SWITZERLAND’S SECURITY
Annual Report 2010
of the Federal Intelligence Service FIS
Switzerland’s Security
2010
Table of contents
Preface
5
Comprehensive threat assessment
9
1.
Terrorism
21
1.1
Jihadism worldwide
22
1.2
Jihadism in Switzerland
31
1.3
PKK
35
1.4
LTTE and its successors
38
1.5
The funding of terrorism 42
2.
Violent extremism
47
2.1
Right-wing extremism
48
2.2
Left-wing extremism
54
2.3
Animal rights extremism
60
3.
Proliferation
65
4.
Illegal intelligence
73
5.
Attacks on Swiss IT infrastructure
79
List of abbreviations
87
ANNUAL REPORT 2010 | FIS
3
Preface
ANNUAL REPORT 2010 | FIS
5
PREFACE
First year as a federal office
The Federal Intelligence Service (FIS) looks back at its first year as a federal office.
The world is in a state of flux, and this is having a significant effect in Europe. This report shows
that the security situation in Switzerland is still giving no cause for concern. Nonetheless, there
are numerous developments taking place that require careful observation and analysis. Some of
the FIS’s assessments have proved accurate, for example in relation to left-wing extremism and to
Libya. Other developments can be predicted only with difficulty or not at all. This is clear from the
upheavals we are currently experiencing in North Africa and in the Arab world. Intelligence services can deal with such developments by describing possible scenarios, but generally not by making
definite predictions. As with natural disasters, it is possible to describe possible developments, but
not exactly when and where they will occur. Politicians and security forces rely on a functional
intelligence service to raise awareness of such events: the ability to give a comprehensive threat
assessment is more important than ever.
In this reporting period, the Federal Council has given the FIS his basic mandate, defining the
service’s core areas of work within the statutory framework. This has strengthened the leadership
and improved the targeted use of the FIS’s capabilities.
2010 brought positive results in terms of continuity in the fulfilment of tasks during the transition
period. On the other hand, the Control Delegation of the Swiss Parliament highlighted the unfinished legacy with regard to data management in the area of internal security.
The Federal Council, DDPS and FIS have taken measures to resolve the problems in compliance with applicable law. For example, for the first time, newly-created automatic data deletion
programmes have been employed, which have reduced the amount of personal data in the Internal
Security information system from over 210,000 to less than 90,000 items. In addition, the FIS has
tightened its reporting and recording criteria. Additional staff have been deployed on a temporary
basis to make it possible to clear up remaining issues by the end of 2012 while at the same time
continuing to carry out routine operations responsibly and in the interest of the security of the Swiss
population.
6
ANNUAL R E P O RT 2 0 1 0 | F I S
PREFACE
Information is the raw material of intelligence services. Data must be acquired, linked to other
data, evaluated and of course appropriately stored. The substantial reduction in the amount of personal data contained in the Internal Security information system may be seen by some experts as
risky in the light of current developments. However, the FIS has to comply with the legal requirements and to focus primarily on quality. In this context, the loss of knowledge due to the deletion of
data is something we have to be able to cope with.
We are thus following the course laid down by law and policy. I am certain that in Switzerland too,
there will be a growing appreciation that the early detection of strategically relevant developments
and threats is one of the State’s core functions. For this purpose and to deal operationally with events
relating to security, Switzerland requires an appropriate instrument in the shape of an effective,
democratically controlled intelligence service.
Federal Department of Defence,
Civil Protection and Sport DDPS
Ueli Maurer
Federal Councillor
ANNUAL REPORT 2010 | FIS
7
Comprehensive threat assessment
ANNUAL REPORT 2010 | FIS
9
COMPREHENSIVE THREAT ASSESSMENT
Introduction
The Federal Intelligence Service (FIS) has to provide a ‘comprehensive assessment of the threat
situation’ (Art. 3 para. 1, Federal Act on Responsibilities in the Area of the Civilian Intelligence
Service (CISA)). It has to assess relevant external threats as well as those emanating from within
Switzerland.
To this end, the FIS publishes an overall assessment annually. This is not limited to the narrow
confines of security policy, but also covers other threats which could significantly harm Switzerland.
Adverse trends in the economy are therefore just as much part of the catalogue of threats as the
damaging consequences of other countries’ policies to protect their own interests. The intelligence
service is not suggesting here that it should be given new responsibilities. It is conscious that the
assessment of these phenomena can only be undertaken in collaboration with other federal agencies.
Overall, since the FIS’s last report, the threat situation has changed in a few respects: there have
not, however, been any events or trends leading to major changes in Switzerland or in its strategic
environment. Looked at in the long term, the situation in Switzerland remains very stable and peaceful. Although the threats and dangers identified are real, they can assume proportions that pose a
threat to national security only under certain conditions. Nonetheless, it is essential to take steps
to anticipate these threats, not least in order to prevent them feeding on one another and becoming
uncontrollable.
The current threat assessment looks at developments up until the time of going to press in midFebruary 2011 and represents a follow-up to the comprehensive threat assessment first published in
June 2010. It will highlight the most significant changes compared with last year’s threat assessment.
An excursus (publication deadline end of March 2011) looks in more detail at the developments in
the Arab world which began at the end of 2010 and could have major impacts on security in Switzerland.
10
ANNUAL R E P O RT 2 0 1 0 | F I S
COMPREHENSIVE THREAT ASSESSMENT
Dangers from the
strategic environment
Restriction of
freedom of action
Direct threats and dangers
Terrorism
Political and economic
coercive efforts
Danger to the economy
Espionage
Regional conflicts
Violent extremism
Proliferation
Crime and violence
Increasing mobility
Dependence on imported
raw materials and energy
Military threat
Attacks against
IT infrastructure
ANNUAL REPORT 2010 | FIS
11
COMPREHENSIVE THREAT ASSESSMENT
Threats from the strategic environmen t
Restrictions on Switzerland’s freedom
of action in relation to its geopolitical
environment constitute a real threat, with
the potential to cause long-term strategic
damage.
No change from last year’s report. The new
geoeconomic and geopolitical realities are
weakening Switzerland’s traditionally strong
position as a business and financial location and
restricting its political freedom of action, particularly with regard to its immediate environment.
The consequences of the current economic
crisis could have an effect on social cohesion.
No change from last year’s report. Large
budget deficits and financial difficulties, including in countries in Switzerland’s immediate
environment, will place further strain on the international finance system. Wide-ranging discussions are currently taking place in the EU on
how the European Financial Stability Facility (EFSF) support mechanism can be strengthened in anticipation of possible further crises.
12
ANNUAL R E P O RT 2 0 1 0 | F I S
Regional conflicts and the collapse of state
structures could have a range of repercussions for Switzerland in several areas, including migration, terrorism and proliferation.
Since the upheavals in the Arab world, this
statement has become even more relevant than
it was at the time of last year’s report. For more
information on developments in the Arab world,
see the excursus on pages 18 and 19.
Proliferation activities – including in
Switzerland – could result in future threats
to Switzerland, in the form of weapons of
mass destruction and long-range delivery
systems.
From today’s perspective, Iran remains the
only additional country which could gain access to delivery systems capable of reaching
Switzerland within the next few years.
COMPREHENSIVE THREAT ASSESSMENT
Proliferation activities, as well as the activities of terrorist and criminal organisations
and of foreign intelligence services in Switzerland, jeopardise the country’s position as
a business and financial centre and also put
Switzerland under additional international
pressure.
The disputes surrounding Iran’s and North
Korea’s nuclear programmes continue. Iran
continues to enrich uranium, against the will of
the UN Security Council. A new uranium enrichment plant in North Korea came to light at
the end of 2010.
On 19 January 2011, the Federal Council resolved to bring Switzerland’s sanctions against
Iran into line with those of its major trading
partners, which go beyond the UN sanctions.
The Federal Council’s decision will prevent circumvention and at the same time will increase
legal security for Swiss companies operating
internationally. The exposure of proliferation
deals could be used to justify measures against
the advantages of Switzerland as a business
location, should this be the intention of other
countries. Particularly in times of global economic crisis, it may seem an attractive proposition to introduce trade restrictions disadvantageous to Switzerland on the grounds of national
security interests. In this context, proliferation
poses a risk to Switzerland as a location for
trade and industry. In the case of Iran, this risk
has at least been mitigated through the abovementioned decision of the Federal Council.
As a consequence of increasing mobility,
more and more Swiss citizens abroad are
exposed to the dangers of terror attacks, kidnapping, political unrest or natural disasters.
The transfer of power from the old to the new
government in Ivory Coast, which has not yet
been completed, and the recent upheavals in the
Arab world are currently paramount concerns.
It has not to date been necessary to undertake
large-scale evacuations of Swiss citizens from
these areas. In the case of Egypt, however, the
Federal Department of Foreign Affairs (FDFA)
did at the end of January recommend leaving
the country temporarily; there were also attacks
on Swiss journalists. There is still a high risk of
being kidnapped in the Sahel region.
Switzerland’s dependence on imported
raw materials and energy makes it
vulnerable to attempts by other countries
to exert pressure in the pursuit of policies to
protect their own interests.
No change from last year’s report. While recent developments in the Arab world have led
to rises in the prices of energy imports, they
have not yet caused supply bottlenecks. This
situation could change if stability in the Persian
Gulf is threatened.
ANNUAL REPORT 2010 | FIS
13
COMPREHENSIVE THREAT ASSESSMENT
D irec t threats and dangers
The threat of terrorism is not a grave
danger to the state at present. An attack in
Switzerland is possible, but overreaction to
such an attack could cause greater long-term
damage than the attack itself. The likelihood of weapons of mass destruction being
deployed successfully remains low.
In 2010 there were a series of terrorism warnings in Europe, at times combined with raised
terror alert levels and increased deployment of
security forces. These warnings, which were
generally vague in nature, all triggered intense
media coverage, but were probably at least in
part motivated by domestic politics.
Switzerland was not named as a target country in any of the attack threats, and intelligence
produced no indication that Switzerland might
be directly affected by possible acts of terror.
However, Swiss citizens and Swiss interests
could be affected by attacks abroad.
Attempts to exert political or economic
pressure form part of the national interest
politics of other states. They may restrict
the Swiss authorities’ freedom of action and
damage our national interests.
No change from last year’s report. The pressure on the Swiss taxation system continues.
14
ANNUAL R E P O RT 2 0 1 0 | F I S
Illegal intelligence activities undermine
state sovereignty. Industrial espionage may
also damage the competitiveness of companies based in Switzerland and threaten the
country’s position as a financial and business
location.
No change from last year’s report; the threat
remains high. This is illustrated by the theft of
US State Department documents – allegedly by
a US government employee – and their subsequent publication by Wikileaks. Protection and
prevention measures in the area of information
and IT security, as well as traditional precautions against illegal intelligence, are therefore
still important.
Violent extremism in Switzerland leads
to local security problems and, particularly
where violent left- and right-wing extremism is concerned, presents a threat to the
peace and public order.
In 2010, attention focussed principally on
left-wing extremism. A particularly high-profile
case was that of three left-wing extremists arrested in April 2010, who had allegedly planned
an attack on IBM in Rüschlikon, near Zurich.
Left-wing extremists’ solidarity campaigns
reached a climax with the parcel bomb attacks
on various embassies, including the Swiss
COMPREHENSIVE THREAT ASSESSMENT
embassy in each case, in Athens (Greece) and
Rome (Italy). Local anarchist groups claimed
responsibility for the attacks, saying that they
had acted partly out of solidarity with the people detained in connection with the attempted
attack on IBM in Switzerland.
The nature of the attacks and campaigns
changed with the adoption of the ‘deportation
initiative’ on 28 November 2010. For example,
people wearing masks stole a ballot box and
set it on fire, and a polling station was targeted
in an arson attack. As in the campaign against
the deportation initiative, the Swiss People’s
Party (SVP) was targeted by left-wing extremists on several occasions. For example, around
one hundred people, mainly left-wing radicals,
took part in an unauthorised protest against
the SVP’s Albisgüetli conference on 21 January 2011. During the riots following the breakup of the rally, a member of the National Council was attacked and injured.
Criminality and violence in Switzerland
are not on a scale that would represent a
grave danger to the state. Organized crime
could take on strategic significance.
No trend changes compared with last year’s
report. The following current assessment of organized crime in Switzerland comes mainly
from the Federal Office of Police (fedpol),
which is responsible for analysing this type of
threat.
There have been repeated signs in recent
years that Italian criminal organizations are
present in Switzerland. This is due to Italy’s
geographical proximity, the large Italian population in Switzerland and also to the strength of
Switzerland as a financial centre. Italian criminal organizations are involved in drug trafficking, arms dealing and money laundering. The
’Ndrangheta, in particular, has been identified in
Italy as an organisation with a high potential to
infiltrate business and politics. It is currently using this potential to expand its activities in other
countries in western Europe.
Criminal groups from south-east Europe are
playing an important role in the development
of crime in Switzerland. They are particularly
active in the field of narcotics trafficking, where
they have dominated the heroin market for the
last two decades. However, they are also involved in property-related crimes and peoplesmuggling and -trafficking.
Bands of Georgian burglars have been active
in Switzerland and in numerous other European
countries for several years. Their members generally apply for asylum after entering a country
illegally, and they principally commit propertyrelated crimes. Part of the proceeds flows into
the coffers of the criminal world in the countries of the former Soviet Union.
Groups from West Africa make their presence felt primarily in the Swiss cocaine market.
West African networks have the capability to
acquire large quantities of cocaine direct from
South America and sell it all over Europe. According to the latest estimates from fedpol, the
cocaine trade in Switzerland generates an an-
ANNUAL REPORT 2010 | FIS
15
COMPREHENSIVE THREAT ASSESSMENT
nual turnover of between 369 and 520 million
Swiss francs. The profits returned to the regions
of origin corrupt both the state structures there
and the formal economy.
The examples cited show that Switzerland
is used by criminal organizations not merely
as a safe haven or a financial centre, but also
as a field of operations. This gives rise to a direct threat in the form of basic crime and also
through conflicts between groups competing
for a share of the illegal markets. Money generated, laundered and invested here in Switzerland also represents a direct threat to the good
reputation of the country as a financial centre.
The profits of criminal organisations also contribute, rather more indirectly, toward the fact
that the sometimes unfavourable economic, social and political conditions in the regions of
origin are at least not improving. This leads to
a vicious circle, with lucrative fields of activity
and investment options for criminals on the one
hand and a large reservoir of potential young
criminal recruits in the regions of origin on the
other.
Switzerland does not currently face any
military threat.
No change from last year’s report. A war in
Europe which would affect Swiss territory is
unlikely in the foreseeable future. In the medium term, however, a threat from more distant
regions could still emerge, based on weapons of
mass destruction and long-range delivery systems.
16
ANNUAL R E P O RT 2 0 1 0 | F I S
Attacks on critical IT infrastructure
(cyber attacks) could reinforce other types
of threat and assume proportions that could
potentially jeopardize the entire system.
In 2010, the media reporting on the Stuxnet
computer worm gave widespread coverage to
an issue that has been under discussion in specialist circles for some considerable time. The
Reporting and Analysis Centre for Information
Assurance (MELANI) has repeatedly pointed
out this threat in its half-yearly reports since
2005. The issue here is that using manipulated
computer programmes, so-called malware, it is
possible to manipulate not just computers, but
also entire industrial control systems and therefore possibly also vital processes and operations.
In June 2010, MELANI informed the federal IT security authorities and the operators of
critical infrastructures about newly-discovered
malware called Stuxnet, targeted at manipulating process control systems. The results of the
technical investigations (high degree of complexity, use of advanced expertise in the area of
security) give rise to the suspicion that a government is behind Stuxnet. The investigations
focused on several nuclear installations in Iran
which may have been infected with Stuxnet. A
spokesperson for the Iranian government confirmed that an attack had taken place on control systems in industrial installations around
the country and mentioned a figure of around
30,000 infected computers.
COMPREHENSIVE THREAT ASSESSMENT
Since the discovery of Stuxnet in June 2010,
MELANI has remained in contact with the operators of critical infrastructures, in order to
exchange relevant findings and security advice.
To date, no infections have been reported by operators of critical infrastructures in Switzerland.
It must be assumed that similar attacks will occur more frequently in future and could also affect Switzerland.
On 10 December 2010, the Federal Council
debated threats to Switzerland through attacks
from cyberspace and resolved to bolster protective measures against such attacks on Switzerland. A group of experts, including representatives from the FIS, is to draw up an overall
federal strategy against cyber threats by the end
of 2011.
Almost all these threats and dangers to Switzerland and its interests also place demands on
the intelligence service. It is either directly or
indirectly responsible for helping to combat
them. The challenges facing the intelligence
service are clear: it needs to work together with
its partners in the Confederation and the cantons, as well as with its partners abroad, to detect new threats at an early stage and to cast sufficient light on the increasingly complex threat
landscape, to assess the threats identified and,
together with its partners, to take the necessary
steps to combat and prevent these threats. As
well as capabilities, means and resources commensurate with the threat, this also requires
alertness to these concerns on the part of politicians and the general public.
ANNUAL REPORT 2010 | FIS
17
COMPREHENSIVE THREAT ASSESSMENT
Excursus – Arab world 2011
A wave of protests has been taking place throughout the Arab world since
January this year which has affected all the countries of this region in one
way or another. Two regimes have been toppled (Tunisia and Egypt) and
in one case (Libya), the conflict between the regime and the opposition has
led to an international military operation being launched to protect the civilian population. The momentous upheavals currently taking place in the Arab
world are not yet over. It is therefore not yet possible to make a comprehensive assessment of the medium- and long-term impacts, including the repercussions for Switzerland. Switzerland is not only affected by these upheavals,
but demands will also be placed on it in the short, medium and long terms.
The first emergency measures in the areas of humanitarian aid, development assistance and support for the transition process have been implemented. Looking at strategic prospects in the longer term, it can be assumed that
new opportunities for Switzerland may arise. One possible area of action for
Switzerland, maybe in collaboration with others, is that of helping to establish democratic societies.
At the same time, however, consideration must be given to the fact that
in the long term there will continue to be numerous and significant risks.
These relate to the unfavourable general economic and demographic conditions, problems of internal security and continuing regional conflicts, in
particular between Israel and the Arab world and in the Persian Gulf. It can
be concluded from this that there are specific threats to Swiss interests from
migration pressure, terrorist activity, energy insecurity, potentate funds, organized crime etc.
18
ANNUAL R E P O RT 2 0 1 0 | F I S
COMPREHENSIVE THREAT ASSESSMENT
Atlantic
Ocean
Algiers
Tunis
TUNISIA
Rabat
Mediterranean
Sea
Tripoli
M O R O CCO
LEBANON
PALESTINE
Cairo
A LG E R I A
LIBYA
Tehran
SYRIA
IR AQ
Damascus
Amman Bagdad
JORDAN
Kuwait
BAHRAIN
Manama
Riyadh
Doha
EGYPT
IRAN
KUWAIT
QATAR
Abu Dhabi
U.A.E .
Re
d
SAUDI
ARABIA
Muscat
Se
OMAN
a
YEMEN
Sanaa
Arabian
Sea
1000 km
ANNUAL REPORT 2010 | FIS
19
1. Terrorism
ANNUAL REPORT 2010 | FIS
21
TERRORISM | Jihadism worldwide
1.1 Jihadism worldwide
SELEC TED E VENTS
22
23 February
An AQIM (Al-Qaeda in the Islamic Maghreb) group released a French hostage. He
had been kidnapped on 26 November 2009 in Menaka in Mali.
1 May
Faisal Shahzad, a US citizen of Pakistani origin, made a failed attempt to detonate a
bomb on Times Square in New York (USA).
21 May
Mustafa Abu al-Yazid, alias Sheikh Said al-Masri, core al-Qaeda’s ‘number three’,
was killed in a US air attack on the village of Mohammed Khel in North Waziristan
(Pakistan).
27 June
A bomb attack by radical Islamists on a police station in Bugojno (Bosnia and Herzegovina) claimed one dead and seven injured.
24 / 25 July
During the night, a suicide bomb attack was carried out on the gendarmerie in Beni
Aissi, in Kabylia, Algeria. The attack cost one guard his life, and eight policemen
were injured.
25 July
AQIM announced the death of a French hostage. They had murdered the man after
the failure of a joint attempt to secure his release by the Mauritanian and French
armies, undertaken on 22 July as part of a wider offensive. Seven jihadists were
killed in the operation.
23 August
An AQIM group in Mali released two Spanish hostages. The third person in the
group kidnapped on 29 November 2009 in northern Mauritania, a Spanish woman,
had already been released on 10 March.
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | Jihadism worldwide
15 / 16
September
During the night, five French citizens, including a married couple, were abducted
in Arlit (Niger) by an AQIM commando and taken to northern Mali. The victims
worked for the French nuclear company Areva and for Satom.
29 October
Two parcel bombs with return addresses in Yemen were seized at East Midlands
Airport (UK) and at Dubai airport (United Arab Emirates). The explosive devices
were viable.
11 December
A suicide bomber, a Swede of Iranian origin, blew himself up in the centre of Stockholm. Shortly beforehand, his car had exploded nearby, injuring passers-by.
Al-Qaeda internet propaganda:
special edition of ‘Inspire’
magazine on the end-of-October
parcel bombs.
ANNUAL REPORT 2010 | FIS
23
TERRORISM | Jihadism worldwide
SITUATION
firearms would lead to large numbers of victims.
In France, meanwhile, security measures for the
capital in particular were tightened in response
to increased intelligence about possible terrorist
attacks, some of which related to AQIM.
No jihadist terrorist attacks subsequently took
place, either in Germany or in France.
Alleged plans for attacks on targets
in Europe
In September, reports appeared in the media
that US intelligence services had foiled terrorist attacks on targets in the UK, France and
Germany. It was claimed that the attacks had
been planned in Pakistan and that the targets
were to have been struck simultaneously. The
reports alleged that the plans for the attacks had
been drawn up by a high-ranking member of alQaeda, with financial support from Osama bin
Laden, but that attacks by US drones on targets
in Waziristan (Pakistan) had, at the very least,
succeeded in disrupting these plans. The US
subsequently advised its citizens to be vigilant
when travelling to Europe, and the UK and Japan upgraded their travel advice for France and
Germany.
At the time of the terror warnings in Germany in autumn 2010, the specific concern of the
authorities was the threat of bomb attacks. The
target was thought to be a large gathering of
people in a major city, the intention apparently
being to detonate the explosive by remote control. There were also fears of a scenario similar
to the Mumbai attacks in November 2008, in
which protracted hostage taking and the use of
Core al-Qaeda
Core al-Qaeda also suffered significant setbacks in 2010. A number of its leaders were
killed in US air strikes, and the organisation
came under pressure from the Pakistani military
offensive in the tribal areas. This also reduced
the organisation’s ability to procure funding
and recruit new members.
The remainder of the organisation’s core
was operational primarily in Pakistan, where
it collaborated with local groups. These groups
work closely together, and some of them now
also have a global agenda. This has created a
network that partially offsets the losses core alQaeda has suffered in terms of personnel and
compensates for its diminished operational capability. One of the most active of these groups
is Therik-e-Taliban Pakistan (TTP), the umbrella organisation of the Taliban in Pakistan, which
Core Al Qaeda
Atlantic
Ocean
Med
TUNISIA
MOROCCO
rane
IRAQ
ISI
an Se
a
L I B YA
SAUDI ARABIA
Re
AQIM
d
Se
MALI
a
M A U R I TA N I A
AFGHANISTAN
PA K I S TA N
ALGERIA
Western
Sahara
iter
NIGER
AQAP
YEMEN
Arabian
Sea
Shabaab
SOMALIA
possible branch
Indian
Ocean
regional branch
zone of activity
24
ANNUAL R E P O RT 2 0 1 0 | F I S
2000 km
Overview of al-Qaeda’s
areas of operation and
branches (no change
from last year)
TERRORISM | Jihadism worldwide
claimed responsibility for the attempted attack
on New York’s Times Square. The perpetrator,
Faisal Shahzad, is said to have been trained at
one of the group’s training camps.
Core al-Qaeda maintains its dominant role
as far as propaganda is concerned and provides
ideological leadership for the global jihad. In
2010, it continued to produce a broad range
of propaganda to fuel the ‘media jihad’. However, core al-Qaeda’s role in the production of
propaganda is facing a growing challenge from
groups such as al-Qaeda in the Arabian Peninsula (AQAP) and AQIM.
AQAP
AQAP claimed responsibility for the attempted attacks involving two parcel bombs that
were seized in the UK and Dubai at the end of
October. Both parcels bore the name of a sender
in Yemen, were transported by private parcel
delivery services and were addressed to recipients in Chicago. According to unconfirmed
reports, the two parcel bombs passed through
a security check in Sana’a (Yemen). The first
bomb was sent by UPS in a passenger aircraft
to Dubai and then onwards in a cargo aircraft
via Cologne to East Midlands Airport, where it
was intercepted. The second bomb was flown
by FedEx in a passenger aircraft via Doha to
Dubai before being discovered there. Both seizures were made on the basis of information
from the intelligence services.
The explosive devices were identical in design and were each concealed in a laser printer
which was contained, together with a laptop,
charger, clothes, books etc., in a parcel weighing 16 kilograms. Analysis of the explosive de-
vices revealed that they were viable and, with
a main charge of 400 grams of pentaerythritol
tetranitrate (PETN), were large enough to cause
critical damage to an aircraft.
AQIM
In 2010, the Algerian security forces put further pressure on the remaining AQIM groups
operating underground in the traditional area
of operations of Algerian jihadists in northern
Algeria. Only in Kabylia and the Aurès mountains did AQIM groups retain any freedom to
manoeuvre. Groups revolting against the central authorities have traditionally found support
in these poor, mountainous areas. All three suicide attacks in 2010 took place in Kabylia. They
were aimed exclusively at the security forces,
which are the main target of the guerrilla war
being waged in this region.
In the rest of Algeria, the AQIM groups found
themselves on the defensive and carried out
only sporadic small-scale operations. Modelling their operations on those carried out in Iraq
and Afghanistan, they attacked government
representatives or lured security forces into
ambushes. They are no longer able to carry out
large-scale military operations and can undertake more significant suicide attacks, for example against European interests, only on a limited
scale.
In 2010, the AQIM leadership could not, either in the short or the medium term, count on
being able to successfully open up new jihadi
theatres of operations in the Maghreb, particularly in Morocco, Tunisia or Libya, or to establish operational or support networks in Europe.
It concentrated on propaganda, which it dis-
ANNUAL REPORT 2010 | FIS
25
TERRORISM | Jihadism worldwide
seminated via the internet and which was also
broadcast by Arabic satellite channels such as
Al Jazeera.
By contrast, AQIM groups in the Sahara and
the Sahel region continued to carry out their
operations in Mauritania, Niger and Mali. They
became increasingly daring, as they are becoming, both socially and financially, more firmly
rooted in that region, particularly in Mali. The
power of the state is so weak here that it is
forced to allow the AQIM groups the freedom
of movement and scope to engage in all sorts of
illegal activities. However, in 2010 there were
also the first signs that the Mauritanian and Nigerien authorities, in particular, were becoming aware of the problem posed by the AQIM
groups on their territory. Army units from both
countries made several attempts to take action
against the AQIM groups. These attempts led to
a number of clashes, with deaths on both sides.
In reprisal, the Sahel-based AQIM groups
carried out two suicide attacks, in Niger and
Mauritania respectively, which were directed
against the armed forces. In Niger, European
citizens were kidnapped on two occasions. No
operations took place in Mali, as the country is
used by the AQIM groups as a safe haven to
retreat to. This is where the hostage-taking was
organized from. These hostage-takings confirm
among other things that the groups’ capabilities,
e.g. in the area of communications, are improving.
The operations in the Sahel region are fundamental to the survival of AQIM and the continuation of their jihad. They ensure media coverage and give the organization a visible profile.
They also prove to the worldwide jihadist move-
26
ANNUAL R E P O RT 2 0 1 0 | F I S
ment that AQIM is an international and not just
an Algerian force. The message of support for
the group from Osama bin Laden published on
27 October demonstrates the regard in which
AQIM is held internationally. This message has
been used for propaganda purposes by AQIM
emir Abdelmalek Droukdel. On 18 November
he announced that negotiations on the release of
the French hostages had to be conducted with
Bin Laden and under his terms (first and foremost the withdrawal of French troops from Afghanistan). The two audio messages published
in internet forums and by Al Jazeera are not
proof of any direct contact between Bin Laden
and AQIM.
AQIM is additionally attempting to demonstrate, by providing chiefly ideological support
to jihadists in Nigeria, that it has the potential to
expand in the region.
Islamism in south-east Europe
The local security authorities in south-east
European countries are monitoring the activities of Islamists closely. In some of the
countries, the potential threat from individual
radical Islamists is classified as high, as there
is evidence in some cases of radicalisation towards jihadism. At the centre of this are people
described as takfiris, because they use ‘takfirs’
as a way of achieving their goals. A takfir is
used by a Muslim to declare another Muslim
an unbeliever or apostate, thereby legitimizing
his execution. The takfir is an essential element of the jihadist doctrine, where it forms
an important prerequisite for violent and/or
terrorist actions. Both in south-east European
countries and in the diaspora countries, there
TERRORISM | Jihadism worldwide
are reports of individuals of south-east European origin, organized in loose networks, with
increasingly frequent transnational links to jihadist groups.
The Bosnian village of Gornja Maoca is
home to radical Islamists. They have gradually
isolated themselves from the outside world
and live according to their own rules. They
are adherents of Salafism, observe Sharia law
and educate both children and adults in their
own schools. They reject the democratic order
in Bosnia and Herzegovina and as a matter of
principle do not recognize the authority of the
state. This brings them into constant conflict
with the authorities, religious institutions and
their neighbours. During an operation in early February 2010, the authorities confiscated
weapons and tens of thousands of euros from
them. Seven people were arrested. They were
released on parole after around one month.
One person of foreign origin was deported as
an illegal resident. No concrete evidence of
terrorist activity or support for terrorist groups
was found.
The Bosnian security authorities arrested
two people in connection with the bomb attack in Bugojno at the end of June. These were
already known to the authorities due to their
having committed violent crimes, becoming
increasingly radicalized and having connections with takfirism. When they were arrested,
a further explosive device was discovered in
the possession of the main perpetrator. He alleged that his motive had been the desire to
avenge the arrest and prosecution of a fellow
believer for arms smuggling.
South-east European networks in
the diaspora
A takfiri network was extremely active in
2009, organizing several meetings across Europe. A split occurred in 2010. The split was
provoked by two leaders with differing ideological and religious views. A third network of
takfiris of south-east European origin is also active in Europe. Its goal is to radicalize individuals and recruit them for the armed struggle.
ANNUAL REPORT 2010 | FIS
27
TERRORISM | Jihadism worldwide
ASSESSMENT
No concrete information pointing to
imminent attacks in Europe
The information broadcast in the media suggesting imminent attacks was based chiefly on
the statements of a German jihadist detained
in Afghanistan. While he mentioned unspecific
plans to launch attacks on Europe, he did not
give any details of possible targets.
Overall, 2010 saw an increase in the amount
of intelligence, from a variety of sources, concerning possible attacks planned on targets in
Europe. No concrete evidence of imminent attacks in Europe was found in the available intelligence. The FIS was in constant close contact
with its partner services, analysed the situation
and deliberately did not issue a warning, as the
threats were unspecific. Switzerland was not
named as a target country in any of the attack
threats, and intelligence yielded no indication
that Switzerland might be directly affected by
possible acts of terror. Nor was there any evidence of preparation or support activities, or
of suspected terrorists travelling through Switzerland. Swiss citizens and Swiss interests may,
however, also be affected by attacks abroad.
However, the jihadist threat to Europe does
not come solely from groups associated with alQaeda. It is also possible that individuals could
be inspired by the propaganda disseminated by
al-Qaeda and attempt to carry out attacks in Europe. As can be seen from the suicide bombing
in Stockholm, it is almost impossible to gauge
the probability of terrorist attacks by lone perpetrators, let alone prevent them completely.
Core al-Qaeda
The loss of important leaders further weakened core al-Qaeda in 2010. New players and
close cooperation with local Pakistani groups
make the threat from core al-Qaeda more complex and diffuse. The now often global agenda
of active Pakistani groups close to core al-Qaeda shows that the will at least is there to carry
out attacks in the Western world. It thus seems
plausible that the TTP carried out the attempted attack on New York’s Times Square. This
would have been the first time that this group
had carried out an attack outside Pakistan.
Now operationally weakened, core al-Qaeda
is engaged primarily in propaganda activities,
while continuing to provide ideological leadership for the global jihad. In this way, it influences and inspires not only its own regional groups
and other groupings, but also individuals. Such
individuals may carry out attacks independently
of any organization.
Switzerland is still not a specific target for
core al-Qaeda, and there is no evidence of contact between core al-Qaeda and persons living
in Switzerland.
AQAP
AQAP’s attacks outside Yemen have either
failed or been foiled. Nonetheless, they represent a partial success for AQAP in that they
have been reported in the international media
and resurrected memories of 9/11, and as a
consequence have provoked alarm. It is to be
expected that the attempted parcel bomb attack
Al-Qaeda’s area of operation in the
Islamic Maghreb in the year under review.
28
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | Jihadism worldwide
adversely affected if AQIM begins carrying out
attacks on foreign targets again.
Bearing in mind the kidnappings of foreign
citizens which continue to be carried out in
the Sahara and the Sahel region, it is possible
that Swiss tourists could also be victims of
such attacks in future, as did happen in 2009.
In its travel advice, the FDFA advises explicitly against travel to Mali. In the main towns
of this region, and in particular in Mauritania
and Niger, Swiss citizens and Swiss interests
could be affected by terrorist attacks carried out
by AQIM groups against the security forces or
against Western interests.
will serve as a model for other terrorist groups
to plan and carry out similar operations. AQAP
has the capacity, the will and the capability to
carry out attacks at an international level. However, there has been no discernible increase in
the threat of terrorism directly targeting Switzerland as a result of the attempted attacks.
AQIM
The situation in Algeria, the Sahara and the
Sahel region has no direct influence on the
threat in Europe and Switzerland. Nonetheless,
the internationalization of AQIM’s message
may also inspire citizens from the Maghreb
countries based in Europe, i.e. also in Switzerland. These could attempt to establish contact
with AQIM, or might on their own initiative
carry out violent actions which are not directly
connected to AQIM or even to core al-Qaeda.
Swiss citizens and Swiss interests in Algeria have neither been attacked nor designated
as targets by AQIM. However, these could be
The threat in south-east Europe
A large number of groups and organizations
of various Islamist persuasions are active in this
region. A large amount of money also continues
to flow in from Arab countries to support these
groups. Despite this, as far as acts of violence
in the region itself are concerned and ignoring
500 km
Oujda
Rabat
Casablanca
Guerrilla
warfare
Algiers
Annaba
Constantine
Tunis
Sfax
TUNISIA
MOROCCO
Marrakech
Agadir
Tripoli
Ghardaia
Misurata
Béchar
Ifni
Tindouf
Adrar
Ghadamis
ALGERIA
In Salah
WESTERNSAHARA
L I B YA
Zone of Activity
Dakhla
Djanet
Tamanrasset
Safe-haven
Area
M A U R I TA N I A
Nouakchott
Kidal
Tombouctou
Dakar
SENEGAL
GAMBIA
Ségou
Bissau
GUINEABISSAU
MALI
Kayes
Bamako
GUINEA
CHAD
NIGER
Events 2010
BURKINA
Ouagadougou
FA S O
Niamey
NIGERIA
Attack
Abduction
Attempted abduction
ANNUAL REPORT 2010 | FIS
29
TERRORISM | Jihadism worldwide
lone perpetrators, the threat from Islamist terrorism is assessed as being low. However, in the
region as a whole, the risk of individuals being
radicalized and recruited to the armed jihad is
high. Added to this is the risk of logistical support being provided to terrorist groups, particularly for terrorist actions in western Europe. The
greatest threat here comes from takfiri networks
or radicalized lone perpetrators. The problems
are compounded by the relatively easy access
to weapons in the region.
30
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | Jihadism in Switzerland
1.2 Jihadism in Switzerland
SELEC TED E VENTS
10 May
A court in Belgium sentenced Malika El Aroud, a Belgian woman of Moroccan origin, and in absentia Moez Garsallaoui, a Tunisian, to eight years’ imprisonment for
leadership and membership respectively of a terrorist organization. Both had been
resident in Switzerland from the late 1990s and on 21 June 2007 were found guilty
by the Federal Criminal Court of supporting a criminal (terrorist) organization, as
defined under Art. 260ter of the Swiss Criminal Code (SCC), and of other criminal
acts.
26 July
In an audio message, Ayman al-Zawahiri, core al-Qaeda’s number two, mentioned
the passing of the Swiss referendum against the building of minarets as a sign of the
West’s Islamophobia.
A website defaced
in connection
with the passing
of the referendum
against the building of minarets.
ANNUAL REPORT 2010 | FIS
31
TERRORISM | Jihadism in Switzerland
SITUATION
Core al-Qaeda and the minaret
building ban
Reactions to the referendum against the
building of minarets which was passed on
29 November 2009 remained muted in 2010.
No serious threats or violent actions against
Switzerland or Swiss interests were recorded.
There were, however, demonstrations, for example in Pakistan and Indonesia. The ban on
building minarets also sporadically cropped up
as an issue in jihadist internet forums. In these
forums, the referendum against the building of
minarets was repeatedly referred to, together
with the bans on burqas and the caricatures of
Mohammed, as a sign of the West’s Islamophobia.
Core al-Qaeda also expressed its views
on the minaret building ban. On 26 July, in a
47-minute speech calling for opposition to the
veil ban in Europe, their number two, Ayman
al-Zawahiri, also referred to Switzerland and
the minaret building ban. He mentioned the
fact that the Swiss have forbidden the building
of minarets as an example of the Islamophobia which in his eyes existed in the West. The
audio message placed Switzerland on a level
with other countries of the so-called ‘crusade
alliance’. In the other core al-Qaeda messages,
there was no further mention of Switzerland.
32
ANNUAL R E P O RT 2 0 1 0 | F I S
South-east European Islamists
The majority of Muslims in Switzerland
originate from south-east Europe. Traditionally,
south-east European Muslims see Islam as primarily apolitical, but there is a minority with
ties to Islamism. This minority is not a uniform
group; south-east European Islamists represent
a variety of different forms of Islamism. A notable tendency toward takfirism can be observed.
In Switzerland, two takfiri networks have so far
been identified, belonging to different ideological currents.
▪▪ One of the networks underwent a split in
2010. In 2009, it had drawn attention to itself by organizing meetings attended by participants from all over Europe, and had also
found sympathizers in Switzerland.
▪▪ In 2010, the establishment of a transnational
network could be observed in Switzerland,
not all the members of which were takfiris
of south-east European origin. It aims to
form a community of its own and to recruit
followers for the armed jihad. The network
is directly involved in the recruitment and
deployment of individuals. In this country,
too, individuals have been radicalized or recruited. Intelligence also indicates that activists in Switzerland play an important role in
financing the network. They have avoided
using the services of the Swiss financial sector for these activities.
TERRORISM | Jihadism in Switzerland
In addition to these two networks, other individuals came to our attention in 2010 who had
close links with radical Islamists in Bosnia and
Herzegovina. According to the information currently at our disposal, these individuals have
not formed an organization in Switzerland.
In 2010 there was no evidence that acts of terrorism involving persons of south-east European origin resident in Switzerland were planned
or that preparations for such acts were being
made.
Travel and movements
At the end of 2007, Moez Garsallaoui journeyed from Belgium to the Afghan/Pakistani
border area as the leader of a group of likeminded people. On their return to Europe at the
end of 2008, some members of the group were
arrested in Belgium, and in 2010 they were
convicted by a court of law. They are alleged
to have visited training camps in the tribal areas of Pakistan and to have planned attacks in
Belgium. Across Europe, an increase in travel
motivated by jihadism can be observed. In
Switzerland, too, we know of several other cases besides that of Garsallaoui. The individuals
involved travelled to countries including Somalia and Yemen.
The Tunisian
jihadist sentenced
in Switzerland
[photo taken in 2008]
ANNUAL REPORT 2010 | FIS
33
TERRORISM | Jihadism in Switzerland
ASSESSMENT
Consequences of the ban on building
minarets
Al-Zawahiri’s audio message was the first
time that core al-Qaeda had addressed the subject of the referendum against the building of
minarets. The mention of the minaret ban was
not taken up as an issue by jihadist circles, and
there are no reports indicating that it has resulted in a threat to Switzerland.
The FIS is continuing to monitor the ongoing debate about Islamophobia. The citing of
the minaret building ban as part of the alleged
evidence of a hostile attitude to Islam entails
potential risks. For example, it might cause increasing numbers of people to put Switzerland
in the camp of those hostile to Islam, or it might
encourage the radicalization of individuals. In
the long term, it is impossible to rule out exploitation of this issue by Islamist circles in Europe
and Switzerland, and this could also potentially
lead to violent actions.
Takfiris and returnees as security risks
The potential threat posed by some south-east
European takfiris is classified as high, as there
are signs of increasing radicalisation towards
jihadism. Even though there is no evidence that
acts of terrorism involving persons resident in
Switzerland have been planned or that preparations for such acts have been made, a threat to
Switzerland and its interests does exist. Individuals who join the armed jihad damage the foreign and security policy interests of their coun-
34
ANNUAL R E P O RT 2 0 1 0 | F I S
try of origin or former country of residence. If
an increased number of combatants originating
from Switzerland were to become active in the
jihadist areas and carry out attacks on the civilian population or on international troops, this
could bring about calls at the international level for Switzerland to adopt more far-reaching
measures in relation to combating terrorism.
The increase in jihad-motivated travel movements will necessarily entail at least some of the
jihadists returning to Europe. Returnees, who
have generally already been radicalized in their
countries of origin or former residence, pose a
considerable risk to the security of individual
countries. Returnees who have visited training camps or even fought in jihadist areas may
be returning with the intention of carrying out
attacks, or even having been ordered to do so.
There is a danger that returnees from the armed
jihad will take an active part in terrorist activities or support such activities either in Switzerland or using the country as a base. They could
also play an important role in radicalizing Muslims. However, so far there has been no confirmation of any returnees in Switzerland.
TERRORISM | PKK
1.3 PKK
SELEC TED E VENTS
15 February
At an unauthorized demonstration by the Kurdistan Workers’ Party (PKK) in Olten,
an activist threatened campaigns against Europe by young Kurds.
25 / 26 February Demonstrations took place in several European cities. The protest was directed
against coercive measures by the authorities, including numerous arrests of PKK
members and house searches in Italy, France and before that also in the Netherlands.
4 March
In Belgium, police actions at the studios of the PKK-linked television broadcaster
Roj TV brought broadcasting to a standstill.
8 June
A bomb attack on a police bus in Istanbul left 15 people injured. The Kurdistan Freedom Falcons (TAK) claimed responsibility.
22 June
A TAK bomb attack on a bus carrying military personnel in Istanbul killed five people and left a dozen injured.
16 August
The PKK leadership announced a unilateral ceasefire for the duration of Ramadan
and then extended it until the end of October.
31 August
The Danish Justice Minister decided to institute legal proceedings against Roj TV
and Mesopotamia Broadcast A/S METV. They were accused of supporting the PKK,
which is classified as a banned terrorist organization.
31 October
TAK injured 32 policemen and passers-by in a suicide bombing in Istanbul. The
leadership of the PKK denied responsibility and extended their ceasefire until the
Turkish parliamentary elections in June 2011.
RUSSIA
Black Sea
Caspian
Sea
GEORGIA
Istanbul
ANKARA
AZERBAIJAN
ARMENIA
KURDISH AREAS
TURKEY
Izmir
Tabriz
Diyarbakir
Antalya
Adana
Mosul
Kirkuk
CYPRUS
Mediterranean Sea
Outline map
of Kurdish areas
SYRIA
LEBANON
DAMASCUS
IRAQ
BAGHDAD
ISRAEL
JORDAN
IRAN
200 km
ANNUAL REPORT 2010 | FIS
35
TERRORISM | PKK
SITUATION
Situation in Turkey
The thaw at the end of the spring was followed by a wave of violence in excess of average levels in previous years. The operations of
the Turkish army and of guerrilla units of the
PKK’s Kurdish Nation Defence Forces (HPG)
led to heavy losses on both sides. When the
number of attacks reached its peak, in the middle of August, the PKK leadership declared a
unilateral ceasefire for the duration of Ramadan,
the Islamic month of fasting. In mid-September
the ceasefire was extended until the end of October. Following the attack in Istanbul at the end
of October, for which TAK claimed responsibility, the head of the Executive Committee of the
Kurdistan Democratic Confederation (KCK),
Murat Karayilan, announced the extension of
the unilateral ceasefire until the parliamentary
elections in June 2011.
The Turkish parliament renewed the mandate
for cross-border military operations against
PKK positions and safe havens in northern Iraq.
The armed forces, under their new chief of staff
General Isik Kosaner, continued their efforts to
inflict as much damage as possible on the PKK.
Despite the ongoing fighting, the PKK leader
Abdullah Öcalan, imprisoned since 1999, has
been seeking peace talks with the government
for some time. At the end of August, an advisor
to Prime Minister Erdogan indicated that talks
were taking place between the Turkish authorities and Öcalan.
36
ANNUAL R E P O RT 2 0 1 0 | F I S
Situation in the diaspora community
At the beginning of 2010, coercive measures
by the police in Italy, France and the Netherlands led to numerous protests being organized in several European cities. The majority of
these passed off peacefully, especially in Switzerland. Here, the demonstrations were well organized, authorized by the authorities in each
case and conducted in a peaceful way. An exception to this was the unauthorized protest in
Olten in mid-February, where a young activist
threatened to carry out acts of violence. Otherwise, there has been scarcely any public reaction from the Kurdish diaspora community to
the continuing fighting, with its heavy casualties, in the Turkish/Iraqi border area.
In 2010, PKK sub-units continued to engage
in propaganda and training activities, to recruit
new members and to collect donations. Recruitment was carried out in Europe for cadre positions and ideological training camps. As in
previous years, every so often combatants were
sent to the front line. In addition, there is credible evidence that on several occasions money
and materials were delivered from Europe to
Erbil by couriers. From there, it is assumed that
it found its way to the Qandil mountains to supply the HPG units.
TERRORISM | PKK
ASSESSMENT
Signs of fragmentation in the PKK
Despite the attempts at dialogue between the
Turkish authorities and the PKK, it remains
unlikely that the government will recognize
the PKK as the legitimate representative of
the Kurds. While he is in prison, Öcalan’s influence and room for manoeuvre are restricted.
KCK leader Murat Karayilan advocates a tough
stance toward the government. There is no
sign of any long-term easing of the conflict, as
younger cadres in the PKK, splinter groups and
other extremist activists show little interest in
resolving the conflict. The attack in Istanbul on
31 October is an illustration of this.
Turkey is planning a far-reaching constitutional review in 2011, which will probably
also reflect a continuation of the Government’s
trend toward more Kurd-friendly policies. Rapprochement could split the PKK and create internal conflicts.
The European executive of the PKK, the
European Kurdish Democratic Community
Coordination, will probably continue the dual
strategy of armed conflict on the front line and
superficially peaceful campaigning for political
recognition in Europe. The focus, in Switzerland as elsewhere in Europe, will continue to be
on propaganda, covert collection of contributions and the recruitment of young fighters and
cadres. The leadership structure remains stable.
The cadres act professionally, operate crossborder networks and are regularly replaced.
European safe haven
The diaspora community’s demonstrations
are less to do with the situation in the Kurdish
area and more to do with the situation in the
diaspora itself. The protests are centred around
the coercive measures taken against European
PKK cadres and media such as Roj TV. The potential for violence and for mobilization for protests and attacks on Turkish institutions remains,
particularly among young people belonging to
the PKK’s youth movement, Komalen Ciwan.
However, the PKK can operate best under
peaceful conditions in Switzerland.
PKK flag at a demonstration in front of
the Federal parliament building
[archive photo]
ANNUAL REPORT 2010 | FIS
37
TERRORISM | LTTE and its successors
1.4 LTTE and its successors
SELEC TED E VENTS
3 March
In Germany, five members of the Tamil Coordination Committee (TCC) were arrested by the police. The TCC functioned in Germany as the coordination centre for
the Liberation Tigers of Tamil Eelam (LTTE).
5 May
A member of the TCC was arrested in Offenburg (Germany). It is alleged that during
a collection for the LTTE, the man stabbed and wounded a Tamil who was unwilling
to contribute.
14 May
In Vancouver (Canada), a Canadian citizen of Tamil origin was sentenced to six
months in prison for financing terrorism. The man had admitted raising funds for a
Tamil non-governmental organization in the knowledge that these would benefit the
LTTE.
12 June
Following a bomb attack on a railway track in the Indian state of Tamil Nadu, leaflets were found pointing to the LTTE as the perpetrators.
15 June
In the Netherlands, four members of the LTTE were arrested for financial support of
a terrorist organization.
27 November
The LTTE’s annual Heroes’ Day celebration took place at Forum Fribourg.
LTTE propaganda at a
Tamil event in St. Gallen
38
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | LTTE and its successors
SITUATION
End of LTTE in Sri Lanka
In 2010, the security situation in Sri Lanka
continued to stabilize. The LTTE no longer
plays any role in this island state and is considered to have been annihilated. Of the approximately 11,000 people arrested as LTTE combatants after the war, the majority have been
released, since they are no longer considered a
threat to the Sri Lankan state.
Some of the numerous foreign branches
of the LTTE, including in Switzerland, still
exist, but as in the previous year came under
enormous pressure from the law enforcement
agencies. On 3 March, five LTTE cadres were
remanded in custody in Germany. In the Netherlands, seven LTTE members were arrested
on 26 April and a further four on 15 June. On
12 June, in the Indian state of Tamil Nadu there
was a bomb attack on a railway track, for which
the LTTE was held responsible on the basis of
leaflets discovered there. However, the Indian
authorities have not confirmed that the LTTE
was behind the attack.
Political groups as successors
In the competition for the LTTE’s political
legacy and international network, two Tamil
groups have pushed their way to the fore:
▪▪ The Global Tamil Forum (GTF), based in
England, is a amalgamation of several national Tamil forums; in 2010 the GTF was
relatively inactive.
▪▪ The Transnational Government of Tamil
Eelam (TGTE) sees itself as the Tamil government in exile and as the political contact
for all matters relating to Tamils in Sri Lanka.
It is represented in countries with large Tamil
diaspora communities – as well as Switzerland, these include Australia, Denmark, Germany, France, the UK, Italy, Canada, New
Zealand, Norway, Sweden and the US.
Like the LTTE, both organizations advocate
a Tamil state in Sri Lanka, but they officially
distance themselves from the Tigers’ use of violence. For the purpose of democratic legitimacy,
the TGTE organized elections for its parliament
in exile at the beginning of May, in countries
where this was possible. These included Switzerland. The parliament convened a few weeks
later in Philadelphia (USA).
Players in Switzerland
Several players were also active in Switzerland:
▪▪ Although the LTTE in Sri Lanka has been destroyed, the Swiss branch of the organization
is still active and in 2010 it organized a few
private gatherings. However, the number
of participants at these gatherings, most of
which took the form of commemorative
events, was lower overall than in previous
years.
ANNUAL REPORT 2010 | FIS
39
TERRORISM | LTTE and its successors
▪▪ The TGTE maintained a secretariat in Geneva, but it was not particularly active and has
since been closed. In October, a Swiss Tamil
woman was elected in New York (USA) as
deputy spokesperson of the parliament in
exile. At the beginning of November, a Sri
Lankan citizen resident in Switzerland was
appointed as a deputy minister in the TGTE.
▪▪ The Swiss Council of Eelam Tamils (SCET),
which was established in March by elections
in the Tamil community in Switzerland, was
more active.
SCET restricts its activities to Switzerland,
and it also has as its aim the establishment of
an autonomous state in Sri Lanka. Many of its
members, like the Swiss representatives in the
TGTE, have links with the LTTE. SCET organized demonstrations in June and August in front
of the UN office in Geneva, and at the end of
August it organized a protest march from Geneva to Brussels to demonstrate against discrimination against Tamils in Sri Lanka. These
events passed off peacefully and received little
public attention.
Despite the destruction of the LTTE in Sri
Lanka, funds are still being collected in the
Tamil community in Switzerland, and funds
from abroad are being channelled into Switzerland. While in previous years there were indications that the money was being used to support
the LTTE in Sri Lanka, it was unclear what the
funds were being used for in 2010.
TGTE elections
in Switzerland
40
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | LTTE and its successors
ASSESSMENT
Power struggle in the Tamil separatist
movement
There is very little difference between the
ideologies of the Tamil groups which emerged
following the defeat of the LTTE. Their goal
remains the creation of an autonomous Tamil
state in Sri Lanka, although, unlike the LTTE,
they want to establish it by political means and
not by force of arms. However, there are differences and in-fighting regarding the leadership
role and influence on the large Tamil diaspora
community around the globe. A resolution of
the struggle for power will be complicated by
the fact that these groups lack the backing of
the Tamil population in Sri Lanka. The latter
are exhausted and are preoccupied with rebuilding their livelihoods. While for a long time the
LTTE and their fight for a Tamil state did have
the backing of Tamils in Sri Lanka, this is no
longer the case today. It is therefore probable
that the post-LTTE groups will in the short to
medium term be primarily preoccupied with
their own affairs. There is also the possibility of
internal disputes involving violent conflict.
Provisional end to the armed struggle
Tamil terrorism came to an end – possibly only
a temporary one – with the annihilation of the
LTTE in Sri Lanka. In the medium term, the improving security and economic situation in Sri
Lanka should also benefit Tamils in the east and
north of the country and further dampen their
interest in armed resistance. If, however, the
government excludes the Tamils from economic
progress or treats them as second-class citizens,
dissatisfaction could once again find expression
in violent protests and renewed support for a
separatist and potentially terrorist movement. In
such a case, the large Tamil diaspora community
in Switzerland may once again show solidarity
with the population and also with any new terrorist group in Sri Lanka.
ANNUAL REPORT 2010 | FIS
41
TERRORISM | The funding of terrorism
1.5 The funding of terrorism
SELEC TED E VENTS
42
4 March
The National Council, as the second chamber, referred the motion ‘The UN is undermining the basis of our legal system’ to the Federal Council (Motion 09.3719).
The motion calls for Switzerland to suspend the implementation of UN sanctions to
combat terrorism where these do not meet minimum procedural safeguards.
23 June
The German Federal Ministry of the Interior has banned the International Humanitarian Aid organization (IHH) for its indirect financial support of Hamas.
July
A jihadist internet forum looked at the issue of how a terrorist group active in Iraq,
Islamic State of Iraq (ISI) could make up for the shortfall in donations. Suggestions made included criminal activities such as kidnapping and extorting protection
money.
1 August
The agreement between the EU and the US on SWIFT, the Society for Worldwide
Interbank Financial Telecommunication, came into force. Since then, it has again
been possible for the US, on request, to access and analyse SWIFT data relating to
suspicious bank transactions. The previous agreement did not stand up to EU data
protection guidelines.
9 September
The EU’s Court of First Instance reprimanded the EU, stating that the legal basis for
entering the Al-Aqsa Foundation on the EU’s list of terrorist organizations was insufficient (ECJ, Court of First Instance, Case T-348/07 Stichting Al-Aqsa v Council
of the European Union).
26 September
The UN Special Rapporteur on human rights and counter-terrorism presented his
report to the UN General Assembly. He complained that individuals included on the
UN terror list had no recourse to legal action to contest their inclusion.
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | The funding of terrorism
SITUATION
Overview
In Switzerland, the number of suspicious
activity reports submitted to the authorities
by Swiss financial services providers in connection with suspected financing of terrorism
remained low. In 2010, only 13 out of a total
of 1,159 suspicious activity reports submitted
to the Money Laundering Reporting Office
(MROS) related to suspected financing of terrorism. Ten of these were passed on to the law
enforcement agencies. One noticeable change
compared with last year is in the level of the reported assets: in 2009 these amounted to around
9,500 francs, but in 2010 they were over 23 million francs. However, this should be qualified
by the fact that one single suspicious activity
report, concerning assets of over 18.6 million
francs, alone accounted for the bulk of this figure. This case is still being processed. In four
further cases with a combined total of around
4.4 million francs, proceedings were terminated.
It is consequently not possible to demonstrate
any change in the trend compared with the previous year.
The consistently low number of suspicious
activity reports in Switzerland should not distract from the fact that there is still a need for
action to be taken on the financing of terrorism.
The German ban on the IHH and the SWIFT
agreement demonstrate this.
Legal tensions
The balance between safeguarding legal
principles and taking measures to combat the
financing of terrorism was a frequent subject
of debate in 2010. A particular concern was
the problem of how the so-called ‘terror lists’
should be used. Here, legal arguments received
greater support than in the previous year. The
referral to the Federal Council of the motion
‘The UN is undermining the basis of our legal system’, the reprimand of the EU Court
of First Instance and the UN Special Rapporteur’s complaint in September are evidence of
this. In July, a court of appeal in Washington
DC was also looking at this problem (United
States Court of Appeals, District of Columbia
First page of the
UN terror list
ANNUAL REPORT 2010 | FIS
43
TERRORISM | The funding of terrorism
Circuit, No. 09-1059, PMOI v. USDoS). The
court objected to the fact that the People’s Mojahedin Organization of Iran (PMOI) had not
been granted a fair hearing when it was entered
on the US State Department’s list of foreign
terrorist organizations. The State Department
therefore had to review the listing. At the end
of November, the EU, through its Official Journal, informed several organizations included
on the EU terror list that they could submit a
documented request to the Council of the European Union that their entry be reviewed (O.J. C
316/06 of 20 November 2010).
Funding from criminal activities
Terrorist organizations have long been using
criminal activity as a source of funding. Recent
years have seen an expansion in such activity,
and in 2010 the trend continued. For example,
in the Sahel region AQIM kidnapped several
citizens of Western countries in order to extort
a ransom. A new development was observed
on the Horn of Africa, where there is said to
have been contact between the pirates on the
Somalian coast and al-Shabaab Islamist rebels.
Through these contacts, al-Shabaab could gain
logistical as well as financial support.
44
ANNUAL R E P O RT 2 0 1 0 | F I S
TERRORISM | The funding of terrorism
ASSESSMENT
Switzerland not a terrorism funding hub
Switzerland as a financial centre still does not
play a key role in the financing of terrorist activities. This can be seen from, among other things,
the low number of suspicious activity reports
submitted to the authorities by Swiss financial
services providers and the small number of investigations into suspected terrorism funding
carried out by the federal criminal police in recent years. However, it should be borne in mind
that both in Switzerland and abroad, informal
payment systems and other alternative methods
of transferring funds, such as the hawala system
or cash couriers are largely beyond the control
of the authorities. Moreover, it is always difficult to provide concrete proof that funds will be
used for terrorist activities after they have been
taken out of the country.
Global standards
Improving international cooperation is particularly important given the tension between legal principles and state sanctions for combating
terrorism funding. It is imperative that acceptable common legal standards be established and
applied. Otherwise, suspected terrorist organizations could use legal actions to force state
authorities to act and could even demand and
receive compensation, which in the worst-case
scenario could then be used to fund terrorist activities. Switzerland has been active in this area
for years, supporting jointly with other countries an initiative aimed at making UN listing
and delisting procedures more transparent.
A dangerous mixture
Combating criminal activities which serve to
fund terrorism remains a major challenge. The
situation becomes even more difficult when
these activities are indirectly supported by
countries, as can happen for example where
ransoms are paid in kidnapping cases. Terrorists pursue their funding activities in every
conceivable area and now make only very limited use of the international banking system for
transferring money.
ANNUAL REPORT 2010 | FIS
45
2. Violent extremism
ANNUAL REPORT 2010 | FIS
47
VIOLENT EXTREMISM | Right-wing extremism
2.1 Right-wing extremism
SELEC TED E VENTS
48
23 January
Early on this Saturday morning, a brawl took place in a well-known pub in Bern,
in which three individuals from right-wing extremist and hooligan circles were involved. The three men beat and kicked their two victims, who both needed hospital
treatment. The cantonal police carried out searches of the houses of two of the suspects and seized weapons and ammunition. At the time of going to press, proceedings for attempted grievous bodily harm and violation of weapons law were still
pending.
31 January
On this Sunday, there was a large-scale confrontation between right-wing extremists
and other festival-goers at a festival in Schwanden, in the canton of Glarus. Several
injured people needed hospital treatment. The cantonal police brought charges of
assault and, where applicable, affray.
1 March
In a violent altercation between three men in Basel, a dark-skinned foreigner was
seriously injured and had to be hospitalized. Criminal proceedings were instituted
against the two perpetrators, of whom at least one is a right-wing extremist known
to the police.
13 / 14 March
In Amriswil, in the canton of Thurgau, approximately 120 to 150 people took part in
a skinhead concert. The concert-goers were from various parts of Switzerland, but
also from abroad, including Germany and Austria. Right-wing extremists had hired
the party room on the pretext of holding a birthday party.
25 April
At a gravel quarry in the canton of St. Gallen, nine right-wing extremists played
airsoft and engaged in paramilitary exercises. Airsoft involves teams equipped with
airguns fighting against each other, simulating military scenarios.
ANNUAL R E P O RT 2 0 1 0 | F I S
VIOLENT EXTREMISM | Right-wing extremism
8 August
In 2010, right-wing extremists continued their tradition of celebrating Swiss National Day at the Rütli, in the canton of Uri. However, since 2006 they have stopped
taking part in the official celebrations, generally holding their celebration separately
on the Sunday following 1 August. This is because since that time access to the Rütli
meadow has been regulated by means of a ticketing system. In 2010, approximately
150 right-wing extremists gathered at the Rütli; their celebrations passed off peacefully and without incident.
19 September
In Dulliken, in the canton of Solothurn, an altercation occurred between right-wing
extremists and foreigners. One right-wing extremist used a pepper spray and also
injured some of the bystanders.
A right-wing extremist kitted out
for airsoft and paramilitary exercises
ANNUAL REPORT 2010 | FIS
49
VIOLENT EXTREMISM | Right-wing extremism
SITUATION
Number of events
The situation regarding right-wing extremism
in Switzerland has not changed substantially in
recent years, including the downward trend in
numbers. In 2010, a decrease in the number
of events motivated by right-wing extremism
was recorded, down to a total of 55, following
a slight increase in 2009, when there were 85
compared with 76 in 2008. The number of incidents involving violence fell from 32 to 13,
representing the lowest level for many years
(2008: 24, before that, between 52 and 64). Furthermore, there is a clear continuation of the
trend toward purely political events, which in
accordance with the Federal Act on Measures
to Safeguard Internal Security (BWIS) are not
subject to surveillance by the intelligence services.
Commemorative days
Right-wing extremists attach particular importance to Switzerland’s history and regularly
take part not only in the National Day celebrations and the commemoration of the Battle of
Sempach, but also in other commemorative
111 109 109
100
85
76
Total number 75
of incidents
64
50 52
Number of
violence-related
incidents
25
0
50
55
58
24
32
13
2005 2006 2007 2008 2009 2010
ANNUAL R E P O RT 2 0 1 0 | F I S
days. For example, right-wing extremists met
in September in the canton of Bern to remember,
in a wreath-laying ceremony, the soldiers who
fell in World War One. In October 2010, a rightwing extremist group carried out a ceremony in
the canton of Nidwalden to commemorate the
French invasion of 1798.
On 26 June 2010, the Lucerne authorities refrained on security grounds from holding an official battle celebration at Sempach, in the canton of Lucerne, and just held a commemorative
mass. The Party of Nationally Oriented Swiss
(PNOS) organized a wreath-laying ceremony at
the Winkelried monument in Sempach on 3 July.
Shortly afterwards, the wreath was removed,
probably by left-wing extremists. In retaliation,
the PNOS threatened to fit next year’s wreath
with an explosive device, in order to prevent a
similar occurrence. It also warned that left-wing
extremists in the canton of Lucerne would have
‘nothing to laugh about’ in the next few months.
The Lucerne criminal investigative authorities
launched an initial investigation into the PNOS
explosives threat. The proceedings were then
abandoned, as the requirements for bringing a
prosecution were not fulfilled. For its part, the
PNOS has offered a reward of 500 francs to find
the perpetrator or perpetrators and says that it
has filed criminal charges for theft. On 9 July,
PNOS representatives laid another wreath in
front of the monument. Examination by the police revealed that the wreath was not fitted with
an explosive device.
Events motivated by right-wing extremism
reported to the FIS since 2005 (excluding graffiti)
VIOLENT EXTREMISM | Right-wing extremism
Racial discrimination law
In June 2009 the first Anne Frank Square in
Switzerland was inaugurated in Birsfelden, in
the canton of Basel-Country. Afterwards, the
then President of the Basel Section of PNOS
posted a text on the Basel Section’s website describing Anne Frank’s diary as historically inaccurate and also casting doubt on the Holocaust.
On 23 June 2009 a complaint was filed against
him in Basel for violation of the racial discrimination law (Art. 261bis of the Swiss Criminal
Code (SCC)); in October 2009 he was charged
and, as the person responsible for the website at
the time of the offence, he was sentenced to a
heavy fine by the Basel court on 21 June. The
verdict became final in July.
The convicted man is one of the most active right-wing extremists and also maintains
international contacts. Moreover, this was not
the first time that this PNOS representative had
come into conflict with the law. In 2006 he was
reported for assault and bodily harm and was
later convicted.
Overall, recent years have shown that convictions of all types, including for violation of the
racial discrimination law, can have a considerable preventive effect in right-wing extremist circles. Following convictions, right-wing
extremist activity decreased dramatically or
ceased altogether. Furthermore, it was clear that
the convictions led to fewer new people joining
the scene.
Weapons and violence
Various incidents in 2010 showed that rightwing extremists are still prepared to act with
strong violence. Their fondness for weapons
and combat is also reflected in the paramilitary
exercises and combat training that are organized
and attended by various right-wing extremists.
Incidents such as the assaults at the beginning of March in Basel show that for right-wing
extremists, foreigners still represent the enemy.
Left-wing extremists are another target of their
hostility.
Right-wing extremism in French-speaking
Switzerland
In French-speaking Switzerland, right-wing
extremist groups have been less active over
the last five years. Some long-standing adherents have abandoned or severely curtailed their
activities. It is possible that this is also linked
to the racist incidents at a right-wing extremist
concert in Gamsen, in the canton of Valais, in
2005 and to the total of twelve sentences handed down as a result in 2009.
Right-wing extremists are particularly active
in the cantons of Geneva and Vaud. Right-wing
extremist circles in the cantons of Neuchâtel
and Jura are very small; in the cantons of Valais
and Fribourg they are in the middle of the range
for French-speaking Switzerland in terms of the
numbers of adherents and their activities. Overall, the right-wing extremist scene as a whole in
French-speaking Switzerland numbers just over
100 activists.
In French-speaking Switzerland as a whole,
only certain types of activity take place, such
as skinhead concerts, festivals and meetings,
whereas in German-speaking Switzerland activities carried out also include leafleting, parties, political events, commemorative services
and funeral marches. Right-wing extremists
ANNUAL REPORT 2010 | FIS
51
VIOLENT EXTREMISM | Right-wing extremism
from French-speaking Switzerland often travel
to German-speaking Switzerland to take part in
events such as concerts or the Swiss National
Day celebrations at the Rütli in the canton of
Uri.
Up until around five years ago, negationism,
or the denial of genocide and in particular the
Holocaust, played a considerable role in Frenchspeaking Switzerland. The chief negationists at
that time have since withdrawn from the scene
or served their sentences following convictions
for violation of the racial discrimination law.
Since then, activity in French-speaking Switzerland has also quietened down in this area,
and the international contacts which previously
existed, primarily with negationists in France,
have become less frequent.
planned extremely clandestinely, and they often
succeed in holding events in secret. The authorities frequently only find out about a meeting
after the event.
While the number of conflicts between rightand left-wing extremists is increasing in most
European countries, in Switzerland a decline
can be observed. This could be linked to the
overall decline in right-wing extremist activity
here, but could also be attributable to direct and
improved prevention and repression measures.
Right-wing extremism in Europe
Activities motivated by right-wing extremism
have declined slightly in most European countries. In some countries, they have fallen to a
very low level. Overall, the situation in Europe
can be seen as being relatively peaceful.
Right-wing extremists are becoming increasingly conspiratorial, in order to evade the authorities’ surveillance and security measures,
as well as political and militant pressure from
the left-wing extremist camp. Activities are
Weapons and
ammunition seized
during a house search
52
ANNUAL R E P O RT 2 0 1 0 | F I S
VIOLENT EXTREMISM | Right-wing extremism
ASSESSMENT
Europe-wide developments
There have been few new developments in
right-wing extremist circles in most European
countries in the last two years. The situation in
Switzerland broadly reflects the European trend.
The reasons for the decline in the number of
confrontations between right- and left-wing extremists in Switzerland, in contrast to the trend
in the rest of Europe, are unknown.
PNOS
The incidents involving PNOS demonstrate
the duplicitous approach of the party, which as
a political association officially distances itself
from the use of violence. Some members have
been convicted of making racist remarks, are
violent or at least prepared to use violence, and
maintain contacts with internationally known
right-wing extremist groups and parties. PNOS
is repeatedly confronted with its members’ violations of the law, shown by the convictions
for breaches of the racial discrimination law. In
2010, events surrounding the Sempach memorial day demonstrated PNOS’ continuing willingness to use violence and the readiness of its
representatives to engage in trench warfare with
left-wing extremists. The incidents are characteristic of violent extremist circles in Switzerland. Right- and left-wing extremists continually provoke one another; they threaten to obstruct
or disrupt the other side’s events. Nonetheless,
the number of actual confrontations between
the two ideological camps in Switzerland has
declined, making it the exception in Europe.
Overall assessment
Compared with German-speaking Switzerland, right-wing extremist circles in Frenchspeaking Switzerland are small and fragmented.
As in German-speaking Switzerland, numbers
fluctuate considerably, but most adherents here
are somewhat older than in German-speaking
Switzerland. In the cantons of French-speaking Switzerland, there has been only limited
extremist activity, with right-wing extremists
tending to travel from French-speaking Switzerland to German-speaking Switzerland.
Overall, right-wing extremist activities do not
currently pose a threat to Switzerland’s internal security. However, they may cause sporadic
and localised breaches of the peace and of public order, and therefore have considerable potential to cause damage. This continually results
in considerable costs being incurred for police
operations at demonstrations, for example in
order to prevent clashes between right- and leftwing extremists.
ANNUAL REPORT 2010 | FIS
53
VIOLENT EXTREMISM | Left-wing extremism
2.2 Left-wing extremism
SELEC TED E VENTS
54
30 January
In Basel, around 300 people took part in an authorized demonstration against the
World Economic Forum (WEF) in Davos, in the canton of Graubünden. This resulted in property damage totalling 90,000 francs due to spray-painting, broken glass
and a flare being thrown at a car.
7 February
Around a hundred left-wing extremists among the 500 participants were responsible
for property damage put at around 500,000 francs during an unauthorized ‘Reclaim
the Streets’ rally in Zurich organized via SMS messages, flyers and Facebook.
15 April
In Langnau am Albis (Zurich), the police arrested three left-wing extremists who
were allegedly planning to attack a new IBM factory building in Rüschlikon (Zurich). The police seized a letter claiming responsibility, as well as gas bottles and
explosives.
24 April
In Winterthur (Zurich), eight delivery lorries belonging to Allgemeine Plakatgesellschaft (APG) were set on fire. The total cost of the damage caused was put at around
200,000 francs.
1 May
In Basel, after three cars were destroyed and two others damaged in the early morning hours, left-wing extremists carried out further attacks on vehicles at a clandestinely organized follow-up demonstration in the evening and attacked a police station with Molotov cocktails. The total damage caused to property in connection with
the 1 May events in Basel amounted to around 326,000 francs.
21 May
Left-wing extremists at an unauthorized, clandestinely organized ‘Reclaim the
Streets’ rally in Basel caused damage to vehicles and shop windows and damage to
property through spray-painting which was put at 750,000 francs.
ANNUAL R E P O RT 2 0 1 0 | F I S
VIOLENT EXTREMISM | Left-wing extremism
12 June
In Freiburg, around a hundred left-wing extremists held a demonstration of solidarity with two French people who had been arrested. During the severe rioting that
followed, direct attacks were made on the prison and the police headquarters. Two
policemen were injured, and checks were carried out on 40 demonstrators.
18 September
Property damage estimated at around 300,000 francs was caused during an arson
attack on a construction site on the Hardbrücke bridge in Zurich.
27 / 28
November
In Allschwil (Basel-Country) masked figures stole ballot boxes for the referendum
on the deportation of foreign criminals and set them on fire. The polling station in
Schlieren (Zurich) was the target of an attempted arson attack and locks at various
polling stations in Winterthur (Zurich) were glued up. After the referendum, unauthorized demonstrations took place in Zurich and Bern.
Rally against police violence
on 12 June in Freiburg
ANNUAL REPORT 2010 | FIS
55
VIOLENT EXTREMISM | Left-wing extremism
SITUATION
Number of events
Compared with 2009 (220 incidents), the
number of incidents motivated by left-wing extremism rose in 2010 to 254, of which 109 were
connected with acts of violence. The increase
of around 15 per cent can be attributed in particular to campaigns, some of which involved
violence, against the 28 November 2010 referendum on the deportation of foreign criminals,
launched by the SVP, and to numerous solidarity campaigns with alleged political prisoners.
The case of three left-wing extremists arrested
in April 2010, who had allegedly planned an attack on IBM in Rüschlikon, was of particular
significance.
Peaceful WEF 2010
The WEF took place in Davos (Graubünden)
from 27 to 31 January 2010. The downward
trend of previous years in the numbers of protesters mobilized continued; once again, the
opponents of globalization failed to coordinate
their campaigns, which proceeded in line with
the expectations of the police and organizers,
on a national level. A total of three rallies were
held, all of which were authorized. Damage to
254
250
227 222
214
220
200
Total number
of incidents 150 140
1 May saw a high level of damage to
property
On Labour Day, a large amount of damage
was caused to property in Basel, Zurich and
Bern. An unauthorized follow-up demonstration involving 120 left-wing extremists led to
serious rioting in Basel. The police arrested
15 people. In Zurich, Labour Day passed off
with no major rioting or damage to property,
thanks to systematic intervention by the police. Nonetheless, two people were injured in
clashes, one of them a policeman. 353 people
were temporarily detained. In Bern, in the early
hours of 2 May, a Molotov cocktail was thrown
at a police patrol near the Riding School. In
Lausanne (Vaud) there was an unauthorized
demonstration by left-wing extremists. 54 people were stopped and searched. No major damage to property was recorded.
147
126
Number of 100
violence-related
incidents
property was recorded in Lucerne on 23 January and most notably in Basel on 30 January.
Altogether, around 800 people took part in
the demonstrations; in 2009 there had been a
total of 1,800 participants. Left-wing extremists carried out two arson attacks in connection
with the WEF, one of which failed, and three
paint attacks. The property damage caused by
these, put at around 106,000 francs, roughly
corresponded to that of the previous year. The
organization Revolutionärer Aufbau Schweiz
(RAS) claimed responsibility for three of the
five attacks.
110
127
109
50
0
56
2005 2006 2007 2008 2009 2010
ANNUAL R E P O RT 2 0 1 0 | F I S
Events motivated by left-wing extremism
reported to the FIS since 2005 (excluding graffiti)
VIOLENT EXTREMISM | Left-wing extremism
Rioting at two ‘Reclaim the Streets’ rallies
On 21 May in Basel, 15 left-wing extremists
provoked rioting which caused damage in the
region of 750,000 francs. They were part of a
crowd of around 200 people. A similar event
had taken place earlier in the year, on the night
of 6/7 February in Zurich, when around 100
left-wing extremists not only caused damage
of around 500,000 francs, but also attacked the
police directly with teargas, bottles and stones.
In both cases, violent left-wing extremists exploited for their own purposes a so-called ‘Reclaim the Streets’ event, clandestinely organized by persons unknown. These events involve
the (illegal, but generally peaceful) symbolic
‘recapture’ of public space which the organizers
perceive as having been commercialized or privatized, by holding a street festival or a parade.
The organizers of such events are not part the
left-wing extremist scene. What was striking in
Zurich and Basel was the clever way in which
the well-equipped and highly mobile violent
left-wing extremists had planned and prepared
their actions. A new tactic in Zurich was the
deliberate large-scale mobilization of football
fans.
Planned attack on nanotechnology
laboratory
One of the key events of 2010 was the arrest of three left-wing extremists on 15 April
in Langnau am Albis (Zurich). They were alleged to have planned an attack using an improvised explosive device (IED) on a nanotechnology laboratory being built in Rüschlikon
(Zurich). The three had close links with the an-
archist movement in Italy and there were also
some links with Revolutionärer Aufbau Zurich
(RAZ). RAZ runs one of the two central secretariats of Secours Rouge International (SRI);
the other is located in Brussels.
Since their arrest, left-wing extremists, both
abroad and in Switzerland, have organized a
campaign of solidarity with the detainees. These
included so-called ‘prison walks’ and paint and
arson attacks. The campaign reached its peak
with the actions instigated by SRI on 18 and 19
September in aid of alleged political prisoners
serving long sentences. The days of action were
also in support of Marco Camenisch, in prison
for murder, and culminated on 18 September
in an arson attack on a construction site on the
Hardbrücke bridge in Zurich, causing around
300,000 francs’ worth of damage to property.
As a gesture of solidarity with alleged political prisoners, several parcel bomb attacks were
carried out in Italy on 23 December 2010. A
parcel bomb exploded at the Swiss embassy in
Rome, seriously injuring an embassy employee
on both hands. In claiming responsibility for
the attacks, the left-wing extremist group Federazione Anarchica Informale (FAI), also made
reference to the prisoners detained in Switzerland. Previously, on 1 and 2 November 2010,
the Swiss diplomatic mission in the Greek capital Athens, along with other embassies, had also
been the target of an attempted parcel bomb attack. A jet of flames shot out when a suspicious
parcel was investigated. No-one was injured.
The Greek left-wing extremist organization
Conspiracy of Fire Cells claimed responsibility
for the series of attacks.
ANNUAL REPORT 2010 | FIS
57
VIOLENT EXTREMISM | Left-wing extremism
Attacks against genetic engineering
In 2010, the left-wing extremist movement
took up the issue of genetic engineering. In
connection with this, activists carried out a herbicide attack on 24 June in Pully (Vaud) on a
field where genetically modified wheat was being trialled. Furthermore, the house and car of a
professor of genetic engineering at the Federal
Institute of Technology (ETH) were targeted in
a paint attack in Zurich on 29 June.
Anti-fascism
Asylum, anti-repression, anti-racism and
anti-fascism are particular focal points in the
spectrum of left-wing extremist issues. Falling into this category were the many actions in
connection with the deaths of two detainees in
Bochuz (Vaud) and Schöngrün (Solothurn), in
March and June respectively, and the death of a
car thief from a suburb of Lyon. The latter was
shot by police on 18 April in Sévaz (Fribourg).
The Sévaz incident, linked to the arrest of two
further car thieves shortly afterward, prompted
left-wing extremists to hold a rally on 12 June
in Fribourg, which led to serious riots. Of the
approximately 100 demonstrators, at least 20
were French, mainly from the suburbs of Rouen,
where numerous left-wing extremist squatters
from the Geneva squatter movement which was
disbanded in 2007 have made their home.
On 2 October, the 10th ‘anti-fascist evening
walk’ took place in Bern without any violent incidents. The authorities had not authorized the
event, but nonetheless allowed it to go ahead. In
the period to autumn 2010, the federal capital
was less affected by left-wing extremist vio-
58
ANNUAL R E P O RT 2 0 1 0 | F I S
lence than in previous years. The main reason
for this was probably the 26 September referendum on the future of the Riding School, as the
extremists did not want to jeopardize its continued existence by engaging in violence beforehand. For years, the Riding School has been
seen as the rallying point for violent left-wing
extremist actions. Following the passing of the
referendum on the deportation of foreign criminals in November, however, the federal capital
experienced a renewed increase in violent incidents motivated by left-wing extremism.
Actions linked to the deportation initiative
also took place elsewhere. On 27 November in
Allschwil (Basel-Country), masked figures entered the polling station, stole ballot boxes and
set them on fire. On 28 November, the polling
station in Schlieren (Zurich) was the target of an
attempted arson attack. At various polling stations in Winterthur (Zurich), locks were glued
up. On the evening of the Sunday referendum,
left-wing extremists responded to the result of
the referendum by holding unauthorized rallies
in Zurich and Bern. The participants in these
demonstrations caused damage to property put
at tens of thousands of francs.
VIOLENT EXTREMISM | Left-wing extremism
ASSESSMENT
Issues
2010 was characterized by a large number of
solidarity and protest actions on a wide variety
of issues. There was considerably less emphasis
on the economic crisis than there had been in
the previous year. By contrast, the main priorities from the very broad range of issues taken
up by left-wing extremists were the struggles
against repression, fascism, sexism and migration and asylum policies. The choice of issues
here is heavily influenced by current events. For
example, the referendum on the deportation initiative was accompanied by violent incidents
and rioting, the like of which had never been
seen before in Switzerland in connection with
voting.
Potential for violence
The potential for violence in left-wing extremist circles remains high. It is believed that
left-wing extremists still number around 2,000,
of whom 1,000 are violent. In 2010, no tendency toward terrorism motivated by left-wing
extremism could be identified. However, ties
between the Swiss scene and left-wing terrorist groups abroad are still significant, with RAS
and SRI playing a leading role. RAS remains
the most violent left-wing extremist organization in Switzerland. In November 2010, the
Office of the Attorney General of Switzerland
brought charges against an RAS member at the
Federal Criminal Court in Bellinzona. The principal charges against him related to IED attacks
on business premises in the Zurich area. These
were carried out in the run-up to the G8 summit
in Heiligendamm (Germany) in June 2007 and
at the beginning of WEF 2008. As the suspect
had previously been expelled from RAS due
to internal disagreements, no solidarity actions
followed.
Exploded parcel bomb –
Swiss embassy in Rome,
23 December
ANNUAL REPORT 2010 | FIS
59
VIOLENT EXTREMISM | Animal rights extremism
2.3 Animal rights extremism
SELEC TED E VENTS
1 March
Unidentified perpetrators spray-painted the façade of a fur shop in Schwyz.
1 June
In Lugano (Ticino), a demonstration of solidarity with Austrian activists took place.
Offensiva Animalista organized a gathering in front of the Austrian consulate.
9 June
Protests in front of the Austrian consulate in Geneva were directed against the
Austrian government, which the protesters saw as having taken repressive actions
against animal rights activists.
27 August
Acts of vandalism committed during the 23rd donkey race in Mezzovico (Ticino).
11 September / Damage to hunting lodges in Biberist (Solothurn) in the name of the Animal Libera1 October
tion Front (ALF), with at least 2,000 francs of damage to property caused in each
case.
21 November
60
In Lugano (Ticino), posters advertising the Knie Circus were damaged. The ALF
claimed responsibility for the action.
ANNUAL R E P O RT 2 0 1 0 | F I S
VIOLENT EXTREMISM | Animal rights extremism
SITUATION
ALF
Of all the actions recorded in 2010, those of
the ALF were particularly notable. Their modus
operandi follows one of two patterns: on the one
hand they free animals directly, and on the other
hand they cause harm or damage to people or
companies which are allegedly involved in the
exploitation of animals. The second type includes sabotage, vandalism and arson. In 2010,
the ALF carried out campaigns of both types.
Overview of campaigns and solidarity actions
Animal rights extremists continued to be
active in 2010. Their protests were directed
against fur traders, butchers, zoos, circuses,
pharmaceutical companies, wholesale distributors and other companies which were in some
way connected with the keeping of animals.
With a few exceptions, these passed off peacefully. Among the campaigns which were im-
portant for Switzerland were those against the
fur trade, the use of animals in circuses and the
UK animal research company Huntingdon Life
Sciences (HLS) and the campaign in support of
Austrian animal rights activists who stood trial
in Austria in 2010.
SHAC
The Stop Huntingdon Animal Cruelty
(SHAC) campaign has the goal of forcing HLS
to close down. In 2010, it had very little impact
in Switzerland, although the situation was different in the UK, Germany and France, where
sporadic criminal actions took place. In point
of fact, campaigns against Novartis and other
pharmaceutical companies in Switzerland were
less prominent than in the previous year.
Site of the
paint attack
in Schwyz
on 1 March
ANNUAL REPORT 2010 | FIS
61
VIOLENT EXTREMISM | Animal rights extremism
Further campaigns
In October, the company Escada decided to
abandon the use of fur in its collections from
January 2011, due to the pressure put on it by
animal rights extremists prepared to use violence and the latter’s campaign against the fur
trade. The decision can be seen as a victory for
the animal rights activists, but is not irreversible. Depending on demand, fur products could
be reintroduced into their range. The company
Max Mara has now become the campaign’s
principal target.
Support for the Austrian activists was a particular focal point in 2010. As a reminder: on
21 May 2008, ten people from the Austrian animal rights activist camp were remanded in custody. In February 2010, the public prosecutor
brought charges against 13 animal rights activists. The trial began in March, and was followed
by a series of demonstrations in Switzerland,
which passed off without damage to property.
The activists demonstrated with banners and
placards in front of the Austrian diplomatic
missions in Switzerland to show their support
for the accused.
62
ANNUAL R E P O RT 2 0 1 0 | F I S
During 2010 there were frequent protests
against the exploitation of circus animals. The
campaign for circuses without animals Aktion
Zirkus ohne Tiere (AZOT) was active at circus
performances throughout Switzerland, but particularly in the cantons of Tessin, Vaud and Zurich. AZOT did not carry out any illegal actions.
VIOLENT EXTREMISM | Animal rights extremism
ASSESSMENT
Issues
2010 passed off comparatively peacefully,
and actions linked to the animal liberation
movement were few and far between. The focus was on solidarity with the Austrian activists.
This issue could in future give rise to further
actions, principally at the sites of Austrian diplomatic missions. Furthermore, as the demonstrations carried out at Swiss circuses in 2010
showed, any decrease in AZOT activity is unlikely.
Generally speaking, it can be said that the activists’ potential for violence remains low. However, the links between the animal rights extremists and left-wing extremist circles in Switzerland
should not be overlooked, nor should those with
animal rights extremists abroad, particularly in
Italy, France and the Netherlands, who are prepared to use violence.
Potential for violence
In recent years, the readiness of animal rights
extremists in Switzerland to use violence has
been most apparent in the SHAC campaign.
Until now, however, Swiss animal rights extremists have not shown the propensity to use
violence on as large a scale as can be seen in
other countries. Nonetheless, there are violent
animal rights extremists in this country, and
Switzerland will probably continue to be the
scene of violent actions by foreign SHAC activists. After all, several pharmaceutical companies targeted by the campaigns are based here,
and it can be assumed that Swiss activists will
support SHAC’s actions. It is thus to be expected that violent actions in connection with
SHAC may be carried out at any time and also
that the ALF may carry out illegal actions.
Stop Huntingdon Animal Cruelty propaganda
ANNUAL REPORT 2010 | FIS
63
3. Proliferation
ANNUAL REPORT 2010 | FIS
65
PROLIFERATION
SELEC TED E VENTS
66
12 January
A motorcycle bomb explosion in Tehran allegedly killed a well-known Iranian nuclear scientist.
29 March
Russia and the International Atomic Energy Authority (IAEA) reached agreement
on the establishment of a nuclear fuel bank. This will be open to all members of the
Nuclear Non-Proliferation Treaty who fulfil their obligations.
7 June
The UN Security Council extended for a further year the mandate of the panel of
experts monitoring the imposition of sanctions on North Korea.
9 June
The UN Security Council tightened its sanctions on Iran.
30 September
The US IT security company Symantec published a detailed analysis of malware
thought to be aimed at sabotaging the Iranian enrichment programme.
12 November
North Korea revealed the long-suspected existence of its uranium enrichment plant
during the visit of a delegation of US experts.
23 November
The IAEA in Vienna once again called on Syria to clarify discrepancies in its nuclear
programme.
29 November
A representative of the Iranian nuclear programme died in a suspected assassination,
and another was injured in a similar attack.
6 December
In Geneva, a further round of talks in the dispute about Iran’s nuclear programme
took place.
ANNUAL R E P O RT 2 0 1 0 | F I S
PROLIFERATION
SITUATION
Overview
Proliferation is the term used to refer to the
further spread of weapons of mass destruction and their delivery systems or of goods and
technologies used for their production and acquisition. Switzerland is affected by the proliferation of weapons of mass destruction both on
a national level (for example as a supplier of
technology) and on an international level (for
example through regional destabilization). It is
in Switzerland’s national interest to restrict the
availability of weapons of mass destruction.
North Korea and Iran continue to lie at the
centre of the proliferation debate. However,
Syria, Sudan, Myanmar and other countries are
also rumoured to have relevant programmes. In
2010, North Korea made a high-profile return to
the international stage with the news of its construction of a light water reactor and a uranium
enrichment facility. During the same reporting
period, numerous violent actions aimed at countering Iran’s nuclear ambitions were made public. In both the cases mentioned under ‘Selected
Events’, the actions were thought to have been
targeted specifically at representatives of Iran’s
nuclear programme. It is difficult to gauge how
severely this has been affected.
The national and international non-proliferation agendas were dominated by Iran’s efforts
to evade the international community’s sanctions. Iran is investing considerable resources
in order to alleviate the perceptibly increased
pressure of sanctions on its economy. To do so,
the country is making use of every possible op-
portunity, ranging from diplomatic measures
(for example reconciliation and strengthening
relations with important neighbouring countries) through to simple economic measures (for
example the establishment of ‘Swiss’ companies in Switzerland).
Attempts at circumvention
The imposition of embargo measures against
Iran is increasing the cost of monitoring, even
though economic ties with Iran are tending to
diminish. One of the reasons for this is the large
number of companies approaching the authorities to enquire about the constraints on business
dealings with Iran. The authorities not only explain the export regulations, but also provide
information about, for example, possible terms
of payment. This helps to protect companies
from defaults on payments. The other reason is
that in 2010 there were an increased number of
companies wanting to profit from the difficult
conditions of doing business with Iran. These
included Swiss, Iranian and EU companies.
Among EU companies, in particular, there was
a clear desire to circumvent the EU embargo
measures against Iran by doing business via
Switzerland. For example, in 2010 an attempted bulk delivery of aircraft from a major European manufacturer to Iran via a network of middlemen, including some based in Switzerland,
was prevented by referring the applicants to
the competent foreign authorities. Pursuant to
article 5 of the Goods Control Ordinance, individual export licences are issued only to private
ANNUAL REPORT 2010 | FIS
67
PROLIFERATION
individuals or legal entities that are resident or
have a registered office on Swiss customs territory or in a Swiss customs free zone.
On the international level, there are significant discrepancies in the implementation of
sanctions on Iran. In the case of the EU, sanctions are implemented with various degrees of
seriousness by individual member states. In
2010, for example, it was established that a
large delivery of machine tools subject to international controls had been made to Iran from
an EU member state. The delivery was falsely
declared, with components critical to the system being delivered at a later date as spare parts.
High-level government officials in the country
concerned were aware of this procedure. Such
behaviour puts Swiss companies at a competitive disadvantage and undermines the efforts of
the international community.
Politicization of economic relations
2010 revealed once again the extent to which
economic relations with Iran are becoming politicized. Two separate transactions by Swiss
companies received extensive coverage in the
international media. In both cases, the reporting
departed significantly from the facts. The reputational risk involved in business dealings with
Iran remains very high. The merger between the
Strategic Intelligence Service and the Service
for Analysis and Prevention makes it easier for
the Swiss authorities today to assess allegations
against Swiss interests more comprehensively.
This is because all available data is now included in a single overall evaluation and the new
structure facilitates improved coordination.
68
ANNUAL R E P O RT 2 0 1 0 | F I S
Iranian attempts at procurement via Russia
In 2010, several attempts by Iran to procure
potentially sensitive goods were prevented.
The Iranian attempts were made via intermediaries in Russia. Initial contacts were made
with companies in Switzerland which normally
cover other segments of the market. It would
thus appear that Iran is deliberately testing out
new procurement channels. Swiss firms should
be particularly cautious regarding contact with
new customers who are obviously not end users
and who make requests that are out of the ordinary, and should of their own accord contact the
authorities.
South Asia
The Indian and Pakistani nuclear weapons
programmes remain outside the Nuclear NonProliferation Treaty. These programmes are
more and more geared towards operational military capabilities. The procurement processes
are therefore currently focussed more on knowledge which would ultimately permit the deployment of the weapons capacity acquired and less
on the acquisition of goods and technologies
which would be used directly in the production
of weapons. This knowledge includes, for example, expertise in the area of command and
control systems, communications and preparation for operational deployment, such as cavern
construction and the protection of critical military infrastructures. Attempts by the two rival
countries to establish contacts with Switzerland
were monitored and unwanted developments
were prevented.
PROLIFERATION
Prophylax
The prevention and awareness-raising programme Prophylax, with its extensive network
of contacts with industry, proved effective yet
again in 2010. Thanks to the established contacts and close links with industry, yet another
Syrian procurement attempt was foiled. Prophylax demonstrates how collaboration between
the federal government and the cantons makes
it possible to arrive at a comprehensive picture
of the shared threat, to the advantage of decision makers in both the federal government and
the cantons.
FIS intends to continue the Prophylax programme and also to promote closer contacts
with companies and institutions involved in
research. The prevention and awareness-raising
programme thus applies not only to proliferation, but also to the closely-linked issue of industrial espionage. In this regard, policy is
currently being reviewed to ascertain whether
the awareness-raising programme should be
extended, in a suitable form, to Switzerland’s
banking, business and financial sectors. At the
same time, legal clarification is being sought as
to whether this falls under the jurisdiction of the
FIS in collaboration with other federal authorities.
This type of drilling and milling
machine is used to produce printed
circuit boards. There are indications
suggesting that in Syria, equipment of
this type is being used to manufacture
navigation units for ballistic missiles.
ANNUAL REPORT 2010 | FIS
69
PROLIFERATION
ASSESSMENT
Switzerland as a centre of industry
Internationally, Switzerland is seen as a
competitive business location offering excellent products, which is extremely customeroriented, has a high export ratio and offers
very good general conditions in the areas of
logistics, communications and finance. These
strengths are also attractive to countries seeking to acquire weapons of mass destruction. For
this reason, players in the proliferation field are
looking for contacts or attempting to establish a
presence in Switzerland. The areas of proliferation and illegal intelligence often converge, as
proliferation activity may represent the actions
of a government and, particularly where sensitive procurements are concerned, is accompanied by intelligence measures. It is important
that businesses be aware of this circumstance,
as a company which maintains sensitive contacts with procurement structures in high-risk
countries can very quickly also become the
target of intelligence services. Likewise, care
needs to be exercised by Switzerland’s research,
education and training institutions, as proliferation includes the transfer of knowledge.
Key challenge
The proliferation of weapons of mass destruction and their delivery systems is one of the key
security policy challenges. It runs counter to the
interests of a small country, in that it generally
weakens security structures and reinforces power politics to the detriment of attempts at regula-
70
ANNUAL R E P O RT 2 0 1 0 | F I S
tion. It may potentially also impact directly on
Switzerland. For example, the balance of power
in the Gulf region affects Switzerland’s energy
supply. For this reason, too, Switzerland has
an interest in a long-term stable and peaceful
resolution to the dispute relating to the Iranian
nuclear programme.
Switzerland is fighting the efforts of foreign
states to acquire weapons of mass destruction.
In doing so, it is looking after its own security
interests, implementing its international obligations and actively protecting its businesses and
industries from misuse by third parties. The
protection from misuse by third parties is increasingly becoming key, as in times of global
economic crisis, Switzerland is facing systematic attacks on its locational advantages. Experience shows that the misconduct of a few can
be used as a lever to alter the conditions for an
entire sector of the economy. Export controls
may increase the administrative costs for individual companies and in individual cases can
even threaten their very existence. However, as
shown above, they perform an important function, one that benefits the economy as a whole.
In order to fulfil their responsibilities in the
fight against the proliferation of weapons of
mass destruction, the authorities need powerful
weapons. These include, for example, modern
methods of information procurement and easy
exchange of data between federal and cantonal agencies and agencies abroad. Experience
shows that without the appropriate tools, it is
PROLIFERATION
almost impossible to overcome the high hurdles
which have to be cleared in order to institute
criminal proceedings.
ANNUAL REPORT 2010 | FIS
71
4. Illegal intelligence
ANNUAL REPORT 2010 | FIS
73
ILLEGAL INTELLIGENCE
SITUATION
Surveillance of the financial sector
The economic and financial crisis has increased the pressure on Switzerland as a financial centre. The consequences are also being
felt in the intelligence field. Foreign authorities
and intelligence services still have Swiss banks
and financial institutions based in Switzerland
in their sights.
In 2010, the Office of the Attorney General
of Switzerland investigated an Austrian man
on charges of illegal economic intelligence; the
man is alleged to have sold stolen bank data to
the German authorities. The suspect committed
suicide in September while in custody.
Opposition in exile
Several foreign intelligence services are active in Switzerland. Opponents of a regime
who are resident here are often the targets of
investigation by the intelligence services of
their countries of origin. Some of these intelligence services have sufficient resources to be
able to obtain information on the members of
their diaspora community, monitor it and use it
for internal political purposes. Such activities
were also noted in 2010. For example, intelligence services attempted to monitor and identify participants in opposition group rallies. Observations of this type were noted in Bern and
Geneva, in particular. One intelligence service
recruited informants among opposition activists and used agents to infiltrate the opponents
of the regime.
74
ANNUAL R E P O RT 2 0 1 0 | F I S
In 2010, FIS observed that a North African
country was increasing its intelligence activity.
Besides the usual intelligence activity targeting
opponents of the regime in Switzerland, which
we were already aware of, its intelligence officers maintained a network of informants
spreading across several countries; they were
also active in several European countries. The
investigations are still ongoing.
Geneva
Geneva is particularly important to foreign
intelligence services: the large numbers of
international organizations and NGO’s there
draw not only diplomats, business people and
journalists, but also intelligence officers. These
often do not identify themselves as such and
operate under cover, for example as diplomats,
business people and journalists. Their assignments may relate to Swiss interests as well as to
the interests of third countries.
IT espionage
In recent years, cyber attacks have been observed in Switzerland and other European countries. Although the perpetrators of cyber attacks
for the purposes of espionage cannot always be
identified with certainty, it is possible by analysing the attacks to determine with a high degree
of reliability where they originate from. Moreover, from the methods used, the victims of the
attacks and the type of information sought, for
example technological, economic or political, it
ILLEGAL INTELLIGENCE
is possible to draw fairly accurate conclusions
as to whether the attacker is a government or a
non-state actor.
Some intelligence services are distinguished
by their particularly aggressive methods of
procuring information, and in some European
intelligence services, virtual espionage and
virtual counterespionage are gaining in importance. This is also connected to an increase in
supply, as there is an ever-increasing quantity
of information being circulated electronically
which could potentially be siphoned off. These
methods call for new resources and specialist
expertise. Virtual espionage provides intelligence services with the opportunity to acquire information selectively, possibly without
having to deploy agents abroad. This protects
agents and reduces the political risk of intelligence activities. The targets of cyber attacks
may be administrative bodies or governments,
individual companies or private individuals, but
also opposition activists in exile.
Russian agents
Illegal activity by intelligence agents is a
recurrent and politically highly sensitive issue,
not only in Switzerland but worldwide, and
thus presents a challenge for international diplomacy. At the end of June 2010, ten agents
were arrested in the United States, some of
whom had been collecting information for
Russia’s External Intelligence Service (SVR)
under false identities for approximately ten
years. Shortly afterwards, an eleventh suspect
was arrested in Cyprus, who was subsequently
released on bail and has since disappeared. On
9 July, the agents working for Russia were exchanged in Vienna for four Russians who had
been convicted in Russia of spying for the US
and the UK. One Russian in the spy ring was
stripped of her British citizenship. On 13 July,
during the investigations, a Russian employed
at Microsoft was arrested in the US and subsequently deported for violating immigration
regulations.
The exchange of agents was apparently negotiated between the directors of the Central
Intelligence Agency (CIA) and the SVR and
helped to smooth relations between the US and
Russia. The agents returned to Russia were
interrogated by the SVR and then received
awards from the Russian President.
The Russian spies are alleged to have been
assigned the task of infiltrating circles close
to the government and obtaining information
about, for example, US policy on Afghanistan
and Iran and about the arms treaty between
Moscow and Washington. Contacts are alleged
to have been made with a former high-ranking
US official in the field of national security and
an American nuclear weapons researcher.
The members of the Russian spy ring used
tried and tested methods such as invisible ink,
fake passports for travelling to Moscow and
back to the US, and signs for recognizing each
other at meetings. However, they also used
modern technology such as steganographic
methods, a particular way of concealing encrypted information in inconspicuous data,
and the wireless transmission of data between
laptops. The Federal Bureau of Investigation
(FBI) managed to uncover the spy ring using
ANNUAL REPORT 2010 | FIS
75
ILLEGAL INTELLIGENCE
methods including observation, the bugging of
apartments and hotel rooms and telephone and
e-mail surveillance.
76
ANNUAL R E P O RT 2 0 1 0 | F I S
ILLEGAL INTELLIGENCE
ASSESSMENT
Human Intelligence
The case of the Russian spy ring in the US
graphically illustrates how countries are still
deploying agents, i.e. using so-called ‘human
intelligence’ (HUMINT) to try and obtain information. They attempt to discover the aims
and intentions of foreign countries in advance
and want to know how policy decisions in other
countries are arrived at. This information enables them to develop their own positions and to
present and defend these to their advantage. In
addition, there are also specific military, technological and economic reconnaissance objectives.
In the above case there were no traces leading
to Switzerland, but there were in the 2008 case
of the high-ranking Estonian security official
Hermann Simm. He betrayed NATO secrets to
the SVR. Like the Russian agents in the US, the
agent handler Simm was living in Europe under
a particularly elaborate disguise. He purported
to be a businessman and pretended to have a
nationality other than Russian. Switzerland was
one of the countries he used for logistical purposes. The Simm case shows that it is possible
to uncover even particularly well disguised
agents.
cases, Switzerland’s security interests sometimes have to take second place to, for example,
foreign policy or economic interests. Restrictive
accreditation policies can be used as preventive
measures against intelligence officers under
diplomatic cover who have a relevant previous
conviction abroad. Here, too, however, all relevant political interests have to be weighed up
in each individual case, and bilateral relations
with the sending country may be accorded a
higher weighting than counterespionage.
Economic intelligence
The threat from illegal economic intelligence
is unchanged from last year. However, should
the economic crisis deteriorate again, this threat
could also increase again. In this context, political pressure for a change in Swiss tax policy,
which is attractive compared with those in other
countries, could also increase in future. Moreover, Government and private players are actively continuing their surveillance of Switzerland
as a financial and economic centre.
Prevention
Entry bans are one means of preventing illegal intelligence activity in Switzerland. They
are effective in combating illegal intelligence,
but not always enforceable, since in individual
ANNUAL REPORT 2010 | FIS
77
5. Attacks on Swiss IT infrastructure
ANNUAL REPORT 2010 | FIS
79
ATTACKS ON SWISS IT INFRASTRUCTURE
SELEC TED E VENTS
February
An attack using infected e-mails was discovered. The e-mails were addressed mainly
to employees at the defence ministries of the countries participating in a NATO
conference.
April
A large number of infected websites were discovered using the new checking tool
developed by MELANI.
June
The Stuxnet trojan was discovered; it was targeted at Siemens’ process control systems.
October
The police in the Netherlands disabled a botnet.
November
Denial of Service (DoS) attack on the availability of websites of parties represented
in the Swiss Federal Council.
December
DoS attack on the PostFinance website. The reason was the closing down of Wikileaks founder Julian Assange’s account.
‘Low Orbit Ion
Cannon’ programme,
which can be used
by people without a
high level of computer skills to participate
in attacks.
80
ANNUAL R E P O RT 2 0 1 0 | F I S
ATTACKS ON SWISS IT INFRASTRUCTURE
SITUATION
Attack on process control systems
In June 2010, a Belarusian antivirus company
discovered the Stuxnet malware, which had
been designed to attack process control systems manufactured by Siemens. This malware
exhibited an unprecedented level of complexity. It made use of several previously unknown
security loopholes, misused security certificates
and spread itself via USB storage devices, for
example. It was designed both to gain information on the plant to be controlled and send this
to the attacker and also to manipulate the control systems’ operating software. Stuxnet was
active primarily in Indonesia, India and Iran.
Website infections
A new checking tool developed by MELANI
for Swiss websites led in April to the discovery
of a large number of infected Swiss websites.
As a follow-up measure, MELANI published a
warning and informed the administrators of the
websites affected. In October, the Dutch police
disabled the control servers of the botnet responsible (private computers infected with malware which are controlled remotely by a third
party). A 27-year-old man who is suspected of
being the mastermind behind it has been arrested. The perpetrators’ intention was to generate
the largest possible global botnet in order to sell
or lease parts of it.
Attack using infected e-mails
In the third week of February, an attack using
infected e-mails was discovered. These were
sent mainly to employees of the defence ministries of the countries participating in a NATO
conference. The e-mails, which were written in
English, contained a document relating to this
conference, which was to take place at the end
of February. When the file was opened, the computer was infected and became part of a botnet.
The code’s main function was to intercept login
data for e-mails and social networks. Analysis
of the malware made it possible to identify the
command server and subsequently to produce a
comprehensive list of infected systems. It was
then possible to inform the relevant bodies and
deactivate the botnet. No victims were identified in Switzerland.
Cyber attacks on political parties
The parties represented in the Swiss Federal
Council and their cantonal or communal organisations were the targets of cyber attacks several
times during 2010. At the beginning of 2010,
the website of the Zurich city branch of the SVP
was defaced by a logo on several occasions. The
logo ‘26C3 – Here be Dragons’ would appear.
‘Here be Dragons’ was the slogan of the 26th
conference of the Chaos Computer Club (CCC)
in Berlin. After the clean-up, the homepage was
defaced once more, this time with a hoax video
entitled ‘300 – SVP must die’, referring to the
film ‘300’. In addition, a video about the ref-
ANNUAL REPORT 2010 | FIS
81
ATTACKS ON SWISS IT INFRASTRUCTURE
erendum against the building of minarets was
switched on. At the beginning of November, the
websites of the parties represented in the Swiss
Federal Council were paralysed for several
hours by DoS attacks.
Attack on the PostFinance website.
On 5 December, PostFinance closed the donations account of Wikileaks founder Assange
due to false information regarding his alleged
place of residence in Geneva. PostFinance’s
website was subsequently the target of a DoS
attack by presumed Wikileaks supporters. The
attacks were apparently coordinated by an informal group called Anon Operation, which
has been carrying out electronic retaliation attacks since December 2010. These are directed
at people or institutions which Anon Operation
sees as being opponents of Wikileaks. As well
as PostFinance, the eBay subsidiary PayPal and
the websites of MasterCard, Visa and Interpol
have also been the targets of similar attacks.
The security of assets or data of PostFinance
customers was not threatened by this attack.
International exercises
On 4 November, the EU’s European Network
and Information Security Agency (ENISA) organized its first Europe-wide exercise, entitled
‘Cyber Europe 2010’. The aim was to test the
ability of EU and EFTA countries to respond to
a cyber attack. Around one month beforehand,
the international exercise ‘Cyberstorm III’ had
taken place under the aegis of the International
Watch and Warning Network (IWWN). Switzerland took part in both exercises.
‘Cyber Europe 2010’ enabled testing of the
protection of critical IT infrastructures, prosecutions in the area of cyber crime, government CERT’s (Computer Emergency Response
Teams) and regulators. More than 150 experts
from 70 public bodies were confronted with
over 320 incidents. The exercise was based on a
scenario in which internet connections between
European countries gradually failed or were
substantially restricted. The participants had to
collaborate to prevent further failures and to reestablish the connections. The aim was to find
out how well prepared Europe is to face such
threats. The final report was not yet available
at the time of going to press. Nonetheless, it is
already clear that communications, particularly
where the national CERT’s were concerned,
functioned well. At the European and international levels there are already established
contact lists which are used on a daily basis.
However, these need to be completed, regularly
updated and above all routinely maintained.
Logo of the first ever test of EU and EFTA countries’
ability to respond to a cyber attack.
82
ANNUAL R E P O RT 2 0 1 0 | F I S
ATTACKS ON SWISS IT INFRASTRUCTURE
The network extends beyond Europe’s borders, however, and it was in this context that
MELANI took part in the IWWN’s Cyberstorm III exercise, which took place on 29 and
30 September 2010. The exercise was organized
by the United States Department of Homeland
Security. Representatives from seven Cabinetlevel federal agencies, 11 US states, 60 private
companies and 11 foreign partners took part in
the exercise. This exercise, too, demonstrated
that international contacts are functioning and
that they go beyond mere technical problem
solving.
ANNUAL REPORT 2010 | FIS
83
ATTACKS ON SWISS IT INFRASTRUCTURE
ASSESSMENT
More attacks on process control systems
in future
Process control systems are used to monitor,
manage and control industrial plants or infrastructures for distributing essential commodities
such as electricity, water and fuel, and also in
the area of transport and traffic. Their use would
be inconceivable without information and communications technology (ICT). For some years
already, the possibility that such systems could
be attacked has been alluded to. In the case of
Stuxnet, Iranian nuclear installations were identified as the possible target. It can be assumed
that in future, industrial control systems of all
kinds will increasingly be the focus of attackers.
This will be made possible by the fact that unlike in the past, sensors, machines and switches
today increasingly frequently have their own IP
addresses, the normal internet protocol is used
for communicating with the server and control
software runs on standard operating systems.
However, the use of such cheap conventional
ICT comes at a cost: process control systems
are now basically exposed to the same threats
as IT systems for the mass market. The tensions between cost pressure, efficiency and the
availability of information on the one hand, and
cluster risks, the outsourcing of critical information and increasing vulnerability due to uniform
networked platforms on the other will increase.
84
ANNUAL R E P O RT 2 0 1 0 | F I S
Counterespionage
The threat from espionage using ICT targeted
both at government systems and at companies
persists. The espionage cases which have come
to light should not be seen as discrete independent events, rather common features should be
sought. To this end, links between individual incidents need to be established, and similar cases
have to be clustered and fit into a more general
context. What is standard for all countries and
companies in traditional counterespionage, has
until now been rather a rarity in the world of the
internet and ICT and should also be used more
frequently here.
Website infections
The malware discovered in April with MELANI’s new checking tool was Bredolab. This
integrated the infected computer into a botnet
which is estimated to have consisted of as many
as 30 million computers. For the operator of the
botnet, what mattered most was to spread Bredolab: once it had infected a computer, Bredolab
searched for website administrators’ login details and passwords in order to use this data to
infect further websites automatically. The operator subsequently leased or sold sections of
the botnet to criminals.
ATTACKS ON SWISS IT INFRASTRUCTURE
PDF files as a means of attack
It has not yet been established whether the
hacker attacks which were carried out using an
e-mail attachment about a NATO conference
were targeted attacks. However, the special feature that characterized this case was the use of
PDF files. This is generally the case today, unlike in the past, when Office documents were
often used in hacker attacks. In 2010 there were
also examples of this in Switzerland, where
security loopholes, for which there were as yet
no updates available, were exploited using manipulated PDF documents.
Attacks on political parties
Following the passing of the referendum
against the building of minarets, over 5,000 internet sites were hacked, including the sites of
local branches of the SVP and Young SVP. It is
thought that the majority of these attacks originated from Turkey. The attacks at the beginning of 2010, on the other hand, were probably
launched by attackers from Germany or German-speaking Switzerland and by participants
at the CCC conference. In any case, the website had been listed as a target by the CCC. The
specific perpetrators, however, are unknown,
and no charges have been brought. It appears
that in the case of the defacing of this website,
a loophole in the content management system
was exploited.
In DoS attacks at the beginning of November
on the internet sites of the parties represented
in the Swiss Federal Council, up to 200 computers, largely from Germany, the Netherlands
and the US, dialled up the parties’ websites over
10,000 times per second. This overloaded them.
Neither the perpetrators nor their motives are
known. In this case, too, no charges have been
brought.
DoS attacks are nothing new, and have previously been used for blackmail purposes or
to damage commercial competitors. However,
we are also seeing an increasing number of
politically motivated attacks. For example, it
can be assumed that the motivation in the case
described above and in the DoS attack against
PostFinance due to the closing of Julian Assange’s account was political. In addition to
demonstrations on the ground, protests are increasingly moving into the virtual arena. Where
political conflicts arise, it is therefore likely that
there will in future be more attacks on internet
services, which should prepare themselves appropriately for such eventualities.
ANNUAL REPORT 2010 | FIS
85
List of abbreviations
ANNUAL REPORT 2010 | FIS
87
LIST OF ABBREVIATIONS
ALF................................................................................................................Animal Liberation Front
APG.......................................................................................................Allgemeine Plakatgesellschaft
AQAP.............................................................................................Al Qaeda in the Arabian Peninsula
AQIM...............................................................................................Al Qaeda in the Islamic Maghreb
AZOT............................................................................................................. Circus Without Animals
BWIS........................................................... Federal Act on Measures to Safeguard Internal Security
CCC.................................................................................................................. Chaos Computer Club
CERT........................................................................................Computer Emergency Response Team
CIA........................................................................................................... Central Intelligence Agency
CISA............................................................................. Federal Act on Responsibilities in the Area of
DoS........................................................................................................................... Denial of Service
EFSF.......................................................................................... European Financial Stability Facility
ENISA...............................................................European Network and Information Security Agency
ETH...........................................................................................Swiss Federal Institute of Technology
FAI...................................................................................................Federazione Anarchica Informale
FBI..................................................................................................... Federal Bureau of Investigation
FDFA....................................................................................... Federal Department of Foreign Affairs
fedpol..............................................................................................................Federal Office of Police
FIS............................................................................................................ Federal Intelligence Service
GTF...................................................................................................................... Global Tamil Forum
HLS............................................................................................................. Huntingdon Life Sciences
HPG................................................................................................... Kurdish Nation Defence Forces
HUMINT.............................................................................................................. Human Intelligence
IAEA.......................................................................................... International Atomic Energy Agency
ICT................................................................................ Information and communications technology
IED.......................................................................................................... Improvised explosive device
88
ANNUAL R E P O RT 2 0 1 0 | F I S
LIST OF ABBREVIATIONS
IHH................................................................................ International Humanitarian Aid organization
ISI..........................................................................................................................Islamic State of Iraq
IWWN............................................................................... International Watch and Warning Network
KCK...........................................................................................Kurdistan Democratic Confederation
LTTE................................................................................................Liberation Tigers of Tamil Eelam
MELANI...................................................Reporting and Analysis Centre for Information Assurance
MROS.................................................................... Money Laundering Reporting Office Switzerland
NATO............................................................................................ North Atlantic Treaty Organization
PETN................................................................................................................................... Nitropenta
PKK..............................................................................................................Kurdistan Workers’ Party
PMOI...................................................................................People’s Mojahedin Organization of Iran
PNOS.......................................................................................Partei National Orientierter Schweizer
RAS....................................................................................................Revolutionärer Aufbau Schweiz
RAZ.....................................................................................................Revolutionary Advance Zurich
SCET...................................................................................................Swiss Council of Eelam Tamils
SHAC............................................................................................... Stop Huntingdon Animal Cruelty
SRI...........................................................................................................Secours Rouge International
SVP......................................................................................................................Swiss People’s Party
SVR..............................................................................................Russian foreign intelligence service
SWIFT............................................. Society for Worldwide Interbank Financial Telecommunication
TAK...........................................................................................................Kurdistan Freedom Falcons
TCC.....................................................................................................Tamil Coordination Committee
TGTE............................................................................... Transnational Government of Tamil Eelam
TTP...............................................................................................................Therik-e Taliban Pakistan
WEF............................................................................................................... World Economic Forum
ANNUAL REPORT 2010 | FIS
89
Ed i to r
Federal Intelligence Service FIS
Deadline
14 February 2011
Co n t a c t a d d re s s
Federal Intelligence Service FIS
Papiermühlestrasse 20
CH-3003 Bern
E-mail: info@ndb.admin.ch
Phone: +41 (0)31 323 95 84
www.fis.admin.ch
Distibution
BBL, Verkauf Bundespublikationen,
CH-3003 Bern
E-mail: verkauf.zivil@bbl.admin.ch
www.bundespublikationen.admin.ch
Art.-No 503.001.10eng
ISSN 1664-4719
Co py r i g h t
Federal Intelligence Service FIS, 2011
ANNUAL REPORT 2010 | FIS
91
SWITZERLAND’S SECURITY
Federal Intelligence Service FIS
Papiermühlestrasse 20
CH-3003 Bern
Phone: +41 (0)31 323 95 84
www.fis.admin.ch