IBC Threat Assessment August 2015


This month’s Threat Assessment includes:

  • Joint Investigative Mechanism (JIM) established to determine perpetrator(s) of alleged chemical attacks in Syria but nothing is being done to stop the campaign with the most devastating conventional barrel bomb attacks
  • Insufficient and failing protocol for irradiation of live anthrax at US military laboratory main cause of the shipments of specimens containing live spores to other laboratories
  • Reducing the risk of the use of a dirty bomb by replacing high-risk radiological sources with less dangerous alternatives
  • Recent commercial satellite imagery shows that North Korea may expand and upgrade elements of its nuclear infrastructure in Yongbyon and Pyongsan
  • The proliferation of a newer and more advanced generation of Russian and Chinese MANPADS to Libyan insurgent groups may have a negative impact on aviation security in North Africa


Joint Investigative Mechanism (JIM) established to determine perpetrator(s) of alleged chemical attacks in Syria but nothing is being done to stop the campaign with the most devastating conventional barrel bomb attacks

Increasing international pressure triggered an informal UN Security Council meeting on June 26 with a focus on the use of barrel bombs in Syria. According to the Syrian Observatory of Human Rights a total of 11,324 barrel bombs have been dropped since June 2014, causing the death of 3,602 civilians and 1,816 members of opposition groups. Another 23,000 civilians were injured. During the recent month of Ramadan a total of 5,026 people were killed including 1,220 civilians. A total of 576 civilians (including 148 children and 222 women) were killed in airstrikes carried out by the air force of the Syrian regime.

Berto 1During the June meeting Syrian representatives called for measures to stop the indiscriminate attacks. The UN Security Council was blamed for not implementing its February 2014 resolution that calls for an end to indiscriminate use of weapons in populated areas, including barrel bombs. The Syrian representatives again pledged for the initiation of a no-fly zone to stop the dropping of barrel bombs from government helicopters. Recently the media have reported on the use of ‘container’ bombs that are several times more destructive than barrel bombs.

In a number of cases chlorine was reportedly added to the barrel bombs. The US-based charity Syrian American Medical Society, that runs a number of medical facilities on Syria’s frontlines, plays an important role in the collection of samples after chlorine attacks and smuggling them across the border to Turkey for further analysis. Eighteen incidents of chlorine attacks have been documented since the adoption of the UN Security Council resolution banning chemical weapon attacks.

Zaher al-Saket, a Syrian general who defected and was part of the chemical division of the Syrian army, claims he is investigating a total of 90 incidents of chlorine attacks, including six new ones in the past few months.

An interview with a captured government pilot detailed various aspects and shortcomings of the air campaign by the Syrian government. In the interview colonel Ali Aboud stated that 90 percent of the Syrian air force helicopters had either crashed or had been destroyed leaving only 45 of them operational. He also stated that iPAD apps are being used to help in the targeting of the barrel bombs and assure accurate results. Helicopter pilots usually fly at 5 km close to the maximum altitude of the aircraft to avoid air defenses. There are numerous flight navigation apps in the Apple App store that could be helpful in improving the accuracy of the combat operations.

Last March the UN Security Council approved a US-drafted resolution that condemns the use of toxic chemicals such as chlorine in Syria, and threatens further measures including sanctions in the case of violations. After the June meeting on the barrel bomb tactic the US submitted a draft resolution calling for the establishment of a Joint Investigative Mechanism (JIM) to determine the perpetrator(s) of the alleged chemical attacks. The draft resolution was discussed during July. After the US and Russia came to an agreement resolution 2235 was put to the vote on August 7 and unanimously adopted.

Within 20 days after the adoption of the resolution the terms of reference for the JIM have to be determined and agreed. A joint committee consisting of experts from the UN and the OPCW will file its first report within 90 days. Secretary-General Ban Ki-moon has to report on its progress to the Security Council once a month. The investigative body will identify entities, groups or governments who were perpetrators, organizers, sponsors or otherwise involved in the use of chemical weapons in Syria in instances where the OPCW fact-finding mission had determined that an incident involved or likely involved the use of chemical weapons. (see IBC Treat Assessment of June 2015)

It is not known whether the JIM will only investigate already reported attacks and investigated by the OPCW fact-finding mission. There have been media reports on new chemical attacks since the last OPCW FFM report was submitted and discussed. The Kurds reported that its People Protection Units (YPG) positions near the town of Hasakah had been attacked on June 28 with ‘makeshift chemical projectiles’ fired by Daesh. Another attack was reported in Tel Abrak where several shells struck in agricultural fields near three buildings used by the YPG. The type of chemical had not been definitively determined. In August media reports indicated that Daeash was transporting chemical substances to a town close to Hasakah that allegedly were intended for an attack on Hasakah, which has been the scene of intense fighting in July and August.

The British organization Conflict Armament Research (CAR) investigated fragments and tested exposed YPG fighters in a hospital in Qamishli. Fighters exposed to the chemicals experienced burning of the throat, eyes and nose combined with severe headaches, muscle pain and impaired concentration and mobility. Prolonged exposure to the chemicals also caused vomiting. The exposed fighters tested positive for PH3, a phosphine-based chemical used as an insecticide or fumigation compound. The tests were not definite as no direct samples of the substance in the shells had been independently gathered.

The Kurds interpreted the discovery of industrial-grade gas masks with Daesh fighters as a sign of preparation for chemical warfare along the front line. It is assumed that the first documented attack in Syria with a projectile-delivered chemical agent has been a test run. Reports about transport of additional chemical substances may indicate that the organization has intentions to step up the chemical attacks. Daesh has been experimenting with different designs using improvised munitions and fill them with chemicals that are available to them. Phosphine is an agricultural chemical that would be available in farming regions in northern Syria and is used for fumigating stored grains.


The establishment of a Joint Investigative Mechanism (JIM) is a positive development. For the first time an investigative international panel will determine the perpetrator(s) of the reported chemical attacks in Syria. Resolution 2235 does not include an automatic punishment mechanism. For punitive measures a new resolution will be necessary once the perpetrators have been identified. Russia cooperated with the establishment of the JIM but it is not guaranteed that it will also agree with punitive measures against the Assad regime. Russia’s position is that the Assad regime should be involved in the joint struggle against Daesh, a position that the United States has been avoiding.

The JIM will have no immediate effect on the ground in Syria. It will take more than three months before the first JIM report will be available. Syrian monitoring groups report almost daily new barrel bomb attacks by the regime in numerous provinces with devastating effects on the population. Until now the international coalition has been unwilling to establish a no fly zone and directly confront Syrian regime planes or helicopters. It is only willing to provide air support for coalition trained opposition groups that engage Daesh fighters near the border with Turkey in the hope that this may result in a safety zone and will cut off Daesh supply lines.

It cannot be excluded that cornered Daesh fighters on the frontline may step up their attacks with chemical filled artillery shells. Air support operations by the coalition in a relatively small safety zone on the border with Turkey will have no effect in the rest of the country where the Assad regime is allowed to continue its conventional barrel bomb attacks on populated areas with devastating effects.









































Insufficient and failing protocol for irradiation of live anthrax at US military laboratory main cause of the shipments of specimens containing live spores to other laboratories

Since 2003, anthrax samples were sent by mail from the Dugway Proving Ground military laboratory in Utah, to 86 commercial, academic and federal laboratories in the United States and seven other countries, including Australia, Canada, Germany, Italy, Japan, United Kingdom and South Korea. While it was believed that the anthrax had been sufficiently inactivated it was found that they still contained live spores. The samples had been shipped in liquid form and reportedly had extremely low concentrations of anthrax spores. There were no connected illnesses, but at least 21 people who had direct contact with the spores were treated with antibiotics as a precaution.

Berto 2Inactivated anthrax is shipped to other laboratories to help develop medical countermeasures to protect troops in the event of an attack with biological weapons like anthrax. Four American defense facilities are allowed to ship inactivated anthrax to other laboratories but are using different inactivation protocols. An internal defense department investigation found that the insufficiently inactivated samples that were discovered all came from the Dugway laboratory.

Since 2003, the Pentagon laboratories irradiated or killed a total of 149 batches of live anthrax spores, and declared them safe for subsequent testing. A total of 53 batches were no longer in the Pentagon’s possession and could not be tested. Of the other 96 batches that were in the Pentagon’s possession, 17 had tested positive for live anthrax. They originated from the Dugway laboratory and accounted for more than half of Dugway’s total inventory of 33 batches. The inactivation procedure used at Dugway was found to be failing. The batches were not sufficiently irradiated. Subsequently they were not sufficiently tested afterwards to see whether there still were live spores existing.

The internal investigation found that the broader scientific community lacked the technical information to guide the development of effective protocols for inactivating anthrax spores. As a result each defense laboratory developed its own protocol. Dugway’s protocol clearly failed.

The US Defense Department took full responsibility for the failures and has promised to implement changes. It also recommended the establishment of procedures, processes and protocols that will prevent such a biohazard safety failure from ever happening again. Until a set of standards has been developed for the handling and inactivation of anthrax and other spore-based pathogens there will be a complete moratorium of the production and transport of anthrax.


After the internal investigation the DoD has promised that it will set up a standard protocol for all its high-safety facilities dealing with spore-based pathogens. Until this measure is implemented a moratorium on the shipment of anthrax samples to other laboratories will be maintained. What has not become clear from the internal investigation is why inactivated anthrax had to be sent to other laboratories. Some experts argue that there is no legitimate military or civilian purpose that requires inactivated anthrax from fully virulent strains.

Some observers raised the question why Dugway had not been closed for its failing procedures after having caused a serious biohazard. There will however be an additional investigation into the role of the Dugway leadership and there may be personal consequences.

The internal investigation found that there were 53 irradiated batches of anthrax that were no longer in the Pentagon’s possession and could not be tested. The report said that the recipients of these batches had been informed to destroy them. There is, however, no guarantee or check that this is actually been done meaning that these batches can still be around.


















Reducing the risk of the use of a dirty bomb by replacing high-risk radiological sources with less dangerous alternatives

Two decades ago the International Atomic Energy Agency (IAEA) set up a data base on incidents of missing and unauthorized use of nuclear and radioactive materials. A total of more than 2,500 incidents have been reported by member states and added to the Incident and Trafficking Database. The ITD covers incidents of theft, sabotage, unauthorized access and illegal transfers. Annually more than 100 incidents are reported and most cases involve unauthorized activities.

Some recent examples of incidents with radiological materials are the following:

Berto 3During its campaign in Iraq Daesh reportedly has obtained radioactive materials from captured hospitals and research facilities, with the alleged aim of developing a dirty bomb. The Iraqi government has appealed to the United Nations for international help to reduce the threat in this regard.

Over the past months there have been several cases of theft of quantities of iridium-192 in Mexico. Most of the material that is used in industrial radio-graphics, was recovered after intensive police search operations.

In March, a quantity of cobalt-60 was stolen from a factory in Poznan in Poland. Police recovered part of the material that was buried in a forest. It is not known whether the thieves had any malicious intent.

In March, a radioactive cobalt-60 capsule went missing from the Pomina 3 steel plant in the province of Ba Ria-Vung Tan in Vietnam. The incident was discovered after a radiation safety employee was replaced.  He was not able to account for the missing capsule.

In April, a Japanese activist landed a small drone with a bottle of radioactive sand on the roof of the office of Prime Minister Shinzo Abe. The action reportedly was related to the disapproval of a large section of the population to the government’s reliance on nuclear energy.

In July, the Ukrainian intelligence service USB claimed that pro-Russian rebels in Donbas are developing a dirty bomb after having extracted radiological sources from a Soviet-time nuclear waste bunker at the Donetsk state chemical plant. The rebels reportedly cooperated with Russian experts. The underground bunker allegedly contains cesium, cobalt, strontium-90 and yttrium-90. The rebels have denied the accusations and have invited OSCE monitors to inspect the nuclear waste bunker.

In early August, Ukrainian security service USB detained four suspects in Ivano-Frankivsk. They attempted to sell about 5 kg of uranium -238 to an unknown client. The incidents in Ukraine may be part of the intense propaganda war to blame each other. They have, however, triggered a debate on the likelihood of a so-called false flag operation and what effect such an attack could have on the development of the conflict.

Some states have done experiments to find out the consequences of a dirty bomb attack. Over a period of four years the Israeli IDF has executed a number of experiments in the Negev desert with dirty bombs. As part of the Green Field project some twenty devices laced with radioactive materials were detonated after which the effects were observed. In the Red House experiment a radioactive substance was left in a crowded public space but not exploded. A radioactive material was mixed with water in the ventilation system of a building that simulated a shopping mall. It was found that such an attack would not be effective, as a majority of the radiation would remain in the air conditioning filters. The IDF concluded that a dirty bomb attack poses little physical danger beyond the conventional blast. The real danger of dirty bombs lies in the psychological and economic effects. That is the main reason why they are described as weapons of mass disruption.

Sixteen radiological materials have been identified as high-risk. Five of them are widely applied and relatively easily available. They are cesium-137 (widely used commercially), cobalt-60 (food and blood irradiation, teletherapy and branchytherapy), iridium-192 (industrial radiography), americium-241 (for calibration and gauges) and americium-241/beryllium (well-logging, moisture detection).

The risk of the abuse of the high-risk radiological sources for terrorist purposes has been an international concern for quite some time. Recently a detailed road map was drawn on how this risk can be reduced by gradually replacing these high-risk radiological sources with less dangerous alternatives. Starting with a focus on cesium-137 the replacement could be gradually expanded to other high-risk radiological materials. The roadmap describes six concrete steps that are required with a timeline of ten years. One of the main hindrances with adopting alternatives is the cost. It has been argued that this is misleading as apparent cost advantages, maintenance and upkeep figures do not take into account the costs associated with security measures, liability and decommissioning. It has been argued that the alternatives for cesium-137 do not carry these hidden costs and in certain instances prove more useful.

It is argued that the cost of inaction is greater than the cost of conversion. Governments working with industry can make great strides toward replacement by following the suggested roadmap. Although the timeline in the proposed roadmap is primarily focused for a national replacement strategy it is emphasized that simultaneous international cooperation on these matters is needed.


As the Israeli experiments have demonstrated, dirty bombs are mainly weapons of mass disruption due to their psychological and economic effects. Depending on the type and quantity of the radiological source used in the bomb, cleanup costs can run in to the billions of dollars, if the bomb is exploded in an economically significant urban area. While there have been repeated reports about organizations having intentions to develop a dirty bomb, actual attacks have been minimal until now.

Sometimes organizations have been bragging about their capabilities to instill fear in their opponent, in other cases they just did not have the technical skills. The situation is likely to change when state support is involved or when former high-skilled state agents defect and join terrorist organizations. In failed states or chaotic conflicts organizations terrorist organizations may also have better opportunities to gain access to radiological sources by looting state institutions or nuclear waste storages.

From this perspective the idea of gradually replacing high-risk radiological sources by less dangerous alternatives is a good idea. It will, however, take many years as the suggested roadmap has pointed out and needs significant government leadership and investment. Under the current economic crisis conditions governments are likely to give priority to other pressing issues. They probably will only change their mind after having seen and experienced the effects of a first serious attack with a dirty bomb.






































Recent commercial satellite imagery shows that North Korea may expand and upgrade elements of its nuclear infrastructure in Yongbyon and Pyongsan

Berto 4Recent commercial satellite imagery indicates that North Korea continues with construction activities at its Yongbyon nuclear complex. It appears that it is building cells for the assembly of high-explosives of a nuclear weapon and that it may be running a second hall of uranium enrichment centrifuges. The reactor in Yongbyon is believed to have provided weapons-grade plutonium that was used for the three nuclear tests that were conducted in 2006, 2009 and 2013. North Korea’s nuclear arsenal is estimated to contain 10-16 nuclear weapons and is expected to expand in the coming five years. Recent reporting indicates that it may already have more than 20 nuclear weapons and that the arsenal is growing faster than expected. Satellite imagery of the uranium mine in Pyongsan indicates that North Korea may expand its production capability of yellowcake

An expert report published earlier this year described three possible scenarios for North Korea’s nuclear future. In the low end scenario with a focus on a policy of assured destruction the arsenal would remain at about twenty nuclear weapons. A mid end scenario with about fifty nuclear weapons would allow for the use of nuclear weapons in conflicts in the region. In the high end scenario the arsenal would expand to about hundred nuclear weapons. This would not only assure retaliation against the US but would also allow for threatening with first use in conflicts in the region and lowering the threshold for the use of nuclear weapons. By miniaturizing and diversifying its arsenal North Korea hopes to increase the accuracy of its weapons. This would allow for greater flexibility and would expand its capabilities. It is expected that a smaller nuclear weapon eventually can be mounted on its KN-08 intercontinental missile.

The general goal of the UN sanctions based on UN security council resolutions 1540, 1695 and 1718 is to prevent North Korea from conducting further nuclear tests and launching ballistic missiles. Reporting on the implementation of the sanctions indicates that the North Korean government has demonstrated an ability to endure the sanctions by developing multiple and tiered circumvention techniques.

In 2012, the North Korean government adopted a constitutional amendment declaring the DRPK to be a nuclear weapon state. Pledges by the UN Security Council to refrain from a new series of tests and provocations were ignored. It continued with the development of a key nuclear facility at the Yongbyon site and there are strong suspicions that it has not disclosed all of its nuclear facilities, particularly uranium enrichment sites. Because of the fact that it sees itself as a declared nuclear weapon state, the North Korean government has indicated that it is not interested in an Iran-style disarmament deal. Pyongyang will not accept any preliminary conditions on talks. It is ready to discuss anything except its unilateral disarmament.

In 2008, North Korea walked away from the six party talks (6PT) with South Korea, the United States, China, Japan and Russia, on its denuclearization. Attempts to persuade Pyongyang to return to the negotiation table have failed since then. At the recent talks of the Northeast Asia Peace and Security Mechanism held in May, the participants agreed that the 6PT idea was still very much alive. But as long as the parties continue blaming each other for the stalemate and wait for others to come up with initiatives for a restart, not much progress is to be expected. China has been very active to counterbalance the US influence in the region with its One Belt, One Road (OBOR) initiative, a development strategy and framework with a focus on connectivity and cooperation among countries primarily in Eurasia.

The US remains focused on a policy of containment including covert cyber warfare. Five years ago the American National Security Agency (NSA) reportedly attempted to sabotage North Korea’s nuclear facilities digitally in Operation Olympic Games.  The US may have tried to get to North Korea by compromising technology imported from Iran, Pakistan or China. The attempt failed and the American cyber warriors were not able to reach the highly isolated computer systems that help run the nuclear program and its various components.


The North Korean government views its nuclear weapons program primarily as a means of ensuring the survival of both the nation and the regime. It is not expected to give in to international demands for complete, verifiable and irreversible denuclearization. The mistrust on all sides makes reconciliation and negotiation very difficult.

The nuclear program is not only seen as an effective deterrent and coercive tool but is also seen as an instrument to implement its Byongjin policy with a focus on nuclear capabilities and economic development. It remains therefore unlikely that the Pyongyang government is willing to sacrifice its security needs in return for greater international acceptance. As long as it is able to endure the international sanctions it will only be possible to gain limited concessions for financial and/or political rewards. As the recent satellite imagery indicates the country probably will continue to gradually expand and upgrade elements of its nuclear infrastructure. It is, however, hard to determine whether this is for the production of electricity or the production of highly enriched uranium that could be used for nuclear weapons.

If North Korea is indeed having the future objective of creating a position in which nuclear weapons could be used as a means to deter and repel lower levels of aggression in the region, it would not only have to overcome a number of technological and organization challenges but also significant political and psychological barriers as the weapons could possibly be used against Korean people.































The proliferation of a newer and more advanced generation of Russian and Chinese MANPADS to Libyan insurgent groups may have a negative impact on aviation security in North Africa

Researchers of the Small Arms Survey recently concluded an extensive investigation into the fate of the thousands of MANPADs that were looted from Libyan government arms depots in 2011. They found that nearly all the MANPADs documented in Libya were first generation Strela-2 pattern systems and that the majority of them were past their shelf life. Many of the looted MANPADs were also handled roughly and not stored in the right way, which has an impact on their usefulness. Most armed groups in the region lacked the technical skill and knowledge to find out whether the stolen MANPADs were still functional and could be effectively used in attacks against aviation.

Berto 5It was also established that the total number of MANPADs in the Libyan depots during the looting, was probably lower than the number based on reported import statistics, due to testing, retransfers and use in combat and training exercises. A UK government official came up with an estimate of 3,000 to 13,000 missile systems that were not accounted for. In early 2014, UN investigators had reported that thousands of MANPADs were still available in the arsenals controlled by a wide array of non-state actors in Libya. There have been reports on trafficking of Libyan MANPADs to nine countries, including Algeria, Chad, Egypt, Gaza, Lebanon, Mali, Niger, Syria and Tunisia. These reports are hard to verify as they mostly originate from unnamed officials. A UN panel was, however, able to confirm that launch tubes recovered in the Central African Republic, Lebanon, Mali and Tunisia, originated from shipments to Libya, by comparing lot and serial numbers.

The proliferation of Libyan MANPADs from the government arms depots did not have a significant impact on attacks against aviation. Since 2011, there are no documented attacks on commercial airliners in North Africa. Reports of MANPAD attacks on military aircraft are limited to a handful of incidents in Libya and Egypt. Due to the establishment of a no-fly zone during the civil war in Libya, attacks with MANPADs could be kept to a minimum.

The situation may change as insurgent armed groups in the North African region may gain access to a newer and more advanced generation of MANPADs. More advanced Russian (Igla-S) and Chinese (FN-6) MANPADs reportedly are in the hands of armed groups in Syria and Iraq and may proliferate to North Africa. There is concern about authorized transfers of advanced MANPADs to the governments of Iraq and South Sudan and the plans of Sudan’s Military Industrial Corporation to produce MANPADs. The proliferation of these more advanced MANPADs to insurgent armed groups in Libya, are an immediate threat to aircraft in Libya and a potential threat to military and civilian aircraft throughout the North African region.


The recent Small Arms Survey report provides a more realistic threat assessment posed by the MANPADs looted from the Libyan government arms depots and currently in the hands of non-state actors. The organization not only provided a more realistic estimate of the number of MANPADs looted but also provided plausible explanations why they were not used in a more significant way against aviation in Libya and beyond. In only four countries recovered launch tubes could verifiably be traced to Libya.

As the threat to aviation from the first generation Strela-2 pattern type MANPADs may have been limited, the Small Arms Survey warns of the more serious treat posed by the newer and more advanced generation of Russian (Igla-S) and Chinese (FN-6) MANPADs. Proliferation of these types of MANPADs to Libya would pose a significant threat to aviation in Libya and if not addressed in the right way can even have consequences beyond North Africa.



















Previous articleDeployable Diseases, Detection and Diagnosis: Collaboration in Outbreak
Next articleMedical Countermeasure Planning: An Introduction
Berto Jongman (1955) majored in western sociology at the University of Groningen in 1981. He began his academic career at the Stockholm International Peace Research Institute (SIPRI) in Sweden. From 1982 to 1987 he worked as a researcher at the Polemological Institute of the University of Groningen where he participated in a project on early warning of armed conflict and political violence. In 1987 he moved to the University of Leiden where he acted as data-manager of the Project on Interdisciplinary Research on the Root Causes of Gross Human Rights Violations (PIOOM). In 2002 he moved from academia to government. From early 2002 to late 2012 he worked as a senior terrorism analyst for the Dutch Ministry of Defence. During this period he participated in a number of Advanced Research Working Groups of NATO, e.g. on radicalization, cyber crime/terrorism and the use of Internet by terrorist organizations. A large part of his work at the Ministry involved terrorist threat assessments, including the quarterly assessment of the terrorist threat to the Netherlands for the NCTV. He left the Ministry of Defense in late 2012 and is currently active as a consultant in the area of CBRNe.