MS Risk Blog

Southeast Asia Vessel Hijackings are Increasing and Becoming Deadlier

The killing of a crewmember on board a Vietnamese tanker by pirates earlier this week has marked a deadly escalation in hijackings in waters in Southeast Asia. The attack further highlights the growing threat of piracy in Southeast Asian waters and the fact that the region has developed into the new global hotspot for piracy.

On Sunday, crewmember Tran Duc Dat, 34, was shot in the forehead after pirates boarded the VP Asphalt 2, owned by VP Petrochemical Transport Co in Haiphong. According to the Vietnam Maritime Search and Rescue Coordination Centre, the vessel, which had just left Singapore, was en route to Vietnam. It was attacked at 4:30 AM local time, 60 nautical miles from Singapore waters near Aur island off southern Johor state. The attack occurred in the vicinity where the Vietnamese ship Sunrise 689 was attacked in October. According to sources, the sixteen crewmembers on board the VP Asphalt 2 were tied up as the pirates searched the ship. The hijackers fled with only personal belongings of the crewmembers. The vessel was carrying 2,300 metric tones of liquid asphalt and it is believed that the ship was likely targeted by the pirates in the belief that it was carrying oil products. The tanker has since returned to Singapore and an investigation into the incident is currently underway.

While Sunday’s killing of a crewmember is the first such incident to occur in Malaysian waters in almost two years, the International Maritime Bureau (IMB) has on previous occasions warned about the growing threat of piracy in Southeast Asia, with officials reporting in October that the area accounted for a majority of piracy incidents reported globally. Ship hijackings in waters in Southeast Asia have been on the rise in recent months; with the IMB reporting at least twelve such attacks this year. According to Noel Choong, head of the IMB’s piracy reporting centre in Kuala Lumpur, “it appears groups or syndicates are targeting gas-oil,” adding “they are making a lot of money off of it. They are getting away with it. As long as there is no deterrent, they will continue to hijack ships.”

According to the IMB, in the first three quarters of 2014, there were 103 pirate attacks in Southeast Asia, out of 178 that occurred globally. The IMB has warned that “gangs of thieves armed with knives and guns” are increasingly attacking small tankers carrying either oil or diesel and hijacking them to steal the cargo. According to Mr Choong, pirates can earn US $2 million or more for each hijacked tanker that is carrying oil products.

US, Canada, British Embassies issue warnings in Egypt, UAE, Bahrain

9 December- The US State Department warned U.S. Embassy staff in Cairo to remain close to their homes. A memo released by the Bureau of Diplomatic Security reads, “In light of the heightened tensions and recent attacks on Westerners in the region, the U.S. Embassy has recommended that its staff carefully scrutinize their personal movements and consider staying close to their residences and neighborhoods over the coming period.” It is believed that ISIS and affiliated groups may have increased their targeting of Western nationals in recent weeks. Last week, ISIS-linked Egyptian militant group Ansar Beit al Maqdis took responsibility for the killing of Texan oil worked William Henderson, who was reported missing and killed in August. The embassy has remained open.

Meanwhile, the British embassy in Cairo suspended services beginning Sunday. The embassy declined to give details or indicate when it would reopen. The British Consulate-General in Alexandria is operating as normal. A spokesperson for the British embassy stated, “The decision to suspend public services at the embassy has been taken for security reasons and is in the best interests of our staff. The decision is independent of our wider travel advice for Egypt.” An anonymous source indicated that a suspected militant who was recently detained by Egyptian authorities had confessed to plans to target foreign embassies.

On Monday, Canada also closed its embassy in Cairo due to “security concerns.” No other details have been given to explain the closure, but it is thought to be linked to a video released by ISIS on Sunday. The video depicts a man identified as Canadian militant John Maguire (a.k.a. Abu Anwar al-Canadi) urging attacks against his home country. The video refers to the killing of Canadian soldiers and an attack on parliament in Ottawa, and shows Maguire urging Muslims to follow the example of the recent attacks.

Public Safety Minister Steven Blaney cautioned Canadians in Egypt to remain vigilant. A message on Canada’s Cairo Embassy website states: “The ability to provide consular services may occasionally be limited for short periods due to unsettled security conditions.”

In addition, the US and British diplomatic mission to the United Arab Emirates has warned citizens to be vigilant of further terror attacks targeting Westerners after a school teacher was stabbed to death in a shopping mall and a bomb left outside the home of an American family. The US embassy said it was “engaged at the senior-most levels of the UAE government to ensure the safety and security of US citizens in the UAE,” but urged US citizens to vary their routines and schedules.

Romanian-born Ibolya Ryan, 47, who had become an American citizen and trained as a teacher in the US, died on Thursday after she was attacked by a veiled woman with a butcher’s knife in a public toilet at the Boutik Mall in Abu Dhabi, the UAE’s capital.

A woman has been arrested in connection with the brutal murder of Ibolya Ryan, a Romanian-born naturalised American teacher. The woman is also believed to have left a bomb in front of the home of an Egyptian-American doctor. The bomb was defused before it could detonate. It is believed that the woman may have been working with others to target Westerners.

In response to the recent attacks, Aliya Mawani, counsellor at the Canadian Embassy in Riyadh, said that Canada’s Travel advisory for Bahrain is advising Canadians to exercise a high degree of caution: ‘We encourage all Canadians to monitor updates on the Travel Advisory for Bahrain on a regular basis.”

Gunmen Target Jail in Central Nigeria

According to police officials, gunmen in Nigeria have freed more than 200 prisoners in the latest jailbreak to occur in the restive West African country.

Sources have reported that the gunmen late Saturday stormed the facility, which is located in the central Nigerian city of Minna, in Niger state near the capital Abuja. In recent years, Boko Haram, and its offshoot Ansaru, have been behind several prison raids. A police spokesman for Niger state confirmed the breakout, adding that the incident was still being investigated and that “its unclear if this is Boko Haram or some criminal gangs.” One security source did report that he doubted that “…there were many high profile Boko Haram suspects being held in Minna.” Deputy Superintendent Ibrahim Gambari has reported that police recaptured at least ten escapees from the medium security prison. Local residents reported hearing gunshots however they noted that no explosions were heard in the attack. One resident reported seeing the guards of the prison fleeing shortly after the first assault.

Saturday’s prison attack is the third to occur in the past three months in the West African nation. While jailbreaks are frequent, with police only capturing a fraction of those who escape, over the past several months, suspected Boko Haram militants have increasingly been targeting prisons across Nigeria in a bid to free jailed militants. On 1 December, more than 300 inmates broke out of a prison bombed by gunmen in southwest Ekiti state while on 3 November, 144 escaped from south-central Kogi state after gunmen bombed a prison wall. Two earlier jailbreaks were blamed on Boko Haram however it currently is unknown how many hundreds of Boko Haram suspects are being held in Nigerian jails. If Boko Haram is behind this latest string of prison attacks, it could be an attempt by the militant group to increase its numbers ahead of major attacks that are likely to be carried out over the upcoming holiday season. Over the past several weeks, Boko Haram has intensified its tempo of attacks, carrying out deadly bombings and suicide attacks across northeastern Nigeria on an almost daily basis, with the Nigerian military carrying out minimal efforts in order to prevent attacks from occurring.

The vast majority of people being held in Nigerian jails have either never been charged or are awaiting trial. Despite it being illegal to hold someone for more than 48 hours without bringing charges or presenting them to a magistrate, some prisoners have been held for many years. According to statistics released on 30 June by Nigeria’s Prisons Service, only 18,042 of 56,785 inmates have been convicted of a crime.

3 December – Ebola Situation Report

According to the World Health Organization’s newly released data, as of 3 December there have been 12,145 reported cases of Ebola virus disease (EVD), with 6,070 reported deaths. The WHO has also reported the UN Mission for Ebola Emergency Response (UNMEER) targets of isolating and threating 70 percent of EVD cases and burying 70 percent of EVD-related deaths safely have likely been met in most of the districts in Guinea, Liberia and Sierra Leone. In the three most affected countries, the case fatality rate is at 72% while in hospitalized patients, the case fatality rate stands at 60%.

Guinea

Case incidence in Guinea has slightly increased. In the week leading up to 30 November, there were seventy-seven confirmed cases reported in Guinea, compared with the 148 cases that were reported in the week before.

Since early October, the national transmission trend in Guinea has been slightly increasing, with between 75 and 148 confirmed cases reported in each of the past six weeks. Over the past three weeks, the eastern districts of N’Zerekore, Macenta and Kankan each saw a large number of new cases. In the week to 30 November, N’Zerekore reported 6 new confirmed cases, in comparison to 29 that were reported in the previous week. Macenta saw 15 new confirmed cases and 26 in the previous week; while Kankan saw 7 new confirmed cases, the same number as in the previous week. Officials have indicated that the persistent transmission in Kankan, and in the surrounding areas of Kerouane, Kouroussa and Kissidougou, is of particular concern as local populations infected with Ebola are likely to seek treatment either in the northern region of the country or in neighbouring Mali rather than at the existing facilities, which are located in the nearby south-eastern districts of Gueckedou and Macenta. The first imported Ebola case in Mali travelled from a city in the northern district of Siguiri, which borders Mali, and where there has been persistent transmission since early November. Two new cases were reported in Siguiri this week and between 1 and 3 cases have been reported over the past 7 weeks. According to the WHO, “the lack of established EVD treatment and isolation facilities in this northern, Sahelian zone of the country, combined with a higher than usual degree of resistance among communities to safe burial practices, make this area vulnerable to an increase in cases.”

In the central region of the country, the district of Faranah, which borders the northern Sierra Leonean district of Koinadugu, reported an average of 8 cases per week for each of the past 4 weeks. In the western region of the country, the capital, Conakry, reported 14 new confirmed cases in the week leading up to 30 November. Both Conakry and the neighbouring district of Coyah have reported an increase in the number of new cases during each of the past 2 weeks. In the week to 30 November, Coyah reported 15 new confirmed cases.

Liberia

Over the past five weeks, case incidence in Liberia has stabilized in some regions and is on the decline in others. In the five days leading up to 28 November, Liberia reported 43 new confirmed cases.

The district of Montserrado, which includes the capital Monrovia, reported 34 confirmed cases and accounted for 79% of all confirmed cases reported nationally in the week leading up to 28 November. Bomi (2 confirmed cases); Grand Bassa (4 confirmed cases); Grand Cape Mount (2 confirmed cases); and Margibi (1 confirmed case) are the only other districts to have reported a case/cases during this period.

In the northern region of the country, the district of Lofa, which is located on the border with Guinea and Sierra Leone, reported no cases for a fifth consecutive week.

Sierra Leone

Case incidence may still be increasing in Sierra Leone. In the week leading up to 30 November, officials in Sierra Leone reported 537 new confirmed cases. This is more cases than Guinea and Liberia combined.

The capital Freetown remains the worst affected area, reporting 202 new confirmed cases. Transmission also remains persistent and intense across the country with the exception of the south. The districts of Bo (23 cases); Bombali (66 cases); Kambia (14 cases); Kono (15 cases); Koinadugu (6 cases); Moyamba (3 cases); Port Loko (94 cases); Tonkolili (40 cases); and Western Rural Area (72 cases) continued to report high numbers of new confirmed cases.

In the southern districts of Kenema and Kailahun, both districts reported 0 and 1 case respectively. Since 1 November, Kenema has reported only one case. Bonthe has not reported a case in the past two weeks.

Spain

On 2 December 2014, the WHO declared Spain Ebola free after no new cases were reported since a nurse’s assistant who contracted the virus there tested negative for the deadly disease. Since then, 42 days have passed – effectively double the maximum known incubation period for the virus – without any further confirmed cases.

Syrian, Egyptian Electronic Armies take Aim at ISIS

The Syrian Electronic Army has returned, and a copycat army of hackers has sprung up in Egypt.

The Syrian Electronic Army (SEA) is a group of hacktivists that support the Syrian government and its president, Bashar al Assad. On 27 November, the group targeted Gigya, a company which manages online comment platforms and Identity and Access Management for nearly 700 clients. The SEA breached Gigya’s account and redirected visitors to an SEA website.

The hack impacted 21 major websites including media outlets Aljazeera, the Chicago Tribune, CNBC, CNN Money, the Evening Standard, the Los Angeles Times, Microsoft, National Geographic, NBC, the New York Daily News, the Guardian, and the Independent. The breach also impacted tech companies including Dell, DirecTV, Logitech, Microsoft, and Verizon Wireless. For three and a half hours, visitors to the hacked sites received a message stating, “You’ve been hacked by the Syrian Electronic Army (SEA),” and were then redirected to an image of the SEA’s logo and a Syrian flag.

In response to the attack, Gigya CEO Patrick Salyer said, “To be absolutely clear: neither Gigya’s platform itself, nor any user, administrator nor operational data has been compromised and was never at risk of being compromised.”

On the SEA’s website, the pro-Assad hacktivists said the attack was launched in response to reports that Syrian airstrikes in Raqqa hit civilians, “while the truth the strikes hit the ISIS terrorists.” Raqqa, a city in northern Syria, is the headquarters for terrorist group Islamic State in Iraq and the Sham. On Twitter, the group messaged, “Happy thanks giving, hope you didn’t miss us. The press: Please don’t pretend #ISIS are civilians.”

In a second Tweet, the SEA provided users with information on how to prevent hacking:  “We’re the good guys so this was harmless but just in case the bad guys copy us, use NoScript with Firefox: noscript.net.”

Since their emergence on the hactivist scene in 2011, the SEA has caused disruption to numerous websites, but they are best known for hacking Twitter account of the Associated Press’ in April 2013. The group posted a tweet claiming that Barack Obama had been injured, causing Dow Jones Industrial Average to immediately plunge 143 points in response.

Meanwhile in Egypt, a copycat group has risen and is targeting ISIS and its online propaganda. In late November, less than 24 hours after ISIS social media accounts posted a threatening message from the group’s leader, Abu Bakr al Baghdadi, the Egyptian Electronic Army (EEA) replaced the audio recording with a song, and replaced the ISIS transcript with a logo resembling that of the Egyptian military, accompanied by a writing in Arabic that read “Egyptian Cyber Army.”

The modus-operandi was nearly identical to the methods used by the Syrian Electronic Army, which has inspired the group. However the hacktivists do not have any connection to one another.  According to a spokesman for the group, a man claiming to be a 37-year-old former Cairo police officer who goes by the name “Khaled Abubakr”, the EEA group’s members are all Egyptian. Many come from a military or police background, and all support the Egyptian government led by President Abdel Fattah el-Sisi. It is unclear whether the group is state sanctioned.

The EEA seeks to defend al-Sisi’s governments against opponent such as the Muslim Brotherhood or ISIS. The broad anti-ISIS perspective in the nation has brought a mass of hacktivists to the group who want to counter the terrorist group’s influence on the Internet. The spokesman said that Baghdadi “was delivering a message to all extremists all over the Middle East and my country that you have to use your weapons in the faces of the government and our people, so we took it down and replaced it with a very popular song. All the people instead of hearing this pig heard our song and laughed.”

The group has also claimed to have infiltrated top ISIS web forums, and American pro-democracy websites including the Open Society Foundation and the U.S.-Middle East Partnership Initiative, however there is no solid evidence of these activities. A security researcher says that some of the EAA’s supporters appear to have highly capable technical background.

The EAA has refused to disclose how the attack was conducted. A spokesman for the Internet Archive said that no outside account “made any modifications” to the files other than the original uploader. But that doesn’t rule out the possibility that the account was taken over by the hackers. The group claims they will continue to conduct hacktivist activities. The EAA spokesman said, “We have our people spying on al-Furqan, [the media arm of ISIS] which is the media of the terrorists and this will not be the last thing we are going to do. They must expect us any time.”