Category: Uncategorized

  • Ongoing Tales of Syrian Chemical Weapons – Consortium News

    Ongoing Tales of Syrian Chemical Weapons – Consortium News


    Ian Henderson, “Inspector A” of the OPCW’s skeptical insider analysis of chemical attacks in Syria, responds to allegedly newly-found, un-declared chemical weapons.

    Douma, Syria, Feb. 25, 2018. (Fathi Nizam/Wikimedia Commons)

    By Ian Henderson
    Special to Consortium News

    If Douma, one of the highest-profile “proven” chemical attacks attributed to Syria’s former Bashar Assad government has been shown to be fake, what does it say about new, undeclared Syrian chemical weapons that have supposedly been found?

    It says we should be extremely skeptical about news of such discoveries. 

    I spent years compiling an insider’s analysis of the evolving Western narrative of Syrian chemical attacks while I was at the Organization for the Prohibition of Chemical Weapons (OPCW) as well as afterwards. 

    My conclusion was it is nigh impossible to prove a negative in this situation; to say there had never been a chemical attack by the Syrian government forces.

    However, when it came to high-profile allegations of such attacks in the Syrian towns of East Ghouta, Khan Sheykhoun, Ltamenah, Saraqib and Douma, there were fatal flaws in the official narratives.

    There were unmistakable signs, clear to us on the inside, of fabrication. 

    The Douma attack eight years ago appeared to be the last of a series of chemical allegations against the regime.

    Yet the saga continues. The OPCW sent a new mission to Syria this May to try to find alleged, undeclared chemical weapons from the government of Bashar al-Assad, who was ousted in 2024.

    Before examining the intentions and results of this mission, it is useful to review how the Western-backed OPCW handled its investigation into the 2018 chemical weapons attack in Douma, a suburb of Damascus.

    I was an OPCW inspector on that mission and this is why I blew the whistle.

    The Establishment Narrative

    Syrian President Bashar al-Assad in July 2020, during a visit to the Kremlin. (The Kremlin)

    Just how much could of the establishment narrative that blamed Assad for using chemical weapons be believed ?

    Devised during the early part of the Western and Gulf-backed jihadist war to overthrow Assad a decade and a half ago – and built upon steadily by Western belligerents throughout the crisis – the story that Assad had “gassed his own people” was widely believed with mainstream media fully on board. 

    Doubters were glibly dismissed, including “official” dissenters such as some senior inspectors at the OPCW. I was among them.

    The chemical allegations followed a well-oiled procedure. Armed opposition groups – who were seeking direct Western military intervention to support their effort to overthrow Assad – would raise the alarm online by posting slick images and videos of an alleged chemical attack.

    These opposition groups, sometimes assisted by Western NGOs, would then bring supposed witnesses of these alleged attacks to Gaziantep in Turkey, where the OPCW would send fact-finding missions to interview them.

    The OPCW would generally believe the opposition groups and their witnesses and accept items of supposed “evidence” handed over to them, sometimes months after the alleged attack. Until the Douma allegation in 2018, the fact-finding mission never got to the scene of any Syrian chemical attack after an initial attempt in 2014 went awry.

    The fact-finding report would be secretly drafted under the direct control of OPCW top management, bypassing any procedural or technical oversight, and would conclude that it was “reasonable to believe” that a chemical attack had indeed taken place.

    The follow-up investigations by the heavily politicized Joint Investigative Mechanism (J.I.M.), or by the later Investigation and Identification Team (I.I.T.), would suggest that “a reasonable person would believe” that the Syrian Armed Forces were responsible for the attack.

    OPCW inspectors are not fools. Many of us saw what was going on, seeing the tight political control that the U.S. and to a lesser degree the U.K. exerted over anything to do with the Syrian file. But the draconian confidentiality regime in the OPCW kept everyone subdued.

    The breakthrough came after the April 2018 Douma allegation.

    For the first time, an OPCW team actually got to the scene of an alleged chemical attack, at the town of Douma, in southwestern Syria, about 10 kilometers (6 miles) northeast of Damascus.

    We did our job thoroughly, and in doing so we identified serious flaws in the allegation.

    OPCW Extreme Measures

    Headquarters of the Organisation for the Prohibition of Chemical Weapons in The Hague, The Netherlands. (CEphoto/Wikimedia Commons/ CC BY-SA 4.0)

    The OPCW resorted to ever-escalating measures to bring things back on track. After trying to secretly modify the interim report by withdrawing it from publication and sneaking in the preordained conclusions that were required by influential delegations, senior OPCW officials went to extremes.

    They removed all the team members who had gone to Douma and produced a flawed Fact Finding Mission report written by persons unknown, none of whom had much knowledge of what the Douma team had done.

    The fact-finding report predictably found that “it was reasonable to believe” there had been an attack with chlorine in Douma. This was followed much later by the OPCW’s inevitable I.I.T. report that blamed the Syrian regime for the attack.

    In reaching its conclusions, the drafters claimed, as usual, to have been informed by anonymous experts. The context in the reports was usually along the lines of  the fact-finding mission (F.F.M.) “asked an expert about this and the expert said it was possible.” Many qualified experts and commentators, including me, consider this laughable.

    The OPCW were going too far, and ultimately this led to the ongoing dispute where the two most senior and experienced inspectors in the F.F.M. team objected.

    The drafter of the team’s interim report, Dr. Brendan Whelan (“Inspector B”), was one. I was the other. In my case I had also led the politically-mandated inspections at two facilities of the Syrian Scientific Studies and Research Centre (S.S.R.C.) suspected of harbouring illicit chemical weapons activities.

    Here again, we did our work thoroughly and in drafting the S.S.R.C. inspection reports I made clear that there was nothing amiss in either of the facilities.

    This didn’t stop the U.S., U.K. and France from conducting punitive missile strikes on Barzah S.S.R.C., on the basis of social media postings on the Douma allegation, even before the OPCW team had arrived at the incident scene.

    Destroyed Barzah Syrian Scientific Studies and Research Centre labs, Nov. 7, 2018. (Ian Henderson/OPCW/courtesy former Syrian government)

    Rather than another detailed analysis of the Douma scandal, suffice it to say, the official Douma narrative has been clearly and scientifically picked apart by many credible observers, including by Dr. Whelan and me.

    This has been widely reported, although predictably not much in the mainstream media.

    The OPCW and Western delegations have been in crisis management mode ever since the first leak, that of an internal engineering summary that cast doubt on the allegation that chlorine cylinders had been dropped from aircraft, raising the possibility that militants had placed the cylinders to stage the scene of a chemical attack.

    I was the author of that report.

    Nose of chlorine cylinder alleged to have smashed through a steel-reinforced concrete roof at apartment building “Location 2,” April. 21, 2018. (OPCW, courtesy former Syrian government)

    Worse still for the prevailing Douma narrative, Dr. Whelan recently won a legal case against the OPCW for their charges against him of confidentiality breaches.

    In their submissions, the OPCW inadvertently admitted to suppressing the key toxicology assessment (incidentally by NATO specialists) that dismissed chlorine as the likely cause of death of deceased victims shown in images posted from the scene.

    [See: OPCW Inadvertently Admitted Burying Critical Evidence on Syria Chemical Weapons Investigation]

    The OPCW has refused to engage in any discussion on the facts and scientific substance of the case, ever since concerns were first raised by Dr. Whelan and me.

    This intransigence to re-open the file is likely dictated by the needs of the three belligerent governments that subjected Syria to punitive missile strikes in retaliation for the supposed Syrian chemical attack even before the Douma F.F.M. had started work.

    Any updated or corrected findings on Douma would be inconvenient.

    The New OPCW Mission

    Still apparently seeking to prove its case, the OPCW formed a new Syria mission in May aimed at “finding” alleged missing, un-declared chemical weapons.

    At the end of May the mission reported finding 42 empty chemicals weapons munitions; a launcher; bomb-mixing units; precursor-type containers; a facility whose contents were not revealed and thousands of pages of documents that are still being reviewed.

    The mission also found 650 kg of “a chemical compound known to have been used by the former government for the production of nerve agents,” which the report does not name. It says an unknown quantity of hexamine, a legal chemical with wide industrial use, was found but it is not clear if this is the same compound as in the 650 kg.  

    In September, the Syrian government, now under the leadership of a former al-Qaeda and ISIS leader, began destroying the empty bombs, but not any of the chemicals that were found, presumably meaning none were banned.

    Despite all the fanfare of these results being presented at a U.N. Security Council meeting last month, it appears that the new OPCW mission came up as empty as those bombs. 

    None of these discoveries does anything to prove that Assad ever used a chemical weapon, in other words, nothing to prove that I, along with other OPCW officials and countless observers and commentators who challenged the Assad chemical weapons narrative were wrong. 

    Presumably after all the effort in creating that narrative, Western governments and mainstream media that promoted the Iraq war and then the Syrian conflict to achieve regime change in that country, require a tidier ending than the mess they made of the Iraqi WMD story. 

    Sept. 3 U.N. Security Council meeting on OPCW mission:

    An early press release from the OPCW is telling. It shows what they were attempting to prove with this May mission, in particular two rather flimsy suggestions.

    They report the discovery of some of the empty munitions,

    “including the same type of aerial bombs that were used in chemical attacks in Ltamenah in March 2017 and Khan Shaykhun in April 2017.”

    This refers to empty M4000 aerial bombs, declared by the Syrians as part of their stockpile.

    Aside from the questionable Douma-like irregularities surrounding “evidence” used by the OPCW to conclude that sarin-filled M4000 bombs were used in those attacks, it’s important to mention something else.

    The Syrians had clearly explained to us that 2,000 of these bombs, never filled, had been set aside to be “repurposed,” in other words to be filled with high explosive to turn them into conventional munitions. These could turn up anywhere.

    A second questionable statement in the press release is,

    “Rockets were also found, of the same type as those that were used in the Ghouta chemical weapons attack in August 2013.” 

    This relates to artillery rockets crudely modified with a large cylindrical payload container added at the front.

    For a start, the U.N./OPCW report of Ghouta did not attempt to identify the perpetrators of that sarin attack, since it was not part of their mandate. The accusations against the regime have always been political, something the mainstream media happily took up.

    The Most Credible Analysis So Far

    The Ghouta sarin attack took place on Aug. 21, 2013 and according to Western sources killed more than 1,000 people in the Damascus suburb.

    The most serious investigation of the Ghouta incident to date points to the attack being launched from opposition-occupied positions, and remains the most credible analysis of the attack.

    Indeed the U.N./OPCW team was in Damascus at the time of the attack in Ghouta because it was responding to an earlier request from the Syrian government to investigate chemical attacks against their forces.

    The OPCW release also mentions a typical catch-all referring to “quantities of separately stored chemicals and related equipment, the nature of which is currently under technical analysis.” 

    There will always be suggestions of vague bits and pieces, rusty remnants that “may have been a part of” alleged undeclared elements of a chemical weapons program.

    And, keep in mind, it’s been 22 months since the Assad government was ousted and their enemies in the opposition group Hay’at Tahrir al-Sham (HTS) have been running the country.

    So far as I can see, the OPCW hasn’t found anything remotely close to the desired smoking gun. Anything real, I should say.

    Partners in the Anti-Assad Chemical Narrative

    Syrian President Ahmaad Al Shaara, former Al Nusra/HTS fighter, with Secretary of State Marco Rubio in New York City, September 2025. (State Department Photo, Wikimedia)

    We need to keep in mind how this is working. There are three partners in this latest endeavour on the anti-Assad chemical narrative.

    First, we have the Western governments, belligerents in the Syrian conflict, which worked hard on building the chemical narrative to delegitimise the regime.

    The U.K. government offered specialists to check out suspected sites in Syria to prepare them for the May mission in order to “assist” the current government in finding evidence of hidden chemical weapons.

    That leads us to the second group, the government in Syria, reportedly eager to please their Western sponsors in return for economic favours. They are the Al-Nusra/HTS extremists who, in the case of Douma, fabricated the scene to raise a chemical false flag allegation against the Assad. 

    The third partner is the OPCW.

    That means the various groups who have been on this mission are a). those who staged scenes of chemical attacks; b). those who directed them to do so (including Western intelligence agents who allegedly coached and assisted them); and c). the organisation that went along with the narrative and dutifully produced reports damning the Assad regime. 

    It may appear to the reader that I’m suggesting that the OPCW reports on Syrian chemical weapons will continue to be little more than propaganda, the usual sexed-up nonsense. Perhaps so. In disputing this, these assertions will be dismissed as conspiracy theories.

    However, this argument is weakened because the source of the alternative narrative is the scientists and senior inspectors (many “Western”) from within the OPCW teams, including the Douma fact-finding mission and Scientific Studies and Research Centre inspections.

    This is why Douma remains a key element in the debate. If they did it once (and doggedly stuck to their guns), they probably did it before.

    Many serious and eminent observers are imploring the OPCW to conduct a review of the Douma case, including by the OPCW’s own Scientific Advisory Board.

    I see this being done by credible, independent and neutral experts in the fields of chemistry, toxicology, metallurgy and engineering, overseen by the relevant professional institutes.

    These experts would report their findings transparently, putting their names and reputations behind their analysis. This will clear up the Douma controversy, either demonstrating that it could have actually happened as alleged, or demonstrating the flaws in the OPCW reports.

    Exposing a clear and deliberate fraud would seriously weaken the Western narrative on alleged Syrian chemical attacks. Therefore, in my view, it is not going to happen under the purview of the OPCW.

    Ever.

    I don’t mean to suggest that those calling for a review are unrealistically hopeful.  But the risks of such a review are perhaps too high for it ever to be envisaged by the Western group that was aligned with the efforts on regime change in Syria — chiefly the U.S., the U.K. and France.

    This does not mean it can’t happen. There is more than enough open-source material, as well as now-unclassified facts, images, analysis results and information available from the OPCW itself, from former OPCW officials and inspectors, and held by Member States, that would support a credible in-depth review.

    The basis for expert analysis would be the material used in the fact-finding mission and I.I.T. reports themselves.

    By now we know there isn’t any “smoking gun” evidence. If there had been, it would have been cited in the mission and I.I.T. reports.

    Trust me, this study will bear clear results. My hope is that someone sufficiently curious and responsible will commission and fund it.

    Ian Henderson served as an OPCW inspector from the establishment of the Chemical Weapons Convention in 1997, and was appointed as one of the first Inspection Team Leaders. An experienced chemical engineer with military experience, he led many of the more complex missions to more than 55 countries. After returning to a career in the chemical industry for 10 years he rejoined the OPCW in 2016 as part of the “rehire” scheme aimed at bringing back experienced inspectors. It was during this time that he became involved in the Syrian chemical weapons operations and, along with others, objected to the apparent influences of political control in the organization. He was suspended from the OPCW in May 2019 after the leak (by unknown others) of his dissenting engineering report on the Douma cylinders.



    Source link

  • ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132

    ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132



    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.



    Source link

  • TP-Link Sued by Four More U.S. States Over Router Security and China Ties

    TP-Link Sued by Four More U.S. States Over Router Security and China Ties


    Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court.

    TP-Link Systems is based in Irvine, California. Until a 2024 restructuring, it was affiliated with TP-Link Technologies, a Chinese company that the suits do not name as a defendant.

    The complaints from Florida, Montana , and Nebraska do not allege that the Chinese government has obtained customers’ data through TP-Link. They describe that as a risk under Chinese law. Separately, they say state-backed hackers have exploited flaws in TP-Link routers.

    Iowa’s announcement is worded more strongly in places. Attorney General Brenna Bird’s office said TP-Link firmware gives the Chinese government access to Iowans’ devices and data. The same release also describes that access as something that could happen.

    The next day, 21 state attorneys general sent a letter to the Federal Communications Commission (FCC) about TP-Link’s effort to win approval for new router models in the U.S.

    Three of the complaints also cite five flaws in TP-Link devices supplied by internet service providers (ISPs) to customers. Researchers published technical details of those flaws on October 8. Fixes exist, and they reach users through their ISP.

    What The States Allege

    The suits were filed in state courts under consumer-protection laws. The Florida, Montana, and Nebraska complaints share section headings and passages and make the same main claims.

    The first is that TP-Link advertised security it did not deliver. The complaints quote TP-Link’s web page for HomeShield, its built-in network protection service, as saying it “covers all security scenarios.” The U.S. HomeShield page still said so on October 9.

    Cybersecurity

    The complaints set that against routers that were hacked and models that no longer get fixes. One example is two versions of the Archer AX21. TP-Link no longer updates them and says they reached end of life in May 2024, according to the complaints.

    The second claim is that TP-Link overstated its split from China. The complaints quote the company as saying that the restructuring left it with “entirely different ownership, management, and operations” from those of TP-Link Technologies.

    TP-Link and TP-Link Technologies together employed about 11,000 people in China, according to an April 2025 Bloomberg News report the states cite.

    TP-Link says routers for the U.S. market are made in Vietnam. Only 0.5% of the parts used at its Vietnamese factory, by value, are sourced in Vietnam, and the rest are sourced from or through China, according to the complaints.

    The third claim is that TP-Link’s privacy policies leave out a risk. Its Tether, Tapo, Deco and Kasa Smart apps collect email addresses, location and phone identifiers. A 2017 Chinese intelligence law could expose that data to Chinese intelligence agencies, according to the complaints.

    Florida wants a permanent court order against the practices, the surrender of money made from them, and $10,000 for each willful violation. Montana seeks up to $10,000 per violation.

    Nebraska also wants TP-Link ordered to tell buyers where its products and parts come from, about its ties to China, and about known vulnerabilities that have been exploited in its devices.

    TP-Link’s Response

    “The coordinated lawsuits are built on false premises. They do nothing to advance national security while unfairly penalizing an industry-leading U.S. company,” Steve Kovsky, the company’s corporate affairs officer, said in a statement issued the day the suits were filed.

    For months, the statement said, TP-Link has given state regulators documents showing that its U.S. devices are made in Vietnam. It described itself as “an independent, U.S. company that is not owned or controlled by any foreign government.”

    “We do not, and will not, share customer network data with foreign governments or unauthorized third parties,” it said.

    What The Cited Attacks Show

    The complaints point to real attacks in which hackers took over TP-Link routers.

    Microsoft reported in 2024 that a hacking group it believes is in China had built a network of hacked small-office and home routers. The network was used for password-spray attacks, which try common passwords across many accounts.

    TP-Link routers “make up most of this network,” Microsoft said, counting an average of 8,000 hacked devices active at any time.

    The complaints themselves say devices from other brands were hacked as part of the same network.

    The FBI said in April that Russian military intelligence hackers had compromised TP-Link routers through a flaw tracked as CVE-2023-50224. They changed the routers’ DNS settings and collected passwords and login tokens. TP-Link said in May that, with one exception, the products affected by that flaw had reached end of life.

    The claim that Chinese state hackers used TP-Link routers in the Volt Typhoon and Flax Typhoon campaigns rests on testimony given in 2025. Rob Joyce, a former National Security Agency cybersecurity director, told a House committee that TP-Link routers “were among the various brands” exploited. His written testimony cites no source for that.

    TP-Link disputed the testimony the same day, saying those campaigns “have no discernible preference for using TP-Link routers as a vector.”

    None of the three complaints says TP-Link built a backdoor into its products. The one backdoor they name, Horse Shell, was placed on TP-Link routers by a Chinese state-backed hacking group, according to Check Point Research, which the complaints cite.

    The complaints also note that the U.S. Department of Defense in June listed TP-Link Technologies as a Chinese military company. That is the Chinese firm. TP-Link Systems, the company being sued, is not on the list.

    The FCC Letter

    Since March 23, the FCC has barred new foreign-made consumer routers from the equipment authorization they need before they can be sold in the United States. The only exception is a router that wins a “Conditional Approval.”

    Those approvals are decided by the Department of Homeland Security or the Department of Defense, which the FCC’s notice calls the Department of War.

    The rule covers routers made in any foreign country, whatever the maker’s nationality. It applies by place of production, not by company.

    Routers authorized before the rule can continue to receive software and firmware updates “that mitigate harm to U.S. consumers” until at least March 1, 2027, under an FCC waiver.

    TP-Link said in April that its existing routers “remain fully authorized” and that it was “actively pursuing Conditional Approval for new products.”

    The letter, led by Nebraska Attorney General Mike Hilgers and signed by 20 others, raises three concerns with the FCC. They are TP-Link’s security claims, its claims about separating from China and building routers in Vietnam, and what its privacy disclosures leave out about Chinese intelligence law.

    The letter offers to work with the FCC. It does not ask the agency to deny, delay, or attach conditions to an approval.

    “Consumers should be aware of these risks and the FCC should address them before authorizing these new routers for sale in U.S. markets,” Hilgers said in announcing the letter.

    Montana Attorney General Austin Knudsen said he hoped the FCC would refuse the approval.

    Flaws In ISP-Supplied Devices

    Aginet is TP-Link’s line of mesh systems, routers, and modems that ISPs install for customers and keep up to date.

    The complaints from Florida, Montana, and Nebraska cite five flaws in those devices as evidence that TP-Link’s security problems persist. TP-Link disclosed the flaws on August 10. On October 8, the SEC Consult researchers who found them published the technical details.

    Together, the flaws “allowed an unauthenticated attacker on the same network to fully compromise the affected device,” SEC Consult said, and to run commands as root, the highest privilege level.

    Cybersecurity

    The attacker must first be able to reach the device’s web management interface. Neither SEC Consult nor TP-Link says whether that interface can be reached from the internet.

    The main flaw, CVE-2025-30237, allows crafted web requests to bypass the login check. With it, an attacker without an account can create a “Superadmin” user and enable SSH remote access, according to SEC Consult.

    CVE What It Allows What An Attacker Needs TP-Link Rating (CVSS 4.0, Out Of 10) Models Listed, Of 65
    CVE-2025-30237 Privileged actions on the web interface without logging in Network access to the web management interface 8.7, High 56
    CVE-2025-30238 A low-privileged account can create a high-privileged account and enable SSH A valid low-privileged login 8.6, High 59
    CVE-2025-30239 Stored passwords can be decrypted because the keys are hardcoded per model. On some setups this includes the ISP’s remote-management credentials Access to the device’s stored configuration 8.5, High 65
    CVE-2025-30240 Files on the device can be read through a crafted link on a USB stick Physical access to the USB port 5.1, Medium 33
    CVE-2025-30241 Operating-system commands run with elevated privileges A login to the web interface 8.6, High 31

    SEC Consult calls the set of flaws critical.

    TP-Link lists 65 affected models in its HB, HX, and HC mesh series, its EB, EC, and EX router series, its XC and XX fiber devices, and its VX DSL modems. Only 27 of them are listed for all five flaws, according to the CVE records TP-Link published. Versions that ISPs have customized are also affected, and TP-Link does not list those.

    Owners may not be able to download the fix themselves. The updates are delivered through each ISP, and firmware for ISP versions “may not be publicly available for direct download,” TP-Link’s advisory says.

    TP-Link advises users to check the device’s management interface or its app for a firmware update. If none is offered, they should contact their ISP.

    SEC Consult lists no workaround. Neither advisory says how many devices have received the fix.

    SEC Consult reported the flaws to TP-Link in December 2024, and TP-Link’s advisory followed nearly 20 months later. Most of the fixed firmware had been released by February 2026, according to SEC Consult’s timeline.

    SEC Consult left the exploit commands out of its advisory. Neither advisory reports attacks that use the flaws. None of the five was in the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities as of its October 8 release.

    Neither the complaints nor the advisories tie these flaws to the attacks described above, or to the allegations about China.



    Source link