[Excerpt from "Criminals, Hacktivists, and Nation States"originally posted on Adriana Dvorsak's New Solutions blog hosted at Euractiv. Thanks to Adriana for permitting us to share her work here on Analysis Intelligence.]

…these individuals are not susceptible to international law, for example to Geneva conventions which professional soldiers must follow. In addition these individuals are not familiar with military ethics, laws of neutrality, might not have clear intent, do not follow the rules of hierarchical organization. Individuals can be persecuted under national criminal law, therefore we can understand police pushing for change in criminal law to cover more cyber security threats.

Recent Hacktivist Actors and Targets

You may easily manipulate Recorded Future application to get data on longer time line, on different type of events or look at them in a neat interactive Google Earth view. I came across different actors, for example hacktivists, patriot hackers, online activists, organized cyber crime, terrorist organizations, and other autonomous actors and it seems to me that individuals became very important for cyber security. Diverse as they are, they can not be called a military and they will hardly take part in a classical armed conflict where one military confronts another. But they are so important that militaries hire them and even offer them to NATO as national cyber troops. Well, Romanian hacktivists apparently disagreed with such a side job.

The post can be read in full at Euractiv.

Recorded Future analyst Munish Puri details key issues in the Keystone Pipeline political debate and identifies critical factors that will influence success or failure for the project’s approval.

Methodology

My analysis begins by setting a query in Recorded Future on the Keystone Pipeline. Next, I dove into specific sources and articles, filtering based on popularity, predictions, and frequency of citation. With the larger data set and the specific subsets just listed, I listed the various key players according to the Network, mostly to sensitize my reading and synthesis. Then I analyzed Momentum to track where the story shifted and focused on those points for sentiment analysis. Finally, for each inflection point, I zoomed in on a set of stories to understand what happened, in what order, and why it was reflected on positively and/or negatively.

Mainly, questions centered around what happened with the pipeline proposal, why it was (eventually) rejected, what will happen next — and by whom, and what are the key predictive indicators. As for the latter, I tracked any forward-looking events mentioned in articles, as well as possible alternative outcomes mentioned by the various stakeholders. Also, I changed the parameters for the query to focus on 2012. Lastly, I compiled the analysis below.

Issue Overview

TransCanada plans to extend its Keystone Pipeline (operational from June 2010) from the “tar sands” of Canada’s Alberta province to refineries in Texas on the Gulf Coast.  The $7 billion Keystone Gulf Coast Expansion (Keystone XL) would be completed in two phases, which pass through Nebraska, Montana, South Dakota, Oklahoma, Kansas, and end in Texas. If finished, the extension would increase the United States’ oil supply by half the amount of annual imports.

Debate centers around the cost, value, reliability, and environmental impact of the pipeline. In addition to TransCanada, proponents of the projects — many Republican politicians, construction companies, labor unions, and some (Canadian) government officials — argue that the pipeline will create jobs and decrease the US’ reliance on foreign sources of oil. Political and environmental opposition abounds, particularly as covered by the blog of the National Resources Defense Council (NRDC). Environmental nongovernmental organizations, landowners, Democratic politicians, and even some (American) celebrities express concern over TransCanada’s safety record and the possibility of leakage, as well as concern about climate change and greenhouse gas emissions, a result of oil sands production. On job creation, a report from the Global Labor Institute challenged the company’s estimate, which TransCanada later revised. Finally, potential pipeline construction prompted worry about local environmental impacts, particularly in Nebraska, in which the pipeline could effect the Sand Hills ecosystem or contaminate the Ogallala Aquifier, a major source for irrigation and drinking water.

Key Developments & Sentiment Inflection Points

“In the end, neither side can predict with confidence what Obama will decide.” -Washington Post, November 5, 2011

In early June 2011, the U.S. Department of Transportation ordered the shutdown of TransCanada’s Keystone pipeline, as investigations revealed safety concerns at pump stations. At the same time, the U.S. State Department was completing public consultations about the Keystone XL phase of the project. There is generally positive sentiment around the announcement, likely because it showed U.S. commitment to a proactive approach to preventing possible spills.

In August, the State Department issued its own environmental impact assessment, concluding that the pipeline will not cause significant damage to the environment as long as TransCanada complies with U.S. law. The reaction to this news was noticeably more positive than negative, but that could be as a result of progress toward a decision, not necessarily sentiment about the project.

In October, documents were released (by Mother Jones as a result of a FOIA request by Friends of the Earth) that cast doubt on the impartiality of the State Department’s assessment. Later, the State Department opened an investigation of the process around issuing a permit for the pipeline. Additionally, environmental advocacy organizations sued to stop the development of the pipeline. This development showed positive sentiment, perhaps due to transparency in government decision-making. A second development, TransCanada’s announcement that it could lose up to $1 million per day with a delay was met with negative sentiment, an indicator of disconnect between the company’s statement and public opinion.

In early November, the U.S. State Department announced that it was considering an alternate route for the pipeline, which represented the highest peak in momentum around any event related to the pipeline in 2011. As the reported possibility of the alternative route seemed to be more likely, the State Department announced that it would delay its decision until 2013, which was accompanied by a large spike in positive sentiment. An analyst with MF Global Washington Research Group wrote in a research note that the fate of the pipeline has grown “less secure” and “the odds favour approval, but an extended delay is looking more and more possible.” Given the increased attention and political importance of the decision, President Obama become more personally involved with the decision.

In mid-December, the Republican-led House passed a proposal to require a decision within 60 days. President Obama threatened to veto the bill if it reached his desk, however, the State Department warned that a hasty decision would decrease the project’s chances for approval (in particular, because a recently-passed Nebraska law requires an environmental review that could last from 6 to 9 months). These developments saw an interesting double-peaked positive sentiment curve, with a sizable peak in negative sentiment situated between the two positive peaks — underlying policy uncertainty about whether the Republicans would be able to successfully attach an expedited executive review to legislation on a payroll tax cut.

In mid-January, President Obama announced that he was rejecting the permit for the pipeline, based on insufficient time to evaluate the project, not on the merits of the project itself. Republicans continued to pressure the President to make a decision, highlighting a divide among two traditionally Democratic demographics: labor unions and environmentalists. As a result of the President’s decision, environmental groups celebrated the victory and TransCanada (and the Canadian government) focused on alternative pathways forward on the project.

Conclusion: Predictive Indicators

Following are possible action from various groups, as well as indicators of what to watch in the coming weeks and months:

Corporate – announcements about next steps and tactical shifts:

• Re-file/appeal permit application
• Build pipeline down Pacific corridor to export to China
• Create smaller expansions that would not require State Dept. approval

Legislative/Political – statements from Congressional party leaders:

• Move decision out of hands of State Department and to Federal Energy Regulatory Commission
• Re-attach decision provision to payroll cut extension (expires at end of February)
• Leverage President’s decision to develop political capital for elections

Nongovernmental – change campaign targets and actions:

• Mount resistance to other pipeline projects, such as one proposed by another Canadian company, Enbridge
• Use decision to delay to build momentum during elections

Whether or not the President’s delay on a decision will have a long-term impact will depend, oddly, on future projects that come across his desk (or if they make it that far); given the election and political dynamics, the next decision point will establish a policy precedent for preventing such proposals from coming to fruition.

The Chinese are stuck with one foot in each camp of a contentious battle for control of oil in East Africa. The most recent conflict between the nascent state of South Sudan and its controversial neighbor raises real concerns that China’s controlling stake in 40 percent of Sudan’s oil industry and 60 percent of its export will be seriously disrupted.

This current conflict, which arose earlier this month after claims that Sudan is stealing oil being piped to ports from South Sudan, unfolds just a little more than six months after China put in immediate diplomatic legwork with the new South Sudanese state. They did so with good reason given that estimates suggest the new country is responsible for around 75% of the region’s crude oil output. In the below timeline, you can see how the Chinese publicly responded to the new state in July:

China's response to South Sudan's Independence in July - Click for Live View

History Between China and Sudan

From where does this interest in the stability of Sudan arise? The storyline of relations between China and Sudan includes a backdrop of sanctions imposed on the Sudanese government by the US and UN that left a trade void for the country. China was willing to fill it especially given their increasing need for energy resources, and looking back to 2008 we find a series of investments and diplomatic actions between China and Sudan:

If you look back further than the time frame of the above discussion, you also find that China has been running one of its biggest oil projects in Sudan since 2004. The relationship is ever contentious: China took heat from world leaders when it hosted Sudan’s wanted leader Omar al-Bashir in June of 2011 ahead of the South Sudan’s formal independence, and there are claims that more than $55 million worth of Chinese weapons have been sold to Sudan.

Current Diplomatic Efforts

For some time after al-Bashir visited China, relations between the countries went fairly quiet. There were few, if any, publicly highlighted diplomatic relation events from July to the middle of November (note the time slider on the bottom of the network that shows the time frame being analyzed):

Diplomatic Relation Events for Sudan - July through Mid-November

However, relations suddenly saw a flurry of activity beginning with a pledge from Chinese defense minister Liang Guanglie on November 16 saying that his government would bolster military cooperation with Sudan, and since then, you can see below that China is the second most prominent state (after the United States) for diplomatic relation events with Sudan. The density of lines between network nodes indicates the number of events connecting those entities:

Diplomatic Relation Events for Sudan - Mid-November to Present

Why the sudden action even before the most recent allegations of Sudan stealing in-transit oil from South Sudan? Well, it’s possible that there was anticipation about the United States formally announcing its lifting of sanctions on oil trade with South Sudan after drawing up guidelines for companies to avoid infringing on the sanctions still imposed on Sudan. There also may have been hints that non-Chinese companies such as French oil giant Total would suggest alternative plans to pipe oil through Uganda for export via Kenya or Tanzania; ultimately, a bad solution for China.

The circumstances are fast changing and carry ramifications for the markets, the stability of the entire region, and international relations between China and the Western countries long at odds with Sudan. Monitor further updates by creating an alert for the most recent and near future events related to oil in East Africa.

We’ll be hosting a webinar with security expert Jeffrey Carr where we’ll demonstrate how Recorded Future can be used to gather cyber intelligence from open source.

Date: Tuesday, January 31, 2012
Time: 11am Eastern; 8am Pacific
Duration: 1 Hour

Register online

Topics we’ll cover include:

• How Recorded Future offers the only solution which can immediately harvest, cluster, and surface predictive signals from unstructured text
• How Recorded Future makes available what the world knows about the future by aggregating forecasts and predictive signals from across the web
• How advanced data visualization tools support patterns of behavior research, forecasting, and identification of influential relationships between entities
• How temporal reasoning partnered with entity and event extraction can be used on the public web or in private, secure clouds
• A live demonstration of open source research on cyber threats including the evaluation of state and non-state threats, corporate security measures, and the sequence of events surrounding Iran’s capturing a RQ-170 drone

Win a $50 Amazon gift card! No purchase necessary.

1) Sign up for a free trial of Recorded Future

2) Do some analysis

3) Blog/tweet/or share with us.

We’ll pick the coolest entry and send the winning user $50 Amazon Gift Card. See all the details: https://blog.recordedfuture.com/2012/01/03/analysis-contest-with-recorded-future-to-win-50-amazon-gift-card/

Pop over to Drew Conway’s blog Zero Intelligence Agents and check out his latest post “Who are the most central members of the China’s leadership as we enter 2012?” Drew is a PhD student in political science at New York University. Drew studies terrorism and armed conflict; using tools from mathematics and computer science to gain a deeper understanding of these phenomena. He analyzed a massive amount of Recorded Future data gathered from open source, did some math magic and came up with a pretty compelling analysis.

Over the last week, much has been written on Iran’s new electronic warfare capabilities. Iran first claimed that it was able to hijack the RQ-170 drone by jamming its GPS signal and landing it remotely. Now there is a new report that suggests that the Iranians may have blinded a US spy satellite. The report suggests that a laser may have been used to temporarily “blind” a satellite that was conducting surveillance overhead. If this is true, the Iranians must have gained access to advanced electronic warfare equipment.

The sudden flurry of reports about Iran’s capabilities makes it seem like this technology was developed overnight. In reality, this type of advanced equipment needs to be acquired from a superpower, and it looks like the Iranians turned to the Russians for help in this department.

View of discussion around Avtobaza reveals connections to Russia

The Russians admitted to selling the Iranians an advanced electronic intelligence system called the Kvant 1L222 Avtobaza. The Avtobaza is intended to be a, “radar jamming station and RF intelligence gathering tool”. A technical analysis of Iran’s ELINT capabilities postulates that the trucks that the Russians sold to Iran may have, “been modded to work in the satellite ranges”. It was the opinion of the report however that the system was likely used only in the RQ-170 incident.

This appears to be a more likely scenario, unless the Iranians were able to modify the equipment given to them by the Russians. The Iranians have been known to interfere with satellite communications in the past, but trying to modify the Avtobaza appears difficult. The Avtobaza was intended, “to detect airborne side-looking radars, air-to ground fire-control radars and low-altitude flight control radars” but not satellite communications. Despite this, a DIY Iranian ELINT system capable of blinding US satellites might be possible.

Emerging Reports on the Russian-built Avtobaza

Do you think the Avtobaza could be used to interfere with satellite communications? Have a look here at the technical specifications. Would you like to follow Iran’s jamming activity or ELINT capabilities? If so, consider taking a look at Recorded Future’s open source intelligence tools.

What is the regional significance of Hezbollah working with the drug cartels? Let’s consider Hezbollah’s cell activity in Latin America and examine its relationship with the cartels.

The issue has increased in momentum over the past few months

US websites dedicated to border issues and even one of the Republican presidential candidates mentioned the “significant and imminent threat of the Iran-Latin America nexus”. Others have indicated that Hezbollah functions as a sort of insurance policy for Iran in those regions. The state can fund the terrorist group and still exercise plausible deniability in the event of a major attack. Iran perceives its support of Hezbollah as a way to pressure the United States within its strategic sphere of influence in the Americas.

Some sources have said that the strengthening relationship between Iran and Venezuela has increased Hezbollah’s influence in the region. Both leaders are staunchly anti-American, and it is reasonable to think that they would pursue activities that would undermine US interests. Roger Noreiga, the same official that warned of an attack by Hezbollah, indicates that Venezuela, “has allowed Iran to mine uranium” and that Venezuela’s Margarita Island has eclipsed the infamous TBA as the principal safe haven and center of Hezbollah operations in the Americas”. This is particularly disturbing as Iran is suspected of pursuing a nuclear weapon while simultaneously funding Hezbollah close to the US border. Therefore, there major concerns that if Iran obtains a nuclear weapon it might share the weapon with Hezbollah.

There are two major Hezbollah networks operating in the Americas under the direction of the Iranian Quds Force. The first is the Nassereddine network, operated by a former Lebanese citizen that became a Venezuelan and is now the second-ranking diplomatic official to Syria. He currently resides on Margarita Island and runs money laundering operations for the group. The other network is purportedly run by Hojjat al-Eslam Mohsen Rabbani, a culutral attaché from Iran who is involved in various recruitment activities and frequently travels under false papers in Latin America. The two networks together make up the majority of Hezbollah’s activity in the Americas.

Now back to the cartels. Why is the link between Hezbollah and Los Zetas so important? The main concern is that if Hezbollah and Los Zetas are cooperating on drugs (which they are to the tune of hundreds of millions), then why would they not cooperate on weapons? Hezbollah and other extremists may be willing to export their knowledge of IEDs to the cartels. The relationship between Hezbollah and Los Zetas appears to have already expanded beyond drugs. In October 2011, the US authorities revealed that there was an attempt made by Iran to assassinate the Saudi ambassador on US soil.

It looks like Los Zetas was intricately involved with Iran in this and other related plots, “The alleged plot also included plans to pay the cartel, Los Zetas, to bomb the Israeli Embassy in Washington and the Saudi and Israeli Embassies in Argentina, according to a law enforcement official…The plotters also discussed a side deal between the Quds Force, part of Iran’s Islamic Revolutionary Guards Corps, and Los Zetas to funnel tons of opium from the Middle East to Mexico”. Other information that we have found would corroborate the existence of a relationship between Hezbollah and Los Zetas.

There are also some analysts that think that the entire relationship should be played down and that Hezbollah’s influence is overplayed. James Bowsworth of the Christian Science Monitor downplays the relationship saying,

“The case is notable for having all the key words that people get excited about: Hezbollah! Terrorist-financing! Cocaine! Zetas! Venezuela! And all of that appears to be true. At the same time, in spite of all the red flag key words, the details within these articles and the indictment show how the US government can deal with the issue of Hezbollah in the hemisphere without panic and over-reaction”

In the early morning of November 26^th, US military aircraft struck a (previously identified) Pakistani border outpost resulting in 42 Pakistani Military casualties. With a total of 28 dead and 14 seriously wounded, this incident qualifies as the single most deadly cross-bor

der attack on a Pakistani military position since the beginning of the US lead war in Afghanistan.  As a result, Pakistani officials have announced the permanent closure of NATO supply lines into Afghanistan. In addition, the Pakistani government promptly ordered the departure of US persons from the Shamsi air base; which, has reportedly been utilized for the launch and recovery of UAV’s (unmanned aerial vehicles).

The Data

I prefer to keep things simple so after a little keyword experimentation I searched “Islamic Republic of Pakistan” and “drone” and “strikes”. I felt that this combination would best identify past cross-border incursions; even when drones aren’t involved, they’re nearly always referenced.  To have a solid data set to work with I queried from January 1^st 2009 through December 31^st 2012.

What I end up with is the chart below, which has plenty of data and a wonderful view of the momentum and negative sentiment trend lines. To provide a better view of the trending, I’ve included a second chart with the events deselected.

A thorough review of all the events supports an increase in momentum, not surprising, after a drone strike in Pakistani territory. Interestingly, there’s no direct correlation between the large spikes in negative sentiment and civilian and/or Pakistani military casualties. Subsequent searches revealed these spikes typically occurred during times in which the Pakistani government was being criticized, for one reason or another, by the US government. That’s a completely different problem set, but the following analysis was derived from the information obtained via Recorded Future, which quickly permitted me to view similar past events, reactions and outcomes.

Analysis

It’s important to understand that the Pakistani version of an outpost is substantially different from the typical US outpost and often consists of nothing more than hastily dug positions and/or dirt berms. Now this particular border outpost is well within Pakistani territory, located approximately 2.5 kilometers from the Afghanistan border, in the FATA (Federally Administered Tribal Area). The FATA border area is extremely volatile and has long been a point of contention between Pakistani and US Forces, with regular exchanges of small arms fire and occasional strike missions involving US military aircraft. I want to be clear when I state that it’s very common for Pakistani border forces to initiate contact with US troops. Regardless, most of these instances occur during the hours of low visibility when it’s often difficult to distinguish friend from foe. Similarly, complex tribal affiliations and the often not-so-subtle support for and intermingling with militants can further complicate matters.

What if this wasn’t a matter of confusion? To further speculate, it’s possible that a high value target was identified as having been at that location. Due to political sensitivities such an operation would have to have direct approval from the office of the POTUS and would require an extremely high degree of confidence. It’s unlikely that such a sensitive operation would ever be publicized but in my experience, it’s entirely plausible. Given the scenario and increasing political tensions however, it’s equally likely that influential elements within the FATA and/or the Pakistani government intentionally provoked a military response and ensured its escalation. This may sound like a conspiracy theory but there are certainly people out there with much to gain from the growing tensions and political turmoil between the US and Pakistani governments.

The timing of this couldn’t have been better…errrr…worse rather. There’s been an extraordinary amount of political tension between the US and Pakistani governments. The tension was steadily building but the US special operations cross-border raid deep into Pakistan targeting Usama Bin Laden accelerated an already declining relationship. The Pakistani government has openly opposed cross border drone strikes that have always, publically, been a point of contention not to mention a sometimes-political diversion. In previous instances in which border incursions resulted in high civilian casualties, the Pakistani government was quick to publically condemn such strikes. Similarly, it’s common for supply lines to be temporarily closed as a show of strength.

So what happens this time? Well… very likely the same thing that’s happened every other time a similar situation has occurred. From the Pakistani governments perspective, the response needed to be fast, appear tough and demonstrate attacks against Pakistani forces will not be tolerated. The government needs to maintain its sovereignty in the eyes of the people. Similarly, they need to appease tribal leaders as well as the militant elements that could threaten the capitals stability. On the surface, at least from my perspective, this has been achieved. NATO supply routes will be closed and perhaps for a longer period than before, but they’ll inevitably reopen until the next blatant breach of sovereignty. The US was already scheduled to depart the Shamsi air base in June of 2012, so this is more of an inconvenient show of power that at most will reduce the dwell time of the drones and whatever other aircraft are being utilized. There’s no real comparison for this scenario but I suspect this deadline will be extended but not announced. Lastly, I suspect the video from the aircraft involved will be provided as proof that US forces did not initiate contact and were in fact responding to hostile actions.

If you’re interested to try Recorded Future, sign up for a free 14-day trial.