TERROGENCE E x p e r t W e b I n t e l l i g e n c e f o r C o u n t e r - Te r r o r i s m PRODUCTS & CAPABILITIES w w w. t e r r o g e n c e . c o m 2 Open Source Web Intelligence for Counter-Terrorism Founded in 2004, Terrogence is a private open source web intelligence company dedicated to exposing terrorist capabilities and intent. Staffed with experienced intelligence professionals, the company has pioneered powerful, web-specific methodologies and tools for collection, analysis and research, enabling us to provide counter-terrorism intelligence of the highest caliber to governments and organizations worldwide. Based on these proven methodologies, the company employs a cutting-edge web intelligence system called HIWIRE™, to drive the entire OSINT production lifecycle end-to-end. ¡¡ Ten years at the forefront of OSINT ¡¡ Highly trained linguists: Arabic, Persian, Russian, French, Spanish, Chinese, Turkish etc. ¡¡ Intelligence products by renowned SMEs ¡¡ Unparalleled in-house C-IED and HME expertise ¡¡ Flexible collection for tailored time-sensitive intelligence ¡¡ Expert Virtual HUMINT™ operations and deep web and Darknet research Our unique intelligence capabilities, coupled with the commercial nature of our company, enable us to accommodate the intelligence and security needs of organizations worldwide. 3 Table of Contents Intelligence Reports ..............................................................................................................................................................4 AL- KHEMIA™ Forensic Chemical Analysis of Authentic Terrorist HME Recipes ...........................................................6 MÖBIUS™ Deep C-IED Intelligence & Terrorist TTPs Exposed ...................................................................................9 TGALERTS™ Near Real-Time Tactical Alerts with Contextual Analysis ....................................................................12 HYDRA™ Tracking Terrorist Trends & Strategic Developments in the World of Jihad ................................................15 Tailored Services ................................................................................................................................................................18 Customized Intelligence Reports .........................................................................................................................19 Corporate Intelligence ...........................................................................................................................................19 Training & Workshops.............................................................................................................................................20 w w w. t e r r o g e n c e . c o m 5 3 Covering Terrorism from all Angles Islands, with participants from Egypt, Somalia, Algeria and Denmark assessing his methods and plans and offering “lessons-learned” tips from previous failed attacks. This scenario has played itself out in every major terrorist attack or attempt over the past few years. a™ IE ™ ius he mi Es Ds ler TGA TT P HM -K w w w. t e r r o g e n c e . c o m Al Today’s web-based terror backbone is inherently without geographic boundaries. An untrained terrorist in Spain can download an explosives manufacturing tutorial video posted by a Hezbollah IED expert from Lebanon, and learn how best to conceal it onboard an aircraft by participating in a jihadist forum registered to a server in the Canary Hy a™ KS OR W tS™ NE T dr Terrogence intelligence reports combat the inherent nature of modern-day terrorism by exposing every facet of online terror activities; from the websites and forums they operate in, to the emerging developments in TTP’s and weapons technologies being disseminated e and deployed in conflict zones vic r Se and home-fronts around the world. s Mö b Terrogence understands that global terrorism is exactly that: global. Terror capabilities and know-how are no longer limited to specific geographies once they reach the web. Terrogence’s expert reports provide tactical, technical and strategic insight into terrorist activities worldwide. 6 AL-KHEMIA™ Forensic Chemical Analysis of Authentic Terrorist HME Recipes Al-Khemia™ reports expose and analyze authentic terrorist home-made explosives (HMEs) as they emerge on terrorist forums and knowledge bases. The Al-Khemia™ Recipe Bank is an unparalleled repository of forensic HME analysis, aimed at rooting out the IED threat at its HME source. w w w. t e r r o g e n c e . c o m 7 Overview The rapid dissemination of explosives recipes and manufacture know-how via the web means that as soon as a home-made explosive recipe is perfected and disseminated in one part of the world, the threat becomes real in conflict zones and combat theaters everywhere. In each Al-Khemia™ report, a real-life HME recipe, harvested from within online forums and websites used by global terrorists and local insurgents, is meticulously synthesized step-by-step in a controlled laboratory setting and analyzed in perfect detail by forensic chemists and explosives experts. Authentic terrorist HME’s analyzed include: ¡¡ ¡¡ ¡¡ ¡¡ ¡¡ ¡¡ Nitroglycerin ¡¡ Mercury Fulminate Gelatin Dynamite ¡¡ DDNP HDN ¡¡ C4 Astrolite ¡¡ More… Sorbitol Hexanitrate Methyl Ethyl Ketone Peroxide (MEKP) 8 Inside Al-KhemiaTM A typical Al-Khemia TM report comprises two parts: Authentic Terrorist HME Recipe in Full translation Al-Khemia™ reports provide full translation of the original terrorist HME recipe (video, image, document attachment, textual explanation etc.), including all stages and instructions, with preliminary notes on how the HME recipe measures up against scientific synthesis of the same explosive, and what it might be used for. Laboratory Synthesis Reconstruction Terrogence forensic chemical experts deliver the results of a meticulous step-by-step laboratory re-synthesis of the material, along with an exhaustive assessment of its physical and chemical properties in the context of counter-terrorism efforts. w w w. t e r r o g e n c e . c o m “…Our synthesis reconstruction yielded a highly pure compound that will definitely detonate…” 9 MÖBIUS™ Deep C-IED Intelligence & Terrorist TTPs Exposed Möbius™ exposes current and developing IED capabilities and operational TTPs of terrorists and insurgents worldwide, featuring rigorous technical analysis and expert assessment of real-world terrorist MOs as they develop deep within online terrorist networks. w w w. t e r r o g e n c e . c o m 10 Overview As the internet morphs into one vast social network, terrorists work keenly to harness global online collaboration and social networking platforms to share knowledge and improve technological and operational capabilities. Yesterday’s jihadi bomb tutorial from Lebanon becomes today’s bomb in a radical Londoner’s basement, and tomorrow’s disaster in Mumbai. Researched and written by expert WTI and C-IED specialists, Möbius™ reports apprise subscribers of the latest trends in terrorist IEDs and TTPs, as they emerge in online sources including password protected social media platforms where global terrorists seek to recruit, radicalize and plot their next attack. ` 11 Inside Möbius™ The typical Möbius™ digest includes eight individual reports per month, each assigned to one of two categories: Knowledge Base The latest IED developments, instructional materials and technical discussions extracted from terrorist web forums and social networks worldwide. Case Studies Techno-tactical assessments of the most recent IED applications by terrorists globally, often based on videos taken by insurgents on the ground. Each individual CLI is further marked off against six salient categories of tactical intelligence. ¡¡ IED construction ¡¡ Concealment/camouflage ¡¡ Initiation systems ¡¡ Countermeasure awareness ¡¡ Modus operandi ¡¡ Standard weapon utilization w w w. t e r r o g e n c e . c o m “…The last parcel IED was different to the others…a fire bomb without fragmentation…” 12 TGALERTS™ Near Real-Time Tactical Alerts with Contextual Analysis Upon uncovering new and emerging terrorist activities of imminent interest on the web, Terrogence circulates a techno-tactical intelligence alert containing preliminary WTI analysis alongside tactical and contextual relevancy. w w w. t e r r o g e n c e . c o m 13 Overview During the course of our strategic web-intelligence operations, Terrogence collection professionals often encounter outright threats or terror-capability developments of imminent interest. These items immediately enter a techno-tactical analysis fast track to be disseminated in near realtime via the TGAlert Service (TGAlertS™). In order to avoid inundating subscribers with the low threshold of “just news”, TGAlertS™ digs a level deeper, providing context and interpretation. Though strictly dictated by events, TGAlertS™ subscribers receive one alert per week. As the events that inspire near real-time TGAlertS™ develop further, some alerts grow into full-blown intelligence reports worthy of inclusion in our Möbius™ product. 14 Inside the TG Alert™ Service (TGAlertS™) A typical TGAlertS™ is structured as follows: e Alert Terrogence Alert Waist-Belted y Abu Oma r al-Shish wais Incident Summar www .terr ogen Waist on right arm, CQC Wristwatch worn ce. com m of 5 Tagged: from a militant in Fanny pack PBIED recovered Ismailiyyah, Egypt  Page 4 of 5 ani (left t-be(AQ) ) and triba ding al-Qaeda lted PBIEDs (red arro l sheikhs ssed an expan in al-Raqq ws) and we have witne wristwa Ds), now not only tches (yell ah (right) wearing and into 2014 right arm ow arro s n-borne IEDs (PBIE Throughout 2013 ws) on thei Abu Wah attested to -strapped perso ib r style PBIE with bandolieres, previously ment" of waist D (red arro "fashion state onal-use" devic "pers ently wristwa frequ These w) and tch (yell are now e bombers. on his righ ow arrow) ased militants,  sported by suicid g sus-b ankin Cauca Genera t arm ing high-r ional garb of l No operatives, includ as the tradit AQ in te of ced s s waist tly surfa recen around the The Syr act belts have documented comp ian These -Iraqi are Iraq and Syria. na has strapped commanders in demons PBIED fas trated hion am belts as: an evolut Egypt. ong ISIS ion in commande the per rs, who sonal wa are now ist A stasus now Key points seen spo tus sym the Cauca in seen rting the bol previously -strapped PBIED waist  nal Inspiratio Perso n for oth Iraq and Egypt Syria, ers in ance ring by indica appea and "insur symbol A ting the deterrent both a status as ir s wil ander lingness "insuranc truck SVBIED by ISIS comm toAustralian e policy" sacrificesuicide bomber standing on his PBIED sported This tre their live PBIED, Deir ez-Zor, Syria in case of nd also wearing a waist-belted s capture or re ear app captu policy" s to be to risk pact of ed com waist-bel popular operatives expos wh among ted PBIED yed by field en corner those fiel who ma TTP also emplo ed and d operat y choose combat (CQC) ers thu ive eve quart s to s tak close n wearing initiate exhibitplan e out the engaging in the dev ed the the ir advers a contingency ice as a use of aries wit such PBIEDs as presumabl last resort thin-layer y for the h them. documented using ed PBIED Iraqi mil same pur SVBIED drivers PBIED Con itants hav s concea pose (cf. cealed insi led in e Terrogenc de Belt 13244). compac e Alert™ - Growin In genera t belts, TGA0285 g Trend l, these killings among Low-Sig devices than ma Iraqi Mil nature are more ss-casualty itants HIW effective terror att IRE™ II.ID in close It is worth acks. proximity noting tha targeted t some SVB these PB IEDs (cf. IED driver Möbius™ TGA0295 s in Syria in Deir No.: report Aus were als ez-Zor, Syria HIW o docum tralian Sui 14008 intende ented we IRE™ II.ID cide-Bom HIWIRE™ II.ID: d to be aring ber Initiate 13353). used as 14 February 2014 SVBIED This sug s Truck a conting Publication Date: initiation ges SVB ency pla ts that IED malfunctio 2013-2014 n for tar the PBIED Web: n. A sim geting ene Appeared on the s were ilar TTP my forces Isaac (Tzachi) Ganor of an SVB Author: in case IED driv networks of ce. com ww w. te Syria, Iraq, Egypt, AQ, ISIS, rrogen Jihadist social er wit www.te Source: h a PBIED rro sus, Cauca ge , nc e. co was -belted PBIED ted PBIEDs "Fashion Statement”: Waist-Bel TGA0295  Al-Qaeda n Statement”: Terrogence Alert Service™ 7, al-Maqdis in the October the Sinai-based Ansar Bayt also evidenced in Egypt by Directorate (cf. Möbius™ the South Sinai Security 2013 SVBIED Attack against Attack HIWIRE™ II.ID Directorate Targeted in SVBIED report South Sinai Security PBIED in Egypt, as appearance of this compact the of evidence is 13763). There a militant wearing a PBIED 9, 2013, in Ismailiyyah, where documented on February . during a raid on an IED workshop in a fanny-pack was killed Service™ Al-Qaeda "Fashio PBIEDs Service™ ent”: Wa ist-Belted PBIEDs  Pag e3 w w w. t e r r o g e n c e . c o m Terrogenc TGA029 5  AlQaeda "Fa shion Sta tem TGAlertS™ Key Benefits: ¡¡ Near real-time delivery upon detection ¡¡ Brief analysis of context and background ¡¡ Assessment of tactical relevancy to PETN, ETN is well suited to terrorist activity…” Page 1 of 5 d PBIEDs  ment”: Waist-Belte Tactical Assessment & Notes WTI SMEs at Terrogence elaborate on the harvested material, adding expert notes that paint a fuller intelligence picture of the terror activity detected. A brief assessment follows, shedding light on the tactical relevancy of the Intel. sweetener and its relative ease of production compared ion State Al-Qaeda "Fash TGA0295  Comm. Info & Summary of Intel Brief overview of the intelligence source (platfrom type, affiliation, areas of interest etc.) followed by a summary of the intelligence (e.g. Jihadists on a password-protected forum discuss in detail the synthesis of a unique explosive for the express purpose of downing passenger aircraft). “Due to the availability of erythritol as a natural 15 HYDRA™ Tracking Terrorist Trends & Strategic Developments in the World of Jihad At the very forefront of the online war against global jihad, Hydra™ explores the nature, scope and dynamics of extremists’ use of the Internet, focusing on hardcore jihadist forums and terror activities on social media platforms.   w w w. t e r r o g e n c e . c o m 16 Overview Hydra™-Terrogence’s most wide-ranging web intelligence report, monitors terrorist trends and developments as they come to light on the web, where terrorists seek to radicalize, recruit, or plot attacks against religious, cultural and political targets. The report evaluates extremist Islamic propaganda, recruitment and radicalization efforts, deep trends within the evolving world of jihad, while providing strategic WEBINT insights to hard-core global jihadists. Hydra™ paints a rich picture of extremists’ use of the Internet, with particular focus on hardcore jihadi peer-to-peer platforms. Each month, the report examines the latest publications, potential targets and underlying motivations of Internet terrorist activists around the world. 17 Inside Hydra™ A typical Hydra™ report comprises two parts: Highlights of the Jihadi Web Diverse assessments of important technical and non-technical developments within active jihadi networks, e.g. tactics and operational issues, politics & ideology, propaganda, and web communications infrastructure. In Focus A robust dive into trends of special interest in the jihadi world, including tectonic shifts in jihadist politics, deep trends in jihadist tactics and overlooked aspects of jihadist organizations. w w w. t e r r o g e n c e . c o m “..al-qaeda and al-shabab have come to appreciate the potential benefits of humanitarian aid as a tool for winning public support…” 18 TAILORED SERVICES Tailored Intelligence Reports Training & Workshops Corporate Intelligence Terrogence offers a diverse range of intelligence services specializing in all facets of Open Source Web Intelligence (WEBINT). Our service lines are managed by seasoned intelligence and counter-terror experts, delivering the highest quality results to our customers. w w w. t e r r o g e n c e . c o m 19 Tailored Intelligence Reports Corporate Intelligence Terrogence has two virtues that place it above all others: ¡¡ The highest caliber intelligence professionals, linguists and SMEs Information and timing are everything in business. The Internet represents the greatest collection of information in the history of mankind, and companies that are quick to leverage this mass of information secure a competitive edge on the corporate battlefield. The advanced technology and methods that lend superiority to Terrogence web intelligence operations against terrorists are equally powerful – and timely – in the realm of corporate OSINT. ¡¡ A powerful Web Intelligence system designed to maximize the impact that those professionals, linguists & SMEs have on every Terrogence product. This set-up is highly flexible and very powerful when focused on filling specific customer intelligence gaps. Collection efforts can be trained on a specific geography (e.g. Iraq, Afghanistan, Pakistan, Chechnya, West/East Africa), or on a particular subject (e.g. IEDs, VBIEDs, aviation/maritime threats, cyber-terror, homegrown terror etc.). Terrogence can also hone in on individuals, organizations, corporations, specific activities and more. We often navigate multiple verticals on a single project. ¡¡ Provide detailed reports of the political/corporate terrain in veiled territories. ¡¡ Expose hidden agendas, undisclosed assets. ¡¡ Shed light on existing partnerships or potential partnership deals. ¡¡ Reveal public perception of your business. ¡¡ Expose organizations and individuals that harbor ill-will toward your business. 20 Training & Workshops Terrogence offers a selection of workshops & training sessions to first responders, military, intelligence and counter-terror professionals covering WEBINT practices, methodologies and terrorism subject-matter in varying levels of depth and scope. The trainers for our Web Intelligence workshops and training sessions come from rich intelligence and operational backgrounds in SIGINT, HUMINT, OSINT and HLS strategy. Introduction to WEBINT (2 days) This course introduces the world of open-source, web-based intelligence, covering the structure of information on the web, WEBINT search practices and terrorist utilization of the web. Virtual HUMINT & Web Intelligence Collection (5 days) Designed for law enforcement and security professionals, this course communicates advanced methods and tools for gathering actionable Web Intelligence from active terrorist sources on the web. Open Source Web Intelligence Operator (3 weeks) A comprehensive training course designed to train an Open Source Web Intelligence operator to fully conduct WEBINT collection, processing and analysis operations. The course includes theoretical training and real-life collection exercises. w w w. t e r r o g e n c e . c o m