Saturday, May 2, 2026

Iran Is Like Monty Python's Black Knight Sketch

Iran’s arrogant, fanatical and unrealistic bluster after the U.S. military has virtually destroyed its military and industrial base reminds me of Monty Python’s classic Black Knight sketch.

You can watch the sketch via the link below:

Bing Videos 

My Threatcon Column: Homemade Bomb Throwers Plead Not Guilty

Counterterrorism magazine posted my online Threatcon column on the homemade bomb throwers in New York City pleading not guilty. 

You can read the column via the link below or the following text:

IACSP - ThreatCon Articles


On April 15th, Emir Balat, 18, and Ibrahim Kayumi, 19, pleaded not guilty to charges that they attempted to detonate two explosive devices in the vicinity of Gracie Mansion, the official residence of the New York City mayor in Manhattan, and that they were acting in support of ISIS, a designated foreign terrorist organization.

The plea was surprising to me, considering that there are clear videos of the two men hurling the homemade bombs at anti-Islam protestors outside the mayor’s home, and there are also videos of the two bomb throwers being tackled and arrested by NYPD officers afterwards.  


Back on March 10th, the Department of Justice announced the charges against Balat and Kayumi.

“This was an alleged ISIS-inspired act of terrorism that could have killed American citizens,” said then-Attorney General Pamela Bondi. “We will not allow ISIS’s poisonous, anti-American ideology to threaten this nation—our law enforcement officers will remain vigilant, as they were when these devices were brought to a protest.”

Then-Deputy Attorney General Todd Blanche added, “These men allegedly sought to inflict mass casualties in service to ISIS with the hope of exceeding the carnage of the Boston Marathon bombing, We are tremendously grateful to the brave law enforcement officers who ran into harm’s way to apprehend these individuals and disarm the explosives before anyone was harmed. Thanks to the quick investigative work by federal law enforcement, this Department of Justice will prosecute these men who pledged allegiance to a foreign terrorist organization to the fullest extent.”

FBI Director Kash Patel also weighed in, “The defendants allegedly support ISIS and tried to follow the path of that deadly group by attempting to detonate explosive devices in a crowd. The FBI and our partners have no tolerance for terrorist organizations or those inspired by them to engage in attacks. We are committed to stopping acts of violence and will hold accountable those who seek to harm our citizens. I want to commend the brave NYPD officers who took action to prevent injuries or loss of life on the streets of New York.”

As alleged in the Complaint, On or about March 7, 2026, a protest called “Stop the Islamic Takeover of New York City, Stop New York City Public Muslim Prayer” and a counter-protest called “Run Nazis Out of New York City” were held outside of Gracie Mansion. 

“At approximately 12:15 p.m., Balat ignited and threw an explosive device, Device 1, toward the area where the protesters were gathered. Immediately after throwing Device-1, Balat ran to another location down the block and received a second explosive device (Device-2) from Kayumi. After apparently igniting Device-2, Balat dropped Device-2 near where several NYPD officers were standing, ran away from the NYPD officers, and jumped over a barricade. He was tackled and arrested by NYPD officers shortly thereafter, as was Kayumi,” the Complaint noted.

“Following his arrest, while en route to the NYPD precinct, Balat stated to NYPD officers: “this isn’t a religion that just stands when people talk about the blessed name of the prophet . . . We take action! We take action!”; and “if I didn’t do it someone else will come and do it.” Then, after arriving at the NYPD precinct, Balat requested a piece of paper and, after being given a paper and pen, wrote the following: “All praise is due to Allah lord of all worlds! I pledge my allegiance to the Islamic State. Die in your rage yu [sic] kuffar! Emir B.” “Kuffar” is an Arabic term that refers to “non-believers” or “infidels,” and “Die in your rage” is a slogan used by ISIS.”

Law enforcement officers later asked Balat if he was familiar with the Boston Marathon bombing, and if that was what Balat had hoped to accomplish. Balat responded: “No, even bigger.  It was only three deaths.”

After Kayumi was arrested, and as he was being placed inside an NYPD vehicle to be transported from the scene to an NYPD precinct, an individual from the surrounding crowd yelled to Kayumi and asked why Kayumi had done this.  Kayumi responded, “ISIS.” Then, at the NYPD precinct, in response to a question from law enforcement about whether he was affiliated with ISIS, Kayumi indicated that he was. He further stated, in substance and part, that: (i) he has watched ISIS propaganda on his phone; (ii) his actions that day were partly inspired by ISIS; (iii) he did not feel comfortable holding the Devices earlier that day; and (iv) he would not feel comfortable if the Devices were in the interrogation room with him.

After Balat and Kayumi were arrested and the Devices were secured, an FBI Special Agent Bomb Technician (SABT) conducted a preliminary examination of the Devices and determined that they were each approximately the size of a mason jar; that they each had an attached fuse; and that they each had nuts and bolts attached to the exterior, surrounded by duct tape. A preliminary analysis of Device-1, the device that Balat threw into the crowd of protesters, showed that it contained TATP, a highly volatile explosive that is colloquially known as the “Mother of Satan” and extremely sensitive to impact, friction, and heat. TATP has been used in multiple terrorist attacks over the last decade.

The Justice Department stated that on or about March 8, 2026, law enforcement officers located a parked vehicle registered to a family member of Balat a few blocks from Gracie Mansion. From inside the vehicle, law enforcement officers recovered a coiled green material consistent in appearance with hobby fuse, an empty metal can of the same approximate dimensions and appearance as the can recovered from inside Device-1, and a notebook containing handwritten notes. One page of the notebook contains the note “TATP explosive”; another page contains a list of chemical ingredients, including “hydrogen peroxide,” “sulfuric acid,” and “acetone”; and a third page contains a list of components and quantities, such as “aluminum can x6,” and “a box of bolts ect [sic] 2x.”

Balat, 18, of Langhorne, Pennsylvania, and Kayumi, 19, of Newtown, Pennsylvania, are charged with attempted provision of material support and resources to a designated foreign terrorist organization, which carries a maximum sentence of 20 years in prison; use of a weapon of mass destruction, which carries a maximum sentence of life in prison; transportation of explosive materials, which carries a maximum sentence of 10 years in prison; interstate transportation and receipt of explosives, which carries a maximum sentence of 10 years in prison; and unlawful possession of destructive devices, which carries a maximum sentence of 10 years in prison.

Their next court date is June 16.

Paul Davis’ Threatcon column covers crime, espionage and terrorism.

Thursday, April 30, 2026

My Philly Daily Crime Beat Column On The Man Who Crashed His Vehicle Into A Philadelphia Police Station

Philly Daily ran my Crime Beat column on the man who crashed his vehicle into a Philadelphia police station.

You can read the column via the below link below or the following text:


Many people who are arrested and held by the police dream of crashing out of the police station. But earlier this month, one man decided to crash into a police station.

One would think that the lobby of a police station is one of the safest places one can be.

But according to the Philadelphia police, Dieufort Joly, 26, drove his Hyundai Tucson into the lobby of the 2nd Police District station on Castor Avenue in Northeast Philadelphia at 1:40 PM on April 21st.

I know the police station, having been there several times regarding incidents that involved Defense Department personnel when I did security work as a Defense Department civilian at the nearby U.S. naval base on Tabor Road some years ago. I have stood in that lobby waiting to see detectives, just like the six people who were in the lobby when the car crashed through the glass front.   

Philadelphia Police Commissioner Kevin Bethel at a press conference said that the car crash was clearly a deliberate act.

“Based on what we’ve received so far, there’s nothing that would indicate that the individual would be mad at police,” Bethel said to reporters. “I don’t know what could have caused that other than somebody who’s in a different state of mind.

“We are working with our terrorism task force; we have been on the phone with our special agent in charge of the FBI. We’re looking at all the angles, and we will make those determinations if it gets to the threshold where it’s considered a terrorist act.”

Joly was arrested after he left his vehicle. He was taken to Jefferson Torresdale Hospital for treatment. The five people in the lobby were struck by debris.

“We are very, very fortunate today that those individuals were not seriously injured,” Bethel said.

The Philadelphia District Attorney’s Office (DAO) announced they approved the following charges for defendant Dieufort Joly:

Six Counts of:

  • Aggravated Assault (F1)
  • Recklessly Endangering Another Person (REAP) (M2)
  • Simple Assault (M2)

One Count of:

  • Risking Catastrophe (F3) 
  • Institutional Vandalism (F3)
  • Criminal Mischief (F3)
  • Possessing an Instrument of Crime (M1)

According to the DAO, exterior footage shows Dieufort Joly driving down Castor Avenue.  “Joly made a hard right turn into the entrance of the Police District Building and missed two wooden barricades positioned in front. Interior video shows the vehicle, a 2007 Hyundai Tucson, break through the entrance of the building and come to a full stop inside the lobby,” the DAO stated. “Once the vehicle stops, Joly exits the driver’s seat and is eventually detained. Of the six complainants, no one was seriously injured. Defendant Dieufort Joly has been arraigned, and bail is set at $1.7 million dollars. This is an active and ongoing investigation.”

“The Philadelphia District Attorney’s Office is specially assigning one of our excellent and more experienced prosecutors to work collaboratively with our partners at the Philadelphia Police Department,” said District Attorney Larry Krasner. “We are committed to ensuring a fair, appropriate, and just outcome for the terrible incident that occurred at the Police District Building. Thankfully, no one experienced serious physical injuries, although the emotional and mental impact is very real. Our thoughts are with the victims impacted and our first responders who were in the building at the time. The DAO’s Victim Services Team has begun making outreach to all those impacted and ensure they are connected with resources and services.

"We understand how traumatic this was for civilians, we understand how traumatic this was for anyone in law enforcement who may have witnessed it or even heard the crash of this vehicle," Krasner said. "This is not a vehicle that was moving 5 miles an hour. It was coming through the glass front of this new police district at a high rate of speed."

"The video is shocking. The video is terrifying, and frankly, it almost looks miraculous that there's no one right in the immediate path," Krasner said.

Assistant District Attorney Angela Brennan, chief of the DAO’s Major Trials Unit, added, “We will continue to work with our law enforcement partners during this investigation and ensure vertical prosecution from charging through each step of the criminal justice process.”

Joly, who is from Hati, had his passport taken from him. 

Joly is being held on 10% of $1.7 million bail,

Paul Davis’s Crime Beat column appears here each week. He is also a contributor Broad + Liberty and Counterterrorism magazine. He can be reached via pauldavisoncrime.com.

Note: You can read my previous Philly Daily Crime Beat columns via the link below:

Paul Davis On Crime: My Philly Daily Crime Beat Columns 

Tuesday, April 28, 2026

Suspect In White House Correspondents’ Dinner Shooting Charged With Attempt To Assassinate the President

The U.S. Justice Department released the information below:

Cole Tomas Allen, 31, of Torrance, California, was arraigned today in U.S. District Court on charges stemming from the April 25, 2026, shooting at the White House Correspondents’ Association Dinner, announced the Department of Justice.

Allen is charged by complaint with one count of attempt to assassinate the President of the United States, transportation of a firearm & ammunition in interstate commerce with intent to commit a felony, and discharge of a firearm during a crime of violence. 

Shotgun

"Cole Allen now faces the full weight of federal justice,” said Acting Attorney General Todd Blanche. “This alleged assassin was stopped because of the courage and professionalism of law enforcement officers who responded without hesitation by doing their jobs. Because of them, the President of the United States, administration officials and all attendees at the dinner were safe. Make no mistake: deranged attacks on our elected officials will never go unpunished."

“The evidence is abundantly clear: Cole Tomas Allen traveled to Washington D.C. for the purpose of assassinating President Trump and targeting members of the Trump administration, “said FBI Director Kash Patel. “Thanks to the heroic actions of our brave law enforcement partners who acted quickly and professionally, Allen did not succeed - and now, he will be held fully accountable. This FBI and our interagency partners have worked around the clock over the past two days investigating this case, and today’s charges are the first step in justice being served and providing answers to the American people.”

“Cole Allen traveled across the country with deadly weapons and a plan to assassinate the President of the United States,” said U.S. Attorney Jeanine Pirro for the District of Columbia. “The swift and courageous response of the Secret Service officers prevented unimaginable tragedy. There is no room in this city for political violence.”

"This foiled plot was a brazen attempt to assassinate the president and numerous high-ranking U.S. government officials," said Darren Cox, Assistant Director in Charge of the FBI Washington Field Office. "Violence is never an acceptable means of expressing political dissent. I would like to thank our partners for their assistance in the aftermath of this attack as we work tirelessly to ensure Allen is brought to justice."

According to court documents, on April 6, 2026, Allen made a reservation at the Washington Hilton hotel for three nights, from April 24 to April 26, 2026. Allen traveled by train from his home near Los Angeles to Chicago before boarding a train from Chicago to Washington, D.C. Allen arrived in the District at approximately 1 p.m. on April 24, 2026, and checked into the Washington Hilton later that day.

At approximately 8:40 p.m., Allen approached a security checkpoint on the Terrace Level of the hotel leading to the hotel’s ballroom. Allen ran through the magnetometer holding a long gun. U.S. Secret Service personnel assigned to the checkpoint heard a loud gunshot. A U.S. Secret Service officer, who was wearing a ballistic vest, was shot once in the chest. 

The Secret Service officer drew his service weapon and fired multiple times at Allen, who fell to the ground and suffered minor injuries but was not shot. Officers subsequently arrested Allen, who was in possession of a 12-gauge pump action shotgun and a Rock Island Armory 1911 .38 caliber pistol. 

Pistol

Compilation

Following his arrest, Allen was advised of his Miranda rights and invoked his right to remain silent. Allen was transported to Howard University Hospital for minor injuries and has since been released to law enforcement custody. 

Shortly before 8:40 p.m. on April 25, 2026, Allen sent an email to members of his family and a former employer explaining the actions he was about to take. The email, a copy of which law enforcement has obtained from a recipient, stated: “I wish I could have said anything earlier, but doing so would have made none of this possible. My sincerest apologies for all the trouble I've caused. (scheduled send)-Cole.”  Allen signed his email “Cole ‘coldForce’ ‘Friendly Federal Assassin’ Allen.” 

As part of this investigation, law enforcement reviewed records of firearm transactions from California and federal database sources. These records showed that on Aug.17, 2025, Allen purchased a 12-gauge pump action shotgun from a California firearms dealer. On Oct. 6, 2023, Allen purchased a .38 caliber semi-automatic pistol from another firearms dealer. Based on the serial numbers in the database records, these two firearms are the same two firearms that Allen at the Washington Hilton on April 25, 2026.

This case is being investigated by the FBI Washington Field Office and the U.S. Secret Service. It is being prosecuted by Assistant U.S. Attorneys Jocelyn Ballentine, Charles Jones, Adam Barry.                                                                                         


Monday, April 27, 2026

Prolific Chinese State-Sponsored Contract Hacker Extradited From Italy

 The U.S. Justice Department released the information below:

Xu Zewei (泽伟), 34, of the People’s Republic of China was extradited to the United States this weekend and appeared today in U.S. District Court in Houston on a nine-count indictment related to his involvement in computer intrusions between February 2020 and June 2021. Certain of those computer intrusions allegedly are part of the HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States. Other intrusions targeted U.S. COVID-19 research during the height of the pandemic. Xu is charged along with Zhang Yu (张宇), 44, who is also a PRC national.

According to court documents, officers of the PRC’s Ministry of State Security’s (MSS) Shanghai State Security Bureau (SSSB) directed Xu to conduct this hacking. The MSS and SSSB are PRC intelligence services responsible for PRC’s domestic counterintelligence, non-military foreign intelligence, and aspects of the PRC’s political and domestic security. When Xu conducted the computer intrusions, he allegedly worked for a company named Shanghai Powerock Network Co. Ltd. (Powerock). Powerock was one of many “enabling” companies in the PRC that conducted hacking for the PRC government.

“The United States is committed to pursuing hackers who steal information from U.S. businesses and universities and threaten our cybersecurity,” said Assistant Attorney General for National Security John A. Eisenberg. “I commend the prosecutors and investigators who have worked hard and sought justice for years in this investigation, and we look forward to proving our case in court.”

“Today, Xu Zewei will stand in a federal courtroom to answer for crimes that struck at the heart of American science and security — allegedly stealing COVID-19 research from our universities when the world needed it most,” said Acting U.S. Attorney John G.E. Marck for the Southern District of Texas. “We have pursued this moment across years and continents, and the message this office sends today is the same one we sent when we first unsealed this indictment: we will work to protect the American people.”

“The extradition of Xu Zewei demonstrates the FBI's reach extends well beyond U.S. borders,” said Assistant Director Brett Leatherman of the FBI's Cyber Division. “Xu will now answer for his alleged role in HAFNIUM, a group responsible for a vast intrusion campaign directed by China's Ministry of State Security that compromised more than 12,700 U.S. organizations. He is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk. The FBI thanks our Italian law enforcement colleagues, especially the Polizia Postale, whose partnership led to Xu's arrest in Milan and his extradition to the United States.”

According to court documents, in early 2020, Xu and his co-conspirators hacked and otherwise targeted U.S.-based universities, immunologists, and virologists conducting research into COVID‑19 vaccines, treatment, and testing. Xu and others reported their activities to officers in the SSSB who were supervising and directing the hacking activities. For example, on or about Feb. 19, 2020, Xu provided an SSSB officer with confirmation that he had compromised the network of a research university located in the Southern District of Texas. On or about Feb. 22, 2020, the SSSB officer directed Xu to target and access specific email accounts (mailboxes) belonging to virologists and immunologists engaged in COVID-19 research for the university. Xu later confirmed for the SSSB officer that he acquired the contents of the researchers’ mailboxes. 

You can read the rest of the press release via the link below: 

Office of Public Affairs | Prolific Chinese State-Sponsored Contract Hacker Extradited from Italy | United States Department of Justice

Friday, April 24, 2026

Covering The U.S. Army Reserve's 118th Birthday Celebration In Philadelphia

I covered the U.S. Army Reserve’s 118th birthday celebration in Philadelphia yesterday for Reserve + National Guard Magazine.

The Army Reserve’s birthday celebration was held on the Independence Mall in front of Independence Hall.

Lt. General Robert Harter, chief of Army Reserve and commanding general, U.S. Army Reserve Command, was the main speaker and he then swore in 118 future soldiers from New Jersey and Pennsylvania.


After the ceremony, the crowd walked to Betsy Ross’s House where a re-enlistment ceremony was held. Lt. Gen Harter then cut the Army Reserve’s birthday cake.

I’ll post my piece on the Army Reserve’s 118th birthday celebration here when the magazine comes out.

Thursday, April 23, 2026

The Russians Are Coming: My Philly Daily Crime Beat Column On The Russian GRU Unit That Is Hijacking Routers To Steal Sensitive Information

Philly Daily ran my Crime Beat column on Russian GRU hackers.

You can read the column via the link below or the following text:

 Davis: The Russians are coming to a computer near you - Philly Daily

Earlier this month, the National Security Agency (NSA) and other federal agencies co-sealed an FBI public service announcement, “Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information.”

The  public service announcement accompanied an announcement from U. S. Attorney David Metcalf in Philadelphia, the Department of Justice, and the FBI that a court-authorized technical operation to neutralize the U.S. portion of a network of small office/home office (SOHO) routers compromised by a unit within Russia’s Main Intelligence Directorate of the General Staff (GRU: Glavnoye Razvedyvatelnoe Upravlenis) Military Unit 26165, also known as APT28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit.

Having spent more than 37 years doing security work as a young sailor in the U.S. Navy and later as a Defense Department civilian, I’m well-aware of the Russian GRU, which is essentially the same gang as the old Soviet GRU. (Above is the GRU emblem). 

The GRU is the Russian military intelligence agency that operates worldwide alongside the Russian foreign intelligence agency the SVR, which is essentially the old First Main Directorate of the old KGB.

During my time in the Defense Department, I was trained to guard against the KGB (later the SVR) and the GRU. I often traveled to Washington D.C. to receive briefings from the FBI, CIA, DIA and NSA on the threat from the SVR/KGB and the GRU.

The GRU, the military group that includes the Spetsnaz special operations forces and the “active measures” unit that murdered a Russians defector with radiation poisoned tea, also employs full-time hackers.       

According to Metcalf, the hacker unit used the routers to facilitate malicious Domain Name System (DNS) hijacking operations against worldwide targets of intelligence interest to the Russian government, including individuals in the military, government, and critical infrastructure sectors.

“Since at least 2024, GRU actors have exploited known vulnerabilities to steal credentials for thousands of TP-Link routers worldwide. The actors then accessed many of these compromised routers without authorization and manipulated their settings to redirect DNS requests to GRU-controlled servers - i.e., malicious DNS resolvers. GRU actors were indiscriminate in their initial targeting and manipulation of routers. The actors then implemented an automated filtering process to determine which DNS requests were of interest and warranted interception. For select targets, the GRU’s DNS resolvers provided fraudulent DNS records for specific domains that mimicked legitimate services — including Microsoft Outlook Web Access — to facilitate Actor-in-the-Middle attacks against encrypted victim network traffic. In doing so, the GRU actors harvested unencrypted passwords, authentication tokens, emails, and other sensitive information from devices on the same network as the compromised TP-Link routers,” the announcement stated.

“Russian military intelligence once again hijacked Americans’ hardware to commandeer critical data,” said Metcalf. “In the face of continued aggression by our nation-state adversaries, the U.S. government will respond just as aggressively. Working with the FBI — and our partners around the world — we are committed to disrupting and exposing such threats to our nation’s cybersecurity.”

Assistant Attorney General for National Security John A. Eisenberg added. “The GRU’s predatory use of networks in American homes and businesses for its malicious cyber operations remains a serious and persistent threat,” said “NSD will continue to use every tool at our disposal to detect such intrusions and expel hostile foreign actors from our Nation’s networks.”

“Operation Masquerade — led by FBI Boston — is the latest example of how we’re defending our homeland from Russia’s GRU, which weaponized routers owned by unsuspecting Americans in more than 23 states to steal sensitive government, military, and critical infrastructure information,” said Special Agent in Charge Ted E. Docks, of the FBI’s Boston Field Office. “The FBI utilized cutting edge technology and leveraged our private sector and international partners to unmask this malicious activity and remediate routers. Now we’re asking everyone who has a router to secure it, update its firmware, and replace it if needed. By working together, we can guard against nefarious nation state actors trying to compromise our national security.”

“Operation Masquerade demonstrates the FBI’s commitment to identifying, exposing, and disrupting the Russian government's efforts to compromise American devices, steal sensitive information, and target critical infrastructure,” said Assistant Director Brett Leatherman of FBI’s Cyber Division. “GRU actors compromised routers in the US and around the world, hijacking them to conduct espionage. Given the scale of this threat, sounding the alarm wasn't enough. The FBI conducted a court-authorized operation to harden compromised routers across the United States. We urge all router owners to take the remediation steps outlined today, because defending our networks requires all of us. The FBI will continue to use its authorities to identify and impose costs on state-sponsored actors who target the American people.”

According to court documents unsealed in Philadelphia, the FBI developed a series of commands to send to compromised routers in the United States, designed to collect evidence regarding the GRU actors’ activity, reset DNS settings (i.e., remove GRU DNS resolvers and force routers to obtain legitimate DNS resolvers from their Internet Service Providers (ISPs)), and to otherwise prevent the GRU actors from exploiting the original means of unauthorized access.

As described in court documents, the government extensively tested the operation on firmware and hardware for affected TP-Link routers. Other than stymieing the GRU’s ability to access the routers, the operation did not impact the routers’ normal functionality or collect the legitimate users’ content information.

The court-authorized steps to remediate compromised routers can be reversed by legitimate users at any time through factory resets with hardware reset buttons. Legitimate users can also reverse changes by logging into web management pages and restoring desired settings (e.g., factory default settings).

The FBI is working with ISPs to provide notice of the operation to users of SOHO routers covered by the court’s authorization. If you believe you have a compromised router, please contact your local FBI field office or file a report with the FBI’s Internet Crime Complaint Center.

Paul Davis’s Crime Beat column appears here each week. He is also a contributor to Broad + Liberty and Counterterrorism magazine. He can be reached via pauldavisoncrime.com. 

Note: You can read my previous Crime Beat columns via the link below:

Paul Davis On Crime: My Philly Daily Crime Beat Columns