiles. Unnamed diplomats do not know which Chinese companies are involved, but they relayed that Tehran has held additional negotiations with the state-owned Russian chemical maker FKP Anozit. These diplomats estimate that the quantity of AP that Iran is seeking would be enough to build thousands of rockets, including the Zolfaghar missile, which has a range of 700 kilometers. Iran has previously supplied Russia with equipment and munitions which have been used in Ukraine, and also has reportedly advised Moscow on how to circumvent international sanctions. Politico
Sub Saharan Africa
U.N. Requests International Aid for Drought-Stricken Somalia. In a joint news briefing with President Hassan Sheikh Mohamud of Somalia, UN Secretary General Antonia Guterres asked for international support for the country as they face their worst drought in decades. During the press briefing in the country’s capital of Mogadishu, Guterres told reporters that he was there to show the international community the extent of the damage and the need for international support. The country, along with Kenya and Ethiopia, has experienced five consecutive failed rainy seasons, which has killed cattle and crops, and forced 1.7 million people from their homes. According to the UN, famine thresholds have not been met, but half of the country’s population will need humanitarian assistance this year. Al Jazeera VOA
Pirates in Gulf of Guinea Board Chinese Oil Tanker. According to the London-based risk management group EOS Risk Group, a group of pirates boarded a Chinese oil tanker in the Gulf of Guinea on Tuesday. This marks the second such instance of this occurrence in two weeks as a Dutch owned oil tanker was taken over near the Congo. The number of pirates, and number of crew members on the tanker as well as other details still remain unknown. Associated Press
U.N. Relief Agency to Probe Theft of Food Aid in Ethiopia. The UN’s World Food Program (WFP) is investigating the theft of food aid from its operations in Ethiopia, which have appeared in some markets for sale and threatens WFP’s capacity to mobilize more resources for those in need. The WFP called on the partner organizations to take action to curb the misappropriation and diversion of humanitarian relief in the country. Although the letter does not mention any specific cases, two aid workers told AP that food for 100,000 people was recently discovered missing from a warehouse in a town badly affected by the conflict in the northern Tigray region. Although it was not clear who was responsible for the theft, the same warehouse was previously looted by Eritrean soldiers allied to the Ethiopian government in a separate incident. Associated Press
Armed Men Kill 5 Troops Leaving Niger Gold Mining Location. Five soldiers were wounded and several others injured after armed gunmen ambushed a military convoy in the northern Niger region of Agadez. The envoy was reportedly performing escort duties and leaving a gold mining site when it was ambushed. No one has claimed responsibility for the attack, but locals have said that armed groups frequently come through the mining areas to steal gold. Associated Press Washington Post
Cyber & Tech
U.S. Studying Options for Potential AI Regulatory Measures. The Biden administration is requesting public comment on potential regulation and “accountability mechanisms” for artificial intelligence tools. The National Telecommunications and Information Administration (NTIA), a Commerce Department agency that advises the White House on telecommunications and information policy, put out the formal request for input on Tuesday to help inform how to mitigate the security, legal and ethical risks posed by the ongoing AI boom. The NTIA will accept comments over the next sixty days and plans to draft a report on options for federal policy on AI. Reuters Wall Street Journal
China Orders Security Reviews for AI Services. Like the U.S., China is moving to regulate the use and development of artificial intelligence systems as well. The Cyberspace Administration of China (CAC) released draft guidelines that would mandate security reviews of AI services before they are allowed to operate. The reviews will scrutinize AI tools’ accuracy and ensure they respect intellectual property, do not discriminate and do not pose security risks. AI-generated content will also be required to be clearly labeled as such. The CAC is accepting public feedback on these guidelines, which add to the Chinese government’s efforts to regulate data and come as Chinese tech giants release new AI products. Al Jazeera Bloomberg
China’s Alibaba Launches ChatGPT Rival. Amid the wave of regulation on artificial intelligence, Chinese technology giant Alibaba launched its new AI model, “Tongyi Qianwen.” The generative AI chatbot is currently available in both English and Chinese. It will initially be integrated into Alibaba’s workplace messaging app DingTalk and Tmall Genie, a provider of smart home appliances. Alibaba’s computing unit, Alibaba Cloud, developed Tongyi Qianwen to rival OpenAI’s chatbot ChatGPT, which is banned in China. BBC CNBC CNET
France Investigating Complaints Against ChatGPT Amid European Skepticism of Chatbot. France’s privacy watchdog CNIL said Tuesday it has received at least two complaints against OpenAI’s chatbot ChatGPT on the grounds that the chatbot violated privacy rules. CNIL says it is investigating the matter. The French investigation comes amid EU-wide scrutiny of ChatGPT over security and privacy risks and legal and ethical concerns. Reuters Politico
3CX Says North Korean Hackers Behind Supply Chain Attack. Software company 3CX on Tuesday confirmed that North Korean-backed hackers were behind a 3CX supply chain attack last month. Cybersecurity researchers previously said the code used in the attack, which compromised installation software from 3CX, matched malicious code used in past attacks attributed to North Korea’s hacking unit Lazarus Group. 3CX did not specifically accuse Lazarus Group of the attack and said that it is still investigating the impact of the attack. BleepingComputer TechCrunch
CISA Updates Zero Trust Maturity Model. CISA published a second version of its Zero Trust Maturity Model on Tuesday. The new version, which comes over a year after the first release of the model, updates definitions and metrics in guidance for government agencies on implementing zero-trust security architectures, which aim to prevent unauthorized or dangerous access to government data through consistent verification of user credentials. The updated model adds an additional maturity stage to address application workload and data in zero trust strategies. Experts say the model should now look at better considering incident response and also start to look at risks and opportunities from new technologies like artificial intelligence as well as threats from the mass migration to cloud technologies. FedScoop
U.S. State Department Requesting ‘Cyber Assistance Fund’ to Support Partners, Allies. The U.S. State Department’s ambassador for cybersecurity Nate Fick says his department is seeking a “cyber assistance fund” to support cybersecurity efforts in partners and allies. Fick outlined the fund, as well as proposals to invest in online delivery mechanisms for cyber support and make better use of private sector cyber capabilities, as part of wider plans for cyber capacity building and quicker cyber incident response support in friendly foreign countries. Breaking Defense
Indian Separatist Movement Supporters Using Twitter Bots to Promote Violence. Amidst an Indian government manhunt for Sikh separatist leader Amritpal Singh, some backers of the movement – which seeks to create a homeland for Sikhs by establishing a sovereign state called Khalistan in India’s Punjab region – are taking advantage of Twitter’s reduced safety staff and limited content moderation efforts to promote acts of vandalism and at times violence. The supporters are reportedly using multiple networks of linked accounts to simultaneously send out videos and calls for action before they can be actioned by Twitter’s staff. They are also using evasive tactics, such as deleting tweets after they’ve been posted, and using specific word choices to avoid suspension. The tweets are likely coming from outside the Punjab region, as the Indian government recently cut its access to the internet. Many of the tweets urge protesters to gather or take unspecified action against power plants, train tracks, and other strategic targets inside India as well as Indian facilities abroad. Twitter’s head of trust and safety did not respond to an email; the company’s press department responded with a poop emoji, which has been its auto-reply since Mr. Musk took control of the company. Washington Post
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
