Thread by @Dry_Observer

@thespybrief I don't know how much will come out as counterintel dredges vast reams of new evidence - obviously, as I'm not in that world - but arguably *every* nexus of either data points or potentially critical intelligence/crime/terrorism is a key point to review as more data surfaces.

@thespybrief Short version: We have immense data processing resources and more evidence surfacing as various players have to confess everything they know.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM But even if our IT resources increase exponentially - even with post-zetascale or quantum supercomputing - *starting* with narrower data sets or cases crimes gives us a focus small enough to actually work with.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM Also, the @FBI doesn't investigate everything & everyone, they investigate crimes with cause. The @NSAGov is interested in intelligence, not domestic crime which doesn't fall under their purview.

So narrowing the initial focus isn't just logical, but necessary.
cc: @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM What should be terrifying to assorted conspirators and transnational organized crime is that the @FBI handles counterintelligence as well as other crimes, and welding all of these conspiracies, intelligence operations and criminal organizations together...
@NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM With vast evidence sources - bitcoin/cryptocurrency, botnet archives of criminal/intel activities, Darknet black market sites including the transmission of illegal pornography, child rape evidence traded in those operation in a criminal conspiracy extending statutes...
cc: @FBI

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury #FinCEN data on money laundering through Cypriot banks, #DeutscheBank, real estate, Tidal & other micropayments, gaming apps, etc...
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury Is they end up with accessible, integrated databases of evidence, much from the public domain, which can be parsed by sensitivity - sources and methods restricting some material to counterintel, and some evidence only being available to investigators/prosecutors involved.
@FBI

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury Yes, ultimately unlimited quantum search via Grover's algorithm (and quantum decryption via Shom's) can be employed.

But in the meantime, you have an increasing integrated meta-database with overarching information and increasing levels of access.
@FBI

https://twitter.com/Dry_Observer/status/1161053693241942019

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury Better still, you don't have to get remotely full access to use much of this.

Any nation in the world could use the archived tweets through 2017 in the US Library of Congress in concert with bitcoin and other cryptocurrency logs & data like hashtags...
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury To do a basic assessment of the illegal-influence networks on social media targeting themselves, their allies and even their adversaries and neutral parties.

Imagine what greater access and literally owning most other critical databases implies.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury Remember, this isn't all new to investigators.

Inevitably, there will be tools assembled for every aspect of law enforcement & counterintel.

But also realize there's plenty of evidence criminals seem oblivious to. So there's no rush to explain it.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury Oh, and then there's the simplest means of rooting out intelligence and other moles directly.

Which has a few larger implications.
cc: @FBI @NSAGov @US_CYBERCOM @ericgarland

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Briefly, as I've said before, the US can impose a total lockdown of any aggressor's economy, but the worst part is we can lift that total sanction on *everything* for a mere pittance - a virtual gift, even.

For every intel operative & leader involved in this assault.
cc: @FBI

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Now, that might sound like a death sentence for many of those involved, if we get to that point.

But it all depends on the application of such an absolute sanction.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland The @USTreasury can block any financial institution in the world from being countersigned by any US bank - effectively cutting them off from the *entire* global banking system.

This is death for a bank, and lethal for most businesses.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland An entire country could be cut off from the global economy, though this is a very powerful weapon, not to be used lightly.

But what if it were not only held in abeyance if the nation in question disavowed and handed over the operatives, etc involved?
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland What if we provided a final list of who we needed...

& made it clear sanctions would be applied if they were not all handed over by the deadline, *but*...

That deadline could be extended by a set amount for each individual they did hand over. *Alive.*
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Facing the likelihood of complete economic destruction and an intelligence apparatus which was thoroughly compromised in any event, steadily failing and responsible for a catastrophic and ongoing strategic implosion...
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland The pressure to send at least the lowest-level, least-valuable people would become irresistible, if only to buy time.

But as each one was handed over, the cost of handing over the next would diminish accordingly.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Would there be attempts to sow false information, to accuse innocent targets, or increase scrutiny on known leaks or weakness to distract from others?

Of course. That goes without saying.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland But the advantage in multiple *unknown* evidence sources is that it becomes hard enough to get your stories to align with the increasing deluge of data you *do* know is there, much less the information you had no idea existed in the first place.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Translation:
It's reasonable for *every* mole in the US government *and* the governments of our allies to assume they'll be outed in due course.

That operations heretofore unknown will come to light, at least for counterintel.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Some less guilty nations with closer commercial ties to the West will undoubtedly attempt to negotiate.

Consider, though, that removing a swath of spectactularly failed intelligence personnel may have its own logic.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland A successor government may want to purge some people from its intelligence services, or to find scapegoats for an ongoing crisis.

Other countries may want to literally disavow the entire operation & its participants rather than spiral into utter defeat.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Some of this could be handled quietly.

Defections, arrests, etc.
@FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Remember also, the vast number of data points which may indicate illegal deep-cover operatives in Western countries, utterly exposed to big data searches.
cc: @FBI @NSAGov @US_CYBERCOM

https://twitter.com/Dry_Observer/status/1013115340891590658

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland In concert with, again, vast emerging evidence sources, it becomes impossible for anyone outside to determine if a mole or operation was exposed by a cooperating prisoner or defector, compromised communications, or various new sources of evidence.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Oh, and my point that there is yet more to be exposed, in terms of major evidence sources?

See the above thread as an example.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland One final word about increments of delay...

These can range from day to 3 to a week or 2, as appropriate.

If you're a former ally with 15 people of interest trying to disavow the situation, 2 weeks per live handover may work perfectly.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Two people equals nearly a month. Half the list is almost four. By which time you may have managed a diplomatic rapprochement.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Then again, let's say you're Russia and there's exactly 1,500 people of interest, and you get a delay on absolute sanctions of 1 day per 2 live handovers.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Even if you're not a successor regime to the present government, the least valuable 1/3 of that list may be worth far less to you than 250 additional days to prepare for sanctions on that scale.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland And from there, it's only 60 more for each month of breathing room.

The calculus shifts with each change, and makes a true rapprochement more persuasive with every step.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Meanwhile, it becomes impossible to discern which of the people handed over may have shared secrets, or inadvertently revealed them, especially when many of those secrets likely came from other sources as well.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland And as matters become further unraveled, cases which could have never been prosecuted because of sources and methods become ironclad due to all of the evidence and testimony which *can* be shared.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Oh, and need it be said?

If a nation tries to hedge by handing people over to delay matters, but conveniently kills off a few people on the list after receiving it, there are a number of options.

Including specifying two replacements for each loss.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Or increasing targeted sanctions substantially, even if cooperation is at least sufficient to warrant withholding an absolute sanction of the entire national economy.
cc: @FBI @NSAGov @US_CYBERCOM

@thespybrief @FBI @NSAGov @US_CYBERCOM @USTreasury @ericgarland Or checking our list twice against other major "initiatives."

Brexit, 9/11 shortselling, subversion or downed airlines in Ukraine, etc.

I'm sure we can think of a couple of things, if we have to.
cc: @FBI @NSAGov @US_CYBERCOM @GCHQ @AIVD