SWITZERLAND’S SECURITY Annual Report 2010 of the Federal Intelligence Service FIS Switzerland’s Security 2010 Table of contents Preface 5 Comprehensive threat assessment 9 1. Terrorism 21 1.1 Jihadism worldwide 22 1.2 Jihadism in Switzerland 31 1.3 PKK 35 1.4 LTTE and its successors 38 1.5 The funding of terrorism 42 2. Violent extremism 47 2.1 Right-wing extremism 48 2.2 Left-wing extremism 54 2.3 Animal rights extremism 60 3. Proliferation 65 4. Illegal intelligence 73 5. Attacks on Swiss IT infrastructure 79 List of abbreviations 87 ANNUAL REPORT 2010 | FIS 3 Preface ANNUAL REPORT 2010 | FIS 5 PREFACE First year as a federal office The Federal Intelligence Service (FIS) looks back at its first year as a federal office. The world is in a state of flux, and this is having a significant effect in Europe. This report shows that the security situation in Switzerland is still giving no cause for concern. Nonetheless, there are numerous developments taking place that require careful observation and analysis. Some of the FIS’s assessments have proved accurate, for example in relation to left-wing extremism and to Libya. Other developments can be predicted only with difficulty or not at all. This is clear from the upheavals we are currently experiencing in North Africa and in the Arab world. Intelligence services can deal with such developments by describing possible scenarios, but generally not by making definite predictions. As with natural disasters, it is possible to describe possible developments, but not exactly when and where they will occur. Politicians and security forces rely on a functional intelligence service to raise awareness of such events: the ability to give a comprehensive threat assessment is more important than ever. In this reporting period, the Federal Council has given the FIS his basic mandate, defining the service’s core areas of work within the statutory framework. This has strengthened the leadership and improved the targeted use of the FIS’s capabilities. 2010 brought positive results in terms of continuity in the fulfilment of tasks during the transition period. On the other hand, the Control Delegation of the Swiss Parliament highlighted the unfinished legacy with regard to data management in the area of internal security. The Federal Council, DDPS and FIS have taken measures to resolve the problems in compliance with applicable law. For example, for the first time, newly-created automatic data deletion programmes have been employed, which have reduced the amount of personal data in the Internal Security information system from over 210,000 to less than 90,000 items. In addition, the FIS has tightened its reporting and recording criteria. Additional staff have been deployed on a temporary basis to make it possible to clear up remaining issues by the end of 2012 while at the same time continuing to carry out routine operations responsibly and in the interest of the security of the Swiss population. 6 ANNUAL R E P O RT 2 0 1 0 | F I S PREFACE Information is the raw material of intelligence services. Data must be acquired, linked to other data, evaluated and of course appropriately stored. The substantial reduction in the amount of personal data contained in the Internal Security information system may be seen by some experts as risky in the light of current developments. However, the FIS has to comply with the legal requirements and to focus primarily on quality. In this context, the loss of knowledge due to the deletion of data is something we have to be able to cope with. We are thus following the course laid down by law and policy. I am certain that in Switzerland too, there will be a growing appreciation that the early detection of strategically relevant developments and threats is one of the State’s core functions. For this purpose and to deal operationally with events relating to security, Switzerland requires an appropriate instrument in the shape of an effective, democratically controlled intelligence service. Federal Department of Defence, Civil Protection and Sport DDPS Ueli Maurer Federal Councillor ANNUAL REPORT 2010 | FIS 7 Comprehensive threat assessment ANNUAL REPORT 2010 | FIS 9 COMPREHENSIVE THREAT ASSESSMENT Introduction The Federal Intelligence Service (FIS) has to provide a ‘comprehensive assessment of the threat situation’ (Art. 3 para. 1, Federal Act on Responsibilities in the Area of the Civilian Intelligence Service (CISA)). It has to assess relevant external threats as well as those emanating from within Switzerland. To this end, the FIS publishes an overall assessment annually. This is not limited to the narrow confines of security policy, but also covers other threats which could significantly harm Switzerland. Adverse trends in the economy are therefore just as much part of the catalogue of threats as the damaging consequences of other countries’ policies to protect their own interests. The intelligence service is not suggesting here that it should be given new responsibilities. It is conscious that the assessment of these phenomena can only be undertaken in collaboration with other federal agencies. Overall, since the FIS’s last report, the threat situation has changed in a few respects: there have not, however, been any events or trends leading to major changes in Switzerland or in its strategic environment. Looked at in the long term, the situation in Switzerland remains very stable and peaceful. Although the threats and dangers identified are real, they can assume proportions that pose a threat to national security only under certain conditions. Nonetheless, it is essential to take steps to anticipate these threats, not least in order to prevent them feeding on one another and becoming uncontrollable. The current threat assessment looks at developments up until the time of going to press in midFebruary 2011 and represents a follow-up to the comprehensive threat assessment first published in June 2010. It will highlight the most significant changes compared with last year’s threat assessment. An excursus (publication deadline end of March 2011) looks in more detail at the developments in the Arab world which began at the end of 2010 and could have major impacts on security in Switzerland. 10 ANNUAL R E P O RT 2 0 1 0 | F I S COMPREHENSIVE THREAT ASSESSMENT Dangers from the strategic environment Restriction of freedom of action Direct threats and dangers Terrorism Political and economic coercive efforts Danger to the economy Espionage Regional conflicts Violent extremism Proliferation Crime and violence Increasing mobility Dependence on imported raw materials and energy Military threat Attacks against IT infrastructure ANNUAL REPORT 2010 | FIS 11 COMPREHENSIVE THREAT ASSESSMENT Threats from the strategic environmen t Restrictions on Switzerland’s freedom of action in relation to its geopolitical environment constitute a real threat, with the potential to cause long-term strategic damage. No change from last year’s report. The new geoeconomic and geopolitical realities are weakening Switzerland’s traditionally strong position as a business and financial location and restricting its political freedom of action, particularly with regard to its immediate environment. The consequences of the current economic crisis could have an effect on social cohesion. No change from last year’s report. Large budget deficits and financial difficulties, including in countries in Switzerland’s immediate environment, will place further strain on the international finance system. Wide-ranging discussions are currently taking place in the EU on how the European Financial Stability Facility (EFSF) support mechanism can be strengthened in anticipation of possible further crises. 12 ANNUAL R E P O RT 2 0 1 0 | F I S Regional conflicts and the collapse of state structures could have a range of repercussions for Switzerland in several areas, including migration, terrorism and proliferation. Since the upheavals in the Arab world, this statement has become even more relevant than it was at the time of last year’s report. For more information on developments in the Arab world, see the excursus on pages 18 and 19. Proliferation activities – including in Switzerland – could result in future threats to Switzerland, in the form of weapons of mass destruction and long-range delivery systems. From today’s perspective, Iran remains the only additional country which could gain access to delivery systems capable of reaching Switzerland within the next few years. COMPREHENSIVE THREAT ASSESSMENT Proliferation activities, as well as the activities of terrorist and criminal organisations and of foreign intelligence services in Switzerland, jeopardise the country’s position as a business and financial centre and also put Switzerland under additional international pressure. The disputes surrounding Iran’s and North Korea’s nuclear programmes continue. Iran continues to enrich uranium, against the will of the UN Security Council. A new uranium enrichment plant in North Korea came to light at the end of 2010. On 19 January 2011, the Federal Council resolved to bring Switzerland’s sanctions against Iran into line with those of its major trading partners, which go beyond the UN sanctions. The Federal Council’s decision will prevent circumvention and at the same time will increase legal security for Swiss companies operating internationally. The exposure of proliferation deals could be used to justify measures against the advantages of Switzerland as a business location, should this be the intention of other countries. Particularly in times of global economic crisis, it may seem an attractive proposition to introduce trade restrictions disadvantageous to Switzerland on the grounds of national security interests. In this context, proliferation poses a risk to Switzerland as a location for trade and industry. In the case of Iran, this risk has at least been mitigated through the abovementioned decision of the Federal Council. As a consequence of increasing mobility, more and more Swiss citizens abroad are exposed to the dangers of terror attacks, kidnapping, political unrest or natural disasters. The transfer of power from the old to the new government in Ivory Coast, which has not yet been completed, and the recent upheavals in the Arab world are currently paramount concerns. It has not to date been necessary to undertake large-scale evacuations of Swiss citizens from these areas. In the case of Egypt, however, the Federal Department of Foreign Affairs (FDFA) did at the end of January recommend leaving the country temporarily; there were also attacks on Swiss journalists. There is still a high risk of being kidnapped in the Sahel region. Switzerland’s dependence on imported raw materials and energy makes it vulnerable to attempts by other countries to exert pressure in the pursuit of policies to protect their own interests. No change from last year’s report. While recent developments in the Arab world have led to rises in the prices of energy imports, they have not yet caused supply bottlenecks. This situation could change if stability in the Persian Gulf is threatened. ANNUAL REPORT 2010 | FIS 13 COMPREHENSIVE THREAT ASSESSMENT D irec t threats and dangers The threat of terrorism is not a grave danger to the state at present. An attack in Switzerland is possible, but overreaction to such an attack could cause greater long-term damage than the attack itself. The likelihood of weapons of mass destruction being deployed successfully remains low. In 2010 there were a series of terrorism warnings in Europe, at times combined with raised terror alert levels and increased deployment of security forces. These warnings, which were generally vague in nature, all triggered intense media coverage, but were probably at least in part motivated by domestic politics. Switzerland was not named as a target country in any of the attack threats, and intelligence produced no indication that Switzerland might be directly affected by possible acts of terror. However, Swiss citizens and Swiss interests could be affected by attacks abroad. Attempts to exert political or economic pressure form part of the national interest politics of other states. They may restrict the Swiss authorities’ freedom of action and damage our national interests. No change from last year’s report. The pressure on the Swiss taxation system continues. 14 ANNUAL R E P O RT 2 0 1 0 | F I S Illegal intelligence activities undermine state sovereignty. Industrial espionage may also damage the competitiveness of companies based in Switzerland and threaten the country’s position as a financial and business location. No change from last year’s report; the threat remains high. This is illustrated by the theft of US State Department documents – allegedly by a US government employee – and their subsequent publication by Wikileaks. Protection and prevention measures in the area of information and IT security, as well as traditional precautions against illegal intelligence, are therefore still important. Violent extremism in Switzerland leads to local security problems and, particularly where violent left- and right-wing extremism is concerned, presents a threat to the peace and public order. In 2010, attention focussed principally on left-wing extremism. A particularly high-profile case was that of three left-wing extremists arrested in April 2010, who had allegedly planned an attack on IBM in Rüschlikon, near Zurich. Left-wing extremists’ solidarity campaigns reached a climax with the parcel bomb attacks on various embassies, including the Swiss COMPREHENSIVE THREAT ASSESSMENT embassy in each case, in Athens (Greece) and Rome (Italy). Local anarchist groups claimed responsibility for the attacks, saying that they had acted partly out of solidarity with the people detained in connection with the attempted attack on IBM in Switzerland. The nature of the attacks and campaigns changed with the adoption of the ‘deportation initiative’ on 28 November 2010. For example, people wearing masks stole a ballot box and set it on fire, and a polling station was targeted in an arson attack. As in the campaign against the deportation initiative, the Swiss People’s Party (SVP) was targeted by left-wing extremists on several occasions. For example, around one hundred people, mainly left-wing radicals, took part in an unauthorised protest against the SVP’s Albisgüetli conference on 21 January 2011. During the riots following the breakup of the rally, a member of the National Council was attacked and injured. Criminality and violence in Switzerland are not on a scale that would represent a grave danger to the state. Organized crime could take on strategic significance. No trend changes compared with last year’s report. The following current assessment of organized crime in Switzerland comes mainly from the Federal Office of Police (fedpol), which is responsible for analysing this type of threat. There have been repeated signs in recent years that Italian criminal organizations are present in Switzerland. This is due to Italy’s geographical proximity, the large Italian population in Switzerland and also to the strength of Switzerland as a financial centre. Italian criminal organizations are involved in drug trafficking, arms dealing and money laundering. The ’Ndrangheta, in particular, has been identified in Italy as an organisation with a high potential to infiltrate business and politics. It is currently using this potential to expand its activities in other countries in western Europe. Criminal groups from south-east Europe are playing an important role in the development of crime in Switzerland. They are particularly active in the field of narcotics trafficking, where they have dominated the heroin market for the last two decades. However, they are also involved in property-related crimes and peoplesmuggling and -trafficking. Bands of Georgian burglars have been active in Switzerland and in numerous other European countries for several years. Their members generally apply for asylum after entering a country illegally, and they principally commit propertyrelated crimes. Part of the proceeds flows into the coffers of the criminal world in the countries of the former Soviet Union. Groups from West Africa make their presence felt primarily in the Swiss cocaine market. West African networks have the capability to acquire large quantities of cocaine direct from South America and sell it all over Europe. According to the latest estimates from fedpol, the cocaine trade in Switzerland generates an an- ANNUAL REPORT 2010 | FIS 15 COMPREHENSIVE THREAT ASSESSMENT nual turnover of between 369 and 520 million Swiss francs. The profits returned to the regions of origin corrupt both the state structures there and the formal economy. The examples cited show that Switzerland is used by criminal organizations not merely as a safe haven or a financial centre, but also as a field of operations. This gives rise to a direct threat in the form of basic crime and also through conflicts between groups competing for a share of the illegal markets. Money generated, laundered and invested here in Switzerland also represents a direct threat to the good reputation of the country as a financial centre. The profits of criminal organisations also contribute, rather more indirectly, toward the fact that the sometimes unfavourable economic, social and political conditions in the regions of origin are at least not improving. This leads to a vicious circle, with lucrative fields of activity and investment options for criminals on the one hand and a large reservoir of potential young criminal recruits in the regions of origin on the other. Switzerland does not currently face any military threat. No change from last year’s report. A war in Europe which would affect Swiss territory is unlikely in the foreseeable future. In the medium term, however, a threat from more distant regions could still emerge, based on weapons of mass destruction and long-range delivery systems. 16 ANNUAL R E P O RT 2 0 1 0 | F I S Attacks on critical IT infrastructure (cyber attacks) could reinforce other types of threat and assume proportions that could potentially jeopardize the entire system. In 2010, the media reporting on the Stuxnet computer worm gave widespread coverage to an issue that has been under discussion in specialist circles for some considerable time. The Reporting and Analysis Centre for Information Assurance (MELANI) has repeatedly pointed out this threat in its half-yearly reports since 2005. The issue here is that using manipulated computer programmes, so-called malware, it is possible to manipulate not just computers, but also entire industrial control systems and therefore possibly also vital processes and operations. In June 2010, MELANI informed the federal IT security authorities and the operators of critical infrastructures about newly-discovered malware called Stuxnet, targeted at manipulating process control systems. The results of the technical investigations (high degree of complexity, use of advanced expertise in the area of security) give rise to the suspicion that a government is behind Stuxnet. The investigations focused on several nuclear installations in Iran which may have been infected with Stuxnet. A spokesperson for the Iranian government confirmed that an attack had taken place on control systems in industrial installations around the country and mentioned a figure of around 30,000 infected computers. COMPREHENSIVE THREAT ASSESSMENT Since the discovery of Stuxnet in June 2010, MELANI has remained in contact with the operators of critical infrastructures, in order to exchange relevant findings and security advice. To date, no infections have been reported by operators of critical infrastructures in Switzerland. It must be assumed that similar attacks will occur more frequently in future and could also affect Switzerland. On 10 December 2010, the Federal Council debated threats to Switzerland through attacks from cyberspace and resolved to bolster protective measures against such attacks on Switzerland. A group of experts, including representatives from the FIS, is to draw up an overall federal strategy against cyber threats by the end of 2011. Almost all these threats and dangers to Switzerland and its interests also place demands on the intelligence service. It is either directly or indirectly responsible for helping to combat them. The challenges facing the intelligence service are clear: it needs to work together with its partners in the Confederation and the cantons, as well as with its partners abroad, to detect new threats at an early stage and to cast sufficient light on the increasingly complex threat landscape, to assess the threats identified and, together with its partners, to take the necessary steps to combat and prevent these threats. As well as capabilities, means and resources commensurate with the threat, this also requires alertness to these concerns on the part of politicians and the general public. ANNUAL REPORT 2010 | FIS 17 COMPREHENSIVE THREAT ASSESSMENT Excursus – Arab world 2011 A wave of protests has been taking place throughout the Arab world since January this year which has affected all the countries of this region in one way or another. Two regimes have been toppled (Tunisia and Egypt) and in one case (Libya), the conflict between the regime and the opposition has led to an international military operation being launched to protect the civilian population. The momentous upheavals currently taking place in the Arab world are not yet over. It is therefore not yet possible to make a comprehensive assessment of the medium- and long-term impacts, including the repercussions for Switzerland. Switzerland is not only affected by these upheavals, but demands will also be placed on it in the short, medium and long terms. The first emergency measures in the areas of humanitarian aid, development assistance and support for the transition process have been implemented. Looking at strategic prospects in the longer term, it can be assumed that new opportunities for Switzerland may arise. One possible area of action for Switzerland, maybe in collaboration with others, is that of helping to establish democratic societies. At the same time, however, consideration must be given to the fact that in the long term there will continue to be numerous and significant risks. These relate to the unfavourable general economic and demographic conditions, problems of internal security and continuing regional conflicts, in particular between Israel and the Arab world and in the Persian Gulf. It can be concluded from this that there are specific threats to Swiss interests from migration pressure, terrorist activity, energy insecurity, potentate funds, organized crime etc. 18 ANNUAL R E P O RT 2 0 1 0 | F I S COMPREHENSIVE THREAT ASSESSMENT Atlantic Ocean Algiers Tunis TUNISIA Rabat Mediterranean Sea Tripoli M O R O CCO LEBANON PALESTINE Cairo A LG E R I A LIBYA Tehran SYRIA IR AQ Damascus Amman Bagdad JORDAN Kuwait BAHRAIN Manama Riyadh Doha EGYPT IRAN KUWAIT QATAR Abu Dhabi U.A.E . Re d SAUDI ARABIA Muscat Se OMAN a YEMEN Sanaa Arabian Sea 1000 km ANNUAL REPORT 2010 | FIS 19 1. Terrorism ANNUAL REPORT 2010 | FIS 21 TERRORISM | Jihadism worldwide 1.1 Jihadism worldwide SELEC TED E VENTS 22 23 February An AQIM (Al-Qaeda in the Islamic Maghreb) group released a French hostage. He had been kidnapped on 26 November 2009 in Menaka in Mali. 1 May Faisal Shahzad, a US citizen of Pakistani origin, made a failed attempt to detonate a bomb on Times Square in New York (USA). 21 May Mustafa Abu al-Yazid, alias Sheikh Said al-Masri, core al-Qaeda’s ‘number three’, was killed in a US air attack on the village of Mohammed Khel in North Waziristan (Pakistan). 27 June A bomb attack by radical Islamists on a police station in Bugojno (Bosnia and Herzegovina) claimed one dead and seven injured. 24 / 25 July During the night, a suicide bomb attack was carried out on the gendarmerie in Beni Aissi, in Kabylia, Algeria. The attack cost one guard his life, and eight policemen were injured. 25 July AQIM announced the death of a French hostage. They had murdered the man after the failure of a joint attempt to secure his release by the Mauritanian and French armies, undertaken on 22 July as part of a wider offensive. Seven jihadists were killed in the operation. 23 August An AQIM group in Mali released two Spanish hostages. The third person in the group kidnapped on 29 November 2009 in northern Mauritania, a Spanish woman, had already been released on 10 March. ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | Jihadism worldwide 15 / 16 September During the night, five French citizens, including a married couple, were abducted in Arlit (Niger) by an AQIM commando and taken to northern Mali. The victims worked for the French nuclear company Areva and for Satom. 29 October Two parcel bombs with return addresses in Yemen were seized at East Midlands Airport (UK) and at Dubai airport (United Arab Emirates). The explosive devices were viable. 11 December A suicide bomber, a Swede of Iranian origin, blew himself up in the centre of Stockholm. Shortly beforehand, his car had exploded nearby, injuring passers-by. Al-Qaeda internet propaganda: special edition of ‘Inspire’ magazine on the end-of-October parcel bombs. ANNUAL REPORT 2010 | FIS 23 TERRORISM | Jihadism worldwide SITUATION firearms would lead to large numbers of victims. In France, meanwhile, security measures for the capital in particular were tightened in response to increased intelligence about possible terrorist attacks, some of which related to AQIM. No jihadist terrorist attacks subsequently took place, either in Germany or in France. Alleged plans for attacks on targets in Europe In September, reports appeared in the media that US intelligence services had foiled terrorist attacks on targets in the UK, France and Germany. It was claimed that the attacks had been planned in Pakistan and that the targets were to have been struck simultaneously. The reports alleged that the plans for the attacks had been drawn up by a high-ranking member of alQaeda, with financial support from Osama bin Laden, but that attacks by US drones on targets in Waziristan (Pakistan) had, at the very least, succeeded in disrupting these plans. The US subsequently advised its citizens to be vigilant when travelling to Europe, and the UK and Japan upgraded their travel advice for France and Germany. At the time of the terror warnings in Germany in autumn 2010, the specific concern of the authorities was the threat of bomb attacks. The target was thought to be a large gathering of people in a major city, the intention apparently being to detonate the explosive by remote control. There were also fears of a scenario similar to the Mumbai attacks in November 2008, in which protracted hostage taking and the use of Core al-Qaeda Core al-Qaeda also suffered significant setbacks in 2010. A number of its leaders were killed in US air strikes, and the organisation came under pressure from the Pakistani military offensive in the tribal areas. This also reduced the organisation’s ability to procure funding and recruit new members. The remainder of the organisation’s core was operational primarily in Pakistan, where it collaborated with local groups. These groups work closely together, and some of them now also have a global agenda. This has created a network that partially offsets the losses core alQaeda has suffered in terms of personnel and compensates for its diminished operational capability. One of the most active of these groups is Therik-e-Taliban Pakistan (TTP), the umbrella organisation of the Taliban in Pakistan, which Core Al Qaeda Atlantic Ocean Med TUNISIA MOROCCO rane IRAQ ISI an Se a L I B YA SAUDI ARABIA Re AQIM d Se MALI a M A U R I TA N I A AFGHANISTAN PA K I S TA N ALGERIA Western Sahara iter NIGER AQAP YEMEN Arabian Sea Shabaab SOMALIA possible branch Indian Ocean regional branch zone of activity 24 ANNUAL R E P O RT 2 0 1 0 | F I S 2000 km Overview of al-Qaeda’s areas of operation and branches (no change from last year) TERRORISM | Jihadism worldwide claimed responsibility for the attempted attack on New York’s Times Square. The perpetrator, Faisal Shahzad, is said to have been trained at one of the group’s training camps. Core al-Qaeda maintains its dominant role as far as propaganda is concerned and provides ideological leadership for the global jihad. In 2010, it continued to produce a broad range of propaganda to fuel the ‘media jihad’. However, core al-Qaeda’s role in the production of propaganda is facing a growing challenge from groups such as al-Qaeda in the Arabian Peninsula (AQAP) and AQIM. AQAP AQAP claimed responsibility for the attempted attacks involving two parcel bombs that were seized in the UK and Dubai at the end of October. Both parcels bore the name of a sender in Yemen, were transported by private parcel delivery services and were addressed to recipients in Chicago. According to unconfirmed reports, the two parcel bombs passed through a security check in Sana’a (Yemen). The first bomb was sent by UPS in a passenger aircraft to Dubai and then onwards in a cargo aircraft via Cologne to East Midlands Airport, where it was intercepted. The second bomb was flown by FedEx in a passenger aircraft via Doha to Dubai before being discovered there. Both seizures were made on the basis of information from the intelligence services. The explosive devices were identical in design and were each concealed in a laser printer which was contained, together with a laptop, charger, clothes, books etc., in a parcel weighing 16 kilograms. Analysis of the explosive de- vices revealed that they were viable and, with a main charge of 400 grams of pentaerythritol tetranitrate (PETN), were large enough to cause critical damage to an aircraft. AQIM In 2010, the Algerian security forces put further pressure on the remaining AQIM groups operating underground in the traditional area of operations of Algerian jihadists in northern Algeria. Only in Kabylia and the Aurès mountains did AQIM groups retain any freedom to manoeuvre. Groups revolting against the central authorities have traditionally found support in these poor, mountainous areas. All three suicide attacks in 2010 took place in Kabylia. They were aimed exclusively at the security forces, which are the main target of the guerrilla war being waged in this region. In the rest of Algeria, the AQIM groups found themselves on the defensive and carried out only sporadic small-scale operations. Modelling their operations on those carried out in Iraq and Afghanistan, they attacked government representatives or lured security forces into ambushes. They are no longer able to carry out large-scale military operations and can undertake more significant suicide attacks, for example against European interests, only on a limited scale. In 2010, the AQIM leadership could not, either in the short or the medium term, count on being able to successfully open up new jihadi theatres of operations in the Maghreb, particularly in Morocco, Tunisia or Libya, or to establish operational or support networks in Europe. It concentrated on propaganda, which it dis- ANNUAL REPORT 2010 | FIS 25 TERRORISM | Jihadism worldwide seminated via the internet and which was also broadcast by Arabic satellite channels such as Al Jazeera. By contrast, AQIM groups in the Sahara and the Sahel region continued to carry out their operations in Mauritania, Niger and Mali. They became increasingly daring, as they are becoming, both socially and financially, more firmly rooted in that region, particularly in Mali. The power of the state is so weak here that it is forced to allow the AQIM groups the freedom of movement and scope to engage in all sorts of illegal activities. However, in 2010 there were also the first signs that the Mauritanian and Nigerien authorities, in particular, were becoming aware of the problem posed by the AQIM groups on their territory. Army units from both countries made several attempts to take action against the AQIM groups. These attempts led to a number of clashes, with deaths on both sides. In reprisal, the Sahel-based AQIM groups carried out two suicide attacks, in Niger and Mauritania respectively, which were directed against the armed forces. In Niger, European citizens were kidnapped on two occasions. No operations took place in Mali, as the country is used by the AQIM groups as a safe haven to retreat to. This is where the hostage-taking was organized from. These hostage-takings confirm among other things that the groups’ capabilities, e.g. in the area of communications, are improving. The operations in the Sahel region are fundamental to the survival of AQIM and the continuation of their jihad. They ensure media coverage and give the organization a visible profile. They also prove to the worldwide jihadist move- 26 ANNUAL R E P O RT 2 0 1 0 | F I S ment that AQIM is an international and not just an Algerian force. The message of support for the group from Osama bin Laden published on 27 October demonstrates the regard in which AQIM is held internationally. This message has been used for propaganda purposes by AQIM emir Abdelmalek Droukdel. On 18 November he announced that negotiations on the release of the French hostages had to be conducted with Bin Laden and under his terms (first and foremost the withdrawal of French troops from Afghanistan). The two audio messages published in internet forums and by Al Jazeera are not proof of any direct contact between Bin Laden and AQIM. AQIM is additionally attempting to demonstrate, by providing chiefly ideological support to jihadists in Nigeria, that it has the potential to expand in the region. Islamism in south-east Europe The local security authorities in south-east European countries are monitoring the activities of Islamists closely. In some of the countries, the potential threat from individual radical Islamists is classified as high, as there is evidence in some cases of radicalisation towards jihadism. At the centre of this are people described as takfiris, because they use ‘takfirs’ as a way of achieving their goals. A takfir is used by a Muslim to declare another Muslim an unbeliever or apostate, thereby legitimizing his execution. The takfir is an essential element of the jihadist doctrine, where it forms an important prerequisite for violent and/or terrorist actions. Both in south-east European countries and in the diaspora countries, there TERRORISM | Jihadism worldwide are reports of individuals of south-east European origin, organized in loose networks, with increasingly frequent transnational links to jihadist groups. The Bosnian village of Gornja Maoca is home to radical Islamists. They have gradually isolated themselves from the outside world and live according to their own rules. They are adherents of Salafism, observe Sharia law and educate both children and adults in their own schools. They reject the democratic order in Bosnia and Herzegovina and as a matter of principle do not recognize the authority of the state. This brings them into constant conflict with the authorities, religious institutions and their neighbours. During an operation in early February 2010, the authorities confiscated weapons and tens of thousands of euros from them. Seven people were arrested. They were released on parole after around one month. One person of foreign origin was deported as an illegal resident. No concrete evidence of terrorist activity or support for terrorist groups was found. The Bosnian security authorities arrested two people in connection with the bomb attack in Bugojno at the end of June. These were already known to the authorities due to their having committed violent crimes, becoming increasingly radicalized and having connections with takfirism. When they were arrested, a further explosive device was discovered in the possession of the main perpetrator. He alleged that his motive had been the desire to avenge the arrest and prosecution of a fellow believer for arms smuggling. South-east European networks in the diaspora A takfiri network was extremely active in 2009, organizing several meetings across Europe. A split occurred in 2010. The split was provoked by two leaders with differing ideological and religious views. A third network of takfiris of south-east European origin is also active in Europe. Its goal is to radicalize individuals and recruit them for the armed struggle. ANNUAL REPORT 2010 | FIS 27 TERRORISM | Jihadism worldwide ASSESSMENT No concrete information pointing to imminent attacks in Europe The information broadcast in the media suggesting imminent attacks was based chiefly on the statements of a German jihadist detained in Afghanistan. While he mentioned unspecific plans to launch attacks on Europe, he did not give any details of possible targets. Overall, 2010 saw an increase in the amount of intelligence, from a variety of sources, concerning possible attacks planned on targets in Europe. No concrete evidence of imminent attacks in Europe was found in the available intelligence. The FIS was in constant close contact with its partner services, analysed the situation and deliberately did not issue a warning, as the threats were unspecific. Switzerland was not named as a target country in any of the attack threats, and intelligence yielded no indication that Switzerland might be directly affected by possible acts of terror. Nor was there any evidence of preparation or support activities, or of suspected terrorists travelling through Switzerland. Swiss citizens and Swiss interests may, however, also be affected by attacks abroad. However, the jihadist threat to Europe does not come solely from groups associated with alQaeda. It is also possible that individuals could be inspired by the propaganda disseminated by al-Qaeda and attempt to carry out attacks in Europe. As can be seen from the suicide bombing in Stockholm, it is almost impossible to gauge the probability of terrorist attacks by lone perpetrators, let alone prevent them completely. Core al-Qaeda The loss of important leaders further weakened core al-Qaeda in 2010. New players and close cooperation with local Pakistani groups make the threat from core al-Qaeda more complex and diffuse. The now often global agenda of active Pakistani groups close to core al-Qaeda shows that the will at least is there to carry out attacks in the Western world. It thus seems plausible that the TTP carried out the attempted attack on New York’s Times Square. This would have been the first time that this group had carried out an attack outside Pakistan. Now operationally weakened, core al-Qaeda is engaged primarily in propaganda activities, while continuing to provide ideological leadership for the global jihad. In this way, it influences and inspires not only its own regional groups and other groupings, but also individuals. Such individuals may carry out attacks independently of any organization. Switzerland is still not a specific target for core al-Qaeda, and there is no evidence of contact between core al-Qaeda and persons living in Switzerland. AQAP AQAP’s attacks outside Yemen have either failed or been foiled. Nonetheless, they represent a partial success for AQAP in that they have been reported in the international media and resurrected memories of 9/11, and as a consequence have provoked alarm. It is to be expected that the attempted parcel bomb attack Al-Qaeda’s area of operation in the Islamic Maghreb in the year under review. 28 ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | Jihadism worldwide adversely affected if AQIM begins carrying out attacks on foreign targets again. Bearing in mind the kidnappings of foreign citizens which continue to be carried out in the Sahara and the Sahel region, it is possible that Swiss tourists could also be victims of such attacks in future, as did happen in 2009. In its travel advice, the FDFA advises explicitly against travel to Mali. In the main towns of this region, and in particular in Mauritania and Niger, Swiss citizens and Swiss interests could be affected by terrorist attacks carried out by AQIM groups against the security forces or against Western interests. will serve as a model for other terrorist groups to plan and carry out similar operations. AQAP has the capacity, the will and the capability to carry out attacks at an international level. However, there has been no discernible increase in the threat of terrorism directly targeting Switzerland as a result of the attempted attacks. AQIM The situation in Algeria, the Sahara and the Sahel region has no direct influence on the threat in Europe and Switzerland. Nonetheless, the internationalization of AQIM’s message may also inspire citizens from the Maghreb countries based in Europe, i.e. also in Switzerland. These could attempt to establish contact with AQIM, or might on their own initiative carry out violent actions which are not directly connected to AQIM or even to core al-Qaeda. Swiss citizens and Swiss interests in Algeria have neither been attacked nor designated as targets by AQIM. However, these could be The threat in south-east Europe A large number of groups and organizations of various Islamist persuasions are active in this region. A large amount of money also continues to flow in from Arab countries to support these groups. Despite this, as far as acts of violence in the region itself are concerned and ignoring 500 km Oujda Rabat Casablanca Guerrilla warfare Algiers Annaba Constantine Tunis Sfax TUNISIA MOROCCO Marrakech Agadir Tripoli Ghardaia Misurata Béchar Ifni Tindouf Adrar Ghadamis ALGERIA In Salah WESTERNSAHARA L I B YA Zone of Activity Dakhla Djanet Tamanrasset Safe-haven Area M A U R I TA N I A Nouakchott Kidal Tombouctou Dakar SENEGAL GAMBIA Ségou Bissau GUINEABISSAU MALI Kayes Bamako GUINEA CHAD NIGER Events 2010 BURKINA Ouagadougou FA S O Niamey NIGERIA Attack Abduction Attempted abduction ANNUAL REPORT 2010 | FIS 29 TERRORISM | Jihadism worldwide lone perpetrators, the threat from Islamist terrorism is assessed as being low. However, in the region as a whole, the risk of individuals being radicalized and recruited to the armed jihad is high. Added to this is the risk of logistical support being provided to terrorist groups, particularly for terrorist actions in western Europe. The greatest threat here comes from takfiri networks or radicalized lone perpetrators. The problems are compounded by the relatively easy access to weapons in the region. 30 ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | Jihadism in Switzerland 1.2 Jihadism in Switzerland SELEC TED E VENTS 10 May A court in Belgium sentenced Malika El Aroud, a Belgian woman of Moroccan origin, and in absentia Moez Garsallaoui, a Tunisian, to eight years’ imprisonment for leadership and membership respectively of a terrorist organization. Both had been resident in Switzerland from the late 1990s and on 21 June 2007 were found guilty by the Federal Criminal Court of supporting a criminal (terrorist) organization, as defined under Art. 260ter of the Swiss Criminal Code (SCC), and of other criminal acts. 26 July In an audio message, Ayman al-Zawahiri, core al-Qaeda’s number two, mentioned the passing of the Swiss referendum against the building of minarets as a sign of the West’s Islamophobia. A website defaced in connection with the passing of the referendum against the building of minarets. ANNUAL REPORT 2010 | FIS 31 TERRORISM | Jihadism in Switzerland SITUATION Core al-Qaeda and the minaret building ban Reactions to the referendum against the building of minarets which was passed on 29 November 2009 remained muted in 2010. No serious threats or violent actions against Switzerland or Swiss interests were recorded. There were, however, demonstrations, for example in Pakistan and Indonesia. The ban on building minarets also sporadically cropped up as an issue in jihadist internet forums. In these forums, the referendum against the building of minarets was repeatedly referred to, together with the bans on burqas and the caricatures of Mohammed, as a sign of the West’s Islamophobia. Core al-Qaeda also expressed its views on the minaret building ban. On 26 July, in a 47-minute speech calling for opposition to the veil ban in Europe, their number two, Ayman al-Zawahiri, also referred to Switzerland and the minaret building ban. He mentioned the fact that the Swiss have forbidden the building of minarets as an example of the Islamophobia which in his eyes existed in the West. The audio message placed Switzerland on a level with other countries of the so-called ‘crusade alliance’. In the other core al-Qaeda messages, there was no further mention of Switzerland. 32 ANNUAL R E P O RT 2 0 1 0 | F I S South-east European Islamists The majority of Muslims in Switzerland originate from south-east Europe. Traditionally, south-east European Muslims see Islam as primarily apolitical, but there is a minority with ties to Islamism. This minority is not a uniform group; south-east European Islamists represent a variety of different forms of Islamism. A notable tendency toward takfirism can be observed. In Switzerland, two takfiri networks have so far been identified, belonging to different ideological currents. ▪▪ One of the networks underwent a split in 2010. In 2009, it had drawn attention to itself by organizing meetings attended by participants from all over Europe, and had also found sympathizers in Switzerland. ▪▪ In 2010, the establishment of a transnational network could be observed in Switzerland, not all the members of which were takfiris of south-east European origin. It aims to form a community of its own and to recruit followers for the armed jihad. The network is directly involved in the recruitment and deployment of individuals. In this country, too, individuals have been radicalized or recruited. Intelligence also indicates that activists in Switzerland play an important role in financing the network. They have avoided using the services of the Swiss financial sector for these activities. TERRORISM | Jihadism in Switzerland In addition to these two networks, other individuals came to our attention in 2010 who had close links with radical Islamists in Bosnia and Herzegovina. According to the information currently at our disposal, these individuals have not formed an organization in Switzerland. In 2010 there was no evidence that acts of terrorism involving persons of south-east European origin resident in Switzerland were planned or that preparations for such acts were being made. Travel and movements At the end of 2007, Moez Garsallaoui journeyed from Belgium to the Afghan/Pakistani border area as the leader of a group of likeminded people. On their return to Europe at the end of 2008, some members of the group were arrested in Belgium, and in 2010 they were convicted by a court of law. They are alleged to have visited training camps in the tribal areas of Pakistan and to have planned attacks in Belgium. Across Europe, an increase in travel motivated by jihadism can be observed. In Switzerland, too, we know of several other cases besides that of Garsallaoui. The individuals involved travelled to countries including Somalia and Yemen. The Tunisian jihadist sentenced in Switzerland [photo taken in 2008] ANNUAL REPORT 2010 | FIS 33 TERRORISM | Jihadism in Switzerland ASSESSMENT Consequences of the ban on building minarets Al-Zawahiri’s audio message was the first time that core al-Qaeda had addressed the subject of the referendum against the building of minarets. The mention of the minaret ban was not taken up as an issue by jihadist circles, and there are no reports indicating that it has resulted in a threat to Switzerland. The FIS is continuing to monitor the ongoing debate about Islamophobia. The citing of the minaret building ban as part of the alleged evidence of a hostile attitude to Islam entails potential risks. For example, it might cause increasing numbers of people to put Switzerland in the camp of those hostile to Islam, or it might encourage the radicalization of individuals. In the long term, it is impossible to rule out exploitation of this issue by Islamist circles in Europe and Switzerland, and this could also potentially lead to violent actions. Takfiris and returnees as security risks The potential threat posed by some south-east European takfiris is classified as high, as there are signs of increasing radicalisation towards jihadism. Even though there is no evidence that acts of terrorism involving persons resident in Switzerland have been planned or that preparations for such acts have been made, a threat to Switzerland and its interests does exist. Individuals who join the armed jihad damage the foreign and security policy interests of their coun- 34 ANNUAL R E P O RT 2 0 1 0 | F I S try of origin or former country of residence. If an increased number of combatants originating from Switzerland were to become active in the jihadist areas and carry out attacks on the civilian population or on international troops, this could bring about calls at the international level for Switzerland to adopt more far-reaching measures in relation to combating terrorism. The increase in jihad-motivated travel movements will necessarily entail at least some of the jihadists returning to Europe. Returnees, who have generally already been radicalized in their countries of origin or former residence, pose a considerable risk to the security of individual countries. Returnees who have visited training camps or even fought in jihadist areas may be returning with the intention of carrying out attacks, or even having been ordered to do so. There is a danger that returnees from the armed jihad will take an active part in terrorist activities or support such activities either in Switzerland or using the country as a base. They could also play an important role in radicalizing Muslims. However, so far there has been no confirmation of any returnees in Switzerland. TERRORISM | PKK 1.3 PKK SELEC TED E VENTS 15 February At an unauthorized demonstration by the Kurdistan Workers’ Party (PKK) in Olten, an activist threatened campaigns against Europe by young Kurds. 25 / 26 February Demonstrations took place in several European cities. The protest was directed against coercive measures by the authorities, including numerous arrests of PKK members and house searches in Italy, France and before that also in the Netherlands. 4 March In Belgium, police actions at the studios of the PKK-linked television broadcaster Roj TV brought broadcasting to a standstill. 8 June A bomb attack on a police bus in Istanbul left 15 people injured. The Kurdistan Freedom Falcons (TAK) claimed responsibility. 22 June A TAK bomb attack on a bus carrying military personnel in Istanbul killed five people and left a dozen injured. 16 August The PKK leadership announced a unilateral ceasefire for the duration of Ramadan and then extended it until the end of October. 31 August The Danish Justice Minister decided to institute legal proceedings against Roj TV and Mesopotamia Broadcast A/S METV. They were accused of supporting the PKK, which is classified as a banned terrorist organization. 31 October TAK injured 32 policemen and passers-by in a suicide bombing in Istanbul. The leadership of the PKK denied responsibility and extended their ceasefire until the Turkish parliamentary elections in June 2011. RUSSIA Black Sea Caspian Sea GEORGIA Istanbul ANKARA AZERBAIJAN ARMENIA KURDISH AREAS TURKEY Izmir Tabriz Diyarbakir Antalya Adana Mosul Kirkuk CYPRUS Mediterranean Sea Outline map of Kurdish areas SYRIA LEBANON DAMASCUS IRAQ BAGHDAD ISRAEL JORDAN IRAN 200 km ANNUAL REPORT 2010 | FIS 35 TERRORISM | PKK SITUATION Situation in Turkey The thaw at the end of the spring was followed by a wave of violence in excess of average levels in previous years. The operations of the Turkish army and of guerrilla units of the PKK’s Kurdish Nation Defence Forces (HPG) led to heavy losses on both sides. When the number of attacks reached its peak, in the middle of August, the PKK leadership declared a unilateral ceasefire for the duration of Ramadan, the Islamic month of fasting. In mid-September the ceasefire was extended until the end of October. Following the attack in Istanbul at the end of October, for which TAK claimed responsibility, the head of the Executive Committee of the Kurdistan Democratic Confederation (KCK), Murat Karayilan, announced the extension of the unilateral ceasefire until the parliamentary elections in June 2011. The Turkish parliament renewed the mandate for cross-border military operations against PKK positions and safe havens in northern Iraq. The armed forces, under their new chief of staff General Isik Kosaner, continued their efforts to inflict as much damage as possible on the PKK. Despite the ongoing fighting, the PKK leader Abdullah Öcalan, imprisoned since 1999, has been seeking peace talks with the government for some time. At the end of August, an advisor to Prime Minister Erdogan indicated that talks were taking place between the Turkish authorities and Öcalan. 36 ANNUAL R E P O RT 2 0 1 0 | F I S Situation in the diaspora community At the beginning of 2010, coercive measures by the police in Italy, France and the Netherlands led to numerous protests being organized in several European cities. The majority of these passed off peacefully, especially in Switzerland. Here, the demonstrations were well organized, authorized by the authorities in each case and conducted in a peaceful way. An exception to this was the unauthorized protest in Olten in mid-February, where a young activist threatened to carry out acts of violence. Otherwise, there has been scarcely any public reaction from the Kurdish diaspora community to the continuing fighting, with its heavy casualties, in the Turkish/Iraqi border area. In 2010, PKK sub-units continued to engage in propaganda and training activities, to recruit new members and to collect donations. Recruitment was carried out in Europe for cadre positions and ideological training camps. As in previous years, every so often combatants were sent to the front line. In addition, there is credible evidence that on several occasions money and materials were delivered from Europe to Erbil by couriers. From there, it is assumed that it found its way to the Qandil mountains to supply the HPG units. TERRORISM | PKK ASSESSMENT Signs of fragmentation in the PKK Despite the attempts at dialogue between the Turkish authorities and the PKK, it remains unlikely that the government will recognize the PKK as the legitimate representative of the Kurds. While he is in prison, Öcalan’s influence and room for manoeuvre are restricted. KCK leader Murat Karayilan advocates a tough stance toward the government. There is no sign of any long-term easing of the conflict, as younger cadres in the PKK, splinter groups and other extremist activists show little interest in resolving the conflict. The attack in Istanbul on 31 October is an illustration of this. Turkey is planning a far-reaching constitutional review in 2011, which will probably also reflect a continuation of the Government’s trend toward more Kurd-friendly policies. Rapprochement could split the PKK and create internal conflicts. The European executive of the PKK, the European Kurdish Democratic Community Coordination, will probably continue the dual strategy of armed conflict on the front line and superficially peaceful campaigning for political recognition in Europe. The focus, in Switzerland as elsewhere in Europe, will continue to be on propaganda, covert collection of contributions and the recruitment of young fighters and cadres. The leadership structure remains stable. The cadres act professionally, operate crossborder networks and are regularly replaced. European safe haven The diaspora community’s demonstrations are less to do with the situation in the Kurdish area and more to do with the situation in the diaspora itself. The protests are centred around the coercive measures taken against European PKK cadres and media such as Roj TV. The potential for violence and for mobilization for protests and attacks on Turkish institutions remains, particularly among young people belonging to the PKK’s youth movement, Komalen Ciwan. However, the PKK can operate best under peaceful conditions in Switzerland. PKK flag at a demonstration in front of the Federal parliament building [archive photo] ANNUAL REPORT 2010 | FIS 37 TERRORISM | LTTE and its successors 1.4 LTTE and its successors SELEC TED E VENTS 3 March In Germany, five members of the Tamil Coordination Committee (TCC) were arrested by the police. The TCC functioned in Germany as the coordination centre for the Liberation Tigers of Tamil Eelam (LTTE). 5 May A member of the TCC was arrested in Offenburg (Germany). It is alleged that during a collection for the LTTE, the man stabbed and wounded a Tamil who was unwilling to contribute. 14 May In Vancouver (Canada), a Canadian citizen of Tamil origin was sentenced to six months in prison for financing terrorism. The man had admitted raising funds for a Tamil non-governmental organization in the knowledge that these would benefit the LTTE. 12 June Following a bomb attack on a railway track in the Indian state of Tamil Nadu, leaflets were found pointing to the LTTE as the perpetrators. 15 June In the Netherlands, four members of the LTTE were arrested for financial support of a terrorist organization. 27 November The LTTE’s annual Heroes’ Day celebration took place at Forum Fribourg. LTTE propaganda at a Tamil event in St. Gallen 38 ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | LTTE and its successors SITUATION End of LTTE in Sri Lanka In 2010, the security situation in Sri Lanka continued to stabilize. The LTTE no longer plays any role in this island state and is considered to have been annihilated. Of the approximately 11,000 people arrested as LTTE combatants after the war, the majority have been released, since they are no longer considered a threat to the Sri Lankan state. Some of the numerous foreign branches of the LTTE, including in Switzerland, still exist, but as in the previous year came under enormous pressure from the law enforcement agencies. On 3 March, five LTTE cadres were remanded in custody in Germany. In the Netherlands, seven LTTE members were arrested on 26 April and a further four on 15 June. On 12 June, in the Indian state of Tamil Nadu there was a bomb attack on a railway track, for which the LTTE was held responsible on the basis of leaflets discovered there. However, the Indian authorities have not confirmed that the LTTE was behind the attack. Political groups as successors In the competition for the LTTE’s political legacy and international network, two Tamil groups have pushed their way to the fore: ▪▪ The Global Tamil Forum (GTF), based in England, is a amalgamation of several national Tamil forums; in 2010 the GTF was relatively inactive. ▪▪ The Transnational Government of Tamil Eelam (TGTE) sees itself as the Tamil government in exile and as the political contact for all matters relating to Tamils in Sri Lanka. It is represented in countries with large Tamil diaspora communities – as well as Switzerland, these include Australia, Denmark, Germany, France, the UK, Italy, Canada, New Zealand, Norway, Sweden and the US. Like the LTTE, both organizations advocate a Tamil state in Sri Lanka, but they officially distance themselves from the Tigers’ use of violence. For the purpose of democratic legitimacy, the TGTE organized elections for its parliament in exile at the beginning of May, in countries where this was possible. These included Switzerland. The parliament convened a few weeks later in Philadelphia (USA). Players in Switzerland Several players were also active in Switzerland: ▪▪ Although the LTTE in Sri Lanka has been destroyed, the Swiss branch of the organization is still active and in 2010 it organized a few private gatherings. However, the number of participants at these gatherings, most of which took the form of commemorative events, was lower overall than in previous years. ANNUAL REPORT 2010 | FIS 39 TERRORISM | LTTE and its successors ▪▪ The TGTE maintained a secretariat in Geneva, but it was not particularly active and has since been closed. In October, a Swiss Tamil woman was elected in New York (USA) as deputy spokesperson of the parliament in exile. At the beginning of November, a Sri Lankan citizen resident in Switzerland was appointed as a deputy minister in the TGTE. ▪▪ The Swiss Council of Eelam Tamils (SCET), which was established in March by elections in the Tamil community in Switzerland, was more active. SCET restricts its activities to Switzerland, and it also has as its aim the establishment of an autonomous state in Sri Lanka. Many of its members, like the Swiss representatives in the TGTE, have links with the LTTE. SCET organized demonstrations in June and August in front of the UN office in Geneva, and at the end of August it organized a protest march from Geneva to Brussels to demonstrate against discrimination against Tamils in Sri Lanka. These events passed off peacefully and received little public attention. Despite the destruction of the LTTE in Sri Lanka, funds are still being collected in the Tamil community in Switzerland, and funds from abroad are being channelled into Switzerland. While in previous years there were indications that the money was being used to support the LTTE in Sri Lanka, it was unclear what the funds were being used for in 2010. TGTE elections in Switzerland 40 ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | LTTE and its successors ASSESSMENT Power struggle in the Tamil separatist movement There is very little difference between the ideologies of the Tamil groups which emerged following the defeat of the LTTE. Their goal remains the creation of an autonomous Tamil state in Sri Lanka, although, unlike the LTTE, they want to establish it by political means and not by force of arms. However, there are differences and in-fighting regarding the leadership role and influence on the large Tamil diaspora community around the globe. A resolution of the struggle for power will be complicated by the fact that these groups lack the backing of the Tamil population in Sri Lanka. The latter are exhausted and are preoccupied with rebuilding their livelihoods. While for a long time the LTTE and their fight for a Tamil state did have the backing of Tamils in Sri Lanka, this is no longer the case today. It is therefore probable that the post-LTTE groups will in the short to medium term be primarily preoccupied with their own affairs. There is also the possibility of internal disputes involving violent conflict. Provisional end to the armed struggle Tamil terrorism came to an end – possibly only a temporary one – with the annihilation of the LTTE in Sri Lanka. In the medium term, the improving security and economic situation in Sri Lanka should also benefit Tamils in the east and north of the country and further dampen their interest in armed resistance. If, however, the government excludes the Tamils from economic progress or treats them as second-class citizens, dissatisfaction could once again find expression in violent protests and renewed support for a separatist and potentially terrorist movement. In such a case, the large Tamil diaspora community in Switzerland may once again show solidarity with the population and also with any new terrorist group in Sri Lanka. ANNUAL REPORT 2010 | FIS 41 TERRORISM | The funding of terrorism 1.5 The funding of terrorism SELEC TED E VENTS 42 4 March The National Council, as the second chamber, referred the motion ‘The UN is undermining the basis of our legal system’ to the Federal Council (Motion 09.3719). The motion calls for Switzerland to suspend the implementation of UN sanctions to combat terrorism where these do not meet minimum procedural safeguards. 23 June The German Federal Ministry of the Interior has banned the International Humanitarian Aid organization (IHH) for its indirect financial support of Hamas. July A jihadist internet forum looked at the issue of how a terrorist group active in Iraq, Islamic State of Iraq (ISI) could make up for the shortfall in donations. Suggestions made included criminal activities such as kidnapping and extorting protection money. 1 August The agreement between the EU and the US on SWIFT, the Society for Worldwide Interbank Financial Telecommunication, came into force. Since then, it has again been possible for the US, on request, to access and analyse SWIFT data relating to suspicious bank transactions. The previous agreement did not stand up to EU data protection guidelines. 9 September The EU’s Court of First Instance reprimanded the EU, stating that the legal basis for entering the Al-Aqsa Foundation on the EU’s list of terrorist organizations was insufficient (ECJ, Court of First Instance, Case T-348/07 Stichting Al-Aqsa v Council of the European Union). 26 September The UN Special Rapporteur on human rights and counter-terrorism presented his report to the UN General Assembly. He complained that individuals included on the UN terror list had no recourse to legal action to contest their inclusion. ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | The funding of terrorism SITUATION Overview In Switzerland, the number of suspicious activity reports submitted to the authorities by Swiss financial services providers in connection with suspected financing of terrorism remained low. In 2010, only 13 out of a total of 1,159 suspicious activity reports submitted to the Money Laundering Reporting Office (MROS) related to suspected financing of terrorism. Ten of these were passed on to the law enforcement agencies. One noticeable change compared with last year is in the level of the reported assets: in 2009 these amounted to around 9,500 francs, but in 2010 they were over 23 million francs. However, this should be qualified by the fact that one single suspicious activity report, concerning assets of over 18.6 million francs, alone accounted for the bulk of this figure. This case is still being processed. In four further cases with a combined total of around 4.4 million francs, proceedings were terminated. It is consequently not possible to demonstrate any change in the trend compared with the previous year. The consistently low number of suspicious activity reports in Switzerland should not distract from the fact that there is still a need for action to be taken on the financing of terrorism. The German ban on the IHH and the SWIFT agreement demonstrate this. Legal tensions The balance between safeguarding legal principles and taking measures to combat the financing of terrorism was a frequent subject of debate in 2010. A particular concern was the problem of how the so-called ‘terror lists’ should be used. Here, legal arguments received greater support than in the previous year. The referral to the Federal Council of the motion ‘The UN is undermining the basis of our legal system’, the reprimand of the EU Court of First Instance and the UN Special Rapporteur’s complaint in September are evidence of this. In July, a court of appeal in Washington DC was also looking at this problem (United States Court of Appeals, District of Columbia First page of the UN terror list ANNUAL REPORT 2010 | FIS 43 TERRORISM | The funding of terrorism Circuit, No. 09-1059, PMOI v. USDoS). The court objected to the fact that the People’s Mojahedin Organization of Iran (PMOI) had not been granted a fair hearing when it was entered on the US State Department’s list of foreign terrorist organizations. The State Department therefore had to review the listing. At the end of November, the EU, through its Official Journal, informed several organizations included on the EU terror list that they could submit a documented request to the Council of the European Union that their entry be reviewed (O.J. C 316/06 of 20 November 2010). Funding from criminal activities Terrorist organizations have long been using criminal activity as a source of funding. Recent years have seen an expansion in such activity, and in 2010 the trend continued. For example, in the Sahel region AQIM kidnapped several citizens of Western countries in order to extort a ransom. A new development was observed on the Horn of Africa, where there is said to have been contact between the pirates on the Somalian coast and al-Shabaab Islamist rebels. Through these contacts, al-Shabaab could gain logistical as well as financial support. 44 ANNUAL R E P O RT 2 0 1 0 | F I S TERRORISM | The funding of terrorism ASSESSMENT Switzerland not a terrorism funding hub Switzerland as a financial centre still does not play a key role in the financing of terrorist activities. This can be seen from, among other things, the low number of suspicious activity reports submitted to the authorities by Swiss financial services providers and the small number of investigations into suspected terrorism funding carried out by the federal criminal police in recent years. However, it should be borne in mind that both in Switzerland and abroad, informal payment systems and other alternative methods of transferring funds, such as the hawala system or cash couriers are largely beyond the control of the authorities. Moreover, it is always difficult to provide concrete proof that funds will be used for terrorist activities after they have been taken out of the country. Global standards Improving international cooperation is particularly important given the tension between legal principles and state sanctions for combating terrorism funding. It is imperative that acceptable common legal standards be established and applied. Otherwise, suspected terrorist organizations could use legal actions to force state authorities to act and could even demand and receive compensation, which in the worst-case scenario could then be used to fund terrorist activities. Switzerland has been active in this area for years, supporting jointly with other countries an initiative aimed at making UN listing and delisting procedures more transparent. A dangerous mixture Combating criminal activities which serve to fund terrorism remains a major challenge. The situation becomes even more difficult when these activities are indirectly supported by countries, as can happen for example where ransoms are paid in kidnapping cases. Terrorists pursue their funding activities in every conceivable area and now make only very limited use of the international banking system for transferring money. ANNUAL REPORT 2010 | FIS 45 2. Violent extremism ANNUAL REPORT 2010 | FIS 47 VIOLENT EXTREMISM | Right-wing extremism 2.1 Right-wing extremism SELEC TED E VENTS 48 23 January Early on this Saturday morning, a brawl took place in a well-known pub in Bern, in which three individuals from right-wing extremist and hooligan circles were involved. The three men beat and kicked their two victims, who both needed hospital treatment. The cantonal police carried out searches of the houses of two of the suspects and seized weapons and ammunition. At the time of going to press, proceedings for attempted grievous bodily harm and violation of weapons law were still pending. 31 January On this Sunday, there was a large-scale confrontation between right-wing extremists and other festival-goers at a festival in Schwanden, in the canton of Glarus. Several injured people needed hospital treatment. The cantonal police brought charges of assault and, where applicable, affray. 1 March In a violent altercation between three men in Basel, a dark-skinned foreigner was seriously injured and had to be hospitalized. Criminal proceedings were instituted against the two perpetrators, of whom at least one is a right-wing extremist known to the police. 13 / 14 March In Amriswil, in the canton of Thurgau, approximately 120 to 150 people took part in a skinhead concert. The concert-goers were from various parts of Switzerland, but also from abroad, including Germany and Austria. Right-wing extremists had hired the party room on the pretext of holding a birthday party. 25 April At a gravel quarry in the canton of St. Gallen, nine right-wing extremists played airsoft and engaged in paramilitary exercises. Airsoft involves teams equipped with airguns fighting against each other, simulating military scenarios. ANNUAL R E P O RT 2 0 1 0 | F I S VIOLENT EXTREMISM | Right-wing extremism 8 August In 2010, right-wing extremists continued their tradition of celebrating Swiss National Day at the Rütli, in the canton of Uri. However, since 2006 they have stopped taking part in the official celebrations, generally holding their celebration separately on the Sunday following 1 August. This is because since that time access to the Rütli meadow has been regulated by means of a ticketing system. In 2010, approximately 150 right-wing extremists gathered at the Rütli; their celebrations passed off peacefully and without incident. 19 September In Dulliken, in the canton of Solothurn, an altercation occurred between right-wing extremists and foreigners. One right-wing extremist used a pepper spray and also injured some of the bystanders. A right-wing extremist kitted out for airsoft and paramilitary exercises ANNUAL REPORT 2010 | FIS 49 VIOLENT EXTREMISM | Right-wing extremism SITUATION Number of events The situation regarding right-wing extremism in Switzerland has not changed substantially in recent years, including the downward trend in numbers. In 2010, a decrease in the number of events motivated by right-wing extremism was recorded, down to a total of 55, following a slight increase in 2009, when there were 85 compared with 76 in 2008. The number of incidents involving violence fell from 32 to 13, representing the lowest level for many years (2008: 24, before that, between 52 and 64). Furthermore, there is a clear continuation of the trend toward purely political events, which in accordance with the Federal Act on Measures to Safeguard Internal Security (BWIS) are not subject to surveillance by the intelligence services. Commemorative days Right-wing extremists attach particular importance to Switzerland’s history and regularly take part not only in the National Day celebrations and the commemoration of the Battle of Sempach, but also in other commemorative 111 109 109 100 85 76 Total number 75 of incidents 64 50 52 Number of violence-related incidents 25 0 50 55 58 24 32 13 2005 2006 2007 2008 2009 2010 ANNUAL R E P O RT 2 0 1 0 | F I S days. For example, right-wing extremists met in September in the canton of Bern to remember, in a wreath-laying ceremony, the soldiers who fell in World War One. In October 2010, a rightwing extremist group carried out a ceremony in the canton of Nidwalden to commemorate the French invasion of 1798. On 26 June 2010, the Lucerne authorities refrained on security grounds from holding an official battle celebration at Sempach, in the canton of Lucerne, and just held a commemorative mass. The Party of Nationally Oriented Swiss (PNOS) organized a wreath-laying ceremony at the Winkelried monument in Sempach on 3 July. Shortly afterwards, the wreath was removed, probably by left-wing extremists. In retaliation, the PNOS threatened to fit next year’s wreath with an explosive device, in order to prevent a similar occurrence. It also warned that left-wing extremists in the canton of Lucerne would have ‘nothing to laugh about’ in the next few months. The Lucerne criminal investigative authorities launched an initial investigation into the PNOS explosives threat. The proceedings were then abandoned, as the requirements for bringing a prosecution were not fulfilled. For its part, the PNOS has offered a reward of 500 francs to find the perpetrator or perpetrators and says that it has filed criminal charges for theft. On 9 July, PNOS representatives laid another wreath in front of the monument. Examination by the police revealed that the wreath was not fitted with an explosive device. Events motivated by right-wing extremism reported to the FIS since 2005 (excluding graffiti) VIOLENT EXTREMISM | Right-wing extremism Racial discrimination law In June 2009 the first Anne Frank Square in Switzerland was inaugurated in Birsfelden, in the canton of Basel-Country. Afterwards, the then President of the Basel Section of PNOS posted a text on the Basel Section’s website describing Anne Frank’s diary as historically inaccurate and also casting doubt on the Holocaust. On 23 June 2009 a complaint was filed against him in Basel for violation of the racial discrimination law (Art. 261bis of the Swiss Criminal Code (SCC)); in October 2009 he was charged and, as the person responsible for the website at the time of the offence, he was sentenced to a heavy fine by the Basel court on 21 June. The verdict became final in July. The convicted man is one of the most active right-wing extremists and also maintains international contacts. Moreover, this was not the first time that this PNOS representative had come into conflict with the law. In 2006 he was reported for assault and bodily harm and was later convicted. Overall, recent years have shown that convictions of all types, including for violation of the racial discrimination law, can have a considerable preventive effect in right-wing extremist circles. Following convictions, right-wing extremist activity decreased dramatically or ceased altogether. Furthermore, it was clear that the convictions led to fewer new people joining the scene. Weapons and violence Various incidents in 2010 showed that rightwing extremists are still prepared to act with strong violence. Their fondness for weapons and combat is also reflected in the paramilitary exercises and combat training that are organized and attended by various right-wing extremists. Incidents such as the assaults at the beginning of March in Basel show that for right-wing extremists, foreigners still represent the enemy. Left-wing extremists are another target of their hostility. Right-wing extremism in French-speaking Switzerland In French-speaking Switzerland, right-wing extremist groups have been less active over the last five years. Some long-standing adherents have abandoned or severely curtailed their activities. It is possible that this is also linked to the racist incidents at a right-wing extremist concert in Gamsen, in the canton of Valais, in 2005 and to the total of twelve sentences handed down as a result in 2009. Right-wing extremists are particularly active in the cantons of Geneva and Vaud. Right-wing extremist circles in the cantons of Neuchâtel and Jura are very small; in the cantons of Valais and Fribourg they are in the middle of the range for French-speaking Switzerland in terms of the numbers of adherents and their activities. Overall, the right-wing extremist scene as a whole in French-speaking Switzerland numbers just over 100 activists. In French-speaking Switzerland as a whole, only certain types of activity take place, such as skinhead concerts, festivals and meetings, whereas in German-speaking Switzerland activities carried out also include leafleting, parties, political events, commemorative services and funeral marches. Right-wing extremists ANNUAL REPORT 2010 | FIS 51 VIOLENT EXTREMISM | Right-wing extremism from French-speaking Switzerland often travel to German-speaking Switzerland to take part in events such as concerts or the Swiss National Day celebrations at the Rütli in the canton of Uri. Up until around five years ago, negationism, or the denial of genocide and in particular the Holocaust, played a considerable role in Frenchspeaking Switzerland. The chief negationists at that time have since withdrawn from the scene or served their sentences following convictions for violation of the racial discrimination law. Since then, activity in French-speaking Switzerland has also quietened down in this area, and the international contacts which previously existed, primarily with negationists in France, have become less frequent. planned extremely clandestinely, and they often succeed in holding events in secret. The authorities frequently only find out about a meeting after the event. While the number of conflicts between rightand left-wing extremists is increasing in most European countries, in Switzerland a decline can be observed. This could be linked to the overall decline in right-wing extremist activity here, but could also be attributable to direct and improved prevention and repression measures. Right-wing extremism in Europe Activities motivated by right-wing extremism have declined slightly in most European countries. In some countries, they have fallen to a very low level. Overall, the situation in Europe can be seen as being relatively peaceful. Right-wing extremists are becoming increasingly conspiratorial, in order to evade the authorities’ surveillance and security measures, as well as political and militant pressure from the left-wing extremist camp. Activities are Weapons and ammunition seized during a house search 52 ANNUAL R E P O RT 2 0 1 0 | F I S VIOLENT EXTREMISM | Right-wing extremism ASSESSMENT Europe-wide developments There have been few new developments in right-wing extremist circles in most European countries in the last two years. The situation in Switzerland broadly reflects the European trend. The reasons for the decline in the number of confrontations between right- and left-wing extremists in Switzerland, in contrast to the trend in the rest of Europe, are unknown. PNOS The incidents involving PNOS demonstrate the duplicitous approach of the party, which as a political association officially distances itself from the use of violence. Some members have been convicted of making racist remarks, are violent or at least prepared to use violence, and maintain contacts with internationally known right-wing extremist groups and parties. PNOS is repeatedly confronted with its members’ violations of the law, shown by the convictions for breaches of the racial discrimination law. In 2010, events surrounding the Sempach memorial day demonstrated PNOS’ continuing willingness to use violence and the readiness of its representatives to engage in trench warfare with left-wing extremists. The incidents are characteristic of violent extremist circles in Switzerland. Right- and left-wing extremists continually provoke one another; they threaten to obstruct or disrupt the other side’s events. Nonetheless, the number of actual confrontations between the two ideological camps in Switzerland has declined, making it the exception in Europe. Overall assessment Compared with German-speaking Switzerland, right-wing extremist circles in Frenchspeaking Switzerland are small and fragmented. As in German-speaking Switzerland, numbers fluctuate considerably, but most adherents here are somewhat older than in German-speaking Switzerland. In the cantons of French-speaking Switzerland, there has been only limited extremist activity, with right-wing extremists tending to travel from French-speaking Switzerland to German-speaking Switzerland. Overall, right-wing extremist activities do not currently pose a threat to Switzerland’s internal security. However, they may cause sporadic and localised breaches of the peace and of public order, and therefore have considerable potential to cause damage. This continually results in considerable costs being incurred for police operations at demonstrations, for example in order to prevent clashes between right- and leftwing extremists. ANNUAL REPORT 2010 | FIS 53 VIOLENT EXTREMISM | Left-wing extremism 2.2 Left-wing extremism SELEC TED E VENTS 54 30 January In Basel, around 300 people took part in an authorized demonstration against the World Economic Forum (WEF) in Davos, in the canton of Graubünden. This resulted in property damage totalling 90,000 francs due to spray-painting, broken glass and a flare being thrown at a car. 7 February Around a hundred left-wing extremists among the 500 participants were responsible for property damage put at around 500,000 francs during an unauthorized ‘Reclaim the Streets’ rally in Zurich organized via SMS messages, flyers and Facebook. 15 April In Langnau am Albis (Zurich), the police arrested three left-wing extremists who were allegedly planning to attack a new IBM factory building in Rüschlikon (Zurich). The police seized a letter claiming responsibility, as well as gas bottles and explosives. 24 April In Winterthur (Zurich), eight delivery lorries belonging to Allgemeine Plakatgesellschaft (APG) were set on fire. The total cost of the damage caused was put at around 200,000 francs. 1 May In Basel, after three cars were destroyed and two others damaged in the early morning hours, left-wing extremists carried out further attacks on vehicles at a clandestinely organized follow-up demonstration in the evening and attacked a police station with Molotov cocktails. The total damage caused to property in connection with the 1 May events in Basel amounted to around 326,000 francs. 21 May Left-wing extremists at an unauthorized, clandestinely organized ‘Reclaim the Streets’ rally in Basel caused damage to vehicles and shop windows and damage to property through spray-painting which was put at 750,000 francs. ANNUAL R E P O RT 2 0 1 0 | F I S VIOLENT EXTREMISM | Left-wing extremism 12 June In Freiburg, around a hundred left-wing extremists held a demonstration of solidarity with two French people who had been arrested. During the severe rioting that followed, direct attacks were made on the prison and the police headquarters. Two policemen were injured, and checks were carried out on 40 demonstrators. 18 September Property damage estimated at around 300,000 francs was caused during an arson attack on a construction site on the Hardbrücke bridge in Zurich. 27 / 28 November In Allschwil (Basel-Country) masked figures stole ballot boxes for the referendum on the deportation of foreign criminals and set them on fire. The polling station in Schlieren (Zurich) was the target of an attempted arson attack and locks at various polling stations in Winterthur (Zurich) were glued up. After the referendum, unauthorized demonstrations took place in Zurich and Bern. Rally against police violence on 12 June in Freiburg ANNUAL REPORT 2010 | FIS 55 VIOLENT EXTREMISM | Left-wing extremism SITUATION Number of events Compared with 2009 (220 incidents), the number of incidents motivated by left-wing extremism rose in 2010 to 254, of which 109 were connected with acts of violence. The increase of around 15 per cent can be attributed in particular to campaigns, some of which involved violence, against the 28 November 2010 referendum on the deportation of foreign criminals, launched by the SVP, and to numerous solidarity campaigns with alleged political prisoners. The case of three left-wing extremists arrested in April 2010, who had allegedly planned an attack on IBM in Rüschlikon, was of particular significance. Peaceful WEF 2010 The WEF took place in Davos (Graubünden) from 27 to 31 January 2010. The downward trend of previous years in the numbers of protesters mobilized continued; once again, the opponents of globalization failed to coordinate their campaigns, which proceeded in line with the expectations of the police and organizers, on a national level. A total of three rallies were held, all of which were authorized. Damage to 254 250 227 222 214 220 200 Total number of incidents 150 140 1 May saw a high level of damage to property On Labour Day, a large amount of damage was caused to property in Basel, Zurich and Bern. An unauthorized follow-up demonstration involving 120 left-wing extremists led to serious rioting in Basel. The police arrested 15 people. In Zurich, Labour Day passed off with no major rioting or damage to property, thanks to systematic intervention by the police. Nonetheless, two people were injured in clashes, one of them a policeman. 353 people were temporarily detained. In Bern, in the early hours of 2 May, a Molotov cocktail was thrown at a police patrol near the Riding School. In Lausanne (Vaud) there was an unauthorized demonstration by left-wing extremists. 54 people were stopped and searched. No major damage to property was recorded. 147 126 Number of 100 violence-related incidents property was recorded in Lucerne on 23 January and most notably in Basel on 30 January. Altogether, around 800 people took part in the demonstrations; in 2009 there had been a total of 1,800 participants. Left-wing extremists carried out two arson attacks in connection with the WEF, one of which failed, and three paint attacks. The property damage caused by these, put at around 106,000 francs, roughly corresponded to that of the previous year. The organization Revolutionärer Aufbau Schweiz (RAS) claimed responsibility for three of the five attacks. 110 127 109 50 0 56 2005 2006 2007 2008 2009 2010 ANNUAL R E P O RT 2 0 1 0 | F I S Events motivated by left-wing extremism reported to the FIS since 2005 (excluding graffiti) VIOLENT EXTREMISM | Left-wing extremism Rioting at two ‘Reclaim the Streets’ rallies On 21 May in Basel, 15 left-wing extremists provoked rioting which caused damage in the region of 750,000 francs. They were part of a crowd of around 200 people. A similar event had taken place earlier in the year, on the night of 6/7 February in Zurich, when around 100 left-wing extremists not only caused damage of around 500,000 francs, but also attacked the police directly with teargas, bottles and stones. In both cases, violent left-wing extremists exploited for their own purposes a so-called ‘Reclaim the Streets’ event, clandestinely organized by persons unknown. These events involve the (illegal, but generally peaceful) symbolic ‘recapture’ of public space which the organizers perceive as having been commercialized or privatized, by holding a street festival or a parade. The organizers of such events are not part the left-wing extremist scene. What was striking in Zurich and Basel was the clever way in which the well-equipped and highly mobile violent left-wing extremists had planned and prepared their actions. A new tactic in Zurich was the deliberate large-scale mobilization of football fans. Planned attack on nanotechnology laboratory One of the key events of 2010 was the arrest of three left-wing extremists on 15 April in Langnau am Albis (Zurich). They were alleged to have planned an attack using an improvised explosive device (IED) on a nanotechnology laboratory being built in Rüschlikon (Zurich). The three had close links with the an- archist movement in Italy and there were also some links with Revolutionärer Aufbau Zurich (RAZ). RAZ runs one of the two central secretariats of Secours Rouge International (SRI); the other is located in Brussels. Since their arrest, left-wing extremists, both abroad and in Switzerland, have organized a campaign of solidarity with the detainees. These included so-called ‘prison walks’ and paint and arson attacks. The campaign reached its peak with the actions instigated by SRI on 18 and 19 September in aid of alleged political prisoners serving long sentences. The days of action were also in support of Marco Camenisch, in prison for murder, and culminated on 18 September in an arson attack on a construction site on the Hardbrücke bridge in Zurich, causing around 300,000 francs’ worth of damage to property. As a gesture of solidarity with alleged political prisoners, several parcel bomb attacks were carried out in Italy on 23 December 2010. A parcel bomb exploded at the Swiss embassy in Rome, seriously injuring an embassy employee on both hands. In claiming responsibility for the attacks, the left-wing extremist group Federazione Anarchica Informale (FAI), also made reference to the prisoners detained in Switzerland. Previously, on 1 and 2 November 2010, the Swiss diplomatic mission in the Greek capital Athens, along with other embassies, had also been the target of an attempted parcel bomb attack. A jet of flames shot out when a suspicious parcel was investigated. No-one was injured. The Greek left-wing extremist organization Conspiracy of Fire Cells claimed responsibility for the series of attacks. ANNUAL REPORT 2010 | FIS 57 VIOLENT EXTREMISM | Left-wing extremism Attacks against genetic engineering In 2010, the left-wing extremist movement took up the issue of genetic engineering. In connection with this, activists carried out a herbicide attack on 24 June in Pully (Vaud) on a field where genetically modified wheat was being trialled. Furthermore, the house and car of a professor of genetic engineering at the Federal Institute of Technology (ETH) were targeted in a paint attack in Zurich on 29 June. Anti-fascism Asylum, anti-repression, anti-racism and anti-fascism are particular focal points in the spectrum of left-wing extremist issues. Falling into this category were the many actions in connection with the deaths of two detainees in Bochuz (Vaud) and Schöngrün (Solothurn), in March and June respectively, and the death of a car thief from a suburb of Lyon. The latter was shot by police on 18 April in Sévaz (Fribourg). The Sévaz incident, linked to the arrest of two further car thieves shortly afterward, prompted left-wing extremists to hold a rally on 12 June in Fribourg, which led to serious riots. Of the approximately 100 demonstrators, at least 20 were French, mainly from the suburbs of Rouen, where numerous left-wing extremist squatters from the Geneva squatter movement which was disbanded in 2007 have made their home. On 2 October, the 10th ‘anti-fascist evening walk’ took place in Bern without any violent incidents. The authorities had not authorized the event, but nonetheless allowed it to go ahead. In the period to autumn 2010, the federal capital was less affected by left-wing extremist vio- 58 ANNUAL R E P O RT 2 0 1 0 | F I S lence than in previous years. The main reason for this was probably the 26 September referendum on the future of the Riding School, as the extremists did not want to jeopardize its continued existence by engaging in violence beforehand. For years, the Riding School has been seen as the rallying point for violent left-wing extremist actions. Following the passing of the referendum on the deportation of foreign criminals in November, however, the federal capital experienced a renewed increase in violent incidents motivated by left-wing extremism. Actions linked to the deportation initiative also took place elsewhere. On 27 November in Allschwil (Basel-Country), masked figures entered the polling station, stole ballot boxes and set them on fire. On 28 November, the polling station in Schlieren (Zurich) was the target of an attempted arson attack. At various polling stations in Winterthur (Zurich), locks were glued up. On the evening of the Sunday referendum, left-wing extremists responded to the result of the referendum by holding unauthorized rallies in Zurich and Bern. The participants in these demonstrations caused damage to property put at tens of thousands of francs. VIOLENT EXTREMISM | Left-wing extremism ASSESSMENT Issues 2010 was characterized by a large number of solidarity and protest actions on a wide variety of issues. There was considerably less emphasis on the economic crisis than there had been in the previous year. By contrast, the main priorities from the very broad range of issues taken up by left-wing extremists were the struggles against repression, fascism, sexism and migration and asylum policies. The choice of issues here is heavily influenced by current events. For example, the referendum on the deportation initiative was accompanied by violent incidents and rioting, the like of which had never been seen before in Switzerland in connection with voting. Potential for violence The potential for violence in left-wing extremist circles remains high. It is believed that left-wing extremists still number around 2,000, of whom 1,000 are violent. In 2010, no tendency toward terrorism motivated by left-wing extremism could be identified. However, ties between the Swiss scene and left-wing terrorist groups abroad are still significant, with RAS and SRI playing a leading role. RAS remains the most violent left-wing extremist organization in Switzerland. In November 2010, the Office of the Attorney General of Switzerland brought charges against an RAS member at the Federal Criminal Court in Bellinzona. The principal charges against him related to IED attacks on business premises in the Zurich area. These were carried out in the run-up to the G8 summit in Heiligendamm (Germany) in June 2007 and at the beginning of WEF 2008. As the suspect had previously been expelled from RAS due to internal disagreements, no solidarity actions followed. Exploded parcel bomb – Swiss embassy in Rome, 23 December ANNUAL REPORT 2010 | FIS 59 VIOLENT EXTREMISM | Animal rights extremism 2.3 Animal rights extremism SELEC TED E VENTS 1 March Unidentified perpetrators spray-painted the façade of a fur shop in Schwyz. 1 June In Lugano (Ticino), a demonstration of solidarity with Austrian activists took place. Offensiva Animalista organized a gathering in front of the Austrian consulate. 9 June Protests in front of the Austrian consulate in Geneva were directed against the Austrian government, which the protesters saw as having taken repressive actions against animal rights activists. 27 August Acts of vandalism committed during the 23rd donkey race in Mezzovico (Ticino). 11 September / Damage to hunting lodges in Biberist (Solothurn) in the name of the Animal Libera1 October tion Front (ALF), with at least 2,000 francs of damage to property caused in each case. 21 November 60 In Lugano (Ticino), posters advertising the Knie Circus were damaged. The ALF claimed responsibility for the action. ANNUAL R E P O RT 2 0 1 0 | F I S VIOLENT EXTREMISM | Animal rights extremism SITUATION ALF Of all the actions recorded in 2010, those of the ALF were particularly notable. Their modus operandi follows one of two patterns: on the one hand they free animals directly, and on the other hand they cause harm or damage to people or companies which are allegedly involved in the exploitation of animals. The second type includes sabotage, vandalism and arson. In 2010, the ALF carried out campaigns of both types. Overview of campaigns and solidarity actions Animal rights extremists continued to be active in 2010. Their protests were directed against fur traders, butchers, zoos, circuses, pharmaceutical companies, wholesale distributors and other companies which were in some way connected with the keeping of animals. With a few exceptions, these passed off peacefully. Among the campaigns which were im- portant for Switzerland were those against the fur trade, the use of animals in circuses and the UK animal research company Huntingdon Life Sciences (HLS) and the campaign in support of Austrian animal rights activists who stood trial in Austria in 2010. SHAC The Stop Huntingdon Animal Cruelty (SHAC) campaign has the goal of forcing HLS to close down. In 2010, it had very little impact in Switzerland, although the situation was different in the UK, Germany and France, where sporadic criminal actions took place. In point of fact, campaigns against Novartis and other pharmaceutical companies in Switzerland were less prominent than in the previous year. Site of the paint attack in Schwyz on 1 March ANNUAL REPORT 2010 | FIS 61 VIOLENT EXTREMISM | Animal rights extremism Further campaigns In October, the company Escada decided to abandon the use of fur in its collections from January 2011, due to the pressure put on it by animal rights extremists prepared to use violence and the latter’s campaign against the fur trade. The decision can be seen as a victory for the animal rights activists, but is not irreversible. Depending on demand, fur products could be reintroduced into their range. The company Max Mara has now become the campaign’s principal target. Support for the Austrian activists was a particular focal point in 2010. As a reminder: on 21 May 2008, ten people from the Austrian animal rights activist camp were remanded in custody. In February 2010, the public prosecutor brought charges against 13 animal rights activists. The trial began in March, and was followed by a series of demonstrations in Switzerland, which passed off without damage to property. The activists demonstrated with banners and placards in front of the Austrian diplomatic missions in Switzerland to show their support for the accused. 62 ANNUAL R E P O RT 2 0 1 0 | F I S During 2010 there were frequent protests against the exploitation of circus animals. The campaign for circuses without animals Aktion Zirkus ohne Tiere (AZOT) was active at circus performances throughout Switzerland, but particularly in the cantons of Tessin, Vaud and Zurich. AZOT did not carry out any illegal actions. VIOLENT EXTREMISM | Animal rights extremism ASSESSMENT Issues 2010 passed off comparatively peacefully, and actions linked to the animal liberation movement were few and far between. The focus was on solidarity with the Austrian activists. This issue could in future give rise to further actions, principally at the sites of Austrian diplomatic missions. Furthermore, as the demonstrations carried out at Swiss circuses in 2010 showed, any decrease in AZOT activity is unlikely. Generally speaking, it can be said that the activists’ potential for violence remains low. However, the links between the animal rights extremists and left-wing extremist circles in Switzerland should not be overlooked, nor should those with animal rights extremists abroad, particularly in Italy, France and the Netherlands, who are prepared to use violence. Potential for violence In recent years, the readiness of animal rights extremists in Switzerland to use violence has been most apparent in the SHAC campaign. Until now, however, Swiss animal rights extremists have not shown the propensity to use violence on as large a scale as can be seen in other countries. Nonetheless, there are violent animal rights extremists in this country, and Switzerland will probably continue to be the scene of violent actions by foreign SHAC activists. After all, several pharmaceutical companies targeted by the campaigns are based here, and it can be assumed that Swiss activists will support SHAC’s actions. It is thus to be expected that violent actions in connection with SHAC may be carried out at any time and also that the ALF may carry out illegal actions. Stop Huntingdon Animal Cruelty propaganda ANNUAL REPORT 2010 | FIS 63 3. Proliferation ANNUAL REPORT 2010 | FIS 65 PROLIFERATION SELEC TED E VENTS 66 12 January A motorcycle bomb explosion in Tehran allegedly killed a well-known Iranian nuclear scientist. 29 March Russia and the International Atomic Energy Authority (IAEA) reached agreement on the establishment of a nuclear fuel bank. This will be open to all members of the Nuclear Non-Proliferation Treaty who fulfil their obligations. 7 June The UN Security Council extended for a further year the mandate of the panel of experts monitoring the imposition of sanctions on North Korea. 9 June The UN Security Council tightened its sanctions on Iran. 30 September The US IT security company Symantec published a detailed analysis of malware thought to be aimed at sabotaging the Iranian enrichment programme. 12 November North Korea revealed the long-suspected existence of its uranium enrichment plant during the visit of a delegation of US experts. 23 November The IAEA in Vienna once again called on Syria to clarify discrepancies in its nuclear programme. 29 November A representative of the Iranian nuclear programme died in a suspected assassination, and another was injured in a similar attack. 6 December In Geneva, a further round of talks in the dispute about Iran’s nuclear programme took place. ANNUAL R E P O RT 2 0 1 0 | F I S PROLIFERATION SITUATION Overview Proliferation is the term used to refer to the further spread of weapons of mass destruction and their delivery systems or of goods and technologies used for their production and acquisition. Switzerland is affected by the proliferation of weapons of mass destruction both on a national level (for example as a supplier of technology) and on an international level (for example through regional destabilization). It is in Switzerland’s national interest to restrict the availability of weapons of mass destruction. North Korea and Iran continue to lie at the centre of the proliferation debate. However, Syria, Sudan, Myanmar and other countries are also rumoured to have relevant programmes. In 2010, North Korea made a high-profile return to the international stage with the news of its construction of a light water reactor and a uranium enrichment facility. During the same reporting period, numerous violent actions aimed at countering Iran’s nuclear ambitions were made public. In both the cases mentioned under ‘Selected Events’, the actions were thought to have been targeted specifically at representatives of Iran’s nuclear programme. It is difficult to gauge how severely this has been affected. The national and international non-proliferation agendas were dominated by Iran’s efforts to evade the international community’s sanctions. Iran is investing considerable resources in order to alleviate the perceptibly increased pressure of sanctions on its economy. To do so, the country is making use of every possible op- portunity, ranging from diplomatic measures (for example reconciliation and strengthening relations with important neighbouring countries) through to simple economic measures (for example the establishment of ‘Swiss’ companies in Switzerland). Attempts at circumvention The imposition of embargo measures against Iran is increasing the cost of monitoring, even though economic ties with Iran are tending to diminish. One of the reasons for this is the large number of companies approaching the authorities to enquire about the constraints on business dealings with Iran. The authorities not only explain the export regulations, but also provide information about, for example, possible terms of payment. This helps to protect companies from defaults on payments. The other reason is that in 2010 there were an increased number of companies wanting to profit from the difficult conditions of doing business with Iran. These included Swiss, Iranian and EU companies. Among EU companies, in particular, there was a clear desire to circumvent the EU embargo measures against Iran by doing business via Switzerland. For example, in 2010 an attempted bulk delivery of aircraft from a major European manufacturer to Iran via a network of middlemen, including some based in Switzerland, was prevented by referring the applicants to the competent foreign authorities. Pursuant to article 5 of the Goods Control Ordinance, individual export licences are issued only to private ANNUAL REPORT 2010 | FIS 67 PROLIFERATION individuals or legal entities that are resident or have a registered office on Swiss customs territory or in a Swiss customs free zone. On the international level, there are significant discrepancies in the implementation of sanctions on Iran. In the case of the EU, sanctions are implemented with various degrees of seriousness by individual member states. In 2010, for example, it was established that a large delivery of machine tools subject to international controls had been made to Iran from an EU member state. The delivery was falsely declared, with components critical to the system being delivered at a later date as spare parts. High-level government officials in the country concerned were aware of this procedure. Such behaviour puts Swiss companies at a competitive disadvantage and undermines the efforts of the international community. Politicization of economic relations 2010 revealed once again the extent to which economic relations with Iran are becoming politicized. Two separate transactions by Swiss companies received extensive coverage in the international media. In both cases, the reporting departed significantly from the facts. The reputational risk involved in business dealings with Iran remains very high. The merger between the Strategic Intelligence Service and the Service for Analysis and Prevention makes it easier for the Swiss authorities today to assess allegations against Swiss interests more comprehensively. This is because all available data is now included in a single overall evaluation and the new structure facilitates improved coordination. 68 ANNUAL R E P O RT 2 0 1 0 | F I S Iranian attempts at procurement via Russia In 2010, several attempts by Iran to procure potentially sensitive goods were prevented. The Iranian attempts were made via intermediaries in Russia. Initial contacts were made with companies in Switzerland which normally cover other segments of the market. It would thus appear that Iran is deliberately testing out new procurement channels. Swiss firms should be particularly cautious regarding contact with new customers who are obviously not end users and who make requests that are out of the ordinary, and should of their own accord contact the authorities. South Asia The Indian and Pakistani nuclear weapons programmes remain outside the Nuclear NonProliferation Treaty. These programmes are more and more geared towards operational military capabilities. The procurement processes are therefore currently focussed more on knowledge which would ultimately permit the deployment of the weapons capacity acquired and less on the acquisition of goods and technologies which would be used directly in the production of weapons. This knowledge includes, for example, expertise in the area of command and control systems, communications and preparation for operational deployment, such as cavern construction and the protection of critical military infrastructures. Attempts by the two rival countries to establish contacts with Switzerland were monitored and unwanted developments were prevented. PROLIFERATION Prophylax The prevention and awareness-raising programme Prophylax, with its extensive network of contacts with industry, proved effective yet again in 2010. Thanks to the established contacts and close links with industry, yet another Syrian procurement attempt was foiled. Prophylax demonstrates how collaboration between the federal government and the cantons makes it possible to arrive at a comprehensive picture of the shared threat, to the advantage of decision makers in both the federal government and the cantons. FIS intends to continue the Prophylax programme and also to promote closer contacts with companies and institutions involved in research. The prevention and awareness-raising programme thus applies not only to proliferation, but also to the closely-linked issue of industrial espionage. In this regard, policy is currently being reviewed to ascertain whether the awareness-raising programme should be extended, in a suitable form, to Switzerland’s banking, business and financial sectors. At the same time, legal clarification is being sought as to whether this falls under the jurisdiction of the FIS in collaboration with other federal authorities. This type of drilling and milling machine is used to produce printed circuit boards. There are indications suggesting that in Syria, equipment of this type is being used to manufacture navigation units for ballistic missiles. ANNUAL REPORT 2010 | FIS 69 PROLIFERATION ASSESSMENT Switzerland as a centre of industry Internationally, Switzerland is seen as a competitive business location offering excellent products, which is extremely customeroriented, has a high export ratio and offers very good general conditions in the areas of logistics, communications and finance. These strengths are also attractive to countries seeking to acquire weapons of mass destruction. For this reason, players in the proliferation field are looking for contacts or attempting to establish a presence in Switzerland. The areas of proliferation and illegal intelligence often converge, as proliferation activity may represent the actions of a government and, particularly where sensitive procurements are concerned, is accompanied by intelligence measures. It is important that businesses be aware of this circumstance, as a company which maintains sensitive contacts with procurement structures in high-risk countries can very quickly also become the target of intelligence services. Likewise, care needs to be exercised by Switzerland’s research, education and training institutions, as proliferation includes the transfer of knowledge. Key challenge The proliferation of weapons of mass destruction and their delivery systems is one of the key security policy challenges. It runs counter to the interests of a small country, in that it generally weakens security structures and reinforces power politics to the detriment of attempts at regula- 70 ANNUAL R E P O RT 2 0 1 0 | F I S tion. It may potentially also impact directly on Switzerland. For example, the balance of power in the Gulf region affects Switzerland’s energy supply. For this reason, too, Switzerland has an interest in a long-term stable and peaceful resolution to the dispute relating to the Iranian nuclear programme. Switzerland is fighting the efforts of foreign states to acquire weapons of mass destruction. In doing so, it is looking after its own security interests, implementing its international obligations and actively protecting its businesses and industries from misuse by third parties. The protection from misuse by third parties is increasingly becoming key, as in times of global economic crisis, Switzerland is facing systematic attacks on its locational advantages. Experience shows that the misconduct of a few can be used as a lever to alter the conditions for an entire sector of the economy. Export controls may increase the administrative costs for individual companies and in individual cases can even threaten their very existence. However, as shown above, they perform an important function, one that benefits the economy as a whole. In order to fulfil their responsibilities in the fight against the proliferation of weapons of mass destruction, the authorities need powerful weapons. These include, for example, modern methods of information procurement and easy exchange of data between federal and cantonal agencies and agencies abroad. Experience shows that without the appropriate tools, it is PROLIFERATION almost impossible to overcome the high hurdles which have to be cleared in order to institute criminal proceedings. ANNUAL REPORT 2010 | FIS 71 4. Illegal intelligence ANNUAL REPORT 2010 | FIS 73 ILLEGAL INTELLIGENCE SITUATION Surveillance of the financial sector The economic and financial crisis has increased the pressure on Switzerland as a financial centre. The consequences are also being felt in the intelligence field. Foreign authorities and intelligence services still have Swiss banks and financial institutions based in Switzerland in their sights. In 2010, the Office of the Attorney General of Switzerland investigated an Austrian man on charges of illegal economic intelligence; the man is alleged to have sold stolen bank data to the German authorities. The suspect committed suicide in September while in custody. Opposition in exile Several foreign intelligence services are active in Switzerland. Opponents of a regime who are resident here are often the targets of investigation by the intelligence services of their countries of origin. Some of these intelligence services have sufficient resources to be able to obtain information on the members of their diaspora community, monitor it and use it for internal political purposes. Such activities were also noted in 2010. For example, intelligence services attempted to monitor and identify participants in opposition group rallies. Observations of this type were noted in Bern and Geneva, in particular. One intelligence service recruited informants among opposition activists and used agents to infiltrate the opponents of the regime. 74 ANNUAL R E P O RT 2 0 1 0 | F I S In 2010, FIS observed that a North African country was increasing its intelligence activity. Besides the usual intelligence activity targeting opponents of the regime in Switzerland, which we were already aware of, its intelligence officers maintained a network of informants spreading across several countries; they were also active in several European countries. The investigations are still ongoing. Geneva Geneva is particularly important to foreign intelligence services: the large numbers of international organizations and NGO’s there draw not only diplomats, business people and journalists, but also intelligence officers. These often do not identify themselves as such and operate under cover, for example as diplomats, business people and journalists. Their assignments may relate to Swiss interests as well as to the interests of third countries. IT espionage In recent years, cyber attacks have been observed in Switzerland and other European countries. Although the perpetrators of cyber attacks for the purposes of espionage cannot always be identified with certainty, it is possible by analysing the attacks to determine with a high degree of reliability where they originate from. Moreover, from the methods used, the victims of the attacks and the type of information sought, for example technological, economic or political, it ILLEGAL INTELLIGENCE is possible to draw fairly accurate conclusions as to whether the attacker is a government or a non-state actor. Some intelligence services are distinguished by their particularly aggressive methods of procuring information, and in some European intelligence services, virtual espionage and virtual counterespionage are gaining in importance. This is also connected to an increase in supply, as there is an ever-increasing quantity of information being circulated electronically which could potentially be siphoned off. These methods call for new resources and specialist expertise. Virtual espionage provides intelligence services with the opportunity to acquire information selectively, possibly without having to deploy agents abroad. This protects agents and reduces the political risk of intelligence activities. The targets of cyber attacks may be administrative bodies or governments, individual companies or private individuals, but also opposition activists in exile. Russian agents Illegal activity by intelligence agents is a recurrent and politically highly sensitive issue, not only in Switzerland but worldwide, and thus presents a challenge for international diplomacy. At the end of June 2010, ten agents were arrested in the United States, some of whom had been collecting information for Russia’s External Intelligence Service (SVR) under false identities for approximately ten years. Shortly afterwards, an eleventh suspect was arrested in Cyprus, who was subsequently released on bail and has since disappeared. On 9 July, the agents working for Russia were exchanged in Vienna for four Russians who had been convicted in Russia of spying for the US and the UK. One Russian in the spy ring was stripped of her British citizenship. On 13 July, during the investigations, a Russian employed at Microsoft was arrested in the US and subsequently deported for violating immigration regulations. The exchange of agents was apparently negotiated between the directors of the Central Intelligence Agency (CIA) and the SVR and helped to smooth relations between the US and Russia. The agents returned to Russia were interrogated by the SVR and then received awards from the Russian President. The Russian spies are alleged to have been assigned the task of infiltrating circles close to the government and obtaining information about, for example, US policy on Afghanistan and Iran and about the arms treaty between Moscow and Washington. Contacts are alleged to have been made with a former high-ranking US official in the field of national security and an American nuclear weapons researcher. The members of the Russian spy ring used tried and tested methods such as invisible ink, fake passports for travelling to Moscow and back to the US, and signs for recognizing each other at meetings. However, they also used modern technology such as steganographic methods, a particular way of concealing encrypted information in inconspicuous data, and the wireless transmission of data between laptops. The Federal Bureau of Investigation (FBI) managed to uncover the spy ring using ANNUAL REPORT 2010 | FIS 75 ILLEGAL INTELLIGENCE methods including observation, the bugging of apartments and hotel rooms and telephone and e-mail surveillance. 76 ANNUAL R E P O RT 2 0 1 0 | F I S ILLEGAL INTELLIGENCE ASSESSMENT Human Intelligence The case of the Russian spy ring in the US graphically illustrates how countries are still deploying agents, i.e. using so-called ‘human intelligence’ (HUMINT) to try and obtain information. They attempt to discover the aims and intentions of foreign countries in advance and want to know how policy decisions in other countries are arrived at. This information enables them to develop their own positions and to present and defend these to their advantage. In addition, there are also specific military, technological and economic reconnaissance objectives. In the above case there were no traces leading to Switzerland, but there were in the 2008 case of the high-ranking Estonian security official Hermann Simm. He betrayed NATO secrets to the SVR. Like the Russian agents in the US, the agent handler Simm was living in Europe under a particularly elaborate disguise. He purported to be a businessman and pretended to have a nationality other than Russian. Switzerland was one of the countries he used for logistical purposes. The Simm case shows that it is possible to uncover even particularly well disguised agents. cases, Switzerland’s security interests sometimes have to take second place to, for example, foreign policy or economic interests. Restrictive accreditation policies can be used as preventive measures against intelligence officers under diplomatic cover who have a relevant previous conviction abroad. Here, too, however, all relevant political interests have to be weighed up in each individual case, and bilateral relations with the sending country may be accorded a higher weighting than counterespionage. Economic intelligence The threat from illegal economic intelligence is unchanged from last year. However, should the economic crisis deteriorate again, this threat could also increase again. In this context, political pressure for a change in Swiss tax policy, which is attractive compared with those in other countries, could also increase in future. Moreover, Government and private players are actively continuing their surveillance of Switzerland as a financial and economic centre. Prevention Entry bans are one means of preventing illegal intelligence activity in Switzerland. They are effective in combating illegal intelligence, but not always enforceable, since in individual ANNUAL REPORT 2010 | FIS 77 5. Attacks on Swiss IT infrastructure ANNUAL REPORT 2010 | FIS 79 ATTACKS ON SWISS IT INFRASTRUCTURE SELEC TED E VENTS February An attack using infected e-mails was discovered. The e-mails were addressed mainly to employees at the defence ministries of the countries participating in a NATO conference. April A large number of infected websites were discovered using the new checking tool developed by MELANI. June The Stuxnet trojan was discovered; it was targeted at Siemens’ process control systems. October The police in the Netherlands disabled a botnet. November Denial of Service (DoS) attack on the availability of websites of parties represented in the Swiss Federal Council. December DoS attack on the PostFinance website. The reason was the closing down of Wikileaks founder Julian Assange’s account. ‘Low Orbit Ion Cannon’ programme, which can be used by people without a high level of computer skills to participate in attacks. 80 ANNUAL R E P O RT 2 0 1 0 | F I S ATTACKS ON SWISS IT INFRASTRUCTURE SITUATION Attack on process control systems In June 2010, a Belarusian antivirus company discovered the Stuxnet malware, which had been designed to attack process control systems manufactured by Siemens. This malware exhibited an unprecedented level of complexity. It made use of several previously unknown security loopholes, misused security certificates and spread itself via USB storage devices, for example. It was designed both to gain information on the plant to be controlled and send this to the attacker and also to manipulate the control systems’ operating software. Stuxnet was active primarily in Indonesia, India and Iran. Website infections A new checking tool developed by MELANI for Swiss websites led in April to the discovery of a large number of infected Swiss websites. As a follow-up measure, MELANI published a warning and informed the administrators of the websites affected. In October, the Dutch police disabled the control servers of the botnet responsible (private computers infected with malware which are controlled remotely by a third party). A 27-year-old man who is suspected of being the mastermind behind it has been arrested. The perpetrators’ intention was to generate the largest possible global botnet in order to sell or lease parts of it. Attack using infected e-mails In the third week of February, an attack using infected e-mails was discovered. These were sent mainly to employees of the defence ministries of the countries participating in a NATO conference. The e-mails, which were written in English, contained a document relating to this conference, which was to take place at the end of February. When the file was opened, the computer was infected and became part of a botnet. The code’s main function was to intercept login data for e-mails and social networks. Analysis of the malware made it possible to identify the command server and subsequently to produce a comprehensive list of infected systems. It was then possible to inform the relevant bodies and deactivate the botnet. No victims were identified in Switzerland. Cyber attacks on political parties The parties represented in the Swiss Federal Council and their cantonal or communal organisations were the targets of cyber attacks several times during 2010. At the beginning of 2010, the website of the Zurich city branch of the SVP was defaced by a logo on several occasions. The logo ‘26C3 – Here be Dragons’ would appear. ‘Here be Dragons’ was the slogan of the 26th conference of the Chaos Computer Club (CCC) in Berlin. After the clean-up, the homepage was defaced once more, this time with a hoax video entitled ‘300 – SVP must die’, referring to the film ‘300’. In addition, a video about the ref- ANNUAL REPORT 2010 | FIS 81 ATTACKS ON SWISS IT INFRASTRUCTURE erendum against the building of minarets was switched on. At the beginning of November, the websites of the parties represented in the Swiss Federal Council were paralysed for several hours by DoS attacks. Attack on the PostFinance website. On 5 December, PostFinance closed the donations account of Wikileaks founder Assange due to false information regarding his alleged place of residence in Geneva. PostFinance’s website was subsequently the target of a DoS attack by presumed Wikileaks supporters. The attacks were apparently coordinated by an informal group called Anon Operation, which has been carrying out electronic retaliation attacks since December 2010. These are directed at people or institutions which Anon Operation sees as being opponents of Wikileaks. As well as PostFinance, the eBay subsidiary PayPal and the websites of MasterCard, Visa and Interpol have also been the targets of similar attacks. The security of assets or data of PostFinance customers was not threatened by this attack. International exercises On 4 November, the EU’s European Network and Information Security Agency (ENISA) organized its first Europe-wide exercise, entitled ‘Cyber Europe 2010’. The aim was to test the ability of EU and EFTA countries to respond to a cyber attack. Around one month beforehand, the international exercise ‘Cyberstorm III’ had taken place under the aegis of the International Watch and Warning Network (IWWN). Switzerland took part in both exercises. ‘Cyber Europe 2010’ enabled testing of the protection of critical IT infrastructures, prosecutions in the area of cyber crime, government CERT’s (Computer Emergency Response Teams) and regulators. More than 150 experts from 70 public bodies were confronted with over 320 incidents. The exercise was based on a scenario in which internet connections between European countries gradually failed or were substantially restricted. The participants had to collaborate to prevent further failures and to reestablish the connections. The aim was to find out how well prepared Europe is to face such threats. The final report was not yet available at the time of going to press. Nonetheless, it is already clear that communications, particularly where the national CERT’s were concerned, functioned well. At the European and international levels there are already established contact lists which are used on a daily basis. However, these need to be completed, regularly updated and above all routinely maintained. Logo of the first ever test of EU and EFTA countries’ ability to respond to a cyber attack. 82 ANNUAL R E P O RT 2 0 1 0 | F I S ATTACKS ON SWISS IT INFRASTRUCTURE The network extends beyond Europe’s borders, however, and it was in this context that MELANI took part in the IWWN’s Cyberstorm III exercise, which took place on 29 and 30 September 2010. The exercise was organized by the United States Department of Homeland Security. Representatives from seven Cabinetlevel federal agencies, 11 US states, 60 private companies and 11 foreign partners took part in the exercise. This exercise, too, demonstrated that international contacts are functioning and that they go beyond mere technical problem solving. ANNUAL REPORT 2010 | FIS 83 ATTACKS ON SWISS IT INFRASTRUCTURE ASSESSMENT More attacks on process control systems in future Process control systems are used to monitor, manage and control industrial plants or infrastructures for distributing essential commodities such as electricity, water and fuel, and also in the area of transport and traffic. Their use would be inconceivable without information and communications technology (ICT). For some years already, the possibility that such systems could be attacked has been alluded to. In the case of Stuxnet, Iranian nuclear installations were identified as the possible target. It can be assumed that in future, industrial control systems of all kinds will increasingly be the focus of attackers. This will be made possible by the fact that unlike in the past, sensors, machines and switches today increasingly frequently have their own IP addresses, the normal internet protocol is used for communicating with the server and control software runs on standard operating systems. However, the use of such cheap conventional ICT comes at a cost: process control systems are now basically exposed to the same threats as IT systems for the mass market. The tensions between cost pressure, efficiency and the availability of information on the one hand, and cluster risks, the outsourcing of critical information and increasing vulnerability due to uniform networked platforms on the other will increase. 84 ANNUAL R E P O RT 2 0 1 0 | F I S Counterespionage The threat from espionage using ICT targeted both at government systems and at companies persists. The espionage cases which have come to light should not be seen as discrete independent events, rather common features should be sought. To this end, links between individual incidents need to be established, and similar cases have to be clustered and fit into a more general context. What is standard for all countries and companies in traditional counterespionage, has until now been rather a rarity in the world of the internet and ICT and should also be used more frequently here. Website infections The malware discovered in April with MELANI’s new checking tool was Bredolab. This integrated the infected computer into a botnet which is estimated to have consisted of as many as 30 million computers. For the operator of the botnet, what mattered most was to spread Bredolab: once it had infected a computer, Bredolab searched for website administrators’ login details and passwords in order to use this data to infect further websites automatically. The operator subsequently leased or sold sections of the botnet to criminals. ATTACKS ON SWISS IT INFRASTRUCTURE PDF files as a means of attack It has not yet been established whether the hacker attacks which were carried out using an e-mail attachment about a NATO conference were targeted attacks. However, the special feature that characterized this case was the use of PDF files. This is generally the case today, unlike in the past, when Office documents were often used in hacker attacks. In 2010 there were also examples of this in Switzerland, where security loopholes, for which there were as yet no updates available, were exploited using manipulated PDF documents. Attacks on political parties Following the passing of the referendum against the building of minarets, over 5,000 internet sites were hacked, including the sites of local branches of the SVP and Young SVP. It is thought that the majority of these attacks originated from Turkey. The attacks at the beginning of 2010, on the other hand, were probably launched by attackers from Germany or German-speaking Switzerland and by participants at the CCC conference. In any case, the website had been listed as a target by the CCC. The specific perpetrators, however, are unknown, and no charges have been brought. It appears that in the case of the defacing of this website, a loophole in the content management system was exploited. In DoS attacks at the beginning of November on the internet sites of the parties represented in the Swiss Federal Council, up to 200 computers, largely from Germany, the Netherlands and the US, dialled up the parties’ websites over 10,000 times per second. This overloaded them. Neither the perpetrators nor their motives are known. In this case, too, no charges have been brought. DoS attacks are nothing new, and have previously been used for blackmail purposes or to damage commercial competitors. However, we are also seeing an increasing number of politically motivated attacks. For example, it can be assumed that the motivation in the case described above and in the DoS attack against PostFinance due to the closing of Julian Assange’s account was political. In addition to demonstrations on the ground, protests are increasingly moving into the virtual arena. Where political conflicts arise, it is therefore likely that there will in future be more attacks on internet services, which should prepare themselves appropriately for such eventualities. ANNUAL REPORT 2010 | FIS 85 List of abbreviations ANNUAL REPORT 2010 | FIS 87 LIST OF ABBREVIATIONS ALF................................................................................................................Animal Liberation Front APG.......................................................................................................Allgemeine Plakatgesellschaft AQAP.............................................................................................Al Qaeda in the Arabian Peninsula AQIM...............................................................................................Al Qaeda in the Islamic Maghreb AZOT............................................................................................................. Circus Without Animals BWIS........................................................... Federal Act on Measures to Safeguard Internal Security CCC.................................................................................................................. Chaos Computer Club CERT........................................................................................Computer Emergency Response Team CIA........................................................................................................... Central Intelligence Agency CISA............................................................................. Federal Act on Responsibilities in the Area of DoS........................................................................................................................... Denial of Service EFSF.......................................................................................... European Financial Stability Facility ENISA...............................................................European Network and Information Security Agency ETH...........................................................................................Swiss Federal Institute of Technology FAI...................................................................................................Federazione Anarchica Informale FBI..................................................................................................... Federal Bureau of Investigation FDFA....................................................................................... Federal Department of Foreign Affairs fedpol..............................................................................................................Federal Office of Police FIS............................................................................................................ Federal Intelligence Service GTF...................................................................................................................... Global Tamil Forum HLS............................................................................................................. Huntingdon Life Sciences HPG................................................................................................... Kurdish Nation Defence Forces HUMINT.............................................................................................................. Human Intelligence IAEA.......................................................................................... International Atomic Energy Agency ICT................................................................................ Information and communications technology IED.......................................................................................................... Improvised explosive device 88 ANNUAL R E P O RT 2 0 1 0 | F I S LIST OF ABBREVIATIONS IHH................................................................................ International Humanitarian Aid organization ISI..........................................................................................................................Islamic State of Iraq IWWN............................................................................... International Watch and Warning Network KCK...........................................................................................Kurdistan Democratic Confederation LTTE................................................................................................Liberation Tigers of Tamil Eelam MELANI...................................................Reporting and Analysis Centre for Information Assurance MROS.................................................................... Money Laundering Reporting Office Switzerland NATO............................................................................................ North Atlantic Treaty Organization PETN................................................................................................................................... Nitropenta PKK..............................................................................................................Kurdistan Workers’ Party PMOI...................................................................................People’s Mojahedin Organization of Iran PNOS.......................................................................................Partei National Orientierter Schweizer RAS....................................................................................................Revolutionärer Aufbau Schweiz RAZ.....................................................................................................Revolutionary Advance Zurich SCET...................................................................................................Swiss Council of Eelam Tamils SHAC............................................................................................... Stop Huntingdon Animal Cruelty SRI...........................................................................................................Secours Rouge International SVP......................................................................................................................Swiss People’s Party SVR..............................................................................................Russian foreign intelligence service SWIFT............................................. Society for Worldwide Interbank Financial Telecommunication TAK...........................................................................................................Kurdistan Freedom Falcons TCC.....................................................................................................Tamil Coordination Committee TGTE............................................................................... Transnational Government of Tamil Eelam TTP...............................................................................................................Therik-e Taliban Pakistan WEF............................................................................................................... World Economic Forum ANNUAL REPORT 2010 | FIS 89 Ed i to r Federal Intelligence Service FIS Deadline 14 February 2011 Co n t a c t a d d re s s Federal Intelligence Service FIS Papiermühlestrasse 20 CH-3003 Bern E-mail: info@ndb.admin.ch Phone: +41 (0)31 323 95 84 www.fis.admin.ch Distibution BBL, Verkauf Bundespublikationen, CH-3003 Bern E-mail: verkauf.zivil@bbl.admin.ch www.bundespublikationen.admin.ch Art.-No 503.001.10eng ISSN 1664-4719 Co py r i g h t Federal Intelligence Service FIS, 2011 ANNUAL REPORT 2010 | FIS 91 SWITZERLAND’S SECURITY Federal Intelligence Service FIS Papiermühlestrasse 20 CH-3003 Bern Phone: +41 (0)31 323 95 84 www.fis.admin.ch