Original subtitles

of thousands dead, millions displaced.

The Syrian secret police got a lot better

at monitoring social media.

The war is being fought both on the battlefield and online.

If you compromise them,

Assad could come and have them arrested and then killed.

Hackers connected to the Syrian Regime

are targeting the opposition.

ISIS is almost adopting everything

that was successful in Syria.

Sometimes, the consequences are lethal.

Was he a skilled hacker?

Is Syria the model for how future wars will be fought?

♪

As a national security reporter for VICE,

I followed the Syrian War since the beginning.

In 2011, a popular democracy movement

blew up across the Middle East.

It was fueled in part by social media,

became known as the Arab Spring.

Yet Syria was different.

It stayed quiet.

Run by a dictator named Bashar al-Assad,

citizens were terrorized by secret police,

mass surveillance, torture,

and barely had any access to the internet.

Amidst protests in nearby countries,

the Assad Regime made the mistake of restoring access

to Facebook and YouTube.

Almost overnight, protests exploded across the country.

I needed to talk to someone who was on the streets

when protests first went down.

Three weeks after I got there the street protests began,

and that quickly overshadowed everything else we were doing.

Robert Ford was the last US ambassador to serve in Syria.

So when he did open up the internet,

it couldn't have just been for benevolent reasons.

There must've been also a surveillance aspect to it.

When the revolution in Syria started, initially I don't think

the regular foot police and secret police goons

really understood what social media was.

I met once with a protestor, and he was detained.

This was in the suburbs of Damascus.

When he was taken to the secret police station,

they went through his backpack in front of him.

And they were taking everything out, and they said,

"Where is the Facebook? Where is the Facebook?"

As if it was like a book with pages.

So that was early on.

As time went on, the Syrian secret police got a lot better

at monitoring people's computers and monitoring social media.

Protests continued, but Assad wouldn't cede his power.

Instead, he sent soldiers to try and quell the uprising.

The world watched the bloody crackdown play out on YouTube.

Dlshad Othman was uploading videos to YouTube and Facebook

during the early days of the revolution.

It made him a target of the government,

and he had to flee the country.

For his safety, we chose an anonymous location to talk.

Video content was the most important content

coming out from Syria.

We've lost a lot of our friends while they were filming.

Snipers targeting people with cameras?

Absolutely.

Snipers targeting people, or checkpoint will stop you

and check what's in your phones.

But was the regime able to crack into Facebook, or at least

hack into it in some way and get some of that information

that would help them crack down on protestors?

Yes, they were able to get a lot of accounts.

They were able to hack into

a lot of Syrian opposition leaders at that time.

And going back to May 2011,

that was the first time when the Syrian government implemented

man-in-the-middle attack

against the SSL certificate of Facebook.

And explain to me what a man-in-the-middle attack is.

The term "man-in-the-middle attack" came because

there is someone in the middle who's trying to attack you.

What the Syrian government did at that time is

they pushed to the users a fake SSL certificate.

Now, SSL is actually like an envelope and a key.

Key is with Facebook.

Facebook is sending you an envelope to put your data in,

lock it, and then send it back to Facebook.

But the Syrian internet providers,

they received the envelope from Facebook, they replaced it

with another one that they have the key for it.

Their own envelope.

Send it to the Syrian users.

Users, they put their credentials, username,

and passwords and messaging and post and etc. stuff.

They send it back.

Syrian internet providers opened it,

got a copy of data, then send it back to Facebook.

Assad was now using the internet

to expose entire networks of activists.

Once identified, they were often arrested then tortured,

sometimes to death.

The international media exploded with headlines

detailing police crackdowns and tales of torture,

creating a public relations nightmare for Assad.

Soldiers defected from Assad's forces.

Some formed the Free Syrian Army, and the country

descended into a war between rebels and the regime.

But Assad still had his supporters,

some of whom were hackers.

They decided to form a cyber militia.

They called it the Syrian Electronic Army.

Brian Merchant is a reporter at Motherboard,

who investigated the origins of the group.

We met up at VICE's head offices in Brooklyn.

BRIAN: The Syrian Electronic Army

is an activist hacker group.

They're pro-Bashar al-Assad.

They want to reveal the media as frauds,

they wanna reveal the Free Syrian Army as terrorists.

And to do so, they basically institute

a series of high-profile attacks.

So are they just propagandists?

Ultimately that's what their role is,

yeah, is propagandists.

There were mostly website defacements,

but sometimes they had real-world consequences.

The SEA hacked the Twitter account of the Associated Press

and tweeted that the White House had been attacked.

It caused the US Stock Market to dive

until it was exposed to be a fake tweet.

At the top of the militia hierarchy

was a hacker known as Th3Pr0.

Brian received a tip allegedly exposing Th3Pr0's identity.

He contacted him.

I'd been asking him, you know, like we have this information

about you, and we basically can peg you as the leader.

And he got really flustered and angry,

and he denied it in a series of emails,

and he said, "If you reveal me, then you will be hacked.

We will hack VICE."

Brian published his exposé.

Th3Pr0 made good on his word, and VICE was hacked.

I decided to track down Th3Pr0.

He agreed to chat online.

I asked him if the army of hackers

viewed themselves as soldiers.

He said "internet soldier" was the preferred term.

The real soldiers were on the battlefield.

I wanted to know if the SEA

was under the official control of Assad.

Th3Pr0 was adamant that they weren't affiliated

with the government regime, but that they did use

back channels to deliver important intelligence.

Those channels proved to be potentially dangerous

for opposition protestors.

They were capable of collecting a lot of information,

hacking a lot of people.

They published around 11,000 accounts.

They were compromised in different ways.

And then passing this along to the regime?

Absolutely.

We've seen a lot of organizing between them

and the Syrian government, exchanging information between

each other or exchanging targets between each other.

Months after speaking with him,

Th3Pr0, or Ahmed Al Agha as Brian identified,

was indicted for hacking-related charges by the US government.

The Syrian Electronic Army

gained the attention of the world through PR-savvy hacks,

but they weren't Assad's only hacker allies.

BEN: In Syria, what began as a popular democracy movement

rapidly escalated into a civil war.

Assad had responded on the battlefield

with an aggressive campaign of barrel bombs.

Online, the Syrian internet was now infected with malware.

Eva Galperin is a hacker.

She started tracking cyber militias shortly after

the street protests turned into a bloody conflict.

It wasn't long before her research revealed the dangerous

new militia known as the Syrian Malware Team.

They were using the internet to gather intelligence

on opposition forces.

To begin with, there isn't just sort of one Syrian Malware Team.

We were able to track

at least two distinct actors in this space.

These two malware groups were targeting members of the

Syrian opposition, so anybody who was opposed to Assad.

And mostly these were people who were located inside of Syria.

Sometimes in territory that Assad still controlled,

sometimes in territory that Assad no longer controlled,

and sometimes members of the Syrian diaspora,

which became sort of more influential and more powerful

as the conflict has raged on, and more people have left.

And the tools they were using were very different.

Yes.

The malware teams that we were tracking were using

remote access tools like Xtreme RAT, DarkComet, Blackshades.

And something like a RAT, how does it work exactly?

So a remote access tool is a tool that once an attacker

gets you to install it on your machine,

allows them to do anything that you can do on your computer.

So they can log all of your keystrokes,

they can take screenshots, they can see through your webcam,

they can listen through your microphone.

Anything that you're capable of doing, they can do,

and then they can exfiltrate that data back...

back to themselves.

And these remote access tools are very cheap or free,

but they can still get you full control of somebody's computer

if you can get somebody to install them on their computer.

In 2012, Assad's forces used DarkComet

to monitor opposition groups in Aleppo.

They hid the malware in a PDF that claimed to hold

instructions on how to help the city,

which was under siege by the regime.

As soon as the target downloaded the PDF,

the malware was installed,

and Assad's opponents were under surveillance.

These were people that were still in Syrian territory,

and territory controlled by Assad.

And so if you compromise them,

things got very, very dangerous for them because Assad could

come and have them, you know, arrested and then killed.

The cyberspace in Syria now

is ridiculously, ridiculously dirty.

Full of malware, full of phishing,

full of a lot of cyber attacks

that it truly made it an unsafe space for any user.

Different factions looking for intelligence

they can feed to their groups.

They don't care if it's malware.

If it's gonna open a back door in your machine

to some other faction, they don't care.

They just need to get access.

Sounds a lot like the actual war.

It is exactly like the actual war.

It is 100% a reflect for the actual war that's happening.

Soon, DarkComet was used

to further escalate Syria's cyberwar.

Pro-Assad hackers - difficult to attribute

but now all over the Syrian internet - launched an attack

designed to steal battle plans from the Free Syrian Army.

The plans detailed a strategy to retake the town

of Khirbet Ghazaleh, a key city for the rebellion.

Nart Villeneuve was working as a researcher for FireEye

when he first discovered the hack, and he was the

perfect person to tell me how the battle plans were stolen.

There was hand-annotated maps.

Pictures of them were taken with cell phones

and distributed to the fighting units.

Lists of individuals with their names,

phone numbers, whether or not they had weapons.

That stuff is extremely valuable in a conflict zone.

The hack wasn't technically complex.

Instead it relied on social engineering,

a technique where hackers trick their targets

through psychological manipulation.

Hackers initiated contact through Skype,

presenting themselves as beautiful women.

NART: They would initiate conversations,

try to establish a little bit of rapport with them,

ask them to send them a picture of themselves,

flatter them a little bit, and then say, you know,

"Do you wanna see a picture of me?"

When they would send that picture,

really that was the malware.

They would compromise that individual, and then they would

be able to harvest the full Skype chat histories

of anyone else who used that computer as well.

We obviously can't jump straight to concluding who's ultimately

responsible, but it definitely looks like it is a group

that is acting to benefit the Assad Regime,

and has some sort of connection to Lebanon.

It made sense that hackers in Lebanon, possibly affiliated

with Hezbollah, might be supporting Assad.

Hezbollah is Iran's political proxy in Lebanon,

and Iran is the Syrian Regime's ally.

NART: We found a document that is supposedly a leaked document

from Syrian intelligence that we can't verify,

that talks about the exact tactics that we see this group

using to target the opposition, including the use of fake female

personas to try to entrap individuals and other efforts

to discredit the opposition online.

By 2013, Hezbollah was engaging Syrian rebels

on the battlefield.

Now, pro-Assad hackers based in Lebanon

were engaging them in cyberspace too.

But support from Syria's allies wasn't enough for Assad to keep

an emerging threat at bay: the Islamic State.

BEN: In Syria, the war was causing the country to fracture.

Then ISIS arrived.

The jihadis set up their capital in Raqqa.

They took over the land and unleashed a wave of terror.

Like the Electronic Army and the Malware Teams

that had come before them, the Islamic State would also

go after their opponents on the digital frontline.

Their crimes were documented in high-profile execution videos,

distributed over the internet.

Rami Abdul Rahman knows what it's like

to be targeted by ISIS.

He's a Syrian activist who now lives in the UK

after seeking asylum over 15 years ago.

His work exposing war crimes in Syria made him a target.

He was hacked by the terror group supporters,

Photoshopped in front of Jihadi John,

the infamous ISIS executioner,

his data was targeted, and his server was destroyed.

How did that make you feel,

to see yourself in an orange jumpsuit?

But who was behind the hack?

I'd already been communicating

with Islamic State fighters online.

Some of them were as easy as a text message away.

Junaid Hussain was allegedly one of these fighters.

In Syria, he was known as Abu Hussain al-Britani,

the architect of the Islamic State's cyber army.

But before he traveled to Syria to join ISIS,

Junaid was a regular kid from England best known as TriCk

of the now-disbanded UK hacking collective, TeaMp0isoN.

I traveled to Newcastle

to meet with Junaid's former hacking colleague, MLT.

For security reasons, we can't show his face.

What was TriCk like back in the day

before all of this Islamic State stuff?

TriCk hacked the email of Tony Blair's personal assistant.

Together with MLT, he flooded the anti-terror hotline of Mi6

with prank phone calls.

JUNAID: Do you know about TeaMp0isoN?

OPERATOR: I've heard about TeaMp0isoN, yeah.

JUNAID: We embarrass governments,

and ---- the police.

OPERATOR: Yeah...

BEN: They did it as an act of political protest,

but also for the lulz.

It got them both arrested, but only Junaid went to jail.

Did prison change Junaid?

How did he radicalize?

Because I guess after the Tony Blair hack,

he was probably one of the most famous hackers in Britain.

Was he a skilled hacker?

In August 2015, Junaid was killed in a US air strike.

But before he was assassinated, Junaid is thought to have

carried out another cyber attack.

This one was designed to expose the location of the

Islamic State's critics so they could be captured and killed.

BEN: In Syria, cyber attacks were used by groups affiliated

with the Assad Regime to wage war online.

When ISIS arrived, they seemed to adopt similar techniques

to target their opponents.

ISIS claims the men being executed in this video

are members of Raqqa Is Being Slaughtered Silently,

a group of activists who document and expose

the atrocities of the so-called Islamic State.

Hamood Mohamed Almossa is in charge of

cybersecurity for the group.

He agreed to Skype with me from an undisclosed location.

Hamood, do you want to explain to me how ISIS was hunting down

members of your organization online?

(Speaking Arabic)

He can't fully prove it, but Hamood believes Junaid Hussain

orchestrated the attack so that ISIS could locate

and kill their opposition.

Fortunately, Hamood wasn't fooled by the phishing attack,

and he didn't download the malware.

But did others, and were they killed as a result?

ISIS is almost adopting everything

that was successful in Syria.

We're talking about images, we're talking about video,

we're talking about cyber attacks.

And again, these were techniques that were essentially

tried and true from earlier phases of the Syrian Civil War.

Exactly.

And then here we are, they're adopting it again.

The war in Syria showed that armies of hackers

can assist soldiers in the battlefield

because the tools are both easy to use and free to acquire.

This is a set of tools

that are increasingly available to everybody now.

So the whole idea is that these tools are no longer just in

the hands of the Chinese or Russian or American government,

that people like-- well, people like you and me,

only with far worse intentions, now have these tools and can

engage in relatively sophisticated spying.

And same goes for a battlefield.

Absolutely.

As the war becomes hot, and as, you know,

battlefield intelligence becomes more important,

this sort of surveillance and espionage becomes

part of the battlefield and part of the battle plan.

In a lot of cases it's simple social engineering,

but they're very effective at it.

The types of targets that they're going after are usually

individuals active on Twitter and Facebook so they don't need

to use anything particularly advanced to get the job done.

In Syria, the issue is not only the hacking itself,

but the inability of the targets to protect themselves.

You can really no longer be sure what side you're seeing,

or what kind of actor is involved,

or whether you're seeing some sort of false flag.

It just gets murkier and murkier with every year.

Syria is a country, or used to be a country,

that government is watching you by default.

You under surveillance by default.

Syrians, they were not able actually to...

to change their behaviours, to know that they have rights

of their own privacy, or to protect themselves.

So the same things apply now on what's going on in

the cyber conflict in Syria.

People have no knowledge about protection

or why do I have to protect myself.

I thought that I have pretty good security protocols

when it comes to encryption or circumvention or...

or even protocols dealing with people.

Unfortunately, until someone came, and he was a journalist

not from Syria and he starts filming me,

and he was arrested.

And they got access to all our information.

And that was the minute

that I had to leave the country immediately.

So I found that security is not about yourself only,

but it's about the whole network that you're working with.

When the pro-democracy movement started in 2011,

few could've imagined that Syria would fracture

into deadly chaos.

And no one could've guessed what an important role

the internet would play not only on the battlefield,

but crushing free speech and political reform.

While the country's future hangs in the balance,

one thing has become certain: Syria offers a terrible window

into how the battles of the future can unfold,

both off- and online.