[iwar] [fc:Anthrax.Notes-Analysis]

From: Fred Cohen (fc@all.net)
Date: 2001-10-26 21:12:18
Next message: yangyun@metacrawler.com: "[iwar] Taliban gains ground"
Previous message: Fred Cohen: "[iwar] [fc:Work/Intel.groups.-.interesting.request.(anonymized...)]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200110270412.f9R4CJf09288@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Fri, 26 Oct 2001 21:12:18 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Anthrax.Notes-Analysis]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

Subject: [...] Anthrax Notes-Analysis

Hi all,

I have had several requests to put out our analysis for review by all of
you.  To say the least that is a bit intimidating.  Seventeen hundred
plus experts looking over one's shoulder is not especially calming. 
But, I, now that I have had the chance to look over the Anthrax notes,
and came to a conclusion I had thought unlikely, I am interested in
having you shoot as many holes as possible in my analysis.  Just don't
be too nasty. 

My primary purpose in doing the analysis was to determine if the Anthrax
Notes were directly related to the 911 events, and to identify
indicators to support whatever position I assumed after the analysis. 

Please keep in mind that the conclusion at the end is not in concrete
and that none of the answers to the questions below are sufficient to
draw any conclusions by themselves.  I do believe that the preponderance
of evidence (meaning 50.1% or more) makes it more probable than not that
our conclusion is more likely than not to point us in the right
direction.  (Boy, I opened myself up on that one.)

The following is the thought process of G.  Brown &amp; Associates:

1.  Why were there notes sent in the first place re.  The Anthrax
incident and not sent re.  the 1993 and 911 events, which were believed
to be OBL funded and perhaps guided in some way?

2.  Why are the notes dated in the American way vs.  the Middle
East/European way?

3.  Why were the dates on both notes reflected as 09-11-01 when one note
was posted Sept.  18 and the other October 9? (Source: AP article by
Karen Gullo, in papers 10.24.01 titled: "Officials release copies of 3
letters.")

4..  What is the most important goal in these notes to the writer(s) and
what does that tell us about the motives of the writer?

5.  What other clues can we find in these notes?

Let's take them one by one:

1.  Why were notes sent on the Anthrax events and not the 911 events?

One obvious answer might be that the events were conducted by different
groups, but can we trust the obvious? The 911 WTC/Pentagon events were
well-planned, sophisticated operations apparently in the planning for
perhaps years.  If, as many seem to think, the 911 events were the work
of the same people (the planners) as the 1993 WTC bombing why would
their MO change for the Anthrax part of their operation? .  Why, if they
are the same planners running a sophisticated follow on operation would
they feel the need to send a note about the Anthrax? Why not continue in
the same MO? There are other questions to be asked and answered, but
this was enough for us to initially wonder if this was the same group. 
Now could we find supporting evidence one way or the other?

2.  Why are the notes dated in the American way vs.  the Middle
East/European way?

This could be a simple attempt to disguise who the note really came
from.  But, then why would the same mind that planned the WTC/Pent. 
events feel a need to disguise where the anthrax came from? Are they
interested in "persuading" us the attacks were US originated, when they
were willing to let governments think they did the WTC/Pent.? No, we
think it more likely than not, especially after some later comments,
that this was "natural" and not an attempt to disguise the origin of the
anthrax attacks.  The problem with the dates most likely didn't even
enter the mind of the writer.  (Yes, of course, it could have been a OBL
type who has been in the USA for a number of years and become acclimated
to US customs.  But, I think it more likely that if the date were of
concern to the OBL types, they would, under stress, etc., be likely to
revert to their way of doing things, especially in a note to the
American Devils. 

3.  Why were the dates on both notes reflected as 09-11-01 when one note
was posted Sept.  18 and the other October 9?

We felt that not only was the 09-11-01 a natural order for the writer to
reflect the date, but was an attempt to "tie together" their event with
the 911 event.  One of the things that was noted is that the dates on
both notes appeared, from the poor copies I had, to be the largest
writing on the page.  These notes also appeared to be more of a listing
of goals to us and the date was just another part of the listing of
items in the note.  (Even though it wasn't directly in line with the
other items in the list.) Form Variance Analysis™ reveals that when one
has a listing of items, such as numbers, names, goals, etc., that the
order and size gives us clues as to the importance of the items to the
writer.  (Some people do argue that the smaller writing reflects those
things that are most important because the person is focusing intently
on those items.  I disagree, particularly in this case in its totality.)
That drew us to the conclusion that the most important thing on that
page for the writer to convey or "convince" the reader was that this
whole thing was related to that 09-11-01 date or events. 

The next question was why, if the Anthrax is part of the 911 operation,
would OBL and company feel it necessary to convince us of anything after
the WTC/Pent.? Why would he or his people want to disguise or convince
anything now? Their MO in the past has been that their actions speak for
themselves, something about which I would agree at this point.  Why
wouldn't OBL assume there was any need to put a date on the notes at
all? Wouldn't we at least consider they were connected with/without the
date being on there? I think an Ego like some of these attachers have,
wouldn't allow them to consider that "we" wouldn't know it was them, if,
in fact, it was them.  (Clear as mud, right?)

It makes no sense to us that the date should be the most important thing
or really of any importance at all in the mind of the writer.  ( But
then again, we are not the best at thinking like terrorists.)

4.  What is the most important goal to the writer as expressed in these
notes? And what does that tell us about the motives of the writer(s) of
these notes?

    If these notes are part of the 911 attack -- only employing a
different weapon-it is reasonable to say that the goals of Death to
Israel and Death to America would likely be their most important goals,
and probably in that order.  (One could, I suppose, argue that an
explanation for Death to America to be higher in the list than Death to
Israel is because the note is being written to Americans.  But, then, if
that is the case, why are both phrases so far down the list? In the
Brokaw note (same as the NY post note) DTA and DTI are number 4 &amp; 5
(if you count the date as #1) and in the Daschle note the DTA and DTI
are numbers 6 &amp; 7, again counting the date as #1. 

"This is next" in the Brokaw note only answers the question on
everybody's mind about what is next.  It doesn't set forth the prime
objective of the writer, if we assume the writer is part of the 911
event.  Since this is the first note of any kind about any of the 911
and subsequent events, wouldn't it make more sense if it is written by
Middle East radical fundamentals to start with either Allah is Great or
Death to America, rather than "This is next"?

Had the notes been written in the reverse order, i.e., Brokaw
Note:-Allah is Great, Death to Israel, Death to America, This is next
and Take Penacilin Now- we would be more inclined to say the note is
consistent with what we assume are the goals of the terrorists.  Allah
is the one demanding that they do these things (in their mind) and
America and Israel are the ones Allah is directing them to kill,
treating civilian and military all as the enemy.  We also noted that the
word "Death" in "Death to Israel" appeared slightly smaller than other
writing on the page.  This would indicate to us that Death to Israel was
the least important item on the list of goals.  We had a tough time
trying to explain how "This is next" and "Take Penacilin Now" were more
important in the mind of a Middle East radical fundamentalist, than
"Death to Israel."

5.  What is the most important goal in these notes to the writer(s) and
what does that tell us about the motives of the writer?

As noted earlier, we believe that if we treat the date as one of the
items listed by the writer(s), the dates become not only the least
important thing in the note, but the most important thing in the note. 

6.  What else can we learn form the phrases in the notes. 

We found two phrases that really were tough to explain, if we were to
conclude these notes were written by Middle East radical
fundamentalists. 

One is the phrase: "Are you afraid?; the second is "We have this
anthrax,' both of whom were in the Sen.  Daschle note. 

Why would "are you afraid" be a question of importance for a fanatic to
feel compelled to ask? And in rank order, it is more important than
spitting out that Allah is Great, Death to American and Death to Israel. 

We have interpreted the phrase "We have this anthrax" to indicate that
"this" anthrax in these notes is all we have.  This might even explain
the psychological need to say "Are you afraid?" The phrase "You die
now." might also be explained as "you had better die now because we
don't have any more anthrax.  If it had said you will die now and many
more will die in the future, or something along those lines, we might
lean another direction. 

Obviously, we don't have a strong degree of confidence in the last
couple paragraphs, but when taken together with all the other
indicators, we do think it indicates that this is not a long planned
sophisticated attack meant to be part of the 911 events. 

We have the following indicators that these notes are not directly
related to the 911 events:

1.  The fact the notes were sent at all

2.  The dates on the note

3.  The size of the dates in relation to other items in the note

4.  The order of listing of items in the note

5.  The size of Death to Israel compared to other writing

6.  Odd questions: "Are you afraid" etc. 

7.  What does "We have this anthrax." mean in the greater context?

 While some of the above, perhaps all individually, can be interpreted
in different ways, we believe that taken together these indicators seem
to us to point to these notes not being part of the 911 event. 

However, if we assume our theory that these notes are not directly
connected, other than trying to take advantage of the situation and
throw off suspicion from local militia or other US origin terrorists,
most of our questions are answered. 

Of course, there is the question: Did we ask the right questions?

Your comments please. 

Were we tainted? We don't think so, because, if anything, we were
tainted to assume it was part of the grand scheme/war of what we assume
is Middle East radical fundamentalists.  We came to the opposite
conclusion of what we naturally assume to be the case. 

We think it is more likely than not (at least 50.1%) that the Anthrax
notes to Brokaw and Daschle were from other than the mind of the same
people who crashed airliners into the WTC and the Pentagon. 

if you find a lot of holes in this theory, write me privately so I am
not too embarrassed.  (Yes, I know, that is highly unlikely to happen. 
;-)

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Pinpoint the right security solution for your company- Learn how to add 128- bit encryption and to authenticate your web site with VeriSign's FREE guide!
http://us.click.yahoo.com/yQix2C/33_CAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: yangyun@metacrawler.com: "[iwar] Taliban gains ground"
Previous message: Fred Cohen: "[iwar] [fc:Work/Intel.groups.-.interesting.request.(anonymized...)]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:57 PST