State-Sponsored Intelligence
Information in this chapter
Introduction
State-sponsored intelligence has played an integral role in establishing, managing, and retaining dominion since human beings first banded together in large, extended families, thousands of years ago, and began implementing social and geographic boundaries for themselves and their neighbors. History has shown this to be the case, and here, in the twenty-first century, state-sponsored intelligence is no less important or necessary. It is a very real part of our world, one which is not always easily understood but nevertheless imperative to our survival. It involves myriad differing actors, philosophies, methodologies, tools, techniques, and approaches. It is an ever-evolving discipline that sees cross-pollination among contributing entities within the state as pivotal to its success or failure and not open for discussion among the citizenry.
Within the world of state-sponsored intelligence careful consideration is given, but not limited, to the following influencers:
• Intelligence types to be gathered
• Intelligence gathering process
• Intelligence analysis process
• The negative repercussions of conducting state-sponsored intelligence gathering against a target
• Mechanisms for collection and submission of intelligence
• Categorization of intelligence
• Dissemination of intelligence once collected, analyzed, and corroborated
• The sources of the intelligence being acquired
• The degree of difficulty associated with corroborating the samples
• Socioeconomic stability of the nation and nations of interest (friendly or unfriendly) from which the intelligence is derived and to which it is related
• Foreign and international relations policy
• The implications of the intelligence for domestic and foreign concerns
• The potential threat vectors and points of confluence associated with preexisting intelligence and new samples
Much consideration must be given to the areas of operational, tactical, and strategic intelligence. The ability to differentiate and make intelligent decisions based on the information a given organization within a state receives is not trivial. In most respects, it is the culmination of the analysis and review of an immense amount of data and scenarios, some aspects of which were cultivated within academic environments, and removed from the grit of the field while others were cultivated, tested, and noted in the field.
Espionage and Its Influence on Next-Generation Threats
Espionage, in one form or other, has existed throughout the expanse of known, documented (and likely undocumented), human history. Examples of espionage use, development, endorsement, and adoption have been identified and noted in almost every culture of the world. Archeologists and anthropologists have found detailed accounts of such activity in countries such as Egypt, Samaria, Israel, Greece, Persia, Italy, China, Japan, Korea, India, and England; all of which endorsed the use of espionage unrepentantly in order to advance and achieve their agendas. This use ultimately culminated in the achievement or loss of their goals, goods, lands, and assets or life itself.
Within these cultures, the selection and training of practitioners of clandestine crafts was and remains a process shrouded in mystery. These agent provocateurs were carefully trained, in many cases, from birth or early childhood, in furtive disciplines in order that they become prepared for deployment when called on by their ranking authorities. Their missions would include intelligence gathering activities of a varied sort. Some involved infiltration via subversive means allowing the agent in question to operate in the open while in deep cover while others might be deployed in a manner that saw them involved in the propagation, dissemination, and proliferation of propaganda designed to undermine enemy opposition. Still others were deployed with a much simpler mission: to acquire data via any means necessary (in many cases often through seduction), and if need be carry out the mission to completion, utilization, or assassination. Often these activities would see operators deployed behind enemies’ lines in the heart of danger. The clandestine activities practiced by these agents have become the stuff of legends and for good reason. The missions undertaken by these actors in the ancient world just as in the modern one were passed down generationally.
They transitioned cultures, and political and military regimes feared and revered them at the same time.
Because of the economic and tactical value of their skills (supply and demand), these individuals often saw their services sought during times of peace in addition to times leading to and during war. As a result, they became targets of acquisition, viewed as essential to the individuals as well as the organizations that they served or opposed. Fundamental to their success was their knowledge of humanity—the motives that drive the ideological, economic, or primal aspects of humankind.
All were studied, mastered, and incorporated into their methodologies in order to increase field efficacy and garrison analysis. In striving for mastery of these aspects of human psychology in order to be better equipped to exploit when the time came, these agents strove for perfection in their craft. Risk mitigation or minimization was expected of them while deception and subversion became key to their tradecraft, along with the ability to acquire voluminous amounts of data in a variety of ways. This ability to retain information gathered for real or near real-time analysis (in addition to post collection analysis) would serve these agents well in making critical decisions while in the field. The ability to debrief safely and securely—via appropriate channels—became vital in their efforts and continues to be so. Finally, there was the ability to remain—figuratively and literally—silent until safely able to debrief with respect to the intelligence gathered through appropriate, secured channels.
Over time, through conflict—both public and private—these skills were practiced, refined, and proven in real-world situations, leading to the development of modern covert organizations such as the following:
1. United States Office of Naval Investigation (ONI)—the oldest continuously operating intelligence service in the nation. While its mission has taken many different forms over its evolution, the main purpose has not changed from its inception
2. United States Office of Strategic Services (OSS)—now known as the modern Central Intelligence Agency (CIA), developed during World War II
3. United States Armed Forces Security Agency (AFSA)—now known as the National Security Agency (NSA)
4. United Kingdom Ministry of Defence (MOD)—Defence Intelligence Staff (DIS)
5. United Kingdom Government Communications Headquarters (GCHQ)
6. United Kingdom Secret Service (MI5)—responsible for counterintelligence (CI) and security
7. United Kingdom Secret Intelligence Service (SIS a.k.a. MI6) and Special Operations Executive (SOE)
8. Russian Glavnoye Razvedyvatel’noye Upravleniye (GRU) and Sluzhba Vneshney Razvedki (SVR), also known as the Foreign Intelligence Service
9. Chinese Ministry of State Security (MSS)—the Chinese government’s largest and most active foreign intelligence agency
10. Israeli Institute for Intelligence and Special Operation (Mossad or HaMossad)
11. Saudi Re’asat Al Istikhbarat Al A’amah (GIP)—now known as General Intelligence Presidency
12. North Korea Cabinet General Intelligence Bureau of the Korean Workers Party Central Committee (RDEI)—Research Department for External Intelligence and Liaison Department
These organizations and others like them (nationally or subnationally sponsored), continue in the business of data and intelligence gathering for various purposes—some sensitive, some not; some classified, some not classified—all of which are relevant to their individual charters and areas of expertise. Unfortunately, they are not alone in their recognition of the value of data, information, and intelligence on the global stage. Nor were they the only organizations adept in plying like tradecraft for the express purpose of identifying and acquiring data, information, and intelligence (Figure 6.1).
Figure 6.1 United States Intelligence Community as defined by the Federation of American Scientists.
Criminal elements—whether localized geographically or internationally in scope—thrive, proliferate, and encourage criminal ecosystems gathering data, information, and intelligence and marketing its availability to the highest bidder. In Chapter 9, we explore and discuss more about these types of organizations and their activities as they relate to state and nonstate sponsored action in more detail. Often times, they are in direct opposition to organizations such as those mentioned before or against them in field. In some cases, former military and intelligence community operatives and officers the world over have elected to engage in underground enterprise adding a level of sophistication, professionalism, and cohesion not typical of traditional criminal organizations (Figures 6.2–6.6).
Figure 6.2 United States Intelligence Community insignias.
Figure 6.3 Mapping of Intelligence Community to the United States DNI.
Figure 6.4 Intelligence Community Structure.
Figure 6.5 United States Intelligence hierarchy.
Figure 6.6 British Parliament and Intelligence community mappings.
Intelligence Types
As we have seen, the desire to procure intelligence is as old as time. That desire has seen the evolution and birthing of formalized intelligence organizations some of which we have referred to above. However, it is important that we examine and classify intelligence in three easy-to-understand categories:
Let us begin by exploring the first concept, strategic intelligence. It is important to note that this is a simplification of what is not simple by any means. As such, it is a means by which to explain in an expeditious manner the roles that information and intelligence are given, our prioritization of them, and the subsequent use of the intelligence gathered to achieve our ends.
Strategic Intelligence
The etymology of the word strategy comes from the Greek strategia (generalship) and stategos. Strategy quite simply is the art and science of employing the political, economic, psychological, and military forces of a nation, or coalition of nations, to afford the maximum support in the adoption of policies that govern peace or war. Strategic intelligence focuses on broad issues which impact and direct strategy. For example, some of these issues may include but are not limited to the following:
3. Political assessments and assignments
4. Military capabilities and resources
The nature of this intelligence may be technical, scientific, diplomatic, sociological, or any combination thereof. These types of intelligence are analyzed in concert with known information pertaining to the data related to the area in question (e.g., geographic, demographic, and industrial capacities). This information provides a great deal of insight that feeds other intelligence operations and organizations serviced by them.
Tactical Intelligence
Tactical intelligence is focused on support to operations at the tactical level, and would be attached to the Battlegroup. Specialized units operating in reconnaissance capacities carry out the mission to identify, observe, and collect data that will later be delivered to command elements for dissemination to command elements and units. At the tactical level, briefings are then delivered to patrols on current threats and collection priorities; these patrols are then debriefed to elicit information for analysis and communication through the reporting chain. Those with command responsibilities and decision-making power often influence tactical intelligence initiatives, as a part of strategic intelligence agendas. This is a critical concept to grasp hold of and one that is not only ubiquitous but also crucial to the agendas set forth by nation states and their military and intelligence communities.
Operational Intelligence
Operational intelligence (OPINTEL) is a form of data acquisition considered necessary to both intelligence community and military organizations for the successful planning, execution, and accomplishment of missions (tactical and/or strategic), and operations and campaigns within geotheaters and areas of operation—sanctioned and unsanctioned. OPINTEL is focused on providing support to an expeditionary force commander and is traditionally seen attached to headquarters units. This is critical as it feeds into and supports activity associated with strategic and tactical intelligence initiatives. It should not be confused with the activities associated with business process management (sometimes referred to as OPINTEL), which focuses on providing real-time monitoring of business processes and activities as they are executed within enterprise business computer systems.
OPINTEL utilizes Electronic Intelligence (ELINT) among other forms of intelligence gathering mechanisms to identify, gather, and ensure the secure transmission of data from operators to analysts, ultimately arriving in the hands of decision-makers tasked with command responsibilities. ELINT is a form of intelligence that focuses on the interception of noncommunication signals transmitted over electromagnetic waves with the exception being those identified as originating from atomic or nuclear detonations. Nonelectromagnetic transmissions such as those originating in atomic or nuclear detonation fall into the realm of MASINT (Measurement and Signal Intelligence). ELINT saw its birth during World War II in which Allied forces monitored Axis air defense radar systems in order to neutralize them during a bombing raid via direct strikes or electronic countermeasures (Figure 6.7).
Figure 6.7 Data collected during a MASINT operation.
Over time, this practice has continued in other conflicts, in which the United States has been involved, involving the Union of Soviet Socialist Republics (USSR), and the People’s Republic of China during the Cold War, the Democratic Republic of Vietnam (also known as North Vietnam) during the war in Southeast Asia, and in conflicts the world over involving Libya, Iran, and more current conflicts in the middle east. Although it is easy to mistake ELINT for RADINT (Radar Intelligence), RADINT does not involve the interception of radar signals but rather focuses on flight path intelligence and other data specifics derived from the reflection of enemy radar signals. RADINT by virtue of categorical relation is a subset of MASINT. ELINT itself contains the following subcategories:
FISINT focuses on identifying and tracking signals transmitted by foreign entities when testing and deploying new technology in aerospace, surface, and subsurface systems such as tracking and aiming signals and video links. TELINT, which is considered a subcategory of the subcategory that is FISINT, is the process of taking measurements from a remote location and transmitting those measurements to receiving equipment. There are ample applications of telemetry in both the civilian and defense industrial base. Examples of the former may include a power company’s use of radio signals from remote power lines to relay operational information to an intelligence center within the power grid. Examples of the latter may include the use of signals to relay performance and operational information on munitions and smart weapons.
ELINT is an integral aspect of over-arching intelligence processes seen within state sponsored intelligence activity (Figure 6.8).
Figure 6.8 Rockwell Collins ELINT PULSE ANALYZER (PAU)/CS-3001.
Traditional Forms of Intelligence Gathering
Within the sphere of information and intelligence gathering, some techniques have remained unchanged. Simply stated, there was no need to fix what was not broken. Techniques and methodologies of this sort have transcended time, space, culture, and borders as we have described previously largely because of the stagnation in development seen in humanity. The who, what, where, when, how, and whys are all as important today as they were 7000 years ago although the targets and information may have changed as has the reasoning behind the activity in general. Regardless of this, the underlying theme for this type of activity is the need to know, versus the desire to know.
At its core, this is rooted in the ability to manage and control the balance of power within a given contextual model. This is a human issue, which can only be addressed by humans. As a result, field craft, or the tools and methodology of the trade, have been developed to guard against the probing activities of unauthorized parties, or perform these activities without being detected. Failure or success is often predicated on two factors being mastered with respect to this space: deception and subversion. Why are these concepts so important to these activities? For many reasons, however, depending on the context in which one finds oneself, they may mean the difference between life and death. Being able to extract or remove oneself and/or team with the target of interest in hand and without incurring notice is key in all intelligence operations, electronic or otherwise. To be caught in the act is a typically unacceptable option in most cases. Equally, valuable to the success or failure of these activities was the ability to remain silent under the most inhospitable of circumstances as well as in hospitable ones.
Divulging data to anyone other than authorized personnel is an anathema to parties actively engaged in this type of work. As we discussed earlier, we have seen the continued evolution of these two tactics and techniques in addition to the evolution of associated processes. The continued evolution, creation, execution, and implementation of these processes in practice and theory are paramount to intelligence gathering. In modern times, we have seen continued innovation; creation and implementation appear in four primary areas of information and intelligence gathering. The four major methods for information gathering are as follows:
Human Source Intelligence (HUMINT) is a method focused on the identification, compromise, and use of human beings via interpersonal contact for the purpose of gaining valuable intelligence. It is also often utilized for CI. CI refers to efforts made by intelligence, military, and subnational organizations to prevent hostile or enemy intelligence organizations from successfully identifying, gathering, collecting, and analyzing intelligence against them or their allies. It is important to understand that for HUMINT to be most effective, it is necessary to know the target from which the information is to be obtained. This requires either the exploitation of a preexistent relationship or the creation of a relationship for the express purpose of extracting information.
Though it sounds exploitative in nature, it is a vital element tool in information gathering and collecting. HUMINT is extremely effective and at times a dangerous proposition. It requires great care for the well-being of the operative and informant at all times.
This requires that, during the process of trust building, the informant feels safe and reciprocates his or her level of trust with the operative in kind. Although it sounds disagreeable, it is again, within the context of the process of information and intelligence gathering, a well-proven technique with an equally impressive record of success. There are several reasons for its success, however; the basis for the greatest degrees of success seen within this process is the establishment of trust as mentioned previously, between operator and informant.
Equally important to establishing and preserving trust is first being able to identify a target of opportunity from which to begin the building of trust in order to successfully extract information and intelligence. This requires reconnaissance or special surveillance work to be done well in advance, taking into consideration a variety of details about the subject in question and his or her social networks. In many cases, targets or subjects of interest represent and demonstrate an array of characteristics:
1. The willing, friendly, and witting participants
2. The unwilling, unfriendly, and hostile or unwitting participants
Tradition dictates that targets or subjects of opportunity may include human beings working in one or more of the following capacities:
1. Foreign Internal Defense (FID) personnel (e.g., those working with host nation forces or populations in diplomatic or official capacities)
2. Official Advisors or those working in advisory capacities within foreign service or state department roles
3. Diplomats or those holding diplomatic assignments and responsibilities
4. Espionage agents or clandestine operatives
5. Military attachés and/or embassy personnel
6. Nongovernmental organizations or subnational entities
7. Prisoners of war or officially held detainees
9. Routine or specialized military patrols in occupied territory or behind enemy lines
10. Special operations teams operating in occupied territory or behind enemy lines
We next begin reviewing some key cases where HUMINT techniques and tactics have leveraged successfully with catastrophic ends. We focus on four cases of recent historical importance to the people and government of the United States of America. You will notice that in these cases HUMINT was paramount to the successful compromise of these operatives—all of whom betrayed their country and obligations.
Examples of Human Intelligence Gathering
The Case of Julius and Ethel Rosenberg
Perhaps one of the earliest examples of modern HUMINT in the history of the United States in the modern era would be that of Julius and Ethel Rosenberg. The Rosenberg case rocked the nation in its time and continues to reverberate in our world today. Julius Rosenberg was born on May 12, 1918 in New York City as the son of Polish immigrants. He was raised by hard-working parents—Harry, who worked in New York’s garment district and Sophie, who was a homemaker and mother to Julius and his four siblings. At age 16, Julius graduated from the Downtown Talmud Torah School to Seward Park High School; he later enrolled at the City College of New York in order to begin his studies in electrical engineering. Ethel Greenglass was born on September 28, 1915 in New York City as the daughter of Barnet and Tessie Greenglass. Barnet—a sewing machine repair shop proprietor struggled to support his wife, Ethel, and her three siblings. They were impoverished, living in a squalid tenement apartment without heat. Ethel attended the Downtown Talmud Torah School, and then the Seward Park High School where she graduated at age 15. While attending university, young Julius developed and pursued an interest in politics. Soon after, he developed a relationship with a fellow student—eventually leading him to join the Steinmetz Club, which was the campus branch of the Young Communist League. As a member of the League, he would meet other like-minded individuals including Morton Sobell, William Perl, and Joel Barr. He later became a member of the Federation of Architects, Engineers, Chemists, and Technicians (FAECT), a radical union for professionals active at that time.
Eventually, Rosenberg’s political aspirations and devotion had a negative impact on his academic ambitions and although he graduated from university, he did so a semester behind the rest of his class. Ethel, who did not share Julius’ passion for advanced education, became a clerk for a shipping company immediately after graduation. She worked in this role for four years until she was let go because of her role as the organizer of a strike of 150 women workers. Ethel shared a passion for politics not unlike Julius, which later saw her join the Young Communist League, eventually becoming a member of the American Communist Party. Ethel, a gifted singer, enjoyed participating in choir. On New Year’s Day 1939, while waiting to go onstage to sing, she met Julius Rosenberg. During the summer of 1939, the couple married. On graduating, Rosenberg began doing freelance work until the fall of 1940 when the United States Army Signal Corps hired him as a contract employee.
He received promotion in 1942 to the position of inspector. Not long thereafter, Rosenberg and his wife became full-time members of the American Communist Party. Rosenberg himself became the Chairman of Branch 16B of the Part’s Industrial Division. By 1943, something had changed. Rosenberg had dropped out of the party to enter into espionage on a full-time basis, a decision that would ultimate impact both him and his wife and cost them their lives. In 1945, he was fired from his job with the United States Army Signal Corps when his past membership in the Communist Party was discovered. He then took up a position with the Emerson Radio Corporation later forming, in 1946, the G & R Engineering Corporation. On June 17, 1950, Rosenberg was arrested on suspicion of committing espionage against the United States of America after having been named by former business partner David Greenglass (who as a sergeant in the United States Army was assigned to work on the Manhattan Project, which saw him have access to sensitive and classified information, and which would later be relayed to the Soviets). David Greenglass would be key in providing information to the Rosenbergs on the nuclear weapons program. With information in hand provided by David Greenglass (Ethel’s brother), the Rosenbergs went to Harry Gold, a Swiss-born courier for the espionage ring, who then passed it to Anatoly A. Yakovlev, the Soviet Union’s vice-consul in New York City. Rosenberg provided the Soviet Union with sketches of the cross-section of an implosion-type atom bomb (the “Fat Man” bomb dropped on Nagasaki, Japan, as opposed to a bomb with the “gun method” triggering device as used in the “Little Boy” bomb dropped on Hiroshima; Figure 6.10).
Figure 6.9 Julius and Ethel Rosenberg.
Figure 6.10 The diagram of the atomic bomb provided by David Greenglass to the Soviets.
Shortly after the arrest of British spy Klaus Fuchs, who was arrested for providing U.S. and British nuclear secrets to the Soviet Union, Rosenberg was questioned by the Federal Bureau of Investigation (FBI)—and eventually placed under arrest (Figure 6.9). On August 11, 1950, Ethel Rosenberg was also arrested. She had been implicated as being a member of the atomic spy ring along with Julius and others (in fact according to her own brother David, it was Ethel who had been charged with scribing the meetings and notes for the ring). The testimony of her brother aided in sealing her fate. She was found guilty of espionage along with her husband Julius Rosenberg on April 05, 1951 and sentenced to death. Although they both maintained innocence until the end, after a lengthy trial and appeals process, they were executed, on June 19, 1953 in Sing-Sing Prison in New York. However, in the years that followed the executions of the Rosenbergs, there was significant scrutiny and debate over their guilt. This was put to rest, however, when Nikita Khrushchev, leader of the Soviet Union from 1953 to 1964, acknowledged that he had learned of the involvement of the Rosenbergs in the development on the Soviet Union’s nuclear weaponry program from Joseph Stalin and Vyacheslav M. Molotov. Khrushchev went on to say, “…Julius and Ethel Rosenberg had provided very significant help in accelerating the production of our atomic bomb.” He further wrote that “…Let this be a worthy tribute to the memory of those people. Let my words serve as an express of gratitude to those who sacrificed their lives to a great cause of the Soviet state at a time when the United States was using its advantage over our state to blackmail our state and undermine its proletarian cause.” The case of the Rosenbergs set in motion a new era of diligence coinciding with what was being developed by other Department of Defense (DoD), and Intelligence based agencies within the United States and the world over.
It underscored the importance of the type of information that can be gained by careful observation and surveillance of targets of interests via tactics and techniques in addition to mapping out additional parties of interest that make up the social networks and frameworks of the subjects. This information would prove vital going forward in future training and investigations involving HUMINT and CI activities.
The Case of Former FBI Agent Robert Hanssen
Robert Hanssen’s espionage career illustrates how automated information systems are likely to become an operator’s greatest ally for years to come. Robert Hanssen first began his career in espionage by contacting the GRU, the Soviet military intelligence agency. Hanssen had, by this time, demonstrated his fluency in technology, specifically in harvesting data from computer systems and data management platforms. It is important to note that Robert Hanssen never declared any political or ideological reasoning for his participating in espionage against his country (Figures 6.11 and 6.12).
Figure 6.11 Robert Hanssen.
Figure 6.12 Robert Hanssen mug shot on arrest.
For Hanssen, his involvement with espionage had only monetary origins.2 In fact, Hanssen was on more than one occasion noted as saying that he had little use for more than 100,000 USD at any given time—an amount that might strike some as odd but may in fact have proven to be smartly decided on as it was not overly greedy nor was it large enough to necessarily raise suspicion. Today, Hanssen’s accomplishments may not seem impressive; however, in 1979 at the dawn of Hanssen’s career change as a double agent, this was still considered esoteric.3 Robert Hanssen had been assigned to the New York FBI field office where his assignment was to implement a new automated CI database. The system in question was built for the express purpose of tracking the movements and activity of foreign intelligence services operators within the United States and its embassies. As a result of his clearance and his need to know because of his projects profile, Hanssen was able to gain access to other databases, some residing in the NSA, the CIA, and the United States State Department. Hanssen routinely checked the databases located within the FBI’s network environment, specifically those dealing with Electronic Case Filings using variations of his own name.
In 1981, Hanssen was transferred to the Washington, DC office of the FBI. His new role gave him prestige within the Bureau as well as access to various types of information involving a number of different activities in which the Bureau was involved. As he progressed throughout his career, Hanssen became known as the Bureau’s expert on computers and as a result, he gained access to even more data, specifically data related to electronic surveillance and wiretapping—both of which were his responsibility. In 1983, Hanssen was transferred to the Soviet analytical unit within the Bureau. This unit was primarily responsible for studying, identifying, and capturing Soviet spies and intelligence operatives active with the United States of America. Robert Hanssen was in charge of evaluating and monitoring Soviet agents who volunteered to give intelligence to the United States of America, to determine whether or not they were acting as double agents. In 1985, Robert Hanssen took a position with the Bureau’s CI unit based out of New York. In this role, he worked with other agents to study and monitor the movement of Soviets in greater detail. While on a business trip back to Washington, DC, he resumed his career in espionage by becoming a payrolled operative of the KGB. On October 15, 1985 Hanssen sent an anonymous letter to the KGB in which he offered his services for 100,000 USD in cash. To prove his credibility to his new prospective handlers, Hanssen provided them with the names of three Soviet agents working in the United States who were acting as double agents for the United States of America. The following were the agents:
This marked a lucrative and busy period of espionage for Hanssen, which saw him again recalled to Washington, DC to take on a new role within the Bureau. It was during this time that Hanssen was asked to begin investigating the possibility for a mole within the Bureau; a mole that was providing intelligence to the Soviets.
This proved to be a complex and utterly untimely issue for Hanssen as it effectively saw himself looking for himself. It required great care so that he could avoid unmasking himself and his efforts. In 1989, Hanssen provided substantial data on American plans for MASINT. In 1990, Hanssen’s brother-in-law, Mark Wauck, who was also an FBI employee, recommended to the bureau that Hanssen be investigated for espionage. This came as the result of Bonnie Hanssen’s sister Jeanne Beglis finding a pile of cash sitting on the Hanssens’ dresser in 1990 and then telling Wauck. In 1997, IT personnel from the IIS Unit were sent to investigate Hanssen’s FBI desktop computer following a reported failure. Hanssen claimed he simply wanted to connect a color printer to the computer and required the use of a password-breaking program in order to bypass the administrative password. As the FBI believed the story, Hanssen was let off with a warning and the report—though never repealed—was first ridiculed and later ignored by the NSD Security Countermeasures Unit. Hanssen resumed his exhaustive searching of the FBI’s internal computer case record and searched to see if he was under investigation. Finding nothing, he resumed his activities with the Russians working with the SVR. Hanssen, who was extremely guarded with his true identity, never shared it with his Soviet or Russian handlers. Hanssen did so in order to deduce whether or not he was under surveillance and/or investigation for espionage. In fact, with the exception of one failed in-person meeting, Hanssen never met his handlers in person, a decision that proved wise for most of his career as a double agent. Hanssen preferred using aliases and passing intelligence via dead drop systems where both he and his handlers could leave packages in public places using unobtrusive markings to inform the other party that a package was waiting to be collected.
Hanssen was so particular regarding the preservation of his identity that he rejected offers and suggestions made by his handlers for drop sites and instead offered dates specified by himself. Hanssen had collected data for the Soviets and then again after the collapse of the USSR for the Russians as well (Figure 6.13).
Figure 6.13 Drop site used by Robert Hanssen.
He did so by selectively browsing through databases and downloading files onto encrypted disks. He would then take his packages to predefined drop sites using coded messages to communicate with his “handlers.” A “handler” is someone working on behalf of a foreign intelligence service or government whose role is to handle those recruited to work on their behalf. Handlers are often intermediaries who address logistics, pay, and compensation, and other details relevant to ensuring that their source is able to perform and provide data on request. Rough estimates suggest that Hanssen compromised ∼6000 documents of varying degrees of sensitivity. It can be assumed, however, that all of the documents were classified. Among the intelligence that Hanssen relayed to the Soviets, he informed them of how the United States was employing ELINT and RADINT to intercept radar transmissions being sourced by the Soviets. Additionally, Hanssen provided collection schedules for sensors located on classified United States surveillance ships, aircrafts, and satellites. Were this not enough, Hanssen also provided the identities of several Soviet and Russian double agents who had been working with the United States government. Most notable of those directly betrayed by Hanssen was Dmitri Polyakov, code named TOPHAT. Dmitri Polyakov was a CIA informant for more than 20 years prior to his retirement in 1980. He had passed voluminous amounts of information to American intelligence while advancing to the rank of General in the Soviet Army.
For reasons still unknown today—perhaps due to a lack of substantiating evidence—the Soviets did not act on their intelligence about Polyakov until he was betrayed a second time by CIA mole Aldrich Ames in 1985. Polyakov was arrested in 1986 and executed in 1988 by the Soviet authorities and while Ames was officially blamed for giving Polyakov’s name to the Soviets, Hanssen’s role remained unknown until after his arrest in 2001. Among other data points that Robert Hanssen elected to provide were the following:
• Secret tunnels under the Soviet Embassy used to monitor communications
• United States Intelligence Community intelligence reports and assessments on Soviet and Russian capabilities
Prior to his arrest, Hanssen had plans to create a TEMPEST grade environment from which he could communicate openly with his handlers free from the fear of being observed and/or monitored. Additionally, he considered using the wireless 802.11 a and b capabilities of his USRobotics/3Com Palm III PDA to transmit data cleanly and quickly. Hanssen’s career in espionage was long and sophisticated. He was a serious threat and arguably one of the most important spies to have ever originated from within the United States and its intelligence community during and after the Cold War. Robert Hanssen was arrested on February 18, 2001 at Foxstone Park near his home in Vienna, Virginia and was charged with selling American secrets to Russia for more than 1.4 million USD in cash and diamonds over a 22-year period.3 On July 6, 2001, he pleaded guilty to 13 counts of espionage in the United States District Court for the Eastern District of Virginia. He was then sentenced to life in prison without the possibility of parole. His activities have been described as “possibly the worst intelligence disaster in U.S. history.”4
These examples do not represent the entire body of examples relevant to the realm of HUMINT; however, they provide an important insight into what and how compromise is achieved by means of HUMINT. Equally important is the fact that they demonstrate the frailty of humanity and its susceptibility to compromise.
2 Wise, D. 2003, Spy: The Inside Story of How the FBI’s Robert Hanssen Betrayed America. Random House, ISBN 0375758941.
3 Perserec Technical Report 02-5 July 2002. Espionage against the United States by American citizens 1947–2001. By Katherine L. Herbig and Martin F. Wiskoff.
Code Breaking or Cryptanalysis (COMINT/SIGINT)
Codes and their use are, like espionage, well-represented and historically prevalent. Cryptography as an art and science is anything but new. Examine the etymology of the word and you will see quite quickly (and clearly), that it is the science of codes and originated from the Greek words kryptos (secret) and graphos (writing). Historical examples abound from Lysander of the Spartans to Julius Caesar. After the fall of Rome in 472 A.D., it was not until Italian and French cryptographers in the 1500s initiated the resurrection of the art and science of cryptography that it emerged with extremely complex codes and ciphers never previously seen or used. The Science of breaking these codes became known as cryptanalysis. Once begun, it has continued to grow, maturing as a discipline with the advent of new, more complex ciphers and mathematical models.
In modern times, code breaking as well as cryptanalysis is largely dependent on the interception of signals or messages between people (e.g., COMINT or communications intelligence), or between machines and/or networks (e.g., ELINT) or a combination of the two. Regardless of how the data are gathered, the resultant analysis is often as complex as it is thorough. Many cases see analysis being conducted on data deemed “nonsensitive” and “sensitive” with more effort often associated with analyzing “sensitive” data. Analysis of traffic will occur—in real or near real-time packet captures or streamed packet captures—whether the traffic can be decrypted or not.
Aircraft or Satellite Photography (IMINT)
Since the advent of flight, the value of aerial photographs has been realized and recognized as being integral to information and intelligence gathering initiatives of various types. Whether for purposes of espionage, defense, or other state or federally sponsored initiatives, the value demonstrated by aerial photography proved extremely relevant and important historically during times of peace and war. As science and the aerospace industry matured bringing to market advanced satellite technologies, so too did the accuracy and resonance of aerial intelligence acquisition. Today, this is still the case; however, almost anyone has access to basic satellite imagery via technology such as Google Maps and Google World.
Research in Open Publications (OSINT)
Sometimes referred to as Open Source Intelligence because of the use of publicly accessible information outlets and media sources, OSINT involves identifying, selecting, and acquiring information from publicly available sources while being able to analyze that data in order to produce actionable intelligence. It is important to bear in mind that there is no direct correlation to open source software, nor should there be any confusion to that end.
As these tactics evolved, becoming ubiquitous throughout the world via formal and informal organizations, their adoption as standardized forms of observation and information gathering pushed into the realm of the Internet and the cybercriminal arena. Given that in many cases, their use in traditional state sponsored and subnational intelligence operations is well-documented, it is likely that these trends will continue. As we have seen already, the desire to gain information or intelligence regardless of the purpose for doing so has long been a part of human existence and as such, techniques and threats have emerged to see that this information and intelligence gathering capability continues and flourishes.
Web Source Intelligence (WEBINT)
This is the ability to gather open information using the Internet. This can be done in various ways such as using Web crawlers and indexing systems to harvest just about any piece of content that is stored on publically available servers in any language. Additionally, this can also cross over into P2P networks, which are notorious for sharing very sensitive information. The purpose of utilizing WEBINT is performing deep Web collections that allow you to be very specific in what you are intending to gather. Verint is a company that provides WEBINT tools that have strong analytics to correlate unstructured data collections. Analysts who provide the needed intelligence on the specific sources on which they are currently working can use the output of the collection.
In summary, state sponsored intelligence gathering is and will continue as a silent vehicle of information gathering. With the rapid adoption and use of the Internet, it will only make it easier for Foreign Intelligence Services to gather data remotely by utilizing all facets of Web 2.0. Additionally, shifting of the next-generation workforce to a culture of sharing more personal information has shifted the traditional forms of espionage that are typically paid-for services to disclosing sensitive information based on principal.
Summary
In this chapter, we covered some very fundamental aspects of intelligence gathering. Foreign Intelligence Services are able to leverage economies of scale in order to gather information across many vectors that are not accessible to the general public. This provides them with very sensitive information that is worth a lot of money in the wrong the hands. As we articulated the various use cases around espionage, they just illustrate that certain people are willing to take life-changing risks in order to supply the enemy with information. Although these use cases are dealing with espionage, these same use cases can and often mirror the insider threat and corporate espionage we see in the private sector. In the private sector, employees are not vetted on the level of those serving various government agencies. The controls placed on data in the government are on a more need-to-know basis and typically most of their networks are not connected to the Internet, thereby making data exfiltration all that much harder, but it does happen. The key walk-away here is that a lot can be learned from these use cases as the world becomes more connected and your data sets become more disparate.