VZCZCXYZ0000
PP RUEHWEB

DE RUEHTV #0592/01 0731223
ZNY SSSSS ZZH
P 131223Z MAR 08
FM AMEMBASSY TEL AVIV
TO RUEHC/SECSTATE WASHDC PRIORITY 5839
INFO RUEATRS/DEPT OF TREASURY WASHDC PRIORITY
RHEFDIA/DIA WASHDC PRIORITY
RUEAIIA/CIA WASHDC PRIORITY
RHEHNSC/NSC WASHDC PRIORITY

S E C R E T TEL AVIV 000592 
 
SIPDIS 
 
SIPDIS 
 
PLEASE PASS TO TREASURY FOR CONLON; S/CT FOR WORMAN; INR 
FOR CHAMBERS 
 
E.O. 12958: DECL: 03/11/2018 
TAGS: PINR PTER KOGL KTFN IR IS
SUBJECT: PRIVATE ISRAELI COMPANY COLLECTS COUNTER-TERRORISM 
INTELLIGENCE 
 
Classified By: Ambassador Richard H. Jones for reasons 1.4 (b/d) 
 
¶1. (S) On March 7, Econoff received a briefing from senior 
executives at Hazard Threat Analysis, Ltd. (HTA), a private 
company specializing in internet-based counter-terrorism (CT) 
intelligence gathering.  Founder and CEO Aviram Halevi 
explained that all of HTA's research is based on open source 
material gathered by collectors from shared platforms and 
peer-to-peer programs on the internet and Web 2.0.  Halevi 
clarified that the company does not collect business 
intelligence or use hackers.  HTA has a staff of 
approximately 25 researchers, of whom twenty are language 
specialists, primarily in Farsi and Arabic.  The researchers 
are often recently discharged members of Israeli Defense 
Intelligence's (IDI) elite Unit 8200, which is well known in 
Israel as IDI's signal intelligence unit.  The young staff is 
employed by HTA to develop online identities (avatars) in 
discussion groups used by potential terrorists to actively 
solicit information useful to their clients.  Some of these 
identities have been maintained for as long as two years. 
Halevi was quick to note that his employees are not involved 
in terrorist planning online, limiting themselves to observer 
status within the groups.  A typical monthly report costs 
between USD 2500-4500. 
 
¶2. (S) Halevi, a former Lt. Colonel in IDI, said that other 
companies and agencies engage in similar activities, but none 
with the skill or experience of his team.  Discharged 
soldiers from IDI serve as a "bottomless well" of talent, 
said Halevi, and new personnel can always be hired depending 
on the needs of the client.  Halevi explained that the 
researchers and analysts understand the CT context in which 
they are working from their army training, and their skills 
are such that not one false identity has ever been identified 
by other participants in discussion groups.  Halevi noted 
that HTA has a competitive edge in this sort of technical 
analysis, and is currently providing similar reports to the 
Joint Task Force in Iraq (this has not been independently 
confirmed).  In Halevi's view, this ability to analyze 
technical capabilities is what differentiates HTA from others 
in the field, such as the American Rita Katz and her Site 
Institute.  In a separate conversation, IDI Iran analyst Itai 
Yonat told Econoff that HTA analysts often claim 
responsibility for recent terrorist attacks as a means of 
establishing credibility in online groups, using technical 
knowledge of such events in the region.  Yonat confessed that 
the GOI was generally unwilling to outsource intelligence 
work to HTA, but regularly made use of their information when 
provided for free. 
 
¶3. (S) Mickey Segall, Head of Political Analysis, noted that 
HTA was different from traditional intelligence agencies in 
that there is no wall between collection and analysis. 
Instead, collectors and analysts work side-by-side to refine 
the final product and bring it to market as quickly as 
possible.  This allows the staff to "reach across the aisle" 
and change priorities if the customer makes a specific 
request.  Segall worked on Arab and Iranian issues for twenty 
years in IDI where he also reached the rank of Lt. Colonel, 
but said that when he joined HTA one year ago much of the 
company's information was entirely new to him.  It is 
surprising, said Segall, how many high-ranking people keep 
blogs, especially in Iran, which is a relatively techno-savvy 
country.  He offered the example of the Central Bank of Iran, 
which maintains a public site where officials discuss the 
bank's internal policies and comment on actions taken by the 
U.S. Department of the Treasury. 
 
¶4. (S) Segall said that outsourcing to HTA does not replace 
traditional intelligence, but rather enhances it.  "We can be 
there fast, with high quality information tailored to the 
customer," said Segall.  HTA can do both pinpoint research 
and broader situation reports, but is not able to provide the 
sort of "point-to-point" specific information available 
through more traditional intelligence gathering methods. 
Instead, said Segall, the researchers focus on early phases 
of CT when terrorists are often less cautious about their use 
of technology.  Halevi said that this type of information 
could be particularly useful in tracking terrorism finance. 
HTA's analysts often encounter fundraisers for terrorist 
groups, credit card numbers, pin codes, and other identifying 
information, but do not have any customers requesting this 
information.  Halevi also believes that when it comes to 
Iran, there is considerable information that could be 
obtained on the Islamic Revolutionary Guard Corps and other 
groups through the use of link analysis connecting 
individuals with support for terrorism and nuclear 
proliferation. 
 
¶5. (S) The company maintains a databank of private video and 
photographs posted on blogs and discussion groups from target 
countries.  Halevi said that in many cases, the data is 
removed by government censors within minutes, but the footage 
remains accessible forever to HTA researchers.  HTA analysts 
recently used video footage posted on Hamas internet chat 
groups to prepare a report for IDI Research on rocket 
capacity in Gaza.  He added that gaining the confidence of 
U.S. clients is an arduous process, as HTA is not 
incorporated in the United States.  HTA shares contracts with 
its sister company in the United Kingdom, Hazard Management 
Solutions Ltd, which was recently acquired by the Canadian 
company Allen-Vanguard. 
 
********************************************* ******************** 
Visit Embassy Tel Aviv's Classified Website: 
http://www.state.sgov.gov/p/nea/telaviv 
 
You can also access this site through the State Department's 
Classified SIPRNET website. 
********************************************* ******************** 
JONES