All language subtitles for cyberwar.s01e05.720p.hdtv.x264-w4f_Track02

of thousands
dead, millions displaced.

The Syrian secret police
got a lot better

at monitoring social media.

The war is being fought both
on the battlefield and online.

If you compromise them,

Assad could come and have them
arrested and then killed.

Hackers connected
to the Syrian Regime

are targeting the opposition.

ISIS is almost
adopting everything

that was successful in Syria.

Sometimes, the
consequences are lethal.

Was he a skilled hacker?

Is Syria the model for how
future wars will be fought?

♪

As a national security
reporter for VICE,

I followed the Syrian War
since the beginning.

In 2011, a popular
democracy movement

blew up across the Middle East.

It was fueled in
part by social media,

became known as the Arab Spring.

Yet Syria was different.

It stayed quiet.

Run by a dictator
named Bashar al-Assad,

citizens were terrorized
by secret police,

mass surveillance, torture,

and barely had any
access to the internet.

Amidst protests
in nearby countries,

the Assad Regime made the
mistake of restoring access

to Facebook and YouTube.

Almost overnight, protests
exploded across the country.

I needed to talk to someone
who was on the streets

when protests first went down.

Three weeks after I got there
the street protests began,

and that quickly overshadowed
everything else we were doing.

Robert Ford was the last US
ambassador to serve in Syria.

So when he did
open up the internet,

it couldn't have just been
for benevolent reasons.

There must've been also a
surveillance aspect to it.

When the revolution in Syria
started, initially I don't think

the regular foot police
and secret police goons

really understood
what social media was.

I met once with a
protestor, and he was detained.

This was in the
suburbs of Damascus.

When he was taken to the
secret police station,

they went through his
backpack in front of him.

And they were taking
everything out, and they said,

"Where is the Facebook?
Where is the Facebook?"

As if it was like
a book with pages.

So that was early on.

As time went on, the Syrian
secret police got a lot better

at monitoring people's computers
and monitoring social media.

Protests continued, but
Assad wouldn't cede his power.

Instead, he sent soldiers
to try and quell the uprising.

The world watched the bloody
crackdown play out on YouTube.

Dlshad Othman was uploading
videos to YouTube and Facebook

during the early days
of the revolution.

It made him a target
of the government,

and he had to flee the country.

For his safety, we chose an
anonymous location to talk.

Video content was the
most important content

coming out from Syria.

We've lost a lot of our
friends while they were filming.

Snipers targeting
people with cameras?

Absolutely.

Snipers targeting people,
or checkpoint will stop you

and check what's in your phones.

But was the regime able to
crack into Facebook, or at least

hack into it in some way and
get some of that information

that would help them
crack down on protestors?

Yes, they were able to
get a lot of accounts.

They were able to hack into

a lot of Syrian opposition
leaders at that time.

And going back to May 2011,

that was the first time when the
Syrian government implemented

man-in-the-middle attack

against the SSL
certificate of Facebook.

And explain to me what a
man-in-the-middle attack is.

The term "man-in-the-middle
attack" came because

there is someone in the middle
who's trying to attack you.

What the Syrian government
did at that time is

they pushed to the users
a fake SSL certificate.

Now, SSL is actually like
an envelope and a key.

Key is with Facebook.

Facebook is sending you an
envelope to put your data in,

lock it, and then
send it back to Facebook.

But the Syrian
internet providers,

they received the envelope
from Facebook, they replaced it

with another one that
they have the key for it.

Their own envelope.

Send it to the Syrian users.

Users, they put their
credentials, username,

and passwords and messaging
and post and etc. stuff.

They send it back.

Syrian internet
providers opened it,

got a copy of data, then
send it back to Facebook.

Assad was now using the internet

to expose entire
networks of activists.

Once identified, they were
often arrested then tortured,

sometimes to death.

The international media
exploded with headlines

detailing police crackdowns
and tales of torture,

creating a public relations
nightmare for Assad.

Soldiers defected
from Assad's forces.

Some formed the Free
Syrian Army, and the country

descended into a war
between rebels and the regime.

But Assad still
had his supporters,

some of whom were hackers.

They decided to
form a cyber militia.

They called it the
Syrian Electronic Army.

Brian Merchant is a
reporter at Motherboard,

who investigated the
origins of the group.

We met up at VICE's
head offices in Brooklyn.

BRIAN: The Syrian
Electronic Army

is an activist hacker group.

They're pro-Bashar al-Assad.

They want to reveal
the media as frauds,

they wanna reveal the Free
Syrian Army as terrorists.

And to do so, they
basically institute

a series of
high-profile attacks.

So are they just propagandists?

Ultimately that's
what their role is,

yeah, is propagandists.

There were mostly
website defacements,

but sometimes they had
real-world consequences.

The SEA hacked the Twitter
account of the Associated Press

and tweeted that the
White House had been attacked.

It caused the US
Stock Market to dive

until it was exposed
to be a fake tweet.

At the top of the
militia hierarchy

was a hacker known as Th3Pr0.

Brian received a tip allegedly
exposing Th3Pr0's identity.

He contacted him.

I'd been asking him, you know,
like we have this information

about you, and we basically
can peg you as the leader.

And he got really
flustered and angry,

and he denied it in
a series of emails,

and he said, "If you reveal
me, then you will be hacked.

We will hack VICE."

Brian published his exposé.

Th3Pr0 made good on his
word, and VICE was hacked.

I decided to track down Th3Pr0.

He agreed to chat online.

I asked him if
the army of hackers

viewed themselves as soldiers.

He said "internet soldier"
was the preferred term.

The real soldiers
were on the battlefield.

I wanted to know if the SEA

was under the official
control of Assad.

Th3Pr0 was adamant that
they weren't affiliated

with the government regime,
but that they did use

back channels to deliver
important intelligence.

Those channels proved to
be potentially dangerous

for opposition protestors.

They were capable of
collecting a lot of information,

hacking a lot of people.

They published
around 11,000 accounts.

They were compromised
in different ways.

And then passing this
along to the regime?

Absolutely.

We've seen a lot of
organizing between them

and the Syrian government,
exchanging information between

each other or exchanging
targets between each other.

Months after speaking with him,

Th3Pr0, or Ahmed Al Agha
as Brian identified,

was indicted for hacking-related
charges by the US government.

The Syrian Electronic Army

gained the attention of the
world through PR-savvy hacks,

but they weren't Assad's
only hacker allies.

BEN: In Syria, what began as
a popular democracy movement

rapidly escalated
into a civil war.

Assad had responded
on the battlefield

with an aggressive
campaign of barrel bombs.

Online, the Syrian internet
was now infected with malware.

Eva Galperin is a hacker.

She started tracking
cyber militias shortly after

the street protests turned
into a bloody conflict.

It wasn't long before her
research revealed the dangerous

new militia known as
the Syrian Malware Team.

They were using the internet
to gather intelligence

on opposition forces.

To begin with, there isn't just
sort of one Syrian Malware Team.

We were able to track

at least two distinct
actors in this space.

These two malware groups
were targeting members of the

Syrian opposition, so anybody
who was opposed to Assad.

And mostly these were people who
were located inside of Syria.

Sometimes in territory
that Assad still controlled,

sometimes in territory that
Assad no longer controlled,

and sometimes members
of the Syrian diaspora,

which became sort of more
influential and more powerful

as the conflict has raged on,
and more people have left.

And the tools they were
using were very different.

Yes.

The malware teams that
we were tracking were using

remote access tools like Xtreme
RAT, DarkComet, Blackshades.

And something like a RAT,
how does it work exactly?

So a remote access tool is
a tool that once an attacker

gets you to install
it on your machine,

allows them to do anything that
you can do on your computer.

So they can log all
of your keystrokes,

they can take screenshots, they
can see through your webcam,

they can listen
through your microphone.

Anything that you're capable
of doing, they can do,

and then they can
exfiltrate that data back...

back to themselves.

And these remote access tools
are very cheap or free,

but they can still get you full
control of somebody's computer

if you can get somebody to
install them on their computer.

In 2012, Assad's
forces used DarkComet

to monitor opposition
groups in Aleppo.

They hid the malware in
a PDF that claimed to hold

instructions on how
to help the city,

which was under siege
by the regime.

As soon as the target
downloaded the PDF,

the malware was installed,

and Assad's opponents
were under surveillance.

These were people that were
still in Syrian territory,

and territory
controlled by Assad.

And so if you compromise them,

things got very, very dangerous
for them because Assad could

come and have them, you know,
arrested and then killed.

The cyberspace in Syria now

is ridiculously,
ridiculously dirty.

Full of malware,
full of phishing,

full of a lot of cyber attacks

that it truly made it an
unsafe space for any user.

Different factions
looking for intelligence

they can feed to their groups.

They don't care if it's malware.

If it's gonna open a
back door in your machine

to some other faction,
they don't care.

They just need to get access.

Sounds a lot like
the actual war.

It is exactly like
the actual war.

It is 100% a reflect for the
actual war that's happening.

Soon, DarkComet was used

to further escalate
Syria's cyberwar.

Pro-Assad hackers -
difficult to attribute

but now all over the Syrian
internet - launched an attack

designed to steal battle plans
from the Free Syrian Army.

The plans detailed a strategy
to retake the town

of Khirbet Ghazaleh, a
key city for the rebellion.

Nart Villeneuve was working
as a researcher for FireEye

when he first discovered
the hack, and he was the

perfect person to tell me how
the battle plans were stolen.

There was hand-annotated maps.

Pictures of them were
taken with cell phones

and distributed to
the fighting units.

Lists of individuals
with their names,

phone numbers, whether
or not they had weapons.

That stuff is extremely
valuable in a conflict zone.

The hack wasn't
technically complex.

Instead it relied on
social engineering,

a technique where hackers
trick their targets

through psychological
manipulation.

Hackers initiated
contact through Skype,

presenting themselves
as beautiful women.

NART: They would
initiate conversations,

try to establish a little
bit of rapport with them,

ask them to send them
a picture of themselves,

flatter them a little bit,
and then say, you know,

"Do you wanna see
a picture of me?"

When they would
send that picture,

really that was the malware.

They would compromise that
individual, and then they would

be able to harvest the
full Skype chat histories

of anyone else who used
that computer as well.

We obviously can't jump straight
to concluding who's ultimately

responsible, but it definitely
looks like it is a group

that is acting to benefit
the Assad Regime,

and has some sort of
connection to Lebanon.

It made sense that hackers in
Lebanon, possibly affiliated

with Hezbollah, might
be supporting Assad.

Hezbollah is Iran's
political proxy in Lebanon,

and Iran is the
Syrian Regime's ally.

NART: We found a document that
is supposedly a leaked document

from Syrian intelligence
that we can't verify,

that talks about the exact
tactics that we see this group

using to target the opposition,
including the use of fake female

personas to try to entrap
individuals and other efforts

to discredit the
opposition online.

By 2013, Hezbollah was
engaging Syrian rebels

on the battlefield.

Now, pro-Assad hackers
based in Lebanon

were engaging them
in cyberspace too.

But support from Syria's allies
wasn't enough for Assad to keep

an emerging threat at bay:
the Islamic State.

BEN: In Syria, the war was
causing the country to fracture.

Then ISIS arrived.

The jihadis set up
their capital in Raqqa.

They took over the land and
unleashed a wave of terror.

Like the Electronic Army
and the Malware Teams

that had come before them,
the Islamic State would also

go after their opponents
on the digital frontline.

Their crimes were documented in
high-profile execution videos,

distributed over the internet.

Rami Abdul Rahman
knows what it's like

to be targeted by ISIS.

He's a Syrian activist
who now lives in the UK

after seeking asylum
over 15 years ago.

His work exposing war crimes
in Syria made him a target.

He was hacked by the
terror group supporters,

Photoshopped in
front of Jihadi John,

the infamous ISIS executioner,

his data was targeted,
and his server was destroyed.

How did that make you feel,

to see yourself in
an orange jumpsuit?

But who was behind the hack?

I'd already been communicating

with Islamic State
fighters online.

Some of them were as easy
as a text message away.

Junaid Hussain was allegedly
one of these fighters.

In Syria, he was known as
Abu Hussain al-Britani,

the architect of the
Islamic State's cyber army.

But before he traveled
to Syria to join ISIS,

Junaid was a regular kid from
England best known as TriCk

of the now-disbanded UK
hacking collective, TeaMp0isoN.

I traveled to Newcastle

to meet with Junaid's former
hacking colleague, MLT.

For security reasons,
we can't show his face.

What was TriCk like
back in the day

before all of this
Islamic State stuff?

TriCk hacked the email of Tony
Blair's personal assistant.

Together with MLT, he flooded
the anti-terror hotline of Mi6

with prank phone calls.

JUNAID: Do you know
about TeaMp0isoN?

OPERATOR: I've heard
about TeaMp0isoN, yeah.

JUNAID: We embarrass
governments,

and ---- the police.

OPERATOR: Yeah...

BEN: They did it as an
act of political protest,

but also for the lulz.

It got them both arrested,
but only Junaid went to jail.

Did prison change Junaid?

How did he radicalize?

Because I guess after
the Tony Blair hack,

he was probably one of the
most famous hackers in Britain.

Was he a skilled hacker?

In August 2015, Junaid was
killed in a US air strike.

But before he was assassinated,
Junaid is thought to have

carried out another
cyber attack.

This one was designed to
expose the location of the

Islamic State's critics so they
could be captured and killed.

BEN: In Syria, cyber attacks
were used by groups affiliated

with the Assad Regime
to wage war online.

When ISIS arrived, they seemed
to adopt similar techniques

to target their opponents.

ISIS claims the men being
executed in this video

are members of Raqqa Is
Being Slaughtered Silently,

a group of activists
who document and expose

the atrocities of the
so-called Islamic State.

Hamood Mohamed Almossa
is in charge of

cybersecurity for the group.

He agreed to Skype with me
from an undisclosed location.

Hamood, do you want to explain
to me how ISIS was hunting down

members of your
organization online?

(Speaking Arabic)

He can't fully prove it, but
Hamood believes Junaid Hussain

orchestrated the attack
so that ISIS could locate

and kill their opposition.

Fortunately, Hamood wasn't
fooled by the phishing attack,

and he didn't
download the malware.

But did others, and were
they killed as a result?

ISIS is almost
adopting everything

that was successful in Syria.

We're talking about images,
we're talking about video,

we're talking
about cyber attacks.

And again, these were techniques
that were essentially

tried and true from earlier
phases of the Syrian Civil War.

Exactly.

And then here we are,
they're adopting it again.

The war in Syria showed
that armies of hackers

can assist soldiers
in the battlefield

because the tools are both easy
to use and free to acquire.

This is a set of tools

that are increasingly
available to everybody now.

So the whole idea is that these
tools are no longer just in

the hands of the Chinese or
Russian or American government,

that people like-- well,
people like you and me,

only with far worse intentions,
now have these tools and can

engage in relatively
sophisticated spying.

And same goes for a battlefield.

Absolutely.

As the war becomes
hot, and as, you know,

battlefield intelligence
becomes more important,

this sort of surveillance
and espionage becomes

part of the battlefield
and part of the battle plan.

In a lot of cases it's
simple social engineering,

but they're very
effective at it.

The types of targets that
they're going after are usually

individuals active on Twitter
and Facebook so they don't need

to use anything particularly
advanced to get the job done.

In Syria, the issue is not
only the hacking itself,

but the inability of the
targets to protect themselves.

You can really no longer be
sure what side you're seeing,

or what kind of
actor is involved,

or whether you're seeing
some sort of false flag.

It just gets murkier and
murkier with every year.

Syria is a country,
or used to be a country,

that government is
watching you by default.

You under surveillance
by default.

Syrians, they were
not able actually to...

to change their behaviours,
to know that they have rights

of their own privacy,
or to protect themselves.

So the same things apply now
on what's going on in

the cyber conflict in Syria.

People have no
knowledge about protection

or why do I have to
protect myself.

I thought that I have
pretty good security protocols

when it comes to encryption
or circumvention or...

or even protocols
dealing with people.

Unfortunately, until someone
came, and he was a journalist

not from Syria and
he starts filming me,

and he was arrested.

And they got access to
all our information.

And that was the minute

that I had to leave the
country immediately.

So I found that security
is not about yourself only,

but it's about the whole network
that you're working with.

When the pro-democracy
movement started in 2011,

few could've imagined
that Syria would fracture

into deadly chaos.

And no one could've guessed
what an important role

the internet would play
not only on the battlefield,

but crushing free speech
and political reform.

While the country's future
hangs in the balance,

one thing has become certain:
Syria offers a terrible window

into how the battles of
the future can unfold,

both off- and online.