New Rule Will Not Secure Radiological Material at Hospitals, Investigator Says

By Douglas P. Guarino

A cesium 137 device previously in storage at a hospital in New York City. A Government Accountability Office investigator said a new federal rule would not do enough to secure radioactive materials at U.S. medical facilities (U.S. National Nuclear Security Administration photo).

WASHINGTON – A controversial new U.S. Nuclear Regulatory Commission rule will not do enough to ensure that radioactive materials at U.S. hospitals are protected from acts of theft or sabotage, a senior investigator at the nonpartisan Government Accountability Office told Global Security Newswire .
Gene Aloise, director of the GAO natural resources and environment team, released a preliminary report earlier this month finding “that NRC’s security controls for hospitals and medical facilities do not prescribe the specific steps that must be taken to protect their radiological sources,” and that the materials are vulnerable as a result.
The report provided several examples to illustrate this point, including one in which workers had written the access code to a hospital blood bank containing a cesium blood irradiator next to its doorway in a busy hallway.
At another hospital, an irradiator was sitting on a wheeled pallet in a publicly accessible building, in a room not far from an external loading dock. The hallway leading to the room had a camera, but it was pointed away from the room, auditors found.
Such lax security is a problem, the report said, because terrorists could use such radioactive materials to construct a so-called “dirty bomb” -- a crude weapon that could use conventional explosives to disperse harmful radiation throughout an area. Accidents or acts of terrorism using the type of radioactive materials found in hospitals can do significant damage, according to the report, which cited a 1987 incident in Brazil in which an accident involving a medical device containing cesium led to four deaths and necessitated a cleanup involving the demolition of homes and the disposal of 3,500 cubic meters of radioactive waste.
The National Nuclear Security Administration has identified approximately 1,500 hospitals and medical buildings in the United States that contain “high-activity radiological sources,” according to the GAO report.
In some cases U.S. hospital personnel responsible for leading radiological security efforts complained that they lacked expertise in that work, the report said. They told GAO investigators “that it would have been helpful if NRC’s controls were more specific so that [they] would be in a better position to determine what security measures were necessary” to provide adequate protection, according to the report.
Nuclear Regulatory Commission officials did not testify at a March 14 hearing in which Aloise detailed the findings for a Senate Homeland Security subcommittee. Afterward, however, the agency provided the panel with a two-page response to the GAO criticisms, in which it argued that the report provided “an incomplete picture of the NRC’s … security program.”
The commission uses “a multilayered approach for the security of radioactive material … providing a nonprescriptive framework that allows [organizations authorized to use radioactive materials] to develop a security program of measures specifically tailored to its facility,” the response says. The program includes background checks, controlling personnel access to areas where radioactive materials are located and “coordination and tracking of materials shipments,” the commission said.
Regarding the concern that security was unfamiliar territory for hospital workers and that the requirements were vague, the commission said its forthcoming new rule requires facilities “to develop and maintain a documented security program and conduct periodic training on the requirements of the program to licensee personnel,” the NRC response says.
The commission endorsed a nearly-complete draft of the rule on March 16, two days after the GAO concerns became public. The rule, which will take effect one year after it is published in the Federal Register with minor changes, establishes security requirements for what the International Atomic Energy Agency has deemed the most risk-significant radioactive materials, as well as for shipments of small amounts of irradiated reactor fuel. It covers materials used not only at medical facilities but also those used by the oil, gas and other industries.
Senator Daniel Akaka (D-Hawaii), chairman of the Homeland Security Oversight subcommittee that requested the study and hosted the hearing, did not comment directly on the rule but said in a statement to GSN that he was “carefully monitoring agency responses to GAO’s findings and their efforts to address the identified vulnerabilities.
“If unacceptable security gaps are not corrected immediately, I plan to work with my Senate colleagues on legislation that will mandate improvements to our domestic radiological security,” said Akaka, who is due to retire from the Senate early next year.
Aloise, however, is already predicting that the new rule will not fix the problems addressed in his report. In an interview with GSN, the investigator noted that the rule in large part codifies existing NRC security orders made since the Sept. 11, 2011, terrorist attacks. Though the commission purports to go beyond the existing mandate in the new rule, Aloise raised doubts that its impact would change the GAO assessment of the security issue.
The new rule was already controversial. Some state regulators say it does not do enough to protect radioactive materials from being used by terrorists, while others, backed by industry groups, say it is overly burdensome.
The Washington state Health Department in 2011 blasted an earlier draft of the NRC order, saying it “misses the mark” in several areas where state officials believe more robust security measures are needed.
For example, Washington Governor Christine Gregoire (D) in 2008 petitioned the federal commission to either require that trucks carrying certain quantities of radioactive material use GPS tracking or to grant states the authority to require use of the technology, state officials noted in comments on the commission’s proposed rule. Gregoire cited instances in which trucks carrying radioactive material were stolen as evidence of the need for such requirements, state officials added, saying that “it only takes one to become the terrorist event none of us wants to see.”
Specifically, the governor’s petition addressed “Category 2” sources of radioactive material, those the International Atomic Energy Agency believes “could” cause permanent injury to people following exposure for “minutes to hours” and “could possibly” be fatal if exposure lasted “hours to days.”
However, the commission rejected Gregoire’s petition in its approved version of the new rule, saying “GPS tracking is neither justified nor necessary” for Category 2 materials. The rule only requires that Category 1 materials be tracked using GPS or other “telemetric position monitoring” technology.
The U.N. nuclear watchdog defines Category 1 materials as those that “would be likely” to cause permanent injury via exposure for “more than a few minutes” and “would probably” be fatal if exposure lasted “a few minutes to an hour.”
Washington state officials also said federal regulators should require licensees to notify local law enforcement officials of every site that uses category 1 and 2 materials, regardless of the duration of that use. Facing pressure from industry and other state regulators, the commission removed the proposal to require such notification from the final rule, however.
The Conference of Radiation Control Program Directors, which represents some state regulators, said that, in many cases firms licensed to use devices that contain radioactive sources are “notified of the necessity of work on the same day the work is required” and that such “jobs often involve repair of critical oil and gas infrastructure which could be delayed while attempting to determine which [local law enforcement agency] has jurisdiction.”
The Nuclear Energy Institute, which represents the nuclear power industry and submitted comments on the proposal that were also endorsed by the radiopharmaceutical industry, said it was “unrealistic an unnecessary to require licensees to provide advance notification to [local law enforcement officials] of work at temporary job sites.”
In general, the proposed rule “will have significant regulatory burden, does not appear to have a clear analytical basis” and is not “risk-based,” the industry group says.
The National Nuclear Security Administration has established a voluntary program in which it pays some hospitals and other facilities to upgrade their radiological security -- by installing systems such as remote monitoring systems, surveillance cameras, hardened doors, iris scanners, motion detectors and tamper-proof alarms -- and train their staff.
In a March 22 letter, Akaka asks Senate appropriators to boost funding for this Domestic Material Protection program – part of the NNSA Global Threat Reduction Initiative – to $75 million in fiscal 2013 in light of the GAO findings. The Obama administration has requested $55 million for the program, while Congress in fiscal 2012 appropriated $51 million.
In some cases hospitals turn down NNSA assistance rather than pay what Aloise estimates is less than $10,000 per year to maintain the upgrades after a three-to-five-year NNSA warranty expires. Aloise said these rejections come despite the federal agency offering to shoulder what NNSA estimates indicate is more than $300,000 in start-up and installation costs per facility.
“Some just have not bought into the security culture yet,” Aloise said. “They say ‘you’re asking us to protect against something that could happen’ – I tell them yes, that’s the point.”


 http://www.nti.org/gsn/

As Somali Piracy Grows Bolder, NATO Stays the Course

Despite Defense Department budget cuts and ongoing military operations, pirates in the waters off the coast of Somalia won’t see a decrease in naval military presence any time soon. NATO allies recently agreed to continue through 2014 the Ocean Shield operation – a counter-piracy naval operation off the Horn of Africa protecting merchant ships from pirate attack. This is welcome news to many ship owners and charters, which have seen an increase in the number of pirate attacks in the Indian Ocean. In 2011, Somali pirates attacked 439 vessels, fired on 113 of them, hijacked 45, and took 802 hostages. The pirate threat and the international response seem only to be escalating.
Piracy in the Indian Ocean threatens human life, regional stability, and international commerce, costing the global economy $7 billion to $12 billion annually. To address this issue, the National Chamber Foundation (NCF) recently hosted “High Risk on the High Seas: The Economic Impact of Piracy in the Indian Ocean,” an event featuring comments from industry and government experts on the challenge of piracy and the threat to commercial interests in the Indian Ocean.
For ships passing through the 2.5 million square nautical miles of water where Somali pirates operate, security measures are a necessity. Speakers at the NCF program offered several perspectives on the pirate threat, offering insight into the primary areas where governments and industry should focus their efforts.
The immediate need is to mitigate the direct threat to crew members and their ships. One of the panelists at the program, Paul Gugg, Company Security Officer for Chevron, said the “critical evolution in an attack is getting from the small skiff up the side and onto the ship.”
Given that, ships are increasingly fitted with fairly basic physical barriers, like greased rails, fire hoses, and electrified wire. In total, ships passing through the Indian Ocean trade lanes have 14,000 miles of 750 mm stainless steel razor wire protecting ship perimeters. To put that in context, the Somali coastline is only about 1,200 miles long, leaving Gugg to wonder whether the razor wire is being deployed in the right places.
Another effective defensive tactic is speeding through the dangerous waters. Rear Admiral Terry McKnight, former Commander of Piracy Task Force 151, the international naval force tasked with anti-piracy operations, said no ship traveling at 18 to 20 knots will be caught by pirates in small skiffs.
Perhaps even more effective in deterring attacks is the presence of private security firms, hired by ship owners to escort their crew and cargo through pirate-infested waters. Pirates have not succeeding in taking a ship where armed security teams were present.
As an example, Mark Martecchini, Managing Director at Stolt Tankers, said during the program that “in using armed guards, we have had no ships taken, no unfavorable incidents, and the warning shots that have been fired on about 10% of the occasions of transits going through [the Indian Ocean] have been effective in getting the pirates to go search for easier targets.”
While private sector protective measures are important, all of the event’s speakers agreed the continued presence of naval forces in the region is critical to stemming the pirate threat.
The NATO decision to continue the Ocean Shield operation through 2014 supports this. One constant challenge, however, is what to do with pirates once they have been captured. At present, as much as 75% of captured pirates are released making them free to attack another ship on another day. The reasons for this are fairly straightforward: there are not enough nations willing to take the apprehended pirates and put them on trial, and there is not enough prison capacity in Somalia to hold the convicted.
The threat may manifest at sea, but the origins lay on land in Somalia’s turbulent and unstable political environment. While there has been some progress in building prison capacity in the Somali regions of Putland and Somaliland, it is not yet enough to manage the large numbers of pirates caught in the act. Somalia has long been plagued by violence and political unrest. Beyond a weak (if not absent) central government, the al Qaeda-affiliate al Shabaab conducts terrorist acts threatening regional stability. With these significant challenges – which no doubt contribute to the escalating pirate threat – Secretary of State Hillary Clinton said:

“We will encourage the international community to impose further sanctions, including travel bans and asset freezes, on people inside and outside the [Somalia’s Transitional Federal Government] who seek to undermine Somalia’s peace and security or to delay or even prevent the political transition.”

Even as the international community targets pirate ringleaders on land and addresses the growing threat at sea, the panel made clear it is critical to understand that piracy presents large economic costs to industry, the supply chain and the global economy.
In reflecting on these conditions, Mitch King, Supply Chain Director for the Dow Chemical Company, offered:

“This is not just a problem for the vessels that transit through this area. The impact reaches around the globe, from the supplier to the manufacturer, to the shipper, and to the customer…Delays related to piracy create a ripple effect in the supply chain.”

The risks are great, as are the challenges. The common wisdom presented at the program is that there is no silver bullet for piracy in the Indian Ocean. With industry and government continuing to work closely to mitigate the threat, it seems the best course for ships and crew is – to borrow from the maritime lexicon – batten down the hatches and full steam ahead.



 http://www.gwumc.edu/hspi/

Thailand's terrorism nexus

By Anthony Davis and John Cole

The violent unravelling of a bomb plot in the Thai capital, Bangkok, in February and the apparently unrelated seizure of a large cache of explosive precursor materials from a warehouse outside the city in January have drawn international attention to the threat of terrorism in Thailand.
Both incidents involved foreign nationals and highlighted the ease with which terrorist operations could be prepared in the country. The events also called into question both the Thai government's willingness to acknowledge the threat and its preparedness to address it.
Explosive developments
On 12 January, a Swedish citizen of Lebanese extraction, Atris Hussein, was arrested while attempting to depart Bangkok's Suvarnabhumi international airport. His arrest came after Israeli intelligence had alerted Thai authorities to the alleged presence in Bangkok of a cell comprising operatives of the Iranian-backed Lebanese militant group, Hizbullah. Following Hussein's arrest, both Israel and the US issued travel alerts warning of an increased risk of a terrorist attack in Thailand.



http://www.janes.com/products/janes/index.aspx

Seychelles: 17 jailed pirates move to Somaliland

 By TOM ODULA

The Seychelles government has transferred 17 convicted Somali pirates to prisons in Somaliland because of overcrowding in its prisons, official said Thursday.
Seychelles Minister of Home Affairs and Transport Joel Morgan said this is the first time pirates have been moved to Somaliland to complete their prison time.
Morgan said the tranfer of the 17 prisoners will lead to more pirate transfers in the future to the autonomous regions in Somalia of Somaliland and Puntland.
Somaliland is a breakaway northern enclave of war-torn Somalia which has a stable, elected government though it is not recognized internationally as an independent state.
According to government statistics Somali pirates make up 20 percent of Seychelles' 500-person prison population in the main Montagne Posee Prison.
More than two decades of lawlessness in Somalia has created an environment that has allowed piracy to thrive off the Somali coast. Seychelles is one of the few African countries prosecuting pirates arrested by international navies patrolling off Somalia's coastline as part of an effort to crack down on the maritime bandits.
"We have been working hard for the past two years to ensure that, while we will do our part in bringing these pirates to justice, we will no longer have to bear the burden of incarceration indefinitely," said Jean-Paul Adam, the minister for foreign affairs.



 http://www.businessweek.com/

Russia to Send New Anti-Piracy Force to Gulf of Aden

By RIA Novosti
A task force from Russia’s Northern Fleet, led by the Udaloy class destroyer Vice Admiral Kulakov, will soon depart on an new anti-piracy mission off the Somali coast, the fleet’s spokesman Capt. 1st Rank Vadim Serga said on Tuesday.
The destroyer is currently on a training mission in the Barents Sea as part of the preparations for the upcoming tour-of-duty in the Gulf of Aden.
“It will be the first anti-piracy mission for the Vice Admiral Kulakov destroyer,” Serga said.
The new task force will replace the Russian Pacific Fleet’s task force headed by the Admiral Tributs destroyer, which completed its anti-piracy mission off the Somali coast on Monday and set sail for its home base in Vladivostok.
The Admiral Tributs, the Pechenega tanker and a rescue tugboat arrived in the Gulf of Aden on January 12 and escorted five convoys of commercial ships since then.
Task forces from the Russian Navy, usually led by Udaloy class destroyers, operate in the area on a rotating basis.
Russian warships have successfully escorted more than 130 commercial vessels from various countries through pirate-infested waters off the Somali coast since 2008, when Russia joined the international anti-piracy mission in the region.

http://www.defencetalk.com/

Navy ships out radar system ahead of North Korea launch

By Barbara Starr

The U.S. military is sending its most advanced radar system to the Pacific region ahead of North Korea's expected launch of a long-range missile in mid-April, according to a senior U.S. Navy official.
The Sea-Based X-Band Radar sits atop a floating platform and has the ability to search and track targets. In addition, the system can communicate with potential U.S. interceptor missiles at Fort Greely, Alaska, and Vandenberg Air Force Base, California, that could shoot down a target missile.  But the North Koreans have said they plan to launch their missile in a southerly direction, which would mean it is highly doubtful the intercept capability would be needed or used. 
The U.S. military will not officially say the radar is being deployed for the North Korean launch, but one senior U.S. official called the SBX-1 deployment "precautionary."  Both officials declined to be identified because of the sensitive nature of the information.
The Navy official acknowledged that the SBX-1 set sail from Pearl Harbor on March 23. The platform can operate hundreds of miles from the target area it is scanning, so it is not expected to sail close to North Korea.
Military officials have said they are worried the North Korean missile might be so unreliable that debris could fall on a number of Asian countries rather than into the ocean as the North Koreans have said.
SBX-1 is at best an odd-looking military asset. The platform is 240 feet wide, 390 feet long and 280 feet high from the keel to the top of the radar dome that sits on top of the platform. It is staffed with a crew of 86 military and civilian personnel.  In 2009, then-Defense Secretary Robert Gates ordered it to sea in advance of a North Korean missile launch at that time.




http://edition.cnn.com/

Organizations Should Emphasize Basic Security Measures, According to Verizon Report

Many organizations can better protect themselves from hackers by implementing more straightforward, basic security measures, according to a recently released annual report from Verizon. Many smaller organizations could significantly strengthen their IT security by using stronger passwords, for example.
One conclusion from the study, which looked at 855 data breaches that included 174 million stolen records, is that hackers’ methods may be less sophisticated than some people think. Ninety-six percent of attacks were “not highly difficult,” according to the report, and did not require organizations “to resort to difficult or expensive countermeasures.”
Adversaries “are not being forced to change their tactics very much,” said Jay Jacobs, a principal on Verizon’s RISK Intelligence team, in an interview. Hackers are using “the same kinds of attacks over and over again.” The report did find, however that once attackers penetrated an organization’s firewall, more sophistication was then required for activities including siphoning information back to hackers.
The study, the 2012 Data Breach Investigations Report, showed that, similar to the last few years, hackers are frequently using automated methods to conduct attacks.
The study also found that there was a significant increase last year in attacks committed by those with social or political goals, or hacktivists. In 2011, 58 percent of data stolen was attributed to attacks with political or social motives, according to the report. In past years, the overwhelming majority of attacks were driven by financial motives.
Data for the study came from Verizon clients and also from report partners including the United States Secret Service as well as law enforcement agencies from the United Kingdom, the Netherlands, Ireland, and Australia. The study is not an accurate sample of all data breaches, for reasons including the fact that many attacks are not reported or detected. Due partly to the amount of data studied, however, Verizon’s report is a relatively good indicator of hacking trends.
One notable conclusion this year was that smaller organizations are far more likely than larger ones to choose easily guessable passwords or to leave default passwords on devices and machines, according to Jacobs. In addition to strengthening passwords, another important step for smaller organizations to take is to ensure they use a firewall, according to the report.
Some primary steps larger organizations can take include eliminating unnecessary data and monitoring important data that needs to be kept. Larger organizations should also be sure to establish essential security controls and to prioritize their security strategies.
The report also suggests that more organizations could benefit from event logging solutions, which can be particularly helpful in detecting attacks. In more than 90 percent of cases, successful attacks were detected by a third party, such as a law enforcement official, according to the report.



http://www.securitymanagement.com/

Cybercrime Dominated by Gangs: Study

By Laura Spadanuta

Eighty percent of cybercrime is committed by organized crime groups, according to a new study from the John Grieve Centre for Policing and Security at the London Metropolitan University and BAE Systems Detica, Techworld reports.
The study, Organized Crime in the Digital Age, found that most of the organized groups that commit cybercrime are staffed young to middle-aged "technical types," and that the crime rings tend to have up to a dozen people.
According to the article:

The earliest online crimes included pump-and-dump stock scams in the late 1990s, but the real jump came with the development of the mainstream Internet around the turn of the century. Organised crime quickly picked up on the potential for information theft and fraud, which was eventually industrialised with the arrival of botnets around 2006.

“Organised criminal activity has now moved from being an emerging aspect of cybercrime to become a central feature of the digital crime landscape,” said Kenny McKenzie, head of law enforcement for BAE Systems Detica, which commissioned the study. “Our report shows that more and more criminal activities now rely upon the online world.”

The study refers to this as a "fourth era" of organized crime.  Researchers analyzed 7,000 documentary sources for their conclusions.
As far as what types of groups are most susceptible to these attacks, V3 reports that PricewaterhouseCoopers recently warned that financial services firms are most at risk to hacker attacks.



 http://www.securitymanagement.com/

U.S. ambassador claims phone, email hacking

By Jill Dougherty

The U.S. ambassador to Russia is questioning the scrutiny he's getting from Russian state media and has suggested in social media messages that his phones and e-mails are being hacked.
"Everywhere I go NTV is there. Wonder who gives them my calendar? They wouldn't tell me. Wonder what the laws are here for such things," Amb. Michael McFaul wrote on Twitter Thursday about the government-run television network. "When I asked these 'reporters' how they knew my schedule, I got no answer," he wrote in a follow up message.
But it wasn't just the constant presence of the media in his personal space that concerned the American envoy. Invasion of privacy is also an issue, he charged in a second tweet.
"I respect press right to go anywhere & ask any question. But do they have a right to read my email and listen to my phone?" he asked.

The Russian embassy in Washington did not immediately respond to CNN requests for a comment on the situation.
When asked by reporters in Washington whether McFaul was directing his tweets toward the Russian government instead journalists, State Department spokesman Mark Toner said the tweets were "not directed at journalists or the media." McFaul was "simply asking a rhetorical question," Toner added, saying he did not know if the messages were directed at the government.
Toner was unaware if the U.S. Embassy had officially raised the issue of McFaul's tweets with the Russian government.
McFaul, who had a rough reception from some government-controlled media for his outspoken support of pro-democracy groups, has appeared frequently in public in Moscow. At those appearances, protesters have shown up to heckle him and voice their displeasure with his message. A senior administration official told CNN the ambassador decided to publicly confront the issue by tweeting about it.
The architect of the Obama administration's so-called "re-set" policy with Russia, McFaul has had a contentious relationship with the government-run media since his arrival in Moscow earlier this year. An analyst on a government network said McFaul was a "specialist purely in the promotion of democracy," and suggested his agenda was dedicated to supporting opposition leaders in the country.
McFaul has spent his career in government and academia, focused on the former Soviet Union and Russia.



 http://edition.cnn.com/

CBRN Threats and the Arab Spring

 Is there a danger of proliferation in Syria and Libya?
Since the popular uprising against the autocratic regime of Tunisian President Ben Ali in December 2010, a variety of countries in the Middle East and North Africa have experienced large scale demonstrations and protests. More than a year later, the results are mixed. Autocratic governments in Tunisia and Libya have been overthrown, the Egyptian president was forced to resign and whilst new elections have been held in Tunisia and Egypt, the internal situation in Libya remains unstable. Meanwhile, in Syria, large scale demonstrations, followed by government oppression and escalating violence, have pushed the country towards civil war.

Although the so called ‘Arab Spring’ has been generally welcomed, some doubts and concerns about future political developments remain. An important question is whether or not the transformations will lead to new CBRN threats or affect existing ones. In a region with an already precarious security situation, the danger of possible CBRN proliferation is one which should not be overlooked.

A recent UN report from a mission that assessed the impact of the Libyan crisis on the wider Sahel region in North-Africa shows there is reason for concern. The report indicates that large quantities of conventional weapons and ammunition from Libyan stockpiles are smuggled across the border into the region, including advanced weaponry. Some of these weapons could be sold to terrorist groups like Al Qaeda or Boko Haram and an increase in terrorist and criminal activities in the region is already evident.
Although there have been no indications of the proliferation of non-conventional weapons in Libya to non-state actors so far, it is a good example of how the Arab Spring may lead to new CBRN threats.

This report focuses on two Arab countries: Libya and Syria. Both countries have been suspected of attempts to develop nuclear weapons, but more importantly, are widely recognised by the international community to possess chemical weapons. The current unrest in the two countries increases the CBRN proliferation threat. The situation has a negative impact on internal security, and more importantly, may diminish the protection of (suspected) chemical warfare agents and sensitive materials and technology, which makes them easier to obtain by non-state actors. Since international non-proliferation treaties are a key defence against proliferation, the last part of this report will identify possible actions against proliferation as well as likely gaps in the international non-proliferation system.






CBRN CAPABILITY: LIBYA

After years of US led pressure and sanctions, Libya came in from the cold by striking a grand deal with the West in 2003. The Gadhafi regime promised to destroy its chemical weapon arsenal and announced its intentions to halt develop of nuclear weapons. Consequently, it acceded to the Chemical Weapons Convention (CWC) and became a member of the Organisation for the Prohibition of Chemical Weapons (OPCW) in 2004. In return, the West lifted many economic sanctions and upgraded diplomatic ties. Soon thereafter, information about Libya’s past CBRN programme became public.
Although Libya had been a party to the Non-Proliferation Treaty (NPT) since 1975, it began its nuclear programme shortly after Gadhafi came to power in 1969. The regime tried to procure nuclear technologies from other countries, as well as from the A.Q. Khan Network. Despite these efforts, the Gadhafi regime was still years away from developing a nuclear weapon when the deal was struck.

When Libya joined the OPCW, it declared a chemical arsenal of more than 23 metric tons of sulphur mustard agent, about 3000 metric tons of chemical agent precursors and more than 3500 empty aerial bomb casings, designed to carry chemical agents. Among the chemical agent precursors were chemicals that could be used for the production of nerve agents such as Sarin and Soman, which are far more lethal and effective than mustard gas. Large scale production of nerve agents however, proved to pose too many technical difficulties for the Libyan chemical engineers.

Libya has been a party to the Biological and Toxin Weapons Convention (BTWC) since 1982, but before 2003, there were some suspicions that the country also had a biological weapons programme. However, no evidence of this has ever been found.



CBRN CAPABILITY: SYRIA

Syria’s CBRN capability is much more indeterminate. Many sources state that over the years, the regime has developed chemical and possibly biological weapons as a counterweight to Israel’s nuclear capability. According to annual CIA reports to the American Congress, these range from blister agents such as mustard gas to advanced nerve agents like Sarin.

Officially, Syria denies owning CBRN weapons. However, it has not signed the CWC and the OPCW has therefore never been able to inspect in Syria. Concerning the BTWC, Syria has signed the convention, but still has to ratify it. Although the country has been a party to the NPT since 1968, Syria has long had an interest in acquiring nuclear weapons. Last year the International Atomic Energy Agency (IAEA) found Syria to be in non-compliance of the NPT Safeguards Agreement for failing to declare a clandestine nuclear reactor at Dair Alzour, which was destroyed by an Israeli airstrike in September 2007. The history of concealment of Syria’s nuclear activities, Syria’s procurement activities, coupled with the country’s lack of cooperation, made the IAEA decide that it had no confidence in the reactor’s peaceful purposes.

The Syrian regime came close to confessing that it possessed CBRN weapons after Libya announced its decision to dismantle its CBRN programme. In January 2004 President Bashir al-Assad stated that any deal to destroy Syria's chemical and biological capability would only be possible if Israel agreed to abandon its undeclared nuclear arsenal. He also said that Syria is entitled to defend itself by acquiring a chemical and biological deterrent and that ‘it is natural for us to look for means to defend ourselves. It is not difficult to get most of these weapons anywhere in the world and they can be obtained at any time’. A few years later, in a 2009 interview with Der Spiegel, after denying the existence of a nuclear weapons programme the president was asked: ‘so you have no ambitions to produce weapons of mass destruction, not even chemical weapons?’ In response, the president stated: ‘Chemical weapons, that's another thing. But you don't seriously expect me to present our weapons programme to you here? We are in a state of war’.

PROLIFERATION RISKS: LIBYA

Prior to the start of the Libyan civil war last year, the Gadhafi regime had already destroyed 54% of its declared amounts of mustard gas, about 40% of its precursor chemicals for making weapons, as well as its entire stockpile of aerial bombs. Unfortunately, 9 metric tonnes of sulphur mustard agent and over 800 metric tonnes of precursor chemicals remained to destroyed, all stored at a depot on the Al Jufrah Air Base in the Southeast of Libya.

During the civil war, some analysts feared that Gadhafi would use his remaining chemical arsenal against insurgents. Gadhafi did use excessive violence against civilians and insurgents before his downfall, but the concerns that he might use chemical weapons proved to be unfounded.

After the downfall of the Gadhafi regime, US Secretary of State Hillary Clinton stated to the Libyan Transitional National Council that ‘we will look to them to ensure that Libya fulfils its treaty responsibilities [and] that it ensures that its weapons stockpiles do not threaten its neighbours or fall into the wrong hands’. Indeed, Libya’s new government has vowed to adhere to its international obligations to destroy its chemical weapons. But the question remains how the other issue Clinton raised, namely the concern about protection of Libya’s remaining chemical weapon stockpile, will develop.

Although the aforementioned UN report demonstrated that conventional weapons from Libya may threaten the entire region, there are some positive notes on Libya’s chemical weapon stockpiles. As a part of the deal in 2003, Gadhafi also agreed to move the arsenal from badly secured storage bunkers to the Al Jufrah airbase where they were stored in a heavily secured bunker and could easier be monitored by OPCW inspectors. The US State Department claimed in August that ‘We believe that these known missile and chemical agent storage facilities remain secure, and we've not seen any activity, based on our national technical means, to give us concern that they have been compromised’.

Besides these positive aspects however, a year after the start of the revolution the new Libyan government has not been able to stop the fighting, now increasingly between different factions and militias. The lack of security and central control seem to be evidence of a disintegrating state and it is therefore essential that the remaining chemicals weapons and precursor materials are destroyed as soon as possible. There is also the issue of radiological sources in the country, such as intended for legitimate purposes, which can be stolen or illegally exported in the current turmoil.

In addition, the recent discovery of previously undeclared chemical weapons raise further questions, despite the low quantity found. What are the origins of the undeclared agents and projectiles and is there a guarantee that no more chemical weapons remain undeclared?

PROLIFERATION RISKS: SYRIA

In the case of Syria, similar fears to those concerning Libya have arisen in connection with the use of CBRN weapons against its own citizens. There are some good arguments however, why the Assad regime would think twice before using its chemical arsenal. First of all, as the recent UN Security Council vote over a new resolution that condemns the violence in Syria has shown, the regime is becoming increasingly isolated on the world stage. If Assad decides to use his chemical arsenal against his own citizens, he would lose all international support. Moreover, the resulting global outrage would increase the risk of outside military intervention for the regime. Second, due to the so-far limited strength of opposition forces like the Free Syria Army, it is not necessary for Assad’s troops to use its chemical weapon capability, which was developed as a deterrent against Israel’s nuclear capabilities. As the violence in the siege of Homs shows, the regime has plenty of other options.

Other concerns of the international community may prove more valid, namely the risk that in a Syrian power vacuum, chemical weapons may be dispersed to non-state actors in the region, including extremist groups. Organisations such as Hamas, the Islamic Jihad and Hezbollah have been given training, weapons, safe haven, and logistical support by the regime. The relationship with Hamas, however, has recently deteriorated because the organisation publicly refuses to support the regime any longer.Another uncertainty is the fragmented state of the Syrian opposition and the possible presence of individuals and groups, whose intentions with regard to chemical weapons are, at best, unclear.

Unsurprisingly, this is causing increasing concerns in many capitals, not at least in Washington and Jerusalem. In Israel for example, more than 60% of the population keep a gas mask at home for protection against a possible attack. Some voices in Israel have stated that the transfer of chemical weapons into Lebanon would be tantamount to a declaration of war and that it would act to prevent such a move.

THE INTERNATIONAL NON-PROLIFERATION SYSTEM

As should be clear by now, the stakes in Libya and Syria are high, both for its people, its neighbours and the International Community. The biggest concern with Libya and Syria is arguably that non-state actors will get their hands on CBRN materials. UN Security Council Resolution 1540 was passed in 2004 in order to reduce this threat. The norms and standards developed in important international non-proliferation treaties only apply to states; non-state actors are not explicitly identified to also have the intention and capability to develop CBRN weapons.To fill this void Resolution 1540 aims to criminalise the proliferation of weapons of mass destruction by making an appeal to the responsibility of states, which need to take effective measures, adopt and enforce laws, and must refrain from providing support to non-state actors that strive for CBRN weapons. The emphasis of the Resolution is on prevention by states, even by those that are not a party to all the relevant treaties. This is accomplished through its adoption under UN Charter Chapter VII, defining non-state proliferation as a direct threat to peace, which makes the Resolution’s obligations mandatory.

Although Resolution 1540 is certainly a step forward in improving the international non-proliferation system, in the case of Syria and Libya it may be ineffective. The mechanisms, established under Resolution 1540 were designed for a ‘normal’ situation, when these states have a functional government and general law and order prevail, but when a state loses central control and a period of chaos ensues; it no longer is able to fulfil this responsibility. However, the fact that Resolution 1540 was adopted under Chapter VII of the UN Charter, might be of importance from the legal point of view, and this should be explored by the leading world powers – irrespective of their differences regarding broader political aspects of the Syrian crisis.

A partial answer to the problem of proliferation could be increased border controls by neighbouring countries, probably with the assistance of international partners. Regarding Syria, the US government has already offered its assistance in providing border security to Iraq, Jordan, Lebanon and Saudi Arabia. In a more multilateral option, there may also be a role for the OPCW. All of Syria’s neighbours are OPCW Member States and under Article X of the CWC can ask for assistance and protection against chemical weapons, giving the organisation a mandate to help with border protection. Such a move would be considered more legitimate and therefore less politically sensitive, not a bad thing in a region where the geostrategic stakes are high.

CONCLUSION

The existence of chemical weapons in Libya and Syria, coupled with a deteriorating political and security situation, create a dangerous combination, which greatly increases the risk of proliferation to non-state actors. The dilemma for the international community is: what to do when the security of CBRN materials and technology is in jeopardy?

Although some international actors, like the US, have stated that they are watching Syria’s stockpiles closely and even have a general idea about their quantity and location, their impact on the ground is rather limited.Improving border controls to limit weapon trafficking is only an indirect option at the moment, and may not be enough, even with the assistance of the OPCW. Because the focus of current non-proliferation treaties is on the capability and responsibility of states, they fall short when a power vacuum exists and there is no functioning state.

In Syria, the situation is disquieting. The country is not a party to the CWC, has not declared its chemical weapons, precursors and production facilities, while hostilities are on the rise. Negotiations with the regime must therefore not only deal with the on-going violence in the country, but should urge the regime to be open about its CBRN arsenal. In case the regime falls, major efforts should be undertaken to ensure cooperation from the successor government, just as in Libya.

Despite the seriousness of the concerns, the situation in Libya inspires more optimism, due to the commitment of the new government to fulfil its obligations under the CWC and the fact that the chemical weapon destruction process was well on its way before the civil war. It also seems that during the recent war chemical weapons storage facilities remained secure and were not compromised. Still, given the lack of internal stability, an international effort should be made to secure and destroy the remaining chemical stockpiles as quickly as possible.







http://defpro.com/

Japan's Plutonium Stocks Seen as Security Risk

Japan's large reserve of plutonium, originally developed as an atomic fuel source, is increasingly seen as a burden in the wake of last year's Fukushima Daiichi facility disaster and ongoing worries about nuclear terrorism, the Washington Post reported on Tuesday .
The highly advanced island nation has more plutonium stockpiled than any other non-nuclear weapon possessor state, according to a report released last year by the International Panel on Fissile Materials.
Roughly 25 percent of Japan's total plutonium cache -- enough material to fuel in excess of 1,000 bombs -- is held inside the country at atomic facilities plants and holding installations. The remaining plutonium is on loan to other nations.
Japanese Prime Minister Yoshihiko Noda said at this week's Nuclear Security Summit in South Korea that the "myth of safety" surrounding his nation's large nuclear sector had come to an end with the March 2011 earthquake and tsunami that badly damaged the six-reactor Fukushima Daiichi energy plant .
While an act of nature caused the Fukushima crisis, "the man-caused act of sabotage will test our imaginations far more than any natural disaster," Noda said.
U.S. President Obama on Monday said the "smallest amount of plutonium -- about the size of an apple -- could kill hundreds of thousands and spark a global crisis."
"We simply can't go on accumulating huge amounts of the very material, like separated plutonium, that we're trying to keep away from terrorists," Obama told students at Hankuk University in the South Korean capital.
The rationale for holding plutonium -- so it can reprocessed into more nuclear reactor fuel -- does not make as much sense in light of the discovery of new uranium deposits, the Post said.
“These were visions that made sense 30 to 40 years ago, when we thought there was little uranium in the world,” White House adviser Laura Holgate said. “But now we know that the shortage concept is antiquated. We also know more about how vulnerable separated plutonium can be from a terrorist point of view" (Chico Harlan, Washington Post, March 27).
Tokyo and Washington on Tuesday highlighted several areas in which they have worked together to bolster atomic material protections since 2010. Those initiatives include collaboration within the Integrated Support Center for Nuclear Nonproliferation and Nuclear Security, which was first opened in December 2010 in Japan, according to a White House fact sheet.
The center last October welcomed representatives from 16 nations for an initial Regional Training Course on Physical Protection of Nuclear Material and Facilities.
Additionally, the Japan Atomic Energy Agency, with U.S. support, is readying to convert highly enriched uranium at two reactors to low-enriched uranium. The nations more broadly are seeking to switch research reactors away from use of weapon-usable uranium.
The two allies have also shared thoughts on best practices for responding to an intentional disablement of atomic facilities and attempts to pilfer nuclear materials (White House release, March 27).



 http://www.nti.org/gsn/

Defense Department: Yemeni branch of al Qaeda a serious threat to U.S.

By Larry Shaughnessy

Al Qaeda in the Arabian Peninsula represents a "serious threat" to attack the United States, according to a Defense Department official who oversees special operations.
In testimony before a Senate Armed Service subcommittee, Michael Sheehan, the assistant secretary of Defense for special operations/low-intensity conflict, said the United States has made important gains against the al Qaeda affiliate over the past year, but "the group's intent to conduct a terrorist attack in the United States continue to represent a serious threat."

The threat from al Qaeda in the Arabian Peninsula remains in spite of the death of Anwar al-Awlaki, the American-born radical cleric who became the public face of al Qaeda in the Arabian Peninsula.
Al-Awlaki had been tied to the attempt to blow up a US commercial airliner as it approached Detroit on Christmas Day in 2009 and to the cargo plane bomb plot the next year. He was killed by a CIA drone missile attack in September.
There are still key players at large in Yemen: al Qaeda in the Arabian Peninsula leader Naser al-Wuhayshi, a close associate of Osama Bin Laden, and Ibrahim al-Asiri, the skilled bomb maker believed to be behind the aircraft bombing plots as well as a number of former Guantanamo Bay detainees.
Sheehan also testified about Osama Bin Laden's core al Qaeda based in Pakistan. "We have made progress on this front, but al Qaeda is a highly adaptive organization and we must continue to work with Pakistan to address threats emanating from this region."

Raids Target Internet Crime

Microsoft employees recently teamed up with United States marshals to raid buildings housing botnet equipment, according to the New York Times.
Microsoft lawyers and technical employees "gathered evidence and deactivated Web servers ostensibly used by criminals in a scheme to infect computers and steal personal data. At the same time, Microsoft seized control of hundreds of Web addresses that it says were used as part of the same scheme." The Microsoft personnel had obtained a warrant from a federal judge to conduct the sweep, which was part of a civil lawsuit brought by Microsoft targeting equipment used to control the botnets.
Microsoft argues that the individuals behind the botnets are violating Microsoft trademarks through their fake e-mails.

Mr. Boscovich said the Friday sweep was meant to send a message to the criminals behind the scheme, whose identities are unknown. “We’re letting them know we’re looking at them,” said Mr. Boscovich after participating in the Pennsylvania raid, in Scranton.

Before Friday’s sweep, Microsoft attacked three botnets in the last couple of years through civil suits. In each case, Microsoft obtained court orders that permitted it to seize Web addresses and computers associated with the botnets without first notifying the owners of the property. The secrecy was necessary, Microsoft argued, to prevent criminals from re-establishing new communications links to their infected computers.

The Times quoted some security experts as deeming Microsoft's approach effective in fighting botnets. Richard Perlotto, of Shadowserver Foundation, which tracks tools used for online fraud and computer crime, pointed out that the activity is not a replacement for law enforcement action. Microsoft's Richard Boscovich equated the effort with a neighborhood watch program.

 By Laura Spadanuta

http://www.securitymanagement.com/

Bird Flu Research Could Restart in Weeks, Scientist Says

Scientists as soon as the second week of April might be able to resume work related to a pair of studies that increased the transmissibility of the avian flu virus, the leader of one of the projects said on Monday in remarks reported by the Center for Infectious Disease Research and Policy.
Bioterrorism concerns prompted the U.S. National Science Advisory Board for Biosecurity last year to call for withholding some data from separate studies conducted at Erasmus University Medical Center in the Netherlands and the University of Wisconsin (Madison) that boosted the potential for the virus to be passed through the air between ferrets. A panel of experts formed by the World Health Organization last month backed an existing suspension of the research but urged the release of the full findings after a period of months.
The two teams of scientists in January agreed to a nonmandatory study suspension that lapsed on March 20, said Ron Fouchier, who oversaw the research in the Netherlands. Multiple countries have yet to complete reviews of biological material protections at research sites, he said; the reports would comprise one aspect of a plan linked to the WHO panel's February gathering.
The U.S. biodefense panel is slated on Thursday and Friday to examine the most recent versions of articles based on the studies, Fouchier said. Fouchier and Wisconsin study head Yoshihiro Kawaoka are set to participate in an April 3-4 British Royal Society conference in London that is also expected to bring together delegates from the federal panel, managers for the two journals that agreed to withhold components of the research, and numerous specialists in areas including bird flu, biological defense and studies with both peaceful and weapons applications.
Input from all participants would factor into considerations by scientists, but the two research teams and the publications Nature and Science would ultimately determine the timing and other specifics for issuing the studies, Fouchier said.
A possible measure under consideration in the Netherlands would aim to restrict the release of the Dutch study's findings using trade regulations, Fouchier added. "In our opinion," Dutch officials could not invoke the rules in such a manner, he said.
The comprehensive release of data from each project would aid in addressing concerns over the "virulence" of the altered virus strains, he added .
Separately, the European Center for Disease Prevention and Control on Monday stood by its February statement on the controversy



http://www.nti.org/gsn/

DOD Needs Industry’s Help to Catch Cyber Attacks, Commander Says

The Defense Department needs private-sector cooperation in reporting computer network attacks in real time to stop what has been the "greatest transfer of wealth in history" that U.S. companies lose to foreign hackers, the head of U.S. Cyber Command told a Senate committee today.
Army Gen. Keith B. Alexander, who also is the National Security Agency director, told the Senate Armed Services Committee that he supports legislation that would require private companies to report attacks, and added that such reporting needs to happen before an attack is complete.
"We need to see the attack," he said. "If we can't see the attack, we can't stop it. We have to have the ability to work with industry -- our partners -- so that when they are attacked, they can share that with us immediately."
Many cyber defense bills have stalled in Congress over concerns about privacy, overregulation and the military's role in cyber protection, Alexander and the senators noted.
The general compared the current situation, where DOD computers receive some 6 million threatening probes each day, to a missile being fired into U.S. airspace with no radars to see it. "Today, we're in the forensics mode," he said. "When an attack occurs, we're told about it after the fact."
Alexander added, though, that industry should be monitoring their own systems with help from Cyber Command and the Department of Homeland Security. "I do not believe we want the NSA or Cyber Command or the military in our networks, watching it," he said.
Alexander explained the federal partnership of U.S. cyber security as one in which Homeland Security leads in creating the infrastructure to protect U.S. interests, Cyber Command defends against attacks, FBI conducts criminal investigations, and the intelligence community gathers overseas information that could indicate attacks.
"Cyber is a team sport," he said. "It is increasingly critical to our national and economic security. ... The theft of intellectual property is astounding."
The Defense Department's request of $3.4 billion for Cyber Command in fiscal 2013 is one of the few areas of growth in the DOD budget, senators noted. The command has made progress toward its goals of making cyber space safer, maintaining freedom of movement there, and defending the vital interests of the United States and its allies, Alexander said. The command also is working toward paring down the department's 15,000 separate networks, he said.
Cyber threats from nations -- with the most originating in China -- and non-state actors is growing, Alexander said.
"It is increasingly likely, as we move forward, that any attack on the U.S. will include a cyber attack," he said. "These are threats the nation cannot ignore. What we see ... underscores the imperative to act now."




http://www.defencetalk.com/

Peek at rules of engagement in cyber battle

by Suzanne Kelly

General Keith Alexander, who serves as both Director of the National Security Agency as well as Commander of Cyber Command had some interesting things to say before the Senate Armed Services Committee on Tuesday. One of which offered insight into how the rules of engagement might look in the high-tech, but legislatively murky, cyber battlespace:

"If you are to go after a computer in foreign space or some other thing, that might be a response option that would now take, I think, the president and the secretary to step in and start making decisions, versus us taking that on." – General Keith Alexander

Because of advances in technology and the growing sophistication of cyberattacks believed to be launched by both state and non-state actors, the administration along with the Department of Defense and the Department of Homeland Security are working out just how to better position the resources of the NSA to help protect private businesses against attack. Some of those businesses maintain and operate critical infrastructure like nuclear facilities and water treatment facilities that experts argue need a more robust cyber defense strategy.
Hammering out just how to prevent and respond to attacks as a strategy is still very much a work in progress, but adding presidential authority to the mix makes it slightly more clear how the U.S. might clear a path to respond to a cyberattack.



 http://edition.cnn.com/

Nuclear Security Standards Still Lacking After Summit, Advocates Say

By Douglas P. Guarino

 

  The 2012 Nuclear Security Summit in South Korea achieved “modest” new gains toward the goal of ensuring that terrorists cannot obtain vulnerable nuclear materials but did little to establish concrete standards toward that end, observers said on Tuesday .
The gathering of 53 world leaders that wrapped up on Tuesday was meant to build on the accomplishments of the first security summit in Washington in 2010. The communique issued at the conclusion of this week’s event urged continued international cooperation on a host of atomic protection activities, but it is a “limp document” in terms of establishing universally accepted benchmarks, Kenneth Brill, former U.S. ambassador to the International Atomic Energy Agency, told Global Security Newswire.
“The kind of language [used in the document] --‘we encourage,’ ‘we urge,’ ‘if it’s possible’ -- [represents] the lowest common denominator” in international negotiations, Brill said.
The Seoul summit produced some tangible new achievements, such as pledges by Italy and several other nations to eliminate their stocks of fissile material, the nongovernmental Fissile Materials Working Group noted in a Tuesday statement. The summit also yielded an agreement between the United States, France, Belgium and the Netherlands to produce medical isotopes without the use of weapons-grade highly enriched uranium by 2015, the group noted.
In addition, a number of nations also used the summit as a venue for announcing unilateral legislative and other measures for enhancing nuclear security (see related GSN story, today).
However, much like achievements unveiled two years ago, the commitments announced on Tuesday are voluntarily, involve a relatively small number of countries and come with no legally binding standards, Brill and others said.
The stated goal of the 2010 summit -- which produced 67 national commitments -- was that all vulnerable nuclear materials around the world be secured by 2014. The 2012 communique issued Tuesday stated that all governments bear the “fundamental responsibility” of protecting atomic substances and averting their acquisition by extremists.”
The document also places a high priority on guarding caches of highly enriched uranium, and urges countries to by the close of 2013 declare plans to reduce their reliance on the substance to the lowest level possible.
Alexandra Toma, executive director of the Connect U.S. Fund, said the Seoul summit largely produced a “reaffirmation” of the 2010 goals, and that advocates had “hoped to see bolder” new statements that pushed participants toward the creation of international standards for nuclear security.
Seoul summit-goers sought to broaden the scope of the gathering as compared to the 2010 event. However, topics added to the agenda -- including nuclear facility safety and the security of radiological materials that could be used to make so-called “dirty-bombs” -- were also addressed in a “lowest common denominator” fashion, according to Brill.
He said this week’s event “opened the door a crack” to the issue of nuclear facility safety, which some experts have said has become increasingly intertwined with nuclear security following the 2011 Fukushima atomic plant disaster in Japan . The Seoul communiqué affirmed the importance of “coherent and synergistic” nuclear safety measures but did not urge any specific actions.
There is some indication that world leaders might move toward firmer universal commitments on more traditional nuclear security issues by the time the next summit takes place in the Netherlands in 2014, Brill said. For example, the Seoul communique sets a 2014 target date for adopting the 2005 amendment to the Convention for the Physical Protection of Nuclear Material, which includes requirements aimed at protecting nonmilitary nuclear material in domestic use, storage or transport. In addition, some world leaders seem to be warming to the idea that a more robust international consensus is needed, Brill noted.
Brill pointed to remarks at the summit by Australian Prime Minister Julia Gillard, in which she said world leaders “need to establish an accountability framework on nuclear security that builds confidence beyond 2014.
“In that regard, one thing that we might consider would be regular peer reviews of our domestic nuclear security arrangements that would ensure ongoing transparency and keep each of us, and all of us, on our toes, which is where we should be as we deal with this challenge,” Gillard said.
Currently, the “nuclear security regime is a patchwork of unaccountable voluntary arrangements that are inconsistent across borders,” Kenneth Luongo, president of the Partnership for Global Security, said in a statement Tuesday. “Consistent standards, transparency to promote international confidence, and national accountability are additions to the regime that are urgently needed.”



http://www.nti.org/gsn/

Report Imagines Nuclear Attack, Student Sues School Over DHS degree

♦ A report released last November has begun to attract attention inside the Washington Beltway. Key Response Planning factors for the Aftermath of Nuclear Terrorism wasproduced by the U.S. Department of Homeland Security and the National Nuclear Security Administration. It envisions what would happen if terrorists set off a nuclear bomb just blocks away from the White House. "For the fictional attack the U.S. government studied, the blast zone would extend just past the south lawn of the White House and as far east as the FBI headquarters," the Washington Post reports, noting that the scenario would result in approximately 45,000 deaths and 323,000 injuries, including the car drivers up to 12 miles away who would be temporarily blinded by the bomb flash.

♦ Brian Wilhelm, a former student in the counterterrorism program of the International Development Center, is suing the for-profit school, claiming that it is '"'preying on the hopes and dreams of vulnerable students' by lying about post-graduation job prospects, leaving graduates jobless and unable to pay off student loans. Wilhelm was seeking the school's Homeland Security and Investigation Fast-Track Diploma. "Many ICDC Homeland Security Program graduates will never be offered work in the United States Homeland Security Department or otherwise be in a position to profit from their enrollment in ICDC's Homeland Security Programs. And they will be forced to repay hundreds of thousands of dollars in school loans that are nearly impossible to discharge, even in bankruptcy," the complaint alleges.



http://www.securitymanagement.com/

Ex-South African Bio-Chem Head Says Work Was Defensive

The former head of South Africa's biological and chemical weapons initiatives on Monday defended those efforts as primarily aimed at protecting the people of his country, the South African Press Association reported .
Cardiologist Wouter Basson, also known as  "Dr. Death," told the Health Professions Council of South Africa that the then-head of the country's national defense establishment and its surgeon general asked him roughly three decades ago to create a program for safeguarding South Africa from possible biological and chemical weapons attacks.
It was believed at the time that chemical warfare agents supplied by Cuba were being used during Angola's civil war.
“The guidelines were given by the surgeon general, who was a medical doctor of international standing and who advised several governments in other countries,” Basson told the council, which has accused him of behaving unethically. “As a medical doctor I could live with the idea that I was preventing injuries and death through my involvement in developing the substances.”
Basson said he was not closely involved with the work of South African chemical weapons scientists, who worked out of the classified Delta G complex. The cardiologist said the chemical and biological weapons development did not progress to production efforts.
He did acknowledge, though, that tear gas-filled mortars were provided to Angola rebel fighters.
He urged the council to view his actions "with 1980s glasses" (South African Press Association I/Daily News, March 26).
The 1980s, under the nation's apartheid government, were "crazy years," SAPA quoted Basson as saying on Tuesday.
"People did things. Doctors planted bombs. Decisions were made in the context of the time," he said. "Nothing I did was aimed at harming anyone. In fact it was aimed at preserving life and minimizing loss of life. .. I never acted unethically or unprofessionally."
The council is moving forward with its hearing on four counts of unprofessional and unethical conduct filed against Basson (South African Press Association II/IOL News, March 27).
Prosecutor Salie Joubert on Tuesday charged that Basson and his former co-workers were "waging a chemical war against the population which they are trying to justify," the Johannesburg Mail & Guardian reported on Tuesday (Faranaaz Parker, Mail & Guardian, March 27).



 http://www.nti.org/gsn/

Cyberattacks should require presidential authorization, official says

By Ellen Nakashima

Cyberattacks on enemy computer systems should require presidential authority — and not be launched at the discretion of individual military commanders — the nation’s top cyberwarrior told Congress on Tuesday.
The comment by Gen. Keith Alexander, the head of U.S. Cyber Command, offered a rare glimpse into a largely classified debate over standing rules of engagement for the military in cyberspace. Those rules govern what commanders can and cannot do on their own authority outside war zones.

“It really comes down to, so what are those reactions that make sense that we can do defensively, analogous to the missile shoot-down?” he told the Senate Armed Services Committee.
“But if you are to go after a computer in foreign space or some other thing, that might be a response option that would now take, I think, the president and the [defense] secretary to step in and start making decisions, versus us taking that on,” Alexander said. “And I think that’s probably where we’ll end up, and that makes a lot of sense from my perspective.”
Alexander’s remarks came during a hearing that highlighted senators’ concerns about the growing threats to U.S. military, civilian and commercial networks dependent on the Internet. The threats are coming from foreign governments, criminals and hackers and may one day also come from terrorists, officials warn.
The rules of engagement were last updated in 2005 and are being revised to reflect advances in technology and capabilities.
“We are pushing for what we think we need,” Alexander said, noting that his staff members are working with the chairman of the Joint Chiefs of Staff, the Joint Staff and the Pentagon’s civilian leadership. The draft rules also will be vetted by other agencies and the National Security Council.
“Issues being ironed out are what specific set of authorities we will receive, conditions in which we can conduct response actions,” he said, adding that the work is likely to be done “in the next few months.”
The military is not allowed to take actions outside of its computer networks without special permission. Alexander alluded to a contentious debate that has been going on for years inside the Defense Department and the administration about how and when cyberwarriors might take aim at adversaries beyond their network boundaries.
He said the National Security Agency, which Alexander also heads, once detected in foreign computer networks an adversary trying to steal three gigabytes of data from an American defense contractor. The challenge was in alerting the company so that it could act fast enough to stop the theft, he said.
Alexander likened it to seeing a cyber-intrusion happen at “network speed” and then “trying to send a regular mail letter to them [saying] that you’re being attacked.”
He added, “There has got to be a better way to do that.”
Cyber Command was created in 2010 at Fort Meade, next to the operations center for the NSA, the nation’s largest spy agency.
Alexander also said that companies providing essential services such as electricity and water should meet “some set of standards” for network security as well as share data on network attacks with the government. Legislation has been introduced that aims to achieve those goals.
Some Obama administration officials in recent months objected when Alexander said publicly that he wanted greater legal authority to protect the nation’s critical private-sector computer networks against cyberattacks.
On Tuesday, when Sen. Carl Levin (D-Mich.), chairman of the committee, asked whether he was seeking additional legal authority, Alexander said, “No, chairman.”


 http://www.washingtonpost.com/world

Creating a classified cloud for spies

By Suzanne Kelly

The Intelligence Community (IC) is undergoing its biggest technological change ever as a team of hundreds works to build a computer system that links together nearly all of the 17 intelligence entities through a series of classified servers. To call it an ambitious project might be an understatement. The architects of the undertaking aim to get an initial version going by the end of the year.
The chief information officers at the most prominent agencies of the Intelligence Community were assigned the mission last summer when Director of National Intelligence James Clapper began to brace for budget cuts that would hit the community hard. For the first time in a decade, the IC would be forced to downsize under the strain of a budget that could no longer maintain the expansive growth the community had experienced since the terrorist attacks of September 11, 2001.
By last fall, Clapper was paraphrasing a favorite quote by a New Zealand physicist Earnest Rutherford who, in the midst of his own country's budget deliberations in 1927, said, “We’re running out of money so we must begin to think.”

Clapper had heard talk for years about inefficiencies in the community's information technology system. Each of the agencies relied on their own IT systems - problematic for information sharing, but comforting for information security. The traditional thinking seemed to be that the tighter the hold on the information, the easier it was to keep secure. When the budget issue presented itself, Clapper saw an opportunity.
"It was sort of a perfect storm kind of thing," said Clapper, who had kept an eye on cloud computing technology and came to realize that getting the agencies aboard a single cloud might yield not just significant cost savings over time but also information sharing benefits in the shorter term.
What is a Classified Cloud?
The idea of putting the country's sensitive intelligence information in a cloud may not sound all that safe since top intelligence and law enforcement officials have warned that the cyber threat facing the nation may surpass the threat of terrorism. To understand the risk, you have to understand the cloud concept.
Imagine the Internet as essentially a wide array of servers located in various locations around the world. They talk to each other, and they can store data. A cloud is where that data lives.
Businesses and individuals can opt to store information on those vast servers because it’s less of an information load than on their local servers. For a business, it means being able to run complicated programs without having to pay for the expensive technology needed to run them. It's kind of like renting the space.
The CIA has been using cloud technology for years, but there's a key difference between public servers and the Intelligence Community's cloud. In the IC, the cloud does not live on a public server. The challenge until now was figuring out how to facilitate and make the community's clouds interoperable. The model that the community is now moving toward tasks the individual agencies to act as a service provider to the rest of the community, essentially, creating their own IT support structure. This is a closed cloud concept. The hope is that by making the cloud internal to the IC only, it will mitigate the risk of intruders accessing sensitive or classified information.
Still, Clapper knew that selling such a concept across intelligence agencies that pride themselves on independence would require a different skill set entirely.
The Man for the Job
Getting all of the agencies on board with any initiative can be tricky. Clapper needed someone who would walk in the door with credibility. He turned to his principal deputy, Stephanie O'Sullivan, who herself hailed from the most protective of the intelligence agencies, the CIA. Years earlier, O'Sullivan had met Al Tarasiuk, who as CIA’s chief information officer for five years. He was on assignment in Europe when O'Sullivan called.
Tarasiuk's new mission: to sell IC leaders on an initiative requiring them to surrender a measure of their independence.
He says he knew what challenges were ahead.
"It's about enabling integration and enabling information sharing," Tarasiuk said. "The big cultural change is that we agreed to a new business model on how we would manage this."
Three months into execution, there have been hundreds involved in the effort. Their ultimate mission will also require the creation of a single desktop software program shared across the community. When analysts or operators or engineers log on to their computer, they will have the same set of tools at their fingertips.
It's kind of like a super secret version of social media that the architects are hoping will enable missions that now take months to plan to be done in a matter of minutes. But with reward, comes risk.
Risk and Reward
Intelligence operatives are used to taking risk. Less so, perhaps, are the analysts.
A recent study by the non-profit Intelligence and National Security Alliance (INSA) took a hard look at the way the community is to implement the cloud concept. INSA researchers specifically looked at recent mission failures and determined that many were caused either by the way intelligence information had been compartmentalized into 'data silos', or the way people had been managing documents.
"In most cases," the INSA report said, "the critical piece of information necessary for mission success was already possessed. The failure was not in obtaining the information but in locating and applying it to the mission."
In a case like that, the cloud - and more importantly the bigger IT infrastructure change - could really help improve efficiencies if it works the way it is intended.
But there are other, more significant risks to consider as the transformation develops over the next several years. Tarasiuk says he's aware of the challenges.
"We accepted some risk in moving out very quickly," he said.
He won't talk in detail about those risks, but does point out that the Director of the Cyber Command, General Keith Alexander, calls this a more defensible infrastructure. The idea being, if there is only one door into a house, that door is far easier to not only monitor, but to also protect. He also argues that with the new infrastructure, once a problem is detected, it's easier to address.
"When it's centralized you can implement patches," Tarasiuk said. "If you have a malware issue, a vendor comes out and says, 'Hey, we've got a code problem here,, and they do a patch right away. Today, (in the IC) the way we have to do a patch, is its’ distributed to every agency. They do it on their own; we're not involved."
There are some increased risks that Tarasiuk won't talk about but the Government Accountability Office (GAO) has identified.
On Tuesday, the GAO released a report identifying what it called key supply chain-related threats that included the installation of defective hardware or software; counterfeit hardware or software; the intentional installation of intentionally harmful hardware or software; the failure of critical products; and the reliance on malicious or unqualified service providers for technical support issues.
By setting up its own IT force inside the IC, that last one might be mitigated. But all are concerns that the architects say they have considered.
Of course, there is one threat that may be far harder to mitigate.
The Bad Actor Scenario
Even a trusted insider with appropriate clearances can become a risk.
A 'bad actor' as they are called, or a person who spies on his or her own country could theoretically have a field day with the new system. It's a nightmare scenario for the architects.
One need only look at the WikiLeaks disaster that the military says involved just one person accessing data and passing it along to the whistleblower website – which then published sensitive government cables.
"Insider threat is always something that we watch," Tarasiuk said. "I know that private companies are very worried about the same kind of issues, and we have ways to deal with that. I think we as a government have to be sure that we put a lot of emphasis on safeguarding."
The architects hope to help mitigate that risk by tagging data. The NSA already does it. It takes note of who accesses what data, and perhaps more importantly, what they do with it. Tagging the data is critical to keeping the cloud and the new architecture safe.
"We're also tagging people," Tarasiuk said. "When they authenticate themselves into the system, very much like we do today, the system will recognize that they have certain attributes and will allow them to see certain data."
Richard "Dickie" George spent 41 years at the National Security Agency. He now works as a senior cyber expert at the Johns Hopkins Applied Physics Laboratory, which works on government projects. George says you have to be careful who is allowed to see what when you're offering a view of the cloud.
"We have authorities to deal with different information. So if you're putting it in a big cloud, you really have to be extremely careful," he said.
George cites legal requirements that control who is allowed to see what, and the challenge of keeping that straight in a cloud architecture.
"It makes it easier to share because everybody has access to more information," George said. "You have to be careful that people don't inadvertently gain access to information they aren't supposed to have and that data tagging - that labeling of information to ensure that only people with the proper authorities have access to it - that's a critical part of the game."
But as the man tasked to get this done, Tarasiuk has one more concern.
"My biggest worry is that we sold the big picture," he said. "Theoretically it’s great. But now it’s making those things work together on the scale we are talking about. So I have a little fear on the technology side. Not that we can't do it, but that it will take a little longer than we think it should."



http://edition.cnn.com/

At CIA, a convert to Islam leads the terrorism hunt

For every cloud of smoke that follows a CIA drone strike in Pakistan, dozens of smaller plumes can be traced to a gaunt figure standing in a courtyard near the center of the agency’s Langley campus in Virginia.
The man with the nicotine habit is in his late 50s, with stubble on his face and the dark-suited wardrobe of an undertaker. As chief of the CIA’s Counterterrorism Center for the past six years, he has functioned in a funereal capacity for al-Qaeda.

Roger, which is the first name of his cover identity, may be the most consequential but least visible national security official in Washington — the principal architect of the CIA’s drone campaign and the leader of the hunt for Osama bin Laden. In many ways, he has also been the driving force of the Obama administration’s embrace of targeted killing as a centerpiece of its counterterrorism efforts.
Colleagues describe Roger as a collection of contradictions. A chain-smoker who spends countless hours on a treadmill. Notoriously surly yet able to win over enough support from subordinates and bosses to hold on to his job. He presides over a campaign that has killed thousands of Islamist militants and angered millions of Muslims, but he is himself a convert to Islam.
His defenders don’t even try to make him sound likable. Instead, they emphasize his operational talents, encyclopedic understanding of the enemy and tireless work ethic.
“Irascible is the nicest way I would describe him,” said a former high-ranking CIA official who supervised the counterterrorism chief. “But his range of experience and relationships have made him about as close to indispensable as you could think.”
Critics are less equivocal. “He’s sandpaper” and “not at all a team player,” said a former senior U.S. military official who worked closely with the CIA. Like others, the official spoke on the condition of anonymity because the director of CTC — as the center is known — remains undercover.
Remarkable endurance
Regardless of Roger’s management style, there is consensus on at least two adjectives that apply to his tenure: eventful and long.
Since becoming chief, Roger has worked for two presidents, four CIA directors and four directors of national intelligence. In the top echelons of national security, only Robert S. Mueller III, who became FBI director shortly before the Sept. 11, 2001, attacks, has been in place longer.
Roger’s longevity is all the more remarkable, current and former CIA officials said, because the CTC job is one of the agency’s most stressful and grueling. It involves managing thousands of employees, monitoring dozens of operations abroad and making decisions on who the agency should target in lethal strikes — all while knowing that the CTC director will be among the first to face blame if there is another attack on U.S. soil.
Most of Roger’s predecessors, including Cofer Black and Robert Grenier, lasted less than three years. There have been rumors in recent weeks that Roger will soon depart as well, perhaps to retire, although similar speculation has surfaced nearly every year since he took the job.



 http://www.washingtonpost.com/world