Category Archives: Analysis

Political Spearphishing

If you’ve ever visited my LinkedIn you know that I admit to working for a “nameless detective agency” in Los Angeles. I haven’t displayed any of the stuff I’ve been doing, but this week I got something where I can make my findings public, a broad political spearphishing campaign.

 

The origin of the emails were obfuscated, but all anchored at mesrv.com. Using Maltego I found dozens of subdomains.

Many Mail Servers

Many Mail Servers

The Whois lookup for the domain was completely useless, a proxy registration intended to thwart diggers.

mesrv.com Current Whois

mesrv.com Current Whois

But this particular operator didn’t register clean at the start of this game. Hello, Mohammed Benyahia.

mesrv.com by Mohammed Benyahia

mesrv.com by Mohammed Benyahia

The other 21 domains associated with his name were available:

Mohammed Benyahia domains

Mohammed Benyahia domains

Domains are registered to mohamed.benyahia@tersea.com, and a quick scan shows that mesrv.com and tersea.com are quartered in the same place today. This gives me the sense I’ve got the right guy, it’s not like someone picked up the mesrv.com domain at random and put it to work using Benyahia’s business as a cover.

mesrv.com & tersea.com

mesrv.com & tersea.com

I visited tersea.com’s site and they conveniently revealed the @tersea Twitter account. It only took moments to find @Salutismo, Benyahia’s personal account, and then from there the rest fell out quickly.

@tersea & @Salutismo Common Contacts

@tersea & @Salutismo Common Contacts

Some of those are big media accounts, stripping those, it appears we’ve found some possible associates:

Benyahia's Probable Associates

Benyahia’s Probable Associates

Among them, I most like Dany Tech aka Omar Salhane, since he’s locked down and that sounds like a Moroccan name, same as Benyahia. Small accounts like these, particularly long abandoned, are absolutely treasure, they’re a candid admission of how things were in the past, and only a really experienced player will know to clean up, or to salt their trail with fake stuff.

Omar Salhane's One Mention

Omar Salhane’s One Mention

 

So that’s some initial recon. We’re looking for someone who can pick out who is important in a specific left leaning political organization and go at them hard. A Moroccan living in Paris with rented servers in Ireland? That doesn’t add up, so at this point I guess this guy is a service provider to many activities, perhaps some shady, and I change direction a bit.

 

If found thirteen IPv4 and two IPv6 addresses active for the twenty one domains.

Active IPs

Active IPs

tersea.com & Friends

tersea.com & Friends

The tersea.com domain is hosted within AS36884 Wana in Morocco. There are some other servers within AS8560 1 & 1 in France.

1 and 1 Servers

1 & 1 Servers

I thought it would be interesting to employ ThreatCrowd, a Maltego transform that queries Alien Vault’s Open Threat Exchange. Two of the fifteen IPs came back hot – involved in malware campaigns. Notice the number of German domains here? All of Benyahia’s contacts are French speakers, so this looks like a generalized place for bad actors.

ThreatCrowd Results

ThreatCrowd Results

And the main teasea.com domain came back hot, too.

tersea ThreatCrowd Results

tersea ThreatCrowd Results

 

I think Benyahia is a fraudster, a spammer, but he doesn’t read like someone who goes hunting in the American political space. He probably sold some services to someone who did, and that’s a deeper level of digging required to expose the truth. I haven’t seen the details on the attempts so I can’t predict if I’ll be able to display them here, or if they’re specific enough to identify the target.

This sort of work is fun for me, like doing a puzzle where there’s a scavenger hunt for the pieces before I can even start.

 
masecretaireprivee.com
meilleuregarantie.com
hotlineprivee.com
hotline-privee.com
clickconsulte.com
groupe-tersea.com
clikconsulte.com
clicconsult.com
clikconsult.com
clicconsulte.com
updatemybox.com
abdellahyacoubi.com
satisfaction-tui.com
pescallness.com
tercea.com
cozact.com
tersea.net
tersea.com
tersalia.com
mesrv.com
monrdvpro.com

Reducing Infant Mortality With Social Network Analysis

My first experience with social network analysis was downloading the Maltego Community Edition software. I put in an email address, ran a transform, and it showed me the associated Twitter account. A few more clicks, and it showed me the account’s associates. I was immediately hooked – the system represented things on the screen the way I envision them in my head. That was November of 2010. Two years later I took the Social Network Analysis class from Coursera and I would say that this is now a pretty firm career direction for me. There are all sorts of things I have yet to learn, but the basics are in place.

One of the nice things with this course was that it got me out of viewing SNA as purely an opposition research tool. People use generalized network analysis for everything from protein structure to organizational analysis & development. This is the bright side of the SNA coin, and I just noticed Eva Schiffer’s work with Net-Map.

Their most recent project involves cutting infant mortality in rural Nigeria. SNA isn’t always poking around in social media – the practice got its start in the social sciences decades ago. People get trained in Net-Map and then they go out and collect information on organizations by hand, in this case visiting all the people who provide funds and deliver health services in the Nigerian state of Katsina.

Manual Net-Map

Manual Net-Map

This electronic drawing of the manual map shows what they are doing – identifying actors and the flows of money and influence that effect how health care is delivered.

Electronic Version Of Manual Net-Map

Electronic Version Of Manual Net-Map

The entire study is thirty one pages and it contained a lot of detail on how they sorted out the force vectors between nodes – in English, how they determined how much and what type of influence each of the various actors exerted on the others. The systems I am using right now have the ability to label, color, and weight links, and I have written a bit of code to include a time component to Twitter mentions, slowly aging them down to a minimal value, which produces a more accurate graph of current conditions.

A social network graph can save a mother and her child. Maybe next it can reduce the number of children she has from five to three, getting down towards replacement numbers. And another graph could help yield clean water, while a crop map made by a western built drone could identify troubles before they became food security problems. Many of the troubles on the maps I curate are related to having too many people and not enough water or arable land. If we can ensure the safety of infants and mothers that is a step towards ensuring the safety of whole societies. And that is a brighter future for all of us …

Organization, Relationship & Contact Analyzer

I am not sure where I noticed the Social Network Intelligence Analysis to Combat Street Gang Violence paper, as it’s sat on my desktop for at least a week. I read it last night and it’s an interesting take on applying social network analysis to gang membership.

The method employed requires three steps and they chose their own language to define them, avoiding standard terminology from SNA and graph theory. This appears to have been done both as a branding exercise, and to avoid offering a whole paragraph of industry specific word salad to law enforcement management when describing the concepts.

  • Determining Degree Of Membership
  • Identifying Seed Sets
  • Identifying Ecosystems

First, they have to identify members, and this is not like dealing with police officers, who are either active or retired. Gangs have hardcore members, associate members, and occasionally someone’s cousin from out of town is at the wrong party and gets arrested with some genuine bad guys. They used a pagerank like method, assigning a 1 to those who are avowed members (admissions, tattoos, etc) and a 0 to unknowns. Degree of membership was based on the number of arrests with known members.

Second, they seek to identify what they call ‘seed sets’, and this graphic shows a stepwise deconstruction of a network using the removal of low betweenness nodes, until there are a set of link free nodes. Like the membership calculation, there isn’t a pre-existing specific name for this process, but it’s instantly recognizable to anyone who has ever applied SNA to counter-insurgency. They use language from epidemiology to characterize the motivation – they’re not seeking fixers/facilitators, which is what high betweenness nodes can represent, they’re hunting the group of leaders who can plant a new tactic across the entire gang if all of them adopt it.

TIP_DECOMP Algorithim

TIP_DECOMP Algorithim

Third, they ‘map the ecosystem’ of the gang. This involves applying the Louvain partition to the network. I had never seen this name before, but the single parameter is similar to Gephi’s tuning, I checked, and Louvain is mentioned in their implementation.

Tunable clusters of algorithms like this began appearing in tools I use about a year ago – Maltego Radium provides ‘machines’, named collections of common tasks involved in certain sorts of profiling. The system also permits development of new machines. Gephi is an open, exploratory environment that permits plugin development but I haven’t seen any counter-insurgency type work being done with it. Sentinel Visualizer is specifically LE/counter-insurgency but the customization there happens via the open access to its back end database.

This is another piece of proof that there is a market for this sort of work – a mix of subject matter expertise, social science/statistician, and hackerish handler of data. I am going to keep an eye on the market progress of ORCA so I can better understand how an eight page paper evolves into a finished product.

Greater This, Former That

I see that fifty of you think what I write is important enough that you subscribe. Longtime readers understand that when something attracts my eye and I can’t express what I see in words I will work my way around the perimeter, writing about what is known.

IMG & Greece: Institutional Monstrous Failure caught my eye earlier, it’s one of those things in my feed where the title leaps off the page. Some of you are new and will not recall that The Oil Drum and The Automatic Earth once held my attention and shaped my thinking. I might not always say it, but climate change, liquid fuel availability, and their implications regarding our financial sector color everything that I write.

The Mideast has suffered through three imperial dissolutions in the last century. The Ottomans took a tumble starting around 1800 and ending in the 1920s. The Soviet Union arose around the time they ended, then came apart after bleeding out trying to control Afghanistan. The United States was baited into the same trap just ten years after the Soviet implosion. Exceptional Americans and their unwarranted opinions aside, everyone else is starting to grasp that this is an epochal change, as we bankrupted not just our financial system but the environment and our energy sources, too.

Here are the Ottoman losses from 1807 until the formation of Modern Turkey in 1924.

Ottoman Losses 1807-1924

The Ottoman opponent in Europe was the Austro-Hungarian empire.

Austro Hungarian & Ottoman Conflict

Austro Hungarian & Ottoman Conflict

Neither entity survived World War I.

Europe Empires 1914

And we were left with a muddle of ethnic groups and lines on a map in the Balkans.

Balkans Ethnic Groups

Balkans Ethnic Groups

Greece made steady gains at the expense of the Ottomans.

Greek Gains & Ottoman Losses

Greek Gains & Ottoman Losses

Greater Syria, last represented whole by the French Syrian mandate, lost the Sanjak of Alexandretta to the Turks in 1939 and Lebanon gained independence, albeit with frequent meddling, starting in 1943. The Golan Heights were claimed by Israel in 1967, securing their northeast border and the headwaters of the Jordan river.

French Syrian Mandate Territory Losses

French Syrian Mandate Territory Losses

Greater Serbia, more a theory than history, raised its ugly head right after the Soviet dissolution and the idea was finally smashed to bits in Operation Noble Anvil in 1999.

Greater Serbia

Greater Serbia

The Only Red Line That Matters described the one potentially violent fault line between two NATO countries – the dispute between Greece and Turkey over the island of Cyprus, under UN observation for the last forty years.

Cyprus& British Overseas Territories

Cyprus& British Overseas Territories

Russia does not wish to be excluded from the Mediterranean and the loss of their naval supply station at Tartus will do just that. Greek Cypriots have many Russian ties, their recent banking implosion was a diplomatic issue, and Russia may see Limassol as a fallback position if Tartus becomes untenable.

Stepping back to see the whole region, Russia was left feeling duped by the NATO effort in Libya, which was pitched as a no fly zone and then turned into a much more invasive armor plinking exercise. This won’t be repeated in Syria.

What comes next?

This is the big unknown. Here are some things I do know.

  • As above: environment, energy, and economy are all going through an epochal change
  • The U.S. government has been wholly captured by the financial sector and a chorus of a dozen far right think tanks drown out any hint of reality based assessment
  • The media has abdicated its role as the fourth estate – count on them to miss most of what matters and mishandle the rest
  • Whatever promise social media held in remedying big media’s failure is being poisoned by a mixture of corporate & government fiddling and the simple fact that we have no experience in dealing with what is coming
  • 2012 has come and gone, “Worst. Apocalypse. Ever” became a punch line, and the destructive dynamic of Islam’s internal divide matters far more than any discredited end of days myth.

Reality trumps religion. Reality trumps rhetoric, no matter what the underlying ideology. Reality supports exponential growth in closed systems … but only until the limits are reached. The European union has found the edge of their petri dish – tiny Cyprus sneezed and the whole continent’s banking sector was instantly hospitalized with pneumonia. The U.S. is contracting, declining, and Europe is just half a step behind us.

I think what is needed is a graph like the one below, showing the progression of imperial alliances leading up to World War I, only recast for Today’s Tripolar Power Struggle in the Mideast, and it has to factor in the outer ring of global players such as the U.S., Russia, China, and the European Union. I may have a go at doing this if I can figure out which tool to use to express the concepts.

European Imperial Network 1872-1907

European Imperial Network 1872-1907

Stratfor: Egypt’s Waning Influence

Remember when I found this map and noted that Egypt’s presence as the proxy for all Arabs was dated and no longer correct?

Arabs Persians Turks

Arabs Persians Turks

I produced an alternative which I revealed in Today’s Tripolar Power Struggle, replacing Egypt with the Saudi and Qatari Sunni insurgency backers from the Arabian Peninsula.

Perians, Saudis/Qataris & Turks

Perians, Saudis/Qataris & Turks

Today’s offering from Stratfor, entitled Egypt’s Waning Influence, provides confirmation of what I said, but from a slightly different perspective.

Egypt was once the political and religious lynchpin of the Sunni Arab world. Egyptian institutions such as the religious Al-Azhar University and the Islamism championed by the Muslim Brotherhood continue to have significant regional influence, but Egypt is far from being a contender for the role of Arab hegemon. Larger regional issues, such as the Syrian War and the Sunni push back that has placed a formerly ascendant Iran on the defensive, take priority over Egypt’s political morass in the eyes of the United States and its Western allies, who have grown weary of intervening in the Middle East.

Operations like Stratfor and NightWatch can tell you what a given country is going to do based on circumstances. This requires resources, contacts in country who both know the culture and who can assess things in a rational, objective fashion. I am moving in this direction in some ways, but I am interested in underlying drivers such as food and water security, and I can handle volumes of data in a way that many qualitative analysts can not.

This is a nice bit of validation – I’m in the right place, at the right time, and with an assessment that matches that of an industry leader.

Mindfulness In Analysis

My conversion to Buddhism began nine years ago and I have been a student, albeit a poor one at times, of the mindfulness instruction of Andrea Fella of the Insight Meditation Center. This was a life and death matter for me; the ability to pay attention at a very fine level of detail was a significant part of my recovery from Lyme disease.

I was drawn to read the Psychology of Intelligence Analysis about three years ago. I had been dealing with complex, ambiguous situations involving multiple actors and a great deal of deception. The style and content made such an impression on me that I became a regular consumer of monographs and articles on the field. I discovered and squirreled away the CIA Occasional Papers months ago and am only now finding the time to review them.

Making Sense Of Transnational Threats, published in October of 2004, suggests a fusion of intelligence analysis and mindfulness techniques as a means to move our state actor oriented intelligence community into a mode where they can deal with non-state players. I am officially fascinated.

The problem statement is simple enough. When seeking patterns outside the bounds of those formerly addressed by intelligence analysts, it is not enough to move the goalposts, the process itself must be changed, and the includes integrated introspection.

Mindfulness In Intelligence

Mindfulness In Intelligence

The author has some ideas about process at a very high level. The last one is interesting – that’s the place where alternate reality game play fits. Jane McGonigal has long been an advocate of this and I have collected various pieces of her work for reference.

The Mindful Intelligence Process

The Mindful Intelligence Process

The practical ideas are focused on managerial choices for the intelligence sector. I don’t think they could presume to direct employees to do so outside work, but I’ll say it here – the best source of mindfulness meditation is which ever method is used by your faith, as each one has some sort of contemplative tradition. Atheists are free to select which ever they prefer – Andrea Fella’s work is easily interpreted and applied by those who are not Buddhist.

Key Practical Ideas

Key Practical Ideas

States are, with the notable exception of North Korea, bound by treaties, a set of rules appropriate for their society, and they have a history of solving problems in a certain fashion. You see the term “rational actor” applied in foreign policy documents. These prescriptions are for dealing with transnational actors, who are much freer to improvise. The traditional analytical methods of counting resources, referring to historical precedent, and attempting to obtain secrets are much less applicable.

Selected Alternative Analysis Techniques

Selected Alternative Analysis Techniques

The traditional vs transnational table, right hand column, item number two – ‘network’. What they mean was defined in Networks and Netwars, a paper from RAND which is freely available, but which Scribd forbids me to post. This was seminal work in the area and is required reading to understand what the future holds. I have not touched it in over a year and I am due to revisit in shortly.

Traditional vs. Transnational Intelligence Targets

Traditional vs. Transnational Intelligence Targets

Making Sense Of Transnational Threats is a long paper, thirty five pages. This is one of those papers that needs to be read, then set aside, and then read again. Then read some related material. Then come back to it and write something that demonstrates a solid understanding and expands upon the base that it provides.

Well, that’s what I intend to do with this. If you’re listening out there, send me hints on what to look at next …

Looking Forward, Looking Behind

The Democratic Study Group was a 150 staff member legislative service organization(LSO) that had as customers all of the Democratic members of Congress and a good number of Republicans. This internal think tank analyzed policy proposals, serving as an in-house ‘brain’ for Congress. The “Republican Revolution” of 1994 would lead to the defunding of this entity in 1995, functionally turning over control of domestic policy making to the likes of the Heritage Foundation and the American Enterprise Institute. This has result, in my opinion, in an unmitigated policy making disaster that has ended the American empire and that endangers the stability of our nation. The construction of Progressive Congress News was a halting attempt to reverse this trend.

Our intelligence community was more resilient, due to their structure and duties. The outing of Valerie Plame, a twenty year CIA veteran and the head of our counter-proliferation operation, for failure to support the Bush administration’s desire for an adventure in Iraq, ought to have resulted in the prosecution of Dick Cheney and Karl Rove. Instead we limp forward with this crime unpunished, lugging a variety of other attendant baggage of our decay.

Having seen the problems at the domestic level and having a good idea of how they’ll be resolved, I decided I would turn my attention to foreign policy issues. I have gone through the Quadrennial Diplomacy & Development Review, the State Department’s companion to the Defense Department’s Quadrennial Defense Review, I spent the first three months of the year surveying the foreign policy discussion space, and I have my own short list of openings in the area.

I have taken to reading literature from the CIA Library over the last few years and the periodic self assessments are really interesting if you’re familiar with the companion global events from the timeframe. I recently started on the Kent Center Occasional Papers and I found a number of screenshot worthy paragraphs in the second of the series.

media, think tanks, advocacy groups

CIA Kent Center Occasional Papers Vol 1 No 2

CIA Kent Center Occasional Papers Vol 1 No 2

lower the wall between it (our intelligence services) and the policy making process

CIA Kent Center Occasional Papers Vol 1 No 2

CIA Kent Center Occasional Papers Vol 1 No 2

draw attention to their product and market their ideas

CIA Kent Center Occasional Papers Vol 1 No 2

CIA Kent Center Occasional Papers Vol 1 No 2

Break down external barriers and internal silos. Improve the quality of analysis by reducing the feedback loop constraints and enriching communication methods employed, in type, in number, and in frequency. Find and eject bad information and bad actors. Or don’t … at least not at first.

So this is another instance where, although not using the same words, the concept of the hive mind has begun to take root. The question is, what do we do about this? I have a few ideas I’ve sketched down over the last few months, let me explain …

More Will Be Revealed