Iran’s arrogant, fanatical and unrealistic bluster after the U.S. military has virtually destroyed its military and industrial base reminds me of Monty Python’s classic Black Knight sketch.
You can watch the sketch via the link below:
News and commentary on organized crime, street crime, white collar crime, cyber crime, sex crime, crime fiction, crime prevention, espionage and terrorism.
Iran’s arrogant, fanatical and unrealistic bluster after the U.S. military has virtually destroyed its military and industrial base reminds me of Monty Python’s classic Black Knight sketch.
You can watch the sketch via the link below:
Counterterrorism magazine posted my online Threatcon column on the homemade bomb throwers in New York City pleading not guilty.
You can read the column via the link below or the following text:
The plea was surprising to me,
considering that there are clear videos of the two men hurling the homemade
bombs at anti-Islam protestors outside the mayor’s home, and there are also videos
of the two bomb throwers being tackled and arrested by NYPD officers afterwards.
“This was an alleged ISIS-inspired act
of terrorism that could have killed American citizens,” said then-Attorney
General Pamela Bondi. “We will not allow ISIS’s poisonous, anti-American
ideology to threaten this nation—our law enforcement officers will remain
vigilant, as they were when these devices were brought to a protest.”
Then-Deputy Attorney General Todd
Blanche added, “These men allegedly sought to inflict mass casualties in
service to ISIS with the hope of exceeding the carnage of the Boston Marathon
bombing, We are tremendously grateful to the brave law enforcement officers who
ran into harm’s way to apprehend these individuals and disarm the explosives
before anyone was harmed. Thanks to the quick investigative work by
federal law enforcement, this Department of Justice will prosecute these men
who pledged allegiance to a foreign terrorist organization to the fullest
extent.”
FBI Director Kash Patel also weighed in,
“The defendants allegedly support ISIS and tried to follow the path of that
deadly group by attempting to detonate explosive devices in a crowd. The FBI
and our partners have no tolerance for terrorist organizations or those
inspired by them to engage in attacks. We are committed to stopping acts of
violence and will hold accountable those who seek to harm our citizens. I
want to commend the brave NYPD officers who took action to prevent injuries or
loss of life on the streets of New York.”
As alleged in the Complaint, On or about
March 7, 2026, a protest called “Stop the Islamic Takeover of New York City,
Stop New York City Public Muslim Prayer” and a counter-protest called “Run
Nazis Out of New York City” were held outside of Gracie Mansion.
“At approximately 12:15 p.m., Balat
ignited and threw an explosive device, Device 1, toward the area where the
protesters were gathered. Immediately after throwing Device-1, Balat ran to
another location down the block and received a second explosive device
(Device-2) from Kayumi. After apparently igniting Device-2, Balat dropped
Device-2 near where several NYPD officers were standing, ran away from the NYPD
officers, and jumped over a barricade. He was tackled and arrested by NYPD
officers shortly thereafter, as was Kayumi,” the Complaint noted.
“Following his arrest, while en route to
the NYPD precinct, Balat stated to NYPD officers: “this isn’t a religion that
just stands when people talk about the blessed name of the prophet . . . We
take action! We take action!”; and “if I didn’t do it someone else will
come and do it.” Then, after arriving at the NYPD precinct, Balat
requested a piece of paper and, after being given a paper and pen, wrote the
following: “All praise is due to Allah lord of all worlds! I pledge my
allegiance to the Islamic State. Die in your rage yu [sic]
kuffar! Emir B.” “Kuffar” is an Arabic term that refers to “non-believers”
or “infidels,” and “Die in your rage” is a slogan used by ISIS.”
Law enforcement officers later asked
Balat if he was familiar with the Boston Marathon bombing, and if that was what
Balat had hoped to accomplish. Balat responded: “No, even bigger. It
was only three deaths.”
After Kayumi was arrested, and as he was
being placed inside an NYPD vehicle to be transported from the scene to an NYPD
precinct, an individual from the surrounding crowd yelled to Kayumi and asked
why Kayumi had done this. Kayumi responded, “ISIS.” Then, at the
NYPD precinct, in response to a question from law enforcement about whether he
was affiliated with ISIS, Kayumi indicated that he was. He further stated,
in substance and part, that: (i) he has watched ISIS propaganda on his phone;
(ii) his actions that day were partly inspired by ISIS; (iii) he did not feel
comfortable holding the Devices earlier that day; and (iv) he would not feel
comfortable if the Devices were in the interrogation room with him.
After Balat and Kayumi were arrested and
the Devices were secured, an FBI Special Agent Bomb Technician (SABT) conducted
a preliminary examination of the Devices and determined that they were each
approximately the size of a mason jar; that they each had an attached fuse; and
that they each had nuts and bolts attached to the exterior, surrounded by duct
tape. A preliminary analysis of Device-1, the device that Balat threw into
the crowd of protesters, showed that it contained TATP, a highly volatile
explosive that is colloquially known as the “Mother of Satan” and
extremely sensitive to impact, friction, and heat. TATP has been used in
multiple terrorist attacks over the last decade.
The Justice Department stated that on or
about March 8, 2026, law enforcement officers located a parked vehicle
registered to a family member of Balat a few blocks from Gracie
Mansion. From inside the vehicle, law enforcement officers recovered a
coiled green material consistent in appearance with hobby fuse, an empty metal
can of the same approximate dimensions and appearance as the can recovered from
inside Device-1, and a notebook containing handwritten notes. One page of
the notebook contains the note “TATP explosive”; another page contains a list
of chemical ingredients, including “hydrogen peroxide,” “sulfuric acid,” and
“acetone”; and a third page contains a list of components and quantities, such
as “aluminum can x6,” and “a box of bolts ect [sic] 2x.”
Balat, 18, of Langhorne, Pennsylvania,
and Kayumi, 19, of Newtown, Pennsylvania, are charged with attempted provision
of material support and resources to a designated foreign terrorist
organization, which carries a maximum sentence of 20 years in prison; use of a
weapon of mass destruction, which carries a maximum sentence of life in prison;
transportation of explosive materials, which carries a maximum sentence of 10
years in prison; interstate transportation and receipt of explosives, which
carries a maximum sentence of 10 years in prison; and unlawful possession of
destructive devices, which carries a maximum sentence of 10 years in prison.
Their next court date is June 16.
Paul Davis’ Threatcon column covers crime, espionage
and terrorism.
Philly Daily ran my Crime Beat column on the man who crashed his vehicle into a Philadelphia police station.
One would think that the lobby of a police station is one of the safest places one can be.
But according to the
Philadelphia police, Dieufort Joly, 26, drove his Hyundai Tucson into the lobby
of the 2nd Police District station on Castor Avenue in Northeast Philadelphia at
1:40 PM on April 21st.
I know the police station,
having been there several times regarding incidents that involved Defense
Department personnel when I did security work as a Defense Department civilian
at the nearby U.S. naval base on Tabor Road some years ago. I have stood in
that lobby waiting to see detectives, just like the six people who were in the
lobby when the car crashed through the glass front.
Philadelphia Police Commissioner Kevin Bethel at a press
conference said that the car crash was clearly a deliberate act.
“Based on what we’ve received so far, there’s nothing that would
indicate that the individual would be mad at police,” Bethel said to reporters.
“I don’t know what could have caused that other than somebody who’s in a
different state of mind.
“We are working with our terrorism task force;
we have been on the phone with our special agent in charge of the FBI. We’re
looking at all the angles, and we will make those determinations if it gets to
the threshold where it’s considered a terrorist act.”
Joly was arrested after he left his vehicle. He was taken to Jefferson Torresdale Hospital
for treatment. The five people in the lobby were struck by debris.
“We are very, very fortunate today that those individuals were
not seriously injured,” Bethel said.
The Philadelphia District Attorney’s Office (DAO) announced they approved
the following charges for defendant Dieufort Joly:
Six Counts of:
One Count of:
According to the DAO, exterior
footage shows Dieufort Joly driving down Castor
Avenue. “Joly made a hard right turn
into the entrance of the Police District Building and missed two wooden
barricades positioned in front. Interior video shows the vehicle, a 2007
Hyundai Tucson, break through the entrance of the building and come to a full
stop inside the lobby,” the DAO stated. “Once the vehicle stops, Joly exits the
driver’s seat and is eventually detained. Of the six complainants, no one was
seriously injured. Defendant Dieufort Joly has been arraigned, and bail is set
at $1.7 million dollars. This is an active and ongoing investigation.”
“The Philadelphia District Attorney’s
Office is specially assigning one of our excellent and more experienced
prosecutors to work collaboratively with our partners at the Philadelphia
Police Department,” said District Attorney Larry Krasner. “We
are committed to ensuring a fair, appropriate, and just outcome for
the terrible incident that occurred at the Police District Building.
Thankfully, no one experienced serious physical injuries, although the
emotional and mental impact is very real. Our thoughts are with the victims
impacted and our first responders who were in the building at the time. The
DAO’s Victim Services Team has begun making outreach to all those impacted
and ensure they are connected with resources and services.
"We understand how
traumatic this was for civilians, we understand how traumatic this was for
anyone in law enforcement who may have witnessed it or even heard the crash of
this vehicle," Krasner said. "This is not a vehicle that was moving 5
miles an hour. It was coming through the glass front of this new police
district at a high rate of speed."
"The video is shocking.
The video is terrifying, and frankly, it almost looks miraculous that there's
no one right in the immediate path," Krasner said.
Assistant District Attorney Angela Brennan, chief
of the DAO’s Major Trials Unit, added, “We will continue to work with our
law enforcement partners during this investigation and ensure
vertical prosecution from charging through each step of the criminal justice
process.”
Joly, who is from Hati, had his passport
taken from him.
Joly is being held on 10% of
$1.7 million bail,
Paul Davis’s Crime Beat
column appears here each week. He is also a contributor Broad + Liberty and
Counterterrorism magazine. He can be reached via pauldavisoncrime.com.
Note: You can read my previous Philly Daily Crime Beat columns via the link below:
The U.S. Justice Department released the information below:
Cole Tomas Allen, 31, of Torrance, California, was
arraigned today in U.S. District Court on charges stemming from the April 25,
2026, shooting at the White House Correspondents’ Association Dinner, announced
the Department of Justice.
Allen is
charged by complaint with one
count of attempt to assassinate the President of the United States,
transportation of a firearm & ammunition in interstate commerce with intent
to commit a felony, and discharge of a firearm during a crime of
violence.
"Cole Allen
now faces the full weight of federal justice,” said Acting Attorney General
Todd Blanche. “This alleged assassin was stopped because of the courage and
professionalism of law enforcement officers who responded without hesitation by
doing their jobs. Because of them, the President of the United States,
administration officials and all attendees at the dinner were safe. Make no
mistake: deranged attacks on our elected officials will never go
unpunished."
“The evidence is
abundantly clear: Cole Tomas Allen traveled to Washington D.C. for the purpose
of assassinating President Trump and targeting members of the Trump
administration, “said FBI Director Kash Patel. “Thanks to the heroic actions of
our brave law enforcement partners who acted quickly and professionally, Allen
did not succeed - and now, he will be held fully accountable. This FBI and our
interagency partners have worked around the clock over the past two days
investigating this case, and today’s charges are the first step in justice
being served and providing answers to the American people.”
“Cole Allen
traveled across the country with deadly weapons and a plan to assassinate the
President of the United States,” said U.S. Attorney Jeanine Pirro for the
District of Columbia. “The swift and courageous response of the Secret Service
officers prevented unimaginable tragedy. There is no room in this city for
political violence.”
"This
foiled plot was a brazen attempt to assassinate the president and numerous
high-ranking U.S. government officials," said Darren Cox, Assistant
Director in Charge of the FBI Washington Field Office. "Violence is never
an acceptable means of expressing political dissent. I would like to thank our
partners for their assistance in the aftermath of this attack as we work
tirelessly to ensure Allen is brought to justice."
According to
court documents, on April 6, 2026, Allen made a reservation at the Washington
Hilton hotel for three nights, from April 24 to April 26, 2026. Allen traveled
by train from his home near Los Angeles to Chicago before boarding a
train from Chicago to Washington, D.C. Allen arrived in the District
at approximately 1 p.m. on April 24, 2026, and checked into the
Washington Hilton later that day.
At approximately
8:40 p.m., Allen approached a security checkpoint on the Terrace Level of
the hotel leading to the hotel’s ballroom. Allen ran through the
magnetometer holding a long gun. U.S. Secret Service personnel assigned to the
checkpoint heard a loud gunshot. A U.S. Secret Service officer,
who was wearing a ballistic vest, was shot once in the chest.
The Secret
Service officer drew his service weapon and fired multiple times at Allen,
who fell to the ground and suffered minor injuries but was not
shot. Officers subsequently arrested Allen, who was
in possession of a 12-gauge pump action shotgun and a Rock Island Armory 1911
.38 caliber pistol.
Following his
arrest, Allen was advised of his Miranda rights
and invoked his right to remain silent. Allen was transported to Howard University
Hospital for minor injuries and has since been released to law enforcement
custody.
Shortly before
8:40 p.m. on April 25, 2026, Allen sent an email to members of his family
and a former employer explaining the actions he was about to take. The email, a
copy of which law enforcement has obtained from a recipient, stated:
“I wish I could have said anything earlier, but doing so would have
made none of this possible. My sincerest apologies for all the
trouble I've caused. (scheduled send)-Cole.” Allen signed his
email “Cole ‘coldForce’ ‘Friendly Federal Assassin’ Allen.”
As part of this
investigation, law enforcement reviewed records of firearm transactions from
California and federal database sources. These records showed that on Aug.17,
2025, Allen purchased a 12-gauge pump action shotgun from
a California firearms dealer. On Oct. 6, 2023,
Allen purchased a
.38 caliber semi-automatic pistol from another firearms dealer. Based
on the serial numbers in the database records, these two firearms are the same
two firearms that Allen at the Washington Hilton on April
25, 2026.
This case is being investigated by the FBI Washington Field Office and the U.S. Secret Service. It is being prosecuted by Assistant U.S. Attorneys Jocelyn Ballentine, Charles Jones, Adam Barry.
The U.S. Justice Department released the information below:
Xu
Zewei (徐泽伟), 34, of the People’s Republic of China
was extradited to the United States this weekend and appeared today in U.S.
District Court in Houston on a nine-count
indictment related to his involvement in computer intrusions
between February 2020 and June 2021. Certain of those computer intrusions
allegedly are part of the HAFNIUM computer intrusion campaign that compromised
thousands of computers worldwide, including in the United States. Other
intrusions targeted U.S. COVID-19 research during the height of the pandemic.
Xu is charged along with Zhang Yu (张宇), 44, who is also a PRC national.
According to
court documents, officers of the PRC’s Ministry of State Security’s (MSS)
Shanghai State Security Bureau (SSSB) directed Xu to conduct this hacking. The
MSS and SSSB are PRC intelligence services responsible for PRC’s domestic
counterintelligence, non-military foreign intelligence, and aspects of the
PRC’s political and domestic security. When Xu conducted the computer
intrusions, he allegedly worked for a company named Shanghai Powerock Network
Co. Ltd. (Powerock). Powerock was one of many “enabling” companies in the PRC
that conducted hacking for the PRC government.
“The United
States is committed to pursuing hackers who steal information from U.S.
businesses and universities and threaten our cybersecurity,” said Assistant
Attorney General for National Security John A. Eisenberg. “I commend the
prosecutors and investigators who have worked hard and sought justice for years
in this investigation, and we look forward to proving our case in court.”
“Today, Xu Zewei
will stand in a federal courtroom to answer for crimes that struck at the heart
of American science and security — allegedly stealing COVID-19 research from
our universities when the world needed it most,” said Acting U.S. Attorney John
G.E. Marck for the Southern District of Texas. “We have pursued this moment
across years and continents, and the message this office sends today is the
same one we sent when we first unsealed this indictment: we will work to
protect the American people.”
“The extradition
of Xu Zewei demonstrates the FBI's reach extends well beyond U.S. borders,”
said Assistant Director Brett Leatherman of the FBI's Cyber Division. “Xu will
now answer for his alleged role in HAFNIUM, a group responsible for a vast
intrusion campaign directed by China's Ministry of State Security that
compromised more than 12,700 U.S. organizations. He is one of many contractors
the Chinese government uses to obscure its hand in cyber operations, and others
who do the same face the same risk. The FBI thanks our Italian law enforcement
colleagues, especially the Polizia Postale, whose partnership led to Xu's
arrest in Milan and his extradition to the United States.”
According to court documents, in early 2020, Xu and his co-conspirators hacked and otherwise targeted U.S.-based universities, immunologists, and virologists conducting research into COVID‑19 vaccines, treatment, and testing. Xu and others reported their activities to officers in the SSSB who were supervising and directing the hacking activities. For example, on or about Feb. 19, 2020, Xu provided an SSSB officer with confirmation that he had compromised the network of a research university located in the Southern District of Texas. On or about Feb. 22, 2020, the SSSB officer directed Xu to target and access specific email accounts (mailboxes) belonging to virologists and immunologists engaged in COVID-19 research for the university. Xu later confirmed for the SSSB officer that he acquired the contents of the researchers’ mailboxes.
You can read the rest of the press release via the link below:
I covered the U.S. Army Reserve’s 118th birthday celebration in Philadelphia yesterday for Reserve + National Guard Magazine.
The Army Reserve’s birthday celebration was held on the Independence Mall in front of Independence Hall.
Lt. General Robert Harter, chief of Army Reserve and commanding
general, U.S. Army Reserve Command, was the main speaker and he then swore in
118 future soldiers from New Jersey and Pennsylvania.
After the ceremony, the crowd walked to
Betsy Ross’s House where a re-enlistment ceremony was held. Lt. Gen Harter then
cut the Army Reserve’s birthday cake.
I’ll post my piece on the Army Reserve’s 118th birthday celebration here when the magazine comes out.
Philly Daily ran my Crime Beat column on Russian GRU
hackers.
You can read the column via the link below or the following
text:
Davis: The Russians are coming to a computer near you - Philly Daily
Earlier this month, the National Security Agency (NSA) and other federal agencies co-sealed an FBI public service announcement, “Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information.”
The public service
announcement accompanied an announcement from U. S. Attorney David Metcalf in
Philadelphia, the Department of Justice, and the FBI that a court-authorized
technical operation to neutralize the U.S. portion of a network of small
office/home office (SOHO) routers compromised by a unit within Russia’s Main
Intelligence Directorate of the General Staff (GRU: Glavnoye Razvedyvatelnoe
Upravlenis) Military Unit 26165, also known as APT28, Sofacy Group, Forest
Blizzard, Pawn Storm, Fancy Bear, and Sednit.
Having spent more than 37 years doing security work as a young
sailor in the U.S. Navy and later as a Defense Department civilian, I’m
well-aware of the Russian GRU, which is essentially the same gang as the old
Soviet GRU. (Above is the GRU emblem).
The GRU is the Russian military intelligence agency that
operates worldwide alongside the Russian foreign intelligence agency the SVR,
which is essentially the old First Main Directorate of the old KGB.
During my time in the Defense Department, I was trained to guard
against the KGB (later the SVR) and the GRU. I often traveled to Washington
D.C. to receive briefings from the FBI, CIA, DIA and NSA on the threat from the
SVR/KGB and the GRU.
The GRU, the military group that includes the Spetsnaz special
operations forces and the “active measures” unit that murdered a Russians
defector with radiation poisoned tea, also employs full-time hackers.
According to Metcalf, the hacker unit used the routers to
facilitate malicious Domain Name System (DNS) hijacking operations against
worldwide targets of intelligence interest to the Russian government, including
individuals in the military, government, and critical infrastructure sectors.
“Since
at least 2024, GRU actors have exploited known vulnerabilities to steal
credentials for thousands of TP-Link routers worldwide. The actors then
accessed many of these compromised routers without authorization and
manipulated their settings to redirect DNS requests to GRU-controlled servers
- i.e., malicious DNS resolvers. GRU actors were indiscriminate in their
initial targeting and manipulation of routers. The actors then implemented an
automated filtering process to determine which DNS requests were of interest
and warranted interception. For select targets, the GRU’s DNS resolvers
provided fraudulent DNS records for specific domains that mimicked legitimate
services — including Microsoft Outlook Web Access — to facilitate
Actor-in-the-Middle attacks against encrypted victim network traffic. In doing
so, the GRU actors harvested unencrypted passwords, authentication tokens,
emails, and other sensitive information from devices on the same network as the
compromised TP-Link routers,” the announcement stated.
“Russian
military intelligence once again hijacked Americans’ hardware to commandeer
critical data,” said Metcalf. “In the face of continued aggression by our
nation-state adversaries, the U.S. government will respond just as
aggressively. Working with the FBI — and our partners around the world — we are
committed to disrupting and exposing such threats to our nation’s
cybersecurity.”
Assistant
Attorney General for National Security John A. Eisenberg added. “The GRU’s
predatory use of networks in American homes and businesses for its malicious
cyber operations remains a serious and persistent threat,” said “NSD will
continue to use every tool at our disposal to detect such intrusions and expel
hostile foreign actors from our Nation’s networks.”
“Operation
Masquerade — led by FBI Boston — is the latest example of how we’re defending
our homeland from Russia’s GRU, which weaponized routers owned by unsuspecting
Americans in more than 23 states to steal sensitive government, military, and
critical infrastructure information,” said Special Agent in Charge Ted E.
Docks, of the FBI’s Boston Field Office. “The FBI utilized cutting edge
technology and leveraged our private sector and international partners to
unmask this malicious activity and remediate routers. Now we’re asking everyone
who has a router to secure it, update its firmware, and replace it if needed.
By working together, we can guard against nefarious nation state actors trying
to compromise our national security.”
“Operation
Masquerade demonstrates the FBI’s commitment to identifying, exposing, and
disrupting the Russian government's efforts to compromise American devices,
steal sensitive information, and target critical infrastructure,” said
Assistant Director Brett Leatherman of FBI’s Cyber Division. “GRU actors
compromised routers in the US and around the world, hijacking them to conduct
espionage. Given the scale of this threat, sounding the alarm wasn't enough.
The FBI conducted a court-authorized operation to harden compromised routers
across the United States. We urge all router owners to take the remediation
steps outlined today, because defending our networks requires all of us. The
FBI will continue to use its authorities to identify and impose costs on state-sponsored
actors who target the American people.”
According
to court documents unsealed in Philadelphia, the FBI developed a series of
commands to send to compromised routers in the United States, designed to
collect evidence regarding the GRU actors’ activity, reset DNS settings (i.e.,
remove GRU DNS resolvers and force routers to obtain legitimate DNS resolvers
from their Internet Service Providers (ISPs)), and to otherwise prevent the GRU
actors from exploiting the original means of unauthorized access.
As
described in court documents, the government extensively tested the operation
on firmware and hardware for affected TP-Link routers. Other than stymieing the
GRU’s ability to access the routers, the operation did not impact the routers’
normal functionality or collect the legitimate users’ content information.
The
court-authorized steps to remediate compromised routers can be reversed by
legitimate users at any time through factory resets with hardware reset
buttons. Legitimate users can also reverse changes by logging into web
management pages and restoring desired settings (e.g., factory default
settings).
The
FBI is working with ISPs to provide notice of the operation to users of SOHO
routers covered by the court’s authorization. If you believe you have a
compromised router, please contact your local FBI field office or file a report
with the FBI’s Internet Crime Complaint
Center.
Paul Davis’s Crime Beat column appears here each week. He is also a contributor to Broad + Liberty and Counterterrorism magazine. He can be reached via pauldavisoncrime.com.
Note: You can read my previous Crime Beat columns via the link below:
Paul Davis On Crime: My Philly Daily Crime Beat Columns