Updated NTAS Bulletin – 1-18-20

Yesterday afternoon the DHS Cybersecurity and Infrastructure Security Agency (CISA) published a new Bulletin on their National Terrorism Advisory System (NTAS). The new Bulletin replaces the one issued on January 4^th, which expired yesterday at 1:00 pm. While the new Bulletin continues to focus on a potential threat from Iran and its proxies, CISA is apparently expecting a narrowing the focus of that threat.

Change in Focus

The Bulletin continues to focus on two major potential threats, cyber attacks and direct action by Iranian proxies. In the earlier bulletin CISA made the following comment about the potential for cyberattacks:

“Iran maintains a robust cyber program and can execute cyber attacks (sic) against the United States. Iran is capable, at a minimum, of carrying out attacks with temporary disruptive effects against critical infrastructure in the United States.”

The new advisory changes that wording to a more focused:

“Iran maintains a robust cyber program and is capable, at a minimum, of carrying out attacks with temporary disruptive effects against critical infrastructure in the United States. Based on Iran’s historic homeland and global targeting patterns, the financial services and energy sectors, maritime assets, as well as U.S. Government and symbolic targets represent consistent priorities for Tehran’s malicious operational planning.”

While the chemical sector is not included in the listed potential target list, some chemical facilities could certainly be included in the ‘energy sector’.

Both versions address the potential for direct terrorist attacks in the United States. In the earlier version CISA stated:

“Homegrown Violent Extremists could capitalize on the heightened tensions to launch individual attacks.”

The latest version narrows both the possible agents and targets of terrorist attacks in the US:

“Homegrown Violent Extremists (HVE) sympathetic to Iran could capitalize on the heightened tensions to launch individual attacks, with little or no warning, against U.S.-based Iranian dissidents, Jewish, Israeli, and Saudi individuals as well as against the U.S. Government infrastructure and personnel.”

While not all terrorist attacks employ improvised explosive devices (IED), the potential for such attacks certainly exists. HVE’s will probably not have access to weapons supplied by Iran so they will probably be forced to locally source materials for IEDs. While many IEDs use commercially available chemicals, employing larger devices will necessitate obtaining precursor chemicals from chemical facilities. Facilities maintaining inventories of such chemicals of interest (COI) will need to maintain increased vigilance.

Commentary

One other change in the versions of the Bulletin is just a little bit odd. The earlier version included the comment; “An attack in the homeland may come with little or no warning.” There is no similar phrase in the latest version. This could indicate that CISA feels that the law enforcement community and the intelligence community have a better handle on the identity of potential HVE’s. I do not really expect that that is true. Rather I think that this is a measure of how serious CISA takes the potential threat.

As more time passes between the assassination of General Qassem Soleimani, it would seem that the threat of additional retaliation measures by Iran and its proxies should decrease. The confounding issue is the increasing dissention in Iran. I believe that there is an increasing possibility of Iran’s proxies increasing pressure on the US to cause responses (including sanctions) that would allow the current Iranian regime to point to the US as a common enemy to promote unity within Iran.