Central Command shuts down social media sites hacked by ISIS supporters

Hackers identifying themselves with the Islamic State or ISIS embarrassed the U.S. military's Central Command with attacks on its social media sites Monday while President Obama spoke in Washington about protecting online networks against cyber attacks.

The breach caused little actual damage but gave Islamic radicals another propaganda coup online, where more of the country's adversaries are looking to score victories, said Colin Clarke, a warfare researcher with Rand Corporation in Pittsburgh.

“We've seen with ISIS, more so than with terrorist groups in the past, that they're devoting resources to media, public relations, propaganda,” Clarke told the Tribune-Review. “They're constantly tweeting and releasing things in real time. This is just a reminder.”

U.S. Central Command confirmed to the Trib that its social media sites were hacked. CentCOM worked with Twitter and YouTube to get all of its accounts locked down in a process that took about an hour.

CentCOM spokesman Maj. Brian Fickel said operational military networks were not compromised and the military agency's operations were not impacted by what the command is calling an act of cybervandalism. The social media sites would be restored, he said.

“This wasn't a compromise through any military system,” Fickel told the Trib. “It was compromised through something commercial.”

Rep. Michael McCaul, R-Texas, who chairs the House Homeland Security Committee, said the incident was “severely disturbing.” He compared the incident with attacks on Sony Entertainment last month that Obama blamed on North Korea.

McCaul said the United States needs to define clear consequences for online adversaries.

“Extremists are developing the capability to conduct cyberattacks against U.S. interests and those of our allies,” McCaul said. “Assaults from cyber-jihadists will become more common unless the administration develops a strategy for appropriately responding.”

Information and pictures on CentCOM's sites were replaced with words and images promoting ISIS around 12:45 p.m. On the command's Twitter site (@CENTCOM), images and messages were replaced by an image of an Islamic State attacker next to the words “CyberCaliphate” and “i love you isis.”

Subsequent messages showed information that appeared to be about U.S. military situational protocols for dealing with China and North Korea — including the latter's nuclear capabilities. The hackers also posted a public directory of Pentagon employees and retirees.

On YouTube.com, the hackers displayed two pro-ISIS videos showing attacks on U.S. troops.

None of the information posted was classified, and it had not come from CentCOM's server, officials said. The military command notified law enforcement about the potential release of personal information and will be contacting people whose information was posted.

Because the hack focused on the social media sites rather than CentCOM's own servers, it was more embarrassing than dangerous, Clarke said.

“It's very important to differentiate,” he said. “Twitter is a lot more vulnerable than something run by CentCOM would be. Twitter accounts are hacked all the time. It's less concerning than if it had been a CentCOM network.”

The hack raises questions about how well the government is protecting its passwords — and about how long it took for CentCOM to take down the accounts, said Steven Stalinsky, executive director of the Middle East Media Research Institute, a Washington nonprofit that has tracked Islamic radicals' use of social media. The group issued a report last year finding ISIS groups had posted more than 200 images of beheadings to social media sites.

“This is what's going to keep happening — this kind of hacking by jihadi groups,” Stalinsky said. “There's a whole new generation of tech-savvy jihadis.”

The attacks Monday could have been carried out by hackers who are sympathetic with the Islamic State rather than by ISIS fighters actually living in Syria or Iraq, he said. Moments after the CentCOM sites were hacked, other ISIS fighters were retweeting stories about the incident and posting messages on a pro-ISIS message board, Stalinsky said.

“We defeated Twitter's administration, hacked the Americans' accounts, gathered their data and terrified their leadership ...,” one user posted in a message translated by the Research Institute.

Separately, hackers who identified themselves with the group Anonymous took over websites for a French jihadi website over the weekend, and said on Twitter that they were retaliating for the fatal gun attack on a French satire magazine in Paris last week.

“It is our responsibility to act,” Anonymous said in a video posted with the Twitter handle @OpCharlieHebdo. “... Anonymous has always fought for freedom of speech and freedom of the press. We will never stop.”

Monday's online incident could have had more than just propaganda value if the hackers had used their access to send out messages that appeared to be coming from CentCOM, Stalinsky said. The stock market dipped $136 billion in 2013 after hackers used a compromised Associated Press Twitter account to say the White House had been attacked.

“It's definitely an annoyance but it could have been more dangerous if they had sent out fake tweets,” Stalinsky said. “That's something social media companies have to address, and government agencies have to do better with their passwords.”

Officials with Twitter and YouTube did not immediately respond to requests for comment.

The CentCOM breach happened as Obama gave a speech in Washington about the need for stronger cybersecurity. He plans to appear Tuesday at the Department of Homeland Security to talk about how federal agencies can work with the private sector to defend against cyber attacks.

“If we're going to be connected, then we need to be protected,” Obama said at the Federal Trade Commission on Monday. “As Americans, we shouldn't have to forfeit our basic privacy when we go online to do our business.”

The Trib began last year publishing a series of stories called “Cyber Rattling: The Next Threat,” reporting on the threat of hack attacks on government, the military and the nation's infrastructure. Those stories are available at Triblive.com (click on the “Investigative” tab) or on Twitter at #TribCyber.