Documents
Social Media and False Documents
Oct. 28, 2015
OFFICIAL USE ONLY
Homeland.
INTELLIGENCE ASSESSMENT
r.
Social Media and False Documents
Enabling Known or SusPected Terrorists to
Fabricate Plausible Stories of Own Deaths,
Challenge Security Detection
27 August 20 5
Office of Intelligence and Analysis
IA-0269- I 5
(U) Warning: This OFFICIAL USE ONLY Itconta?ns information diatmaybeexempt of InformatimAct(5 U.SC 552). h?stobeaxmolled
from DHS.
(U) All US person information has been m'n?mized you require the nirl?mized US person hformao'on, please calm the IM Brandi at IAPMQIquhlgov, or IAPMthu?cgw.
OFFICIAL USE ONLY
OFFICIAL USE ONLY
Homeland.
INTELLIGENCE ASSESSMENT
r.
Social Media and False Documents
Enabling Known or SusPected Terrorists to
Fabricate Plausible Stories of Own Deaths,
Challenge Security Detection
27 August 20 5
Office of Intelligence and Analysis
IA-0269- I 5
(U) Warning: This OFFICIAL USE ONLY Itconta?ns information diatmaybeexempt of InformatimAct(5 U.SC 552). h?stobeaxmolled
from DHS.
(U) All US person information has been m'n?mized you require the nirl?mized US person hformao'on, please calm the IM Brandi at IAPMQIquhlgov, or IAPMthu?cgw.
OFFICIAL USE ONLY
7? Homeland
Securlty
Of?ce of Intelligence and Analysis
INTELLIGENCE ASSESSMENT
27 August 20 5
Social Media and False Documents Enabling Known or Suspected
Terrorists to Fabricate Plausible Stories of Own Deaths, Challenge Security
Detection
Prepared by the O?ice of Intelligence and Analysis Coordinated with CBP, ICE FBI, NCTC, NSA, TSA, and USCG.
(U) Scope
This Assessment identi?es possible pitfalls and opportunities to detect foreign ?ghters faking their deaths predominantly using
social media and subsequently traveling on fraudulent identities. In particular, this Assessment highlights tactics that have potential
implications for US watchlisting and other screening efforts. including those employed by DHS. This Assessment will be disseminated to
state, local. tribal, territorial. and private sector homeland security partners to assist in the identi?cation of priorities for protective and
support measures regarding terrorism and other threats to homeland security. The information cut-off date for this Assessment is
August 20 5.
(U) Key Judgments
Social media is enabling a small, but increasing, number of lower-level known or suspected
terrorists (KSTs) from Western countries to fabricate stories of their deaths in an attempt to evade
security scrutiny, a tactic that prominent terrorists used before the proliferation of social media.
One provision in US watchlisting guidance to confirm the death ofa KST is when the
demise is part ofa ?high profile case in the public sphere,? raising the possibility?albeit a relatively small
one?that national and international news outlets could increase the perceived credibility and prominence
of erroneous social media information that could be used in watchlists.? Increasing proliferation of social
media probably has made this watchlisting criterion?having a high pro?le case in the public sphere?
mostly outmoded for confirming the deaths of KSTs.
US screening efforts remain relatively well-positioned to detect KSTs, even in the unlikely
event that a fabricated story of one?s death leads to a KST being listed as ?confirmed dead? in
Terrorist Identities Datamart Environment (TIDE) database. When KSTs are reported dead, these
individuals frequently maintain their watchlist status, because US procedures require that all known
missing, unexpired travel documents belonging to these individuals be maintained for screening purposes.
The retention of travel document information related to watchlisted KSTs, including many of those
confirmed to be dead, is a particularly effective method of detecting a KST who might attempt returning to
the United States.
Most KSTs who seek to return to Western countries after faking their deaths, however,
probably would use fraudulent travel documents to avoid divulging their true identities while not
discrediting the fabricated accounts of their deaths.
Although more countries are now issuing fraud-resistant e-passports, many countries still must
develop the means to read and vet the biometric data embedded in such documents at their ports of entry
to detect terrorists traveling on fraudulent documents.
Examples of ?a high pro?le case in the public sphere" provided by the 20 3 Watchlisting Guidance include ?media footage
con?rming a suicide bomber's death, 9l hijackers. and death of Abu Musaq aI Zarqawi.? guidance cites announcements
and of?cial battle damage assessments" as instances when this provision can be used to con?rm a KST's death in TIDE.
7? Homeland
Securlty
Of?ce of Intelligence and Analysis
INTELLIGENCE ASSESSMENT
27 August 20 5
Social Media and False Documents Enabling Known or Suspected
Terrorists to Fabricate Plausible Stories of Own Deaths, Challenge Security
Detection
Prepared by the O?ice of Intelligence and Analysis Coordinated with CBP, ICE FBI, NCTC, NSA, TSA, and USCG.
(U) Scope
This Assessment identi?es possible pitfalls and opportunities to detect foreign ?ghters faking their deaths predominantly using
social media and subsequently traveling on fraudulent identities. In particular, this Assessment highlights tactics that have potential
implications for US watchlisting and other screening efforts. including those employed by DHS. This Assessment will be disseminated to
state, local. tribal, territorial. and private sector homeland security partners to assist in the identi?cation of priorities for protective and
support measures regarding terrorism and other threats to homeland security. The information cut-off date for this Assessment is
August 20 5.
(U) Key Judgments
Social media is enabling a small, but increasing, number of lower-level known or suspected
terrorists (KSTs) from Western countries to fabricate stories of their deaths in an attempt to evade
security scrutiny, a tactic that prominent terrorists used before the proliferation of social media.
One provision in US watchlisting guidance to confirm the death ofa KST is when the
demise is part ofa ?high profile case in the public sphere,? raising the possibility?albeit a relatively small
one?that national and international news outlets could increase the perceived credibility and prominence
of erroneous social media information that could be used in watchlists.? Increasing proliferation of social
media probably has made this watchlisting criterion?having a high pro?le case in the public sphere?
mostly outmoded for confirming the deaths of KSTs.
US screening efforts remain relatively well-positioned to detect KSTs, even in the unlikely
event that a fabricated story of one?s death leads to a KST being listed as ?confirmed dead? in
Terrorist Identities Datamart Environment (TIDE) database. When KSTs are reported dead, these
individuals frequently maintain their watchlist status, because US procedures require that all known
missing, unexpired travel documents belonging to these individuals be maintained for screening purposes.
The retention of travel document information related to watchlisted KSTs, including many of those
confirmed to be dead, is a particularly effective method of detecting a KST who might attempt returning to
the United States.
Most KSTs who seek to return to Western countries after faking their deaths, however,
probably would use fraudulent travel documents to avoid divulging their true identities while not
discrediting the fabricated accounts of their deaths.
Although more countries are now issuing fraud-resistant e-passports, many countries still must
develop the means to read and vet the biometric data embedded in such documents at their ports of entry
to detect terrorists traveling on fraudulent documents.
Examples of ?a high pro?le case in the public sphere" provided by the 20 3 Watchlisting Guidance include ?media footage
con?rming a suicide bomber's death, 9l hijackers. and death of Abu Musaq aI Zarqawi.? guidance cites announcements
and of?cial battle damage assessments" as instances when this provision can be used to con?rm a KST's death in TIDE.
UNCLASSIFIED FOR OFFICIAL USE ONLY
(U) Social Media Enabling Lower-Level KSTs to Substantiate Fake Accounts of Their Deaths
Social media is enabling a small. but increasing number of lower-level KSTs from Western countries to
fabricate stories of their deaths, many times to evade security scrutiny. A small but growing number of KSTs from the
West are demonstrating the utility of social media platforms in disseminating plausible accounts of fatalities in con?ict zones.
The proliferation in recent years of digital network modalities, particularly social media platforms. offers lower-level KSTs a
greater ability to widely disseminate low-cost and plausible accounts of their deaths.
Tweets from Islamic State supporters on l6 and I7 July 20l5 indicated that a Somalia-based American
KST was dead, according to a Department of Homeland Security Open Source Information Report. however, is
not aware of any separate information to conclude de?nitively that this individual actually died.'
(U) Police in the United Kingdom believed a Syria-based British KST they identi?ed as a ?trained terrorist" had faked
his own death in an attempt to return home undetected, according to press reports.13 Fellow Syria-based militants in
May 20 4 falsely announced on social media that the individual was killed on the battle?eld, which Scotland Yard
believed was a deliberate attempt to mislead authorities. according to press reports in January. Police arrested him the
following month at the port of Dover in southern England."5
(U) Because British security services believe some British ?ghters have used social media to fake their deaths in Iraq or
Syria, Military Intelligence Section 5 as of August 20l4 was investigating the reported deaths of 20 British KSTs to
determine if they fabricated their deaths abroad to facilitate their return to the United Kingdom undetected, according
to unidenti?ed British of?cials quoted in a press report6 Quotes in a press report from a separate unidenti?ed British
of?cial admit that faking one's death in the Syrian con?ict is easy?and very dif?cult, if not impossible, to verify?on the
ground in Syria.7
(U) Security of?cials, as of early july 20 5, were working to con?rm the reported death of a Syria-based Australian
terrorist who previously served a four-year jail term in Australia for his role in a terror plot and gained notoriety last
year when they posed for photos holding the severed heads of enemy ?ghters. As of late june, some Australian of?cials
believed that reports of this terrorist's death were a ploy to help his family return home to Australia from the Middle
East, according to a press report:8
(UIIFOUO) Other Digital Modalities Western Foreign Fighters Use to Broadcast Misinformation
A small number of foreign ?ghters from the West use communication devices and social media accounts to
deceive security services seeking to monitor their locations. l&A assesses foreign ?ghters seeking to use this tactic almost
certainly need to also obscure their cross-border travel or exploit a home country that does not regularly fuse intelligence
on social media, communications intercepm, and travel records in order to successfully deceive security services.
In separate cases, two young US Persons who joined Syria-based violent extremists in early
Yemeni-American female from Alabama and a Somali-American male from Minnesota?took out-of-character steps
of leaving their cell phones at home before departing the United States, according to quotes from their families in
press articles. 9- '0 l&A assesses these individuals might have left their phones behind so the devices could ?eld calls
and demonstrate continued operation in their home countries.
(U) Some ltalian combatants in Syria entrust their password with a friend in Italy who posts fake messages on the
web, giving the impression that the real password holder never left the country. I I Other ltalian KSTs have used
falsified employment contracts and pay slips to demonstrate they were living in Italy even though they actually were
?ghting in Afghanistan, according to an ltalian KST quoted in a press report '2
UNCLASSIFIED FOR OFFICIAL USE ONLY
Page20f5
UNCLASSIFIED FOR OFFICIAL USE ONLY
(U) Social Media Enabling Lower-Level KSTs to Substantiate Fake Accounts of Their Deaths
Social media is enabling a small. but increasing number of lower-level KSTs from Western countries to
fabricate stories of their deaths, many times to evade security scrutiny. A small but growing number of KSTs from the
West are demonstrating the utility of social media platforms in disseminating plausible accounts of fatalities in con?ict zones.
The proliferation in recent years of digital network modalities, particularly social media platforms. offers lower-level KSTs a
greater ability to widely disseminate low-cost and plausible accounts of their deaths.
Tweets from Islamic State supporters on l6 and I7 July 20l5 indicated that a Somalia-based American
KST was dead, according to a Department of Homeland Security Open Source Information Report. however, is
not aware of any separate information to conclude de?nitively that this individual actually died.'
(U) Police in the United Kingdom believed a Syria-based British KST they identi?ed as a ?trained terrorist" had faked
his own death in an attempt to return home undetected, according to press reports.13 Fellow Syria-based militants in
May 20 4 falsely announced on social media that the individual was killed on the battle?eld, which Scotland Yard
believed was a deliberate attempt to mislead authorities. according to press reports in January. Police arrested him the
following month at the port of Dover in southern England."5
(U) Because British security services believe some British ?ghters have used social media to fake their deaths in Iraq or
Syria, Military Intelligence Section 5 as of August 20l4 was investigating the reported deaths of 20 British KSTs to
determine if they fabricated their deaths abroad to facilitate their return to the United Kingdom undetected, according
to unidenti?ed British of?cials quoted in a press report6 Quotes in a press report from a separate unidenti?ed British
of?cial admit that faking one's death in the Syrian con?ict is easy?and very dif?cult, if not impossible, to verify?on the
ground in Syria.7
(U) Security of?cials, as of early july 20 5, were working to con?rm the reported death of a Syria-based Australian
terrorist who previously served a four-year jail term in Australia for his role in a terror plot and gained notoriety last
year when they posed for photos holding the severed heads of enemy ?ghters. As of late june, some Australian of?cials
believed that reports of this terrorist's death were a ploy to help his family return home to Australia from the Middle
East, according to a press report:8
(UIIFOUO) Other Digital Modalities Western Foreign Fighters Use to Broadcast Misinformation
A small number of foreign ?ghters from the West use communication devices and social media accounts to
deceive security services seeking to monitor their locations. l&A assesses foreign ?ghters seeking to use this tactic almost
certainly need to also obscure their cross-border travel or exploit a home country that does not regularly fuse intelligence
on social media, communications intercepm, and travel records in order to successfully deceive security services.
In separate cases, two young US Persons who joined Syria-based violent extremists in early
Yemeni-American female from Alabama and a Somali-American male from Minnesota?took out-of-character steps
of leaving their cell phones at home before departing the United States, according to quotes from their families in
press articles. 9- '0 l&A assesses these individuals might have left their phones behind so the devices could ?eld calls
and demonstrate continued operation in their home countries.
(U) Some ltalian combatants in Syria entrust their password with a friend in Italy who posts fake messages on the
web, giving the impression that the real password holder never left the country. I I Other ltalian KSTs have used
falsified employment contracts and pay slips to demonstrate they were living in Italy even though they actually were
?ghting in Afghanistan, according to an ltalian KST quoted in a press report '2
UNCLASSIFIED FOR OFFICIAL USE ONLY
Page20f5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Though Rare, the Intelligence Community Can Use Public Media to Help Confirm
Deaths of KSTs
(U//FOUO) One provision in US watchlisting guidance to confirm the death of a KST is when the KST’s demise is part of a
“high profile case in the public sphere,” raising the possibility that national and international news outlets could increase the
perceived credibility and prominence of erroneous information derived from social media that could be used in watchlists.
Increasing proliferation of social media probably has made this watchlisting criterion—having a high profile case in the public
sphere—mostly outmoded for confirming the deaths of KSTs.
»
(U//FOUO) The 2013 Watchlisting Guidance, which informs operation of the Terrorist Screening Database (TSDB),
considers KSTs officially dead under two circumstances, including when a KST’s death becomes “a high profile case in
the public sphere.” 13 In addition, the Guidance states that “originators are encouraged to provide all relevant and
unclassified information, to include social media information when appropriate.” 14, *,†
»
(U//FOUO) Guidance from NCTC considers “a high profile case in the public sphere” one basis—among five—to
confirm a KST’s death in TIDE, a portion of which populates the TSDB. 15,‡
»
(U//FOUO) NCTC does not track which of the five provisions are used to confirm the death of a KST in TIDE, but its
Directorate of Terrorist Identities estimates that KSTs have rarely been confirmed dead based solely on them being
part of “a high profile case in the public sphere.” 16
(U//FOUO) US screening efforts remain relatively well-positioned to detect KSTs even in the unlikely event that a
fabricated story of one’s death leads to a KST being listed as “confirmed dead.” When KSTs are reported dead, these
individuals frequently maintain their watchlist status, because US procedures require that all known missing, unexpired
travel documents belonging to these individuals be maintained for screening purposes. The retention of travel document
information related to watchlisted KSTs, including many of those confirmed to be dead, is a particularly effective method of
detecting a KST who might attempt returning to the United States. I&A’s sampling of TIDE holdings suggest that US
screening measures remain in place for most KSTs whose death is not conclusive.
»
(U//FOUO) An I&A review of TIDE on 20 July 2015 found that it listed a total of over 3,500 KSTs who were
confirmed dead, nearly 20 percent of whom remained watchlisted. Of those watchlisted, most were included in
lookouts in the Consular Lookout and Support System (CLASS), the TECS system CBP uses to determine admissibility
of US arrivals, and well over half were on the No Fly list. § More than 13,000 other KSTs as of 20 July were classified as
“reportedly dead” in TIDE; most were included in CLASS, TECS, and nearly 20 percent were on the No Fly list. 17
»
(U//FOUO) The reported death of any Americans abroad, including KSTs, prompts overseas diplomatic posts to enter
their names into State Department screening databases, namely the CLASS and Passport Lookout Tracking System. 18
»
(U//FOUO) KSTs who are “confirmed dead” in US screening repositories will remain watchlisted if these KSTs have
non-expired, unrecovered travel documents, and were members of a terrorist group that collects such KST identity
information for use by other members in preparing for or committing terrorist actions. 19
(U//FOUO) The 2015 Watchlisting Guidance was being finalized as of late July. Latest drafts of this document still allow for the
inclusion of social media into watchlists and the ability to confirm the death of a KST if it is part of a “high profile case in the public
sphere.”
† (U//FOUO) The 2013 Watchlisting Guidance defines originator as “all Executive Departments and Agencies… (that) initially collect and
identify information that supports conclusions that an individual is a KST.”
‡ (U//FOUO) The four other stipulations to confirm a KST’s death in TIDE are: (1) “Reporting on the KST’s death has been
corroborated by at least two different and credible sources;” (2) “initial reporting on the subject is due to his death as an attacker” and
there is no indication that the reporting is unreliable;” (3) the dead KST’s photo is available; or (4) DNA from the dead KST is on hand.
§ (U//FOUO) A significant number of “dead” and “reportedly dead” KSTs cannot be placed on the No Fly List, because of insufficient
biographic information needed to deny boarding to them, according to I&A’s Watchlisting Cell.
*
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 3 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO) Though Rare, the Intelligence Community Can Use Public Media to Help Confirm
Deaths of KSTs
(U//FOUO) One provision in US watchlisting guidance to confirm the death of a KST is when the KST’s demise is part of a
“high profile case in the public sphere,” raising the possibility that national and international news outlets could increase the
perceived credibility and prominence of erroneous information derived from social media that could be used in watchlists.
Increasing proliferation of social media probably has made this watchlisting criterion—having a high profile case in the public
sphere—mostly outmoded for confirming the deaths of KSTs.
»
(U//FOUO) The 2013 Watchlisting Guidance, which informs operation of the Terrorist Screening Database (TSDB),
considers KSTs officially dead under two circumstances, including when a KST’s death becomes “a high profile case in
the public sphere.” 13 In addition, the Guidance states that “originators are encouraged to provide all relevant and
unclassified information, to include social media information when appropriate.” 14, *,†
»
(U//FOUO) Guidance from NCTC considers “a high profile case in the public sphere” one basis—among five—to
confirm a KST’s death in TIDE, a portion of which populates the TSDB. 15,‡
»
(U//FOUO) NCTC does not track which of the five provisions are used to confirm the death of a KST in TIDE, but its
Directorate of Terrorist Identities estimates that KSTs have rarely been confirmed dead based solely on them being
part of “a high profile case in the public sphere.” 16
(U//FOUO) US screening efforts remain relatively well-positioned to detect KSTs even in the unlikely event that a
fabricated story of one’s death leads to a KST being listed as “confirmed dead.” When KSTs are reported dead, these
individuals frequently maintain their watchlist status, because US procedures require that all known missing, unexpired
travel documents belonging to these individuals be maintained for screening purposes. The retention of travel document
information related to watchlisted KSTs, including many of those confirmed to be dead, is a particularly effective method of
detecting a KST who might attempt returning to the United States. I&A’s sampling of TIDE holdings suggest that US
screening measures remain in place for most KSTs whose death is not conclusive.
»
(U//FOUO) An I&A review of TIDE on 20 July 2015 found that it listed a total of over 3,500 KSTs who were
confirmed dead, nearly 20 percent of whom remained watchlisted. Of those watchlisted, most were included in
lookouts in the Consular Lookout and Support System (CLASS), the TECS system CBP uses to determine admissibility
of US arrivals, and well over half were on the No Fly list. § More than 13,000 other KSTs as of 20 July were classified as
“reportedly dead” in TIDE; most were included in CLASS, TECS, and nearly 20 percent were on the No Fly list. 17
»
(U//FOUO) The reported death of any Americans abroad, including KSTs, prompts overseas diplomatic posts to enter
their names into State Department screening databases, namely the CLASS and Passport Lookout Tracking System. 18
»
(U//FOUO) KSTs who are “confirmed dead” in US screening repositories will remain watchlisted if these KSTs have
non-expired, unrecovered travel documents, and were members of a terrorist group that collects such KST identity
information for use by other members in preparing for or committing terrorist actions. 19
(U//FOUO) The 2015 Watchlisting Guidance was being finalized as of late July. Latest drafts of this document still allow for the
inclusion of social media into watchlists and the ability to confirm the death of a KST if it is part of a “high profile case in the public
sphere.”
† (U//FOUO) The 2013 Watchlisting Guidance defines originator as “all Executive Departments and Agencies… (that) initially collect and
identify information that supports conclusions that an individual is a KST.”
‡ (U//FOUO) The four other stipulations to confirm a KST’s death in TIDE are: (1) “Reporting on the KST’s death has been
corroborated by at least two different and credible sources;” (2) “initial reporting on the subject is due to his death as an attacker” and
there is no indication that the reporting is unreliable;” (3) the dead KST’s photo is available; or (4) DNA from the dead KST is on hand.
§ (U//FOUO) A significant number of “dead” and “reportedly dead” KSTs cannot be placed on the No Fly List, because of insufficient
biographic information needed to deny boarding to them, according to I&A’s Watchlisting Cell.
*
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 3 of 5
UNCLASSIFIED FOR USE ONLY
(UIIFOUO) Faking Death Usually Necessitates Assumption of New Identity
Most KSTs who seek to travel internationally after faking their deaths probably would use fraudulent travel
documents that would avoid divulging the true identities while not discrediting the fabricated accounts of their
deaths.
(U) A California-based KST as of August 20 3 considered traveling to Pakistan and faking his own death to evade US
security scrutiny. according to press reporting of the case.20 The KST stated he would travel to Pakistan via Mexico in
his correspondence with a reported al-Qa?ida recruiter; however. he was arrested in October 20 3 carrying a
fraudulent passport as he waited to board a Mexico-bound bus in California. On 30 june 20l4. he was sentenced to l3
years in federal prison. followed by 0 years of supervised release. for attempting to assist a known terrorist
organization.?
(U) A former Syria-based KST who was the subject of a raid associated with the foiled mid-january terrorist plot in
Belgium spread rumors of his death via social media and was discovered only after re-establishing himself in Europe.
according to press reporting?"23 A Belgian associate of this KST also faked his death in Syria before returning to
Belgium. probably by using the fake Dutch passport found in his possession when he was killed by policeu'z?r?26
False Identities Used to Backstop Fabricated Deaths Dif?cult to Detect
Although more countries are now issuing fraud-resistant e-passports. many countries still must develop the
means to read and vet the biometric data embedded in such documents at their ports of entry to detect KSTs traveling on
fraudulent documents. Assuming a new identity after faking one's death places the onus of detecting these individuals on
inconsistent biometric and document checks worldwide to identify these individuals should they attempt to travel.
Countries have more quickly adopted and issued e-passports than they have deployed electronic readers
at ports of entry that can read and verify the data stored on e-passport chips.27
(U) The International Civil Aviation Organization reported that. as of May 20 5. only 46 countries were participating
in the organization's Public Key Directory. which manages the exchange of certificates and certificate-revocation lists
that screeners can use to validate the authenticity of e-passports and to access biometric information.28
(U) Source Summary Statement
The fragmentary nature and other limitations of open source reporting on this trend over the past year makes it difficult
to determine its magnitude. Actual cases and trends raised in reliable open source reporting give us moderate-to-high con?dence
in our assessment that this trend is more than theoretical. We have Iow-to-moderate con?dence that watchlisting steps taken in
Canada and the United States to detect foreign ?ghters who fake their deaths are mostly representative of measures other Western
countries have in place to defend against this trend and others.
(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, private security personnel, and emergency managers
should follow established protocols; all other personnel should call 9 I or contact local law enforcement. Suspicious
activity reports (SARs) will be forwarded to the appropriate fusion center and FBI joint Terrorism Task Force for further action. For
more information on the Nationwide SAR Initiative. visit
(U) Tracked by: HSEC-8.2, HSEC-8.3, HSEC-8.5. HSEC-8.5.2. HSEC-8.8
UNCLASSIFIED FOR USE ONLY
Page4of5
UNCLASSIFIED FOR USE ONLY
(UIIFOUO) Faking Death Usually Necessitates Assumption of New Identity
Most KSTs who seek to travel internationally after faking their deaths probably would use fraudulent travel
documents that would avoid divulging the true identities while not discrediting the fabricated accounts of their
deaths.
(U) A California-based KST as of August 20 3 considered traveling to Pakistan and faking his own death to evade US
security scrutiny. according to press reporting of the case.20 The KST stated he would travel to Pakistan via Mexico in
his correspondence with a reported al-Qa?ida recruiter; however. he was arrested in October 20 3 carrying a
fraudulent passport as he waited to board a Mexico-bound bus in California. On 30 june 20l4. he was sentenced to l3
years in federal prison. followed by 0 years of supervised release. for attempting to assist a known terrorist
organization.?
(U) A former Syria-based KST who was the subject of a raid associated with the foiled mid-january terrorist plot in
Belgium spread rumors of his death via social media and was discovered only after re-establishing himself in Europe.
according to press reporting?"23 A Belgian associate of this KST also faked his death in Syria before returning to
Belgium. probably by using the fake Dutch passport found in his possession when he was killed by policeu'z?r?26
False Identities Used to Backstop Fabricated Deaths Dif?cult to Detect
Although more countries are now issuing fraud-resistant e-passports. many countries still must develop the
means to read and vet the biometric data embedded in such documents at their ports of entry to detect KSTs traveling on
fraudulent documents. Assuming a new identity after faking one's death places the onus of detecting these individuals on
inconsistent biometric and document checks worldwide to identify these individuals should they attempt to travel.
Countries have more quickly adopted and issued e-passports than they have deployed electronic readers
at ports of entry that can read and verify the data stored on e-passport chips.27
(U) The International Civil Aviation Organization reported that. as of May 20 5. only 46 countries were participating
in the organization's Public Key Directory. which manages the exchange of certificates and certificate-revocation lists
that screeners can use to validate the authenticity of e-passports and to access biometric information.28
(U) Source Summary Statement
The fragmentary nature and other limitations of open source reporting on this trend over the past year makes it difficult
to determine its magnitude. Actual cases and trends raised in reliable open source reporting give us moderate-to-high con?dence
in our assessment that this trend is more than theoretical. We have Iow-to-moderate con?dence that watchlisting steps taken in
Canada and the United States to detect foreign ?ghters who fake their deaths are mostly representative of measures other Western
countries have in place to defend against this trend and others.
(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, private security personnel, and emergency managers
should follow established protocols; all other personnel should call 9 I or contact local law enforcement. Suspicious
activity reports (SARs) will be forwarded to the appropriate fusion center and FBI joint Terrorism Task Force for further action. For
more information on the Nationwide SAR Initiative. visit
(U) Tracked by: HSEC-8.2, HSEC-8.3, HSEC-8.5. HSEC-8.5.2. HSEC-8.8
UNCLASSIFIED FOR USE ONLY
Page4of5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO): DHS; OSIR/DHS-OS-0751-15; 24 JUL 2015; DOI 21 JUL 2015; (U//FOUO); Conflicting tweets regarding the possible death of
USPER Mujahid Miski; extracted information is U//FOUO; overall document classification is U//FOUO.
2 (U); Associated Press; 20 JAN 2015; “British Jihadi Faces Prison After Admitting Terrorism Acts”;
http://www.nytimes.com/aponline/2015/01/20/world/europe/ap-eu-britain-jihadi-guilty.html; accessed on 23 APR 2015.
3 (U//FOUO); OSC; EUR2015012071090552; 20 JAN 2015; DOI 20 JAN 2015; (U); British Jihadist Admits to Terror Charges; extracted
information is U; overall document classification is U.
4 (U); Associated Press; 20 JAN 2015; “British Jihadi Faces Prison After Admitting Terrorism Acts”;
http://www.nytimes.com/aponline/2015/01/20/world/europe/ap-eu-britain-jihadi-guilty.html; accessed on 23 APR 2015.
5 (U//FOUO); OSC; EUR2015012071090552; 20 JAN 2015; DOI 20 January 2015; (U); British Jihadist Admits to Terror Charges; extracted
information is U; Overall document classification is U.
6 (U//FOUO); OSC; EUR2014082437694148; 24 AUG 2014; DOI 23 August 2014; (U//FOUO); UK Figures on Absconding Immigrants Raises
Questions on Whether UK Can Catch Returning Jihadists; extracted information is U//FOUO; overall document is classified U//FOUO.
7 (U); Abul Taher and Ian Gallagher; Daily Mail; 17 JAN 2015; “ISIS Fighters Fake Death in Syria to Slip Back to UK and Europe Without being
Detected and Plot Terror Attacks”; http://www.dailymail.co.uk/news/article-2915028/ISIS-fighters-fake-death-Syria-slip-UK-Europe-withoutdetected-plot-terror-attacks.html; accessed 10 JUL 2015.
8 (U); Sky News; 29 JUN 2015; “Growing doubt over demise of Sharrouf;”; http://www.skynews.com.au/news/top-stories/2015/06/29/growingdoubt-over-demise-of-sharrouf.html#sthash.yj2mNxtE.dpuf; accessed: 09 JUL 2015.
9 (U); Jennifer Simonson; Minnesota Public Radio; DOI 26 APR 2015 “For Mothers of Suspects, Nothing but Sorrow”;
http://lacrossetribune.com/search/?l=50&sd=desc&s=start_time&f=html&byline=Laura%20Yuen%20and%20Mukhtar%20Ibrahim%0AMinnesota
%20Public%20Radio%20News; accessed on 28 APR 2015.
10 (U); Arun Rath; National Public Radio; DOI 25 APR 2015 “From Alabama to ISIS”; http://www.npr.org/2015/04/25/402229620/from-alabama-toisis; accessed on 30 APR 2015.
11 (U//FOUO); OSC; EUP20120817058002; 17 AUG 2012; DOI 17 AUG 2012; (U); 'Italian' Volunteers Join Syria Rebels; extracted information is
(U); overall document classification is (U).
12 (U//FOUO); OSC; EUR2015011528815552; 15 JAN 2015; DOI 15 JAN 2015; (U); Italian Jihadist 'Turncoats' Discuss Recruiters' Training
Methods; extracted information is U; overall document classification is U.
13 (U//FOUO); TSC; 2013 Watchlisting Guidance; Section 3.17.1, pg 46; DOI MAR 2013; accessed on 20 JUL 2015; extracted information is
U//FOUO; overall document classification is U//FOUO/SSI.
14 (U//FOUO); TSC; 2013 Watchlisting Guidance; Section 1.18, pg 9-10; DOI MAR 2013; accessed on 20 JUL 2015; extracted information is
U//FOUO; overall document classification is U//FOUO/SSI.
15 (U); NCTC; Directorate of Terrorist Identities; “Dead Status in TIDE (WL Community version): ‘Reportedly Dead’ vs. ‘Confirmed Dead’”; 26
JUN 2015; extracted information is U//FOUO; overall classification: U//FOUO.
16 (U); NCTC; Directorate of Terrorist Identities; DOI 21 JUL 2015; E-mail response to Request for Information; “RE: (U//FOUO) Removal of
KST from watchlisting when death becomes "high profile case in the public sphere”; extracted information is U//FOUO; overall document
classification is U//FOUO.
17 (U//FOUO); DHS; DOI 20 July 2015; I&A Query of Terrorist Identities Datamart (TIDE); “KSTs categorized as ‘confirmed dead’ and
‘reportedly dead’ in TIDE;” accessed on 20 JUL 2015; extracted information is U//FOUO; overall document classification is U//FOUO.
18 (U); State.gov; DOI UNK; “7 FAM 1300 Passport Services”; http://www.state.gov/m/a/dir/regs/fam/
07fam/c22714.htm; accessed: 20 APR 2015.
19 (U); NCTC; Directorate of Terrorist Identities; “Dead Status in TIDE (WL Community version): ‘Reportedly Dead’ vs. ‘Confirmed Dead’”; 26
JUN 2015; extracted information is U//FOUO; overall classification: U//FOUO.
20 (U); Adolfo Flores; Los Angeles Times; 21 OCT 2013 “Orange County Man was to Lead Al Qaeda Attack in December, Feds Allege”;
http://articles.latimes.com/2013/oct/21/local/la-me-ln-oc-man-al-qaeda-attack-20131021; accessed on 9 JUL 2015.
21 (U); Matt Hamilton; Associated Press; 30 JUN 2014 “Sinh Vihn Ngo Nguyen Sentenced to 13 Years for Trying to Aid Al Qaeda”;
http://www.washingtontimes.com/news/2014/jun/30/sentencing-due-for-man-who-tried-to-aid-al-qaida; accessed on 20 MAR 2015.
22 (U//FOUO); OSC; EUL2015012064970018; 20 JAN 2015; DOI 20 JAN 2015; (U); Belgian Terrorism Suspect Abdelhamid A. Faked Death To
Escape Investigators; extracted information is U; overall document classification is U.
23 (U); Charlie D’Agata; CBS News; 19 JAN 2015; “Key Terror Suspect in Belgium Came Back from the Dead”;
http://www.cbsnews.com/news/key-terror-suspect-in-belgium-came-back-from-the-dead/; accessed on 20 APR 2015; extracted information is
(U); overall document classification is (U).
24 (U); Abul Taher and Ian Gallagher; Daily Mail (UK); DOI 17 JAN 2015; “ISIS Fighters Fake Death in Syria to Slip Back to UK and Europe
Without being Detected and Plot Terror Attacks”; http://www.dailymail.co.uk/news/article-2915028/ISIS-fighters-fake-death-Syria-slip-UKEurope-without-detected-plot-terror-attacks.html; accessed 10 JUL 2015.
25 (U); Taneli Savela; NL Times; 16 JAN 2015; "Belgian, Dutch Islamic Extremists Linked”; http://www.nltimes.nl/2015/01/16/belgian-dutch-islamicextremists-linked/; accessed 10 JUL 2015.
26 (U); Taneli Savela; NL Times; 19 JAN 2015; "Jihadist Killed in Belgium Had Fake Dutch Passport"; http://www.nltimes.nl/2015/01/19/jihadistkilled-belgium-fake-dutch-passport/; accessed 10 JUL 2015.
27 (U); 23 SEP 2014; website; extracted information is U//FOUO; the source website is classified higher than this document.
28 (U); International Civil Aviation Organization; MAY 2015; “PKD Participants as of MAY 2015”; http://www.icao.int/Security/mrtd/Pages/PKDParticipants.aspx; accessed 11 AUG 2015.
1
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 5 of 5
UNCLASSIFIED//FOR OFFICIAL USE ONLY
(U//FOUO): DHS; OSIR/DHS-OS-0751-15; 24 JUL 2015; DOI 21 JUL 2015; (U//FOUO); Conflicting tweets regarding the possible death of
USPER Mujahid Miski; extracted information is U//FOUO; overall document classification is U//FOUO.
2 (U); Associated Press; 20 JAN 2015; “British Jihadi Faces Prison After Admitting Terrorism Acts”;
http://www.nytimes.com/aponline/2015/01/20/world/europe/ap-eu-britain-jihadi-guilty.html; accessed on 23 APR 2015.
3 (U//FOUO); OSC; EUR2015012071090552; 20 JAN 2015; DOI 20 JAN 2015; (U); British Jihadist Admits to Terror Charges; extracted
information is U; overall document classification is U.
4 (U); Associated Press; 20 JAN 2015; “British Jihadi Faces Prison After Admitting Terrorism Acts”;
http://www.nytimes.com/aponline/2015/01/20/world/europe/ap-eu-britain-jihadi-guilty.html; accessed on 23 APR 2015.
5 (U//FOUO); OSC; EUR2015012071090552; 20 JAN 2015; DOI 20 January 2015; (U); British Jihadist Admits to Terror Charges; extracted
information is U; Overall document classification is U.
6 (U//FOUO); OSC; EUR2014082437694148; 24 AUG 2014; DOI 23 August 2014; (U//FOUO); UK Figures on Absconding Immigrants Raises
Questions on Whether UK Can Catch Returning Jihadists; extracted information is U//FOUO; overall document is classified U//FOUO.
7 (U); Abul Taher and Ian Gallagher; Daily Mail; 17 JAN 2015; “ISIS Fighters Fake Death in Syria to Slip Back to UK and Europe Without being
Detected and Plot Terror Attacks”; http://www.dailymail.co.uk/news/article-2915028/ISIS-fighters-fake-death-Syria-slip-UK-Europe-withoutdetected-plot-terror-attacks.html; accessed 10 JUL 2015.
8 (U); Sky News; 29 JUN 2015; “Growing doubt over demise of Sharrouf;”; http://www.skynews.com.au/news/top-stories/2015/06/29/growingdoubt-over-demise-of-sharrouf.html#sthash.yj2mNxtE.dpuf; accessed: 09 JUL 2015.
9 (U); Jennifer Simonson; Minnesota Public Radio; DOI 26 APR 2015 “For Mothers of Suspects, Nothing but Sorrow”;
http://lacrossetribune.com/search/?l=50&sd=desc&s=start_time&f=html&byline=Laura%20Yuen%20and%20Mukhtar%20Ibrahim%0AMinnesota
%20Public%20Radio%20News; accessed on 28 APR 2015.
10 (U); Arun Rath; National Public Radio; DOI 25 APR 2015 “From Alabama to ISIS”; http://www.npr.org/2015/04/25/402229620/from-alabama-toisis; accessed on 30 APR 2015.
11 (U//FOUO); OSC; EUP20120817058002; 17 AUG 2012; DOI 17 AUG 2012; (U); 'Italian' Volunteers Join Syria Rebels; extracted information is
(U); overall document classification is (U).
12 (U//FOUO); OSC; EUR2015011528815552; 15 JAN 2015; DOI 15 JAN 2015; (U); Italian Jihadist 'Turncoats' Discuss Recruiters' Training
Methods; extracted information is U; overall document classification is U.
13 (U//FOUO); TSC; 2013 Watchlisting Guidance; Section 3.17.1, pg 46; DOI MAR 2013; accessed on 20 JUL 2015; extracted information is
U//FOUO; overall document classification is U//FOUO/SSI.
14 (U//FOUO); TSC; 2013 Watchlisting Guidance; Section 1.18, pg 9-10; DOI MAR 2013; accessed on 20 JUL 2015; extracted information is
U//FOUO; overall document classification is U//FOUO/SSI.
15 (U); NCTC; Directorate of Terrorist Identities; “Dead Status in TIDE (WL Community version): ‘Reportedly Dead’ vs. ‘Confirmed Dead’”; 26
JUN 2015; extracted information is U//FOUO; overall classification: U//FOUO.
16 (U); NCTC; Directorate of Terrorist Identities; DOI 21 JUL 2015; E-mail response to Request for Information; “RE: (U//FOUO) Removal of
KST from watchlisting when death becomes "high profile case in the public sphere”; extracted information is U//FOUO; overall document
classification is U//FOUO.
17 (U//FOUO); DHS; DOI 20 July 2015; I&A Query of Terrorist Identities Datamart (TIDE); “KSTs categorized as ‘confirmed dead’ and
‘reportedly dead’ in TIDE;” accessed on 20 JUL 2015; extracted information is U//FOUO; overall document classification is U//FOUO.
18 (U); State.gov; DOI UNK; “7 FAM 1300 Passport Services”; http://www.state.gov/m/a/dir/regs/fam/
07fam/c22714.htm; accessed: 20 APR 2015.
19 (U); NCTC; Directorate of Terrorist Identities; “Dead Status in TIDE (WL Community version): ‘Reportedly Dead’ vs. ‘Confirmed Dead’”; 26
JUN 2015; extracted information is U//FOUO; overall classification: U//FOUO.
20 (U); Adolfo Flores; Los Angeles Times; 21 OCT 2013 “Orange County Man was to Lead Al Qaeda Attack in December, Feds Allege”;
http://articles.latimes.com/2013/oct/21/local/la-me-ln-oc-man-al-qaeda-attack-20131021; accessed on 9 JUL 2015.
21 (U); Matt Hamilton; Associated Press; 30 JUN 2014 “Sinh Vihn Ngo Nguyen Sentenced to 13 Years for Trying to Aid Al Qaeda”;
http://www.washingtontimes.com/news/2014/jun/30/sentencing-due-for-man-who-tried-to-aid-al-qaida; accessed on 20 MAR 2015.
22 (U//FOUO); OSC; EUL2015012064970018; 20 JAN 2015; DOI 20 JAN 2015; (U); Belgian Terrorism Suspect Abdelhamid A. Faked Death To
Escape Investigators; extracted information is U; overall document classification is U.
23 (U); Charlie D’Agata; CBS News; 19 JAN 2015; “Key Terror Suspect in Belgium Came Back from the Dead”;
http://www.cbsnews.com/news/key-terror-suspect-in-belgium-came-back-from-the-dead/; accessed on 20 APR 2015; extracted information is
(U); overall document classification is (U).
24 (U); Abul Taher and Ian Gallagher; Daily Mail (UK); DOI 17 JAN 2015; “ISIS Fighters Fake Death in Syria to Slip Back to UK and Europe
Without being Detected and Plot Terror Attacks”; http://www.dailymail.co.uk/news/article-2915028/ISIS-fighters-fake-death-Syria-slip-UKEurope-without-detected-plot-terror-attacks.html; accessed 10 JUL 2015.
25 (U); Taneli Savela; NL Times; 16 JAN 2015; "Belgian, Dutch Islamic Extremists Linked”; http://www.nltimes.nl/2015/01/16/belgian-dutch-islamicextremists-linked/; accessed 10 JUL 2015.
26 (U); Taneli Savela; NL Times; 19 JAN 2015; "Jihadist Killed in Belgium Had Fake Dutch Passport"; http://www.nltimes.nl/2015/01/19/jihadistkilled-belgium-fake-dutch-passport/; accessed 10 JUL 2015.
27 (U); 23 SEP 2014; website; extracted information is U//FOUO; the source website is classified higher than this document.
28 (U); International Civil Aviation Organization; MAY 2015; “PKD Participants as of MAY 2015”; http://www.icao.int/Security/mrtd/Pages/PKDParticipants.aspx; accessed 11 AUG 2015.
1
UNCLASSIFIED//FOR OFFICIAL USE ONLY
Page 5 of 5
CLASSIFICATION: OFFICIAL USE ONLY
Office of Intelligence and Analysis
Customer Feedback Form
Product Title: Social Media and False Documents Enabling Known or Suspected Terrorists to Fabricate Plaus
1. Please select partner type: Select One Select One
2. What is the highest level of intelligence information that you receive? Select One
3. Please complete the following sentence: focus most of my time on:? Select One
4. Please rate your satisfaction with each of the following:
Neither
Very Somewhat Satisfied no.- Somewhat Very
Satisfied Satisfied Dissatisfied Dissatisfied Dissatisfied
Product?s overall usefulness
0
Products timeliness
Product's responsiveness
to your intelligence needs
5. How do you plan to use this product in support of your mission? (Check all that apply.)
DnVe planning and preparedness Efforts. training, and/0r Initiate a law enforcement investigation
emergency response operations Initiate your own regional-specific analysis
Observe, identify, and/or disrupt threats Initiate your own tOpic-Specific analysis
Share with partners Develop long?term homeland security strategies
Allocate resources equipment and personnel) DO not plan to use
Reprioritize Organizational focus Other:
Author or adjust policies and guidelines
6. To further understand your response to question please provide specific details about situations in which you might
use this product.
7. What did this product n_ot address that you anticipated it would?
8. To what extent do you agree with the following two statements?
strongly Neither Agree Strongly
Agree Agree nor Disagree D'sag'ee Disagree A
This product will enable me to make better
decisions regarding this topic. 0
This product provided me with intelligence
information I did not ?nd elsewhere. 0
9. How did you obtain this product? Select One
10. Would you be willing to participate in a follow-up conversation about your feedback? Yes
Position:
State:
Email:
Privacy Act Statement
CLASSIFICATION: OFFICIAL USE ONLY
Product Serial Number: IA-0269-15 REV: 29 October 2014
CLASSIFICATION: OFFICIAL USE ONLY
Office of Intelligence and Analysis
Customer Feedback Form
Product Title: Social Media and False Documents Enabling Known or Suspected Terrorists to Fabricate Plaus
1. Please select partner type: Select One Select One
2. What is the highest level of intelligence information that you receive? Select One
3. Please complete the following sentence: focus most of my time on:? Select One
4. Please rate your satisfaction with each of the following:
Neither
Very Somewhat Satisfied no.- Somewhat Very
Satisfied Satisfied Dissatisfied Dissatisfied Dissatisfied
Product?s overall usefulness
0
Products timeliness
Product's responsiveness
to your intelligence needs
5. How do you plan to use this product in support of your mission? (Check all that apply.)
DnVe planning and preparedness Efforts. training, and/0r Initiate a law enforcement investigation
emergency response operations Initiate your own regional-specific analysis
Observe, identify, and/or disrupt threats Initiate your own tOpic-Specific analysis
Share with partners Develop long?term homeland security strategies
Allocate resources equipment and personnel) DO not plan to use
Reprioritize Organizational focus Other:
Author or adjust policies and guidelines
6. To further understand your response to question please provide specific details about situations in which you might
use this product.
7. What did this product n_ot address that you anticipated it would?
8. To what extent do you agree with the following two statements?
strongly Neither Agree Strongly
Agree Agree nor Disagree D'sag'ee Disagree A
This product will enable me to make better
decisions regarding this topic. 0
This product provided me with intelligence
information I did not ?nd elsewhere. 0
9. How did you obtain this product? Select One
10. Would you be willing to participate in a follow-up conversation about your feedback? Yes
Position:
State:
Email:
Privacy Act Statement
CLASSIFICATION: OFFICIAL USE ONLY
Product Serial Number: IA-0269-15 REV: 29 October 2014