The Global Intelligence Files The Global Intelligence Files by WikiLeaks Released 242291 Emails (Nov 5, 2012 3 PM)
Email ID 1056988 (original text)
SubjectRe: Wikileaks is attacking us
Fromburton@stratfor.com
To analysts@stratfor.com
DateDec 7, 2010 18:40
ReleasedFeb 28, 2012 15:00
Assange is going to make a nice bride in prison.  Screw the terrorist. 
He'll be eating cat food forever, unless George Soros hires him. 

Reva Bhalla wrote:
> what.... the hell is that.  
>
> On Dec 7, 2010, at 11:24 AM, Bayless Parsley wrote:
>
>> would this suffice?
>>
>> <moz-screenshot-88.png>
>>
>>
>> On 12/7/10 11:13 AM, Reva Bhalla wrote:
>>> when are your new book jacket pics coming out?  we need some new
>>> material.
>>>
>>>
>>> On Dec 7, 2010, at 11:12 AM, George Friedman wrote:
>>>
>>>> He is always in an awkward pose. I'm merely posed in one.
>>>> Sent via BlackBerry by AT&T
>>>>
>>>> -----Original Message-----
>>>> From: Reva Bhalla <reva.bhalla@stratfor.com>
>>>> Date: Tue, 7 Dec 2010 11:05:59
>>>> To: Marko Papic<marko.papic@stratfor.com>
>>>> Reply-To: Analyst List <analysts@stratfor.com>
>>>> Cc: <friedman@att.blackberry.net>; Kevin
>>>> Stech<kevin.stech@stratfor.com>; Analyst List<analysts@stratfor.com>
>>>> Subject: Re: Wikileaks is attacking us
>>>>
>>>> Assange v Friedman... who can look more intimidating in an awkward
>>>> pose?  Find out in the 2011 annual forecast
>>>>
>>>>
>>>> On Dec 7, 2010, at 11:00 AM, Marko Papic wrote:
>>>>
>>>>> Potential diary? Comparing WikiLeak attack to Pearl Harbor...
>>>>>
>>>>> Will STRATFOR rebound and eventually launch a nuclear attack against
>>>>> WikiLeaks?
>>>>>
>>>>> Stay tuned... for $199 a year.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On 12/7/10 10:57 AM, George Friedman wrote:
>>>>>>
>>>>>> So pearl harbor it wasn't.
>>>>>>
>>>>>> And while we are at it a moment to remember those that fell at
>>>>>> pearl 69 years ago today wouldn't me out of place.
>>>>>>
>>>>>> If I'm not mistaken more americans died at pearl than died in iraq.
>>>>>> Not trivializing the latter. Simply highlighting the former.
>>>>>> Sent via BlackBerry by AT&T
>>>>>>
>>>>>> From: "Kevin Stech" <kevin.stech@stratfor.com>
>>>>>> Date: Tue, 7 Dec 2010 10:42:57 -0600 (CST)
>>>>>> To: <friedman@att.blackberry.net>; 'Analyst
>>>>>> List'<analysts@stratfor.com
>>>>>>>
>>>>>> Cc: 'Reva Bhalla'<reva.bhalla@stratfor.com>
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> Our research request tracking system was slowed to a crawl, and
>>>>>> brought down for about 10 minutes while I disabled access to the
>>>>>> port it was attacking.
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of George Friedman
>>>>>> Sent: Tuesday, December 07, 2010 10:41
>>>>>> To: Analysts
>>>>>> Cc: Reva Bhalla
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> Did it in anyway hinder our ability to operate.
>>>>>> Sent via BlackBerry by AT&T
>>>>>>
>>>>>> From: "Kevin Stech" <kevin.stech@stratfor.com>
>>>>>> Date: Tue, 7 Dec 2010 10:38:55 -0600 (CST)
>>>>>> To: <friedman@att.blackberry.net>; 'Analyst
>>>>>> List'<analysts@stratfor.com
>>>>>>>
>>>>>> ReplyTo: Analyst List <analysts@stratfor.com>
>>>>>> Cc: 'Reva Bhalla'<reva.bhalla@stratfor.com>
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> We also know that the traffic was specifically designed to test for
>>>>>> misconfigured software in an attempt to gain unauthorized web
>>>>>> content. The traffic was extremely aggressive and not at all subtle
>>>>>> or stealthy. It actually bordered on a denial of service attack.
>>>>>>
>>>>>> We also know that it wasn�t originating from just any wikileaks
>>>>>> address, but from their webserver.
>>>>>>
>>>>>> These facts let us make some pretty solid guesses about what�s
>>>>>> going on. Maybe I�m never proven right, but the leading theory at
>>>>>> this point is IP spoofing.
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of George Friedman
>>>>>> Sent: Tuesday, December 07, 2010 10:35
>>>>>> To: Analysts
>>>>>> Cc: Reva Bhalla
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> And yet we don't even know that for certain. Its inference.
>>>>>>
>>>>>> Here is what we know. A wikileaks address has sent some amateurish
>>>>>> traffic against a minor stratfor site.
>>>>>>
>>>>>> That's it.
>>>>>> The rest inference. It would be interesting if this escalated or we
>>>>>> had more data but until we do, it is hard to justify publishing.
>>>>>> Sent via BlackBerry by AT&T
>>>>>>
>>>>>> From: "Kevin Stech" <kevin.stech@stratfor.com>
>>>>>> Date: Tue, 7 Dec 2010 10:32:25 -0600 (CST)
>>>>>> To: <friedman@att.blackberry.net>; 'Analysts'<analysts@stratfor.com>
>>>>>> ReplyTo: Analyst List <analysts@stratfor.com>
>>>>>> Cc: 'Reva Bhalla'<reva.bhalla@stratfor.com>
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> I completely discount the idea that Wikileaks is doing the
>>>>>> attacking. Nor do I think anyone with legitimate access to their IP
>>>>>> address or network is doing this.
>>>>>>
>>>>>> I think someone outside their network is spoofing their IP address,
>>>>>> generating a lot of annoying traffic, and attempting to get their
>>>>>> IP blacklisted by automatic security processes.
>>>>>>
>>>>>> From: George Friedman [mailto:friedman@att.blackberry.net]
>>>>>> Sent: Tuesday, December 07, 2010 10:28
>>>>>> To: Kevin Stech; Analysts
>>>>>> Cc: Reva Bhalla
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> How do you know that it is wikileaks as an organization attacking
>>>>>> and not someone using them as a mask?
>>>>>> Sent via BlackBerry by AT&T
>>>>>>
>>>>>> From: "Kevin Stech" <kevin.stech@stratfor.com>
>>>>>> Date: Tue, 7 Dec 2010 10:16:15 -0600 (CST)
>>>>>> To: <friedman@att.blackberry.net>; 'Analyst
>>>>>> List'<analysts@stratfor.com
>>>>>>>
>>>>>> Cc: 'Reva Bhalla'<reva.bhalla@stratfor.com>
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> What is unique in this attack
>>>>>>
>>>>>> It is a supposed attack against us by the Wikileaks webserver. Very
>>>>>> very strange and unique, especially in light of all the
>>>>>> circumstances.
>>>>>>
>>>>>> Is this an attack or someone's server gone nuts.
>>>>>>
>>>>>> Definitely an attack. No two ways about it.
>>>>>>
>>>>>> Is there any reason except timing to assume any link to any other
>>>>>> event.
>>>>>>
>>>>>> Not sure what you mean by this.
>>>>>>
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of George Friedman
>>>>>> Sent: Tuesday, December 07, 2010 10:13
>>>>>> To: Analysts
>>>>>> Cc: Reva Bhalla
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> Three questions.
>>>>>>
>>>>>> What is unique in this attack
>>>>>> Is this an attack or someone's server gone nuts.
>>>>>> Is there any reason except timing to assume any link to any other
>>>>>> event.
>>>>>> Sent via BlackBerry by AT&T
>>>>>>
>>>>>> From: Rodger Baker <rbaker@stratfor.com>
>>>>>> Date: Tue, 7 Dec 2010 10:11:21 -0600 (CST)
>>>>>> To: Analyst List<analysts@stratfor.com>
>>>>>> ReplyTo: Analyst List <analysts@stratfor.com>
>>>>>> Cc: 'Reva Bhalla'<reva.bhalla@stratfor.com>
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> I do not think this is something we should write on.
>>>>>> First, do we know whether this is hitting anyone other than stech's
>>>>>> personal server?
>>>>>> second, what does it mean/matter?
>>>>>>
>>>>>>
>>>>>> On Dec 7, 2010, at 10:08 AM, scott stewart wrote:
>>>>>>
>>>>>>
>>>>>> This is not obsessing, the attack is actually very interesting and
>>>>>> different from anything seen in the press.
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of Marko Papic
>>>>>> Sent: Tuesday, December 07, 2010 11:07 AM
>>>>>> To: Analyst List
>>>>>> Cc: Reva Bhalla
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> But the readers would want to know...
>>>>>>
>>>>>> Is a good, "hey, whats up over here?"
>>>>>>
>>>>>> get Stech to write it... He knows what's up and needs to nerd out
>>>>>> on Assange.
>>>>>>
>>>>>> good publicity.
>>>>>>
>>>>>> $
>>>>>>
>>>>>> On 12/7/10 10:05 AM, Reva Bhalla wrote:
>>>>>> let's not obsess over this too much.
>>>>>>
>>>>>> it's really not that important, IMO...
>>>>>>
>>>>>> we sound just as obsessed as the rest of the media over this thing.
>>>>>> let's focus on real issue.
>>>>>>
>>>>>>
>>>>>> On Dec 7, 2010, at 10:03 AM, scott stewart wrote:
>>>>>>
>>>>>>
>>>>>> Yes.
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of Marko Papic
>>>>>> Sent: Tuesday, December 07, 2010 11:00 AM
>>>>>> To: Analyst List
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> If nobody else is noticing it, might be worth a quick 300 word
>>>>>> statement on it... almost like a brief.
>>>>>>
>>>>>> Hey, look... this is what is happening. We dont think WikiLeaks is
>>>>>> Douchbacking us on purpose. We ask our readers for thoughts...
>>>>>>
>>>>>> LINK: Awesome diary
>>>>>>
>>>>>> LINK: Fuck you Assange
>>>>>>
>>>>>>
>>>>>>
>>>>>> On 12/7/10 9:57 AM, Matthew Powers wrote:
>>>>>> I have not been able to find anyone else talking about this
>>>>>> online.  Seems even stranger if it is only Stratfor's research
>>>>>> server.
>>>>>>
>>>>>> Kevin Stech wrote:
>>>>>> Any reason to think the US is not behind this? Cui bono?
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of scott stewart
>>>>>> Sent: Tuesday, December 07, 2010 09:49
>>>>>> To: 'Analyst List'; 'Marko Papic'
>>>>>> Cc: it@stratfor.com
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> I agree that option 2, is not it.  Too obvious to attack us using
>>>>>> their own system.
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of Kevin Stech
>>>>>> Sent: Tuesday, December 07, 2010 10:45 AM
>>>>>> To: 'Analyst List'; 'Marko Papic'
>>>>>> Cc: it@stratfor.com
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> There are only 3 options and they�re all hugely interesting
>>>>>>
>>>>>> Least likely: someone hacked into the wikileaks server, left it
>>>>>> running, and decided to attack stratfor
>>>>>>
>>>>>> Not likely: wikileaks doesn�t like stratfor and is attacking us
>>>>>> from their webserver.
>>>>>>
>>>>>> Likely: someone is spoofing wikileaks and acting like the internet
>>>>>> equivalent of an abusively drunk fratboy to get the wikileaks
>>>>>> server ip blocked from as many networks as possible
>>>>>>
>>>>>> None of those scenarios is uninteresting, but I think my theory
>>>>>> fits best.
>>>>>>
>>>>>> Thoughts?
>>>>>>
>>>>>> From: analysts-bounces@stratfor.com
>>>>>> [mailto:analysts-bounces@stratfor.com
>>>>>> ] On Behalf Of Kevin Stech
>>>>>> Sent: Tuesday, December 07, 2010 09:30
>>>>>> To: 'Marko Papic'; 'Analyst List'
>>>>>> Cc: it@stratfor.com
>>>>>> Subject: RE: Wikileaks is attacking us
>>>>>>
>>>>>> If these nerds were going to attack us, they wouldn�t be doing it
>>>>>> from their webserver. That�s idiotic.
>>>>>>
>>>>>> From: Marko Papic [mailto:marko.papic@stratfor.com]
>>>>>> Sent: Tuesday, December 07, 2010 09:29
>>>>>> To: Analyst List
>>>>>> Cc: Kevin Stech; it@stratfor.com
>>>>>> Subject: Re: Wikileaks is attacking us
>>>>>>
>>>>>> Also, we published the diary on Wikileaks last night... could that
>>>>>> have something to do with it?
>>>>>>
>>>>>>
>>>>>> On 12/7/10 9:27 AM, Marko Papic wrote:
>>>>>> Why us then?
>>>>>>
>>>>>> On 12/7/10 9:26 AM, Kevin Stech wrote:
>>>>>> �or so someone wants us to think.
>>>>>>
>>>>>> The research box is currently being pounded with Internet traffic,
>>>>>> doing a very aggressive, over-the-top, amateurish security scan
>>>>>> that is not only annoying, its actually limiting functionality by
>>>>>> forcing the system to cope with 1000s of bogus requests. It�s the
>>>>>> type of thing that gets your IP address banned, or at least ignored
>>>>>> for a while.
>>>>>>
>>>>>> The IP address doing this? 213.251.145.96
>>>>>>
>>>>>> So who is this asshole at 213.251.145.96? None other than
>>>>>> Wikileaks. But I don�t think Wikileaks is security scanning us, nor
>>>>>> do I even think Wikileaks was hacked and someone is mounting a
>>>>>> security scan from there. I think its far more likely that people
>>>>>> are spoofing the Wikileaks IP address and acting like as big of an
>>>>>> asshole as possible in order to trip everyone�s automatic security
>>>>>> that bans and ignores the offender.
>>>>>>
>>>>>> In a nutshell, I believe someone is spoofing attacks from Wikileaks
>>>>>> in order to get their IP address blocked.
>>>>>>
>>>>>>
>>>>>> Kevin Stech
>>>>>> Research Director | STRATFOR
>>>>>> kevin.stech@stratfor.com
>>>>>> +1 (512) 744-4086
>>>>>>
>>>>>>
>>>>>> -- 
>>>>>>
>>>>>> - - - - - - - - - - - - - - - - -
>>>>>> Marko Papic
>>>>>> Geopol Analyst - Eurasia
>>>>>> STRATFOR
>>>>>> 700 Lavaca Street - 900
>>>>>> Austin, Texas
>>>>>> 78701 USA
>>>>>> P: + 1-512-744-4094
>>>>>> marko.papic@stratfor.com
>>>>>>
>>>>>> -- 
>>>>>>
>>>>>> - - - - - - - - - - - - - - - - -
>>>>>> Marko Papic
>>>>>> Geopol Analyst - Eurasia
>>>>>> STRATFOR
>>>>>> 700 Lavaca Street - 900
>>>>>> Austin, Texas
>>>>>> 78701 USA
>>>>>> P: + 1-512-744-4094
>>>>>> marko.papic@stratfor.com
>>>>>>
>>>>>>
>>>>>> -- 
>>>>>> Matthew Powers
>>>>>> STRATFOR Researcher
>>>>>> Matthew.Powers@stratfor.com
>>>>>>
>>>>>> -- 
>>>>>>
>>>>>> - - - - - - - - - - - - - - - - -
>>>>>> Marko Papic
>>>>>> Geopol Analyst - Eurasia
>>>>>> STRATFOR
>>>>>> 700 Lavaca Street - 900
>>>>>> Austin, Texas
>>>>>> 78701 USA
>>>>>> P: + 1-512-744-4094
>>>>>> marko.papic@stratfor.com
>>>>>>
>>>>>>
>>>>>> -- 
>>>>>>
>>>>>> - - - - - - - - - - - - - - - - -
>>>>>> Marko Papic
>>>>>> Geopol Analyst - Eurasia
>>>>>> STRATFOR
>>>>>> 700 Lavaca Street - 900
>>>>>> Austin, Texas
>>>>>> 78701 USA
>>>>>> P: + 1-512-744-4094
>>>>>> marko.papic@stratfor.com
>>>>>>
>>>>>
>>>>> -- 
>>>>> - - - - - - - - - - - - - - - - -
>>>>> Marko Papic
>>>>> Geopol Analyst - Eurasia
>>>>> STRATFOR
>>>>> 700 Lavaca Street - 900
>>>>> Austin, Texas
>>>>> 78701 USA
>>>>> P: + 1-512-744-4094
>>>>> marko.papic@stratfor.com
>>>>
>>>>
>>>
>>
>