Tag Archives: Britain

UK police hunt Manchester bomber’s network, angered by U.S. leaks

City council employees move flowers from the townhall in Albert Square to St Ann's Square in Manchester, Britain, May 24, 2017. REUTERS/Peter Nicholls

By Michael Holden and Andy Bruce

MANCHESTER, England (Reuters) – Police scrambled to close down a network around the Manchester suicide bomber with arrests in Britain and Tripoli on Wednesday, as details about the investigation were leaked to U.S. media, infuriating authorities who fear a second attack is imminent.

British-born Salman Abedi, 22, who was known to security services, killed 22 people at a concert venue packed with children on Monday.

Authorities believe he had help in building the bomb, which photographs published by the New York Times showed was sophisticated and powerful, and that his accomplices could be ready to strike again.

Manchester police arrested five men and one woman on Wednesday, bringing the total held for questioning to seven, and searched multiple addresses in northern and central England.

Explosives were found at one site, the Independent reported, citing security service sources.

A source said British investigators were hunting for anyone who may have helped build the suicide bomb.

“I think it’s very clear that this is a network that we are investigating,” police chief Ian Hopkins said outside Manchester police headquarters.

“And as I’ve said, it continues at a pace. There’s extensive investigations going on and activity taking place across Greater Manchester as we speak.”

Abedi, who was born in Manchester in 1994 to Libyan parents, blew himself up on Monday night at the Manchester Arena indoor venue at the end of a concert by U.S. pop singer Ariana Grande attended by thousands of children and teenagers.

Police in Tripoli on Wednesday arrested Abedi’s younger brother and his father, who said he did not expect the attack.

“I spoke to [Salman Abedi] about five days ago … there was nothing wrong, everything was normal,” Ramadan Abedi told Reuters, moments before he was arrested.

A spokesman for the local counter-terrorism force said his brother Hashem Abedi was arrested on suspicion of links with Islamic State and was suspected of planning to carry out an attack in the Libyan capital.

The first arrest made in Britain on Tuesday was reported by British and U.S. media to be Abedi’s older brother.

Earlier, interior minister Amber Rudd said the bomber had recently returned from Libya. Her French counterpart Gerard Collomb said he had links with Islamic State and had probably visited Syria as well.

U.S. LEAKS

Authorities in Britain have become increasingly angered by U.S. leaks from the investigation, including the bomber’s name on Tuesday and the photos of blood-stained fragments from the bomb on Wednesday.

British police chiefs said the breaches of trust between security service partners were undermining their efforts.

Rudd had earlier scolded U.S. officials for leaking details.

“The British police have been very clear that they want to control the flow of information in order to protect operational integrity, the element of surprise, so it is irritating if it gets released from other sources, and I have been very clear with our friends that should not happen again,” she said.

But, hours after the warning, the New York Times published the detailed photographs.

A government source told the Guardian newspaper, “Protests have been lodged at every relevant level between the British authorities and our U.S. counterparts.”

British Prime Minster Theresa May will meet U.S. President Donald Trump at a NATO summit in Brussels on Thursday, but officials said she would cut short the second leg of her trip to the G7 summit in Italy.

The Manchester bombing has raised concern across Europe.

Cities including Paris, Nice, Brussels, St. Petersburg, Berlin and London have suffered militant attacks in the last two years.

SOLDIERS ON THE STREETS

The 22 victims in Manchester included an eight-year-old girl, several teenage girls, a 28-year-old man and a Polish couple who had come to collect their daughters.

Britain’s official terror threat level was raised to “critical”, the highest level, late on Tuesday, meaning an attack was expected imminently.

But with just over two weeks to go until a national election, May’s Conservatives and political parties said they would resume campaigning in the coming days.

The Manchester bombing was the deadliest attack in Britain since July 2005, when four British Muslim suicide bombers killed 52 people in coordinated attacks on London’s transport network.

Rudd said up to 3,800 soldiers could be deployed on Britain’s streets, taking on guard duties to free up police to focus on patrols and investigation. An initial deployment of 984 had been ordered, first in London and then elsewhere.

Soldiers were seen at the Houses of Parliament, May’s Downing Street residence and at the London police headquarters at New Scotland Yard.

The Changing of the Guard ceremony at Buckingham Palace, a draw for tourists, was canceled because it requires support from police officers, which authorities decided was not a good use of resources given the threat level.

A source close to the bombing investigation told Reuters that the focus was on whether Abedi had received help in putting together the bomb and on where it had been done.

The bomb used in the attack appeared to contain carefully packed shrapnel and have a powerful, high velocity charge, according to leaked photographs from the investigation published by the New York Times.

The BBC reported that security services thought the bomb was too sophisticated for Abedi to have built by himself.

Police arrested three people in South Manchester, one woman in North Manchester, a man in the nearby town of Wigan, and another man in the central English town of Nuneaton.

CANCELED TOUR

Ariana Grande’s representative said on Wednesday she was suspending her tour to assess the situation and to “pay our proper respects to those lost”. The U.S. singer had been scheduled to perform two shows at London’s O2 arena this week.

Chelsea soccer club said it had canceled a victory parade that had been set to take place on Sunday to celebrate its Premier League title.

Several high-profile sporting events are coming up in Britain, including the soccer FA Cup final at London’s Wembley Stadium and the English rugby club competition final at Twickenham on Saturday and the UEFA Champions League final at Cardiff’s Millennium Stadium on June 3.

Britain also has a national election scheduled for June 8.

All campaigning was suspended after the attack, although major parties said they would resume some activities on Thursday and national-level campaigning on Friday.

The government said a minute’s silence would be held at all official buildings at 1000 GMT (6.00 a.m. ET) on Thursday.

Greater Manchester Police said they were now confident they knew the identity of all the people who lost their lives and had made contact with all the families. They said they would formally name the victims after forensic post-mortems, which would take four or five days.

The bombing also left 64 people wounded, of whom 20 were receiving critical care for highly traumatic injuries to major organs and to limbs, a health official said.

France, which has repeatedly been hit by devastating militant attacks since 2015, extended emergency powers.

(For a graphic showing where the blast hit, click http://tmsnrt.rs/2rbQAay)

(Additional reporting by Guy Faulconbridge, Costas Pitas, Kate Holton, Alistair Smout and Kylie MacLellan in London, and Mark Hosenball in Washington, Writing by Estelle Shirbon, Paul Sandle and William James; Editing by Angus MacSwan, Toni Reinhold)

Manchester bomber was part of a network: police

Messages and floral tributes left for the victims of the attack on Manchester Arena lie around the statue in St Ann's Square in central Manchester, May 24, 2017. REUTERS/Jon Super

By Michael Holden and Andy Bruce

MANCHESTER, England (Reuters) – The Manchester suicide bomber who killed 22 people at a concert venue packed with children was part of a network, the city’s chief of police said on Wednesday as troops deployed across Britain to help prevent further attacks.

Police made four new arrests and searched an address in central Manchester. A source said investigators were hunting for accomplices who may have helped build the suicide bomb and who could be ready to kill again.

“I think it’s very clear that this is a network that we are investigating,” police chief Ian Hopkins said outside Manchester police headquarters.

“And as I’ve said, it continues at a pace. There’s extensive investigations going on and activity taking place across Greater Manchester as we speak.”

Earlier, interior minister Amber Rudd said the bomber, Salman Abedi, had recently returned from Libya. Her French counterpart Gerard Collomb said he had links with Islamic State and had probably visited Syria as well.

Rudd scolded U.S. officials for leaking details about the investigation into the Manchester attack before British authorities were prepared to go public.

The Manchester bombing has raised concern across Europe. Cities including Paris, Nice, Brussels, St Petersburg, Berlin and London have suffered militant attacks in the last two years.

British-born Abedi, 22, blew himself up on Monday night at the Manchester Arena indoor venue at the end of a concert by U.S. pop singer Ariana Grande attended by thousands of children and teenagers.

His 22 victims included an eight-year-old girl, several teenage girls, a 28-year-old man and a Polish couple who had come to collect their daughters.

Britain’s official terror threat level was raised to “critical”, the highest level, late on Tuesday, meaning an attack was expected imminently.

But, just over two weeks away from a national election, Prime Minister Theresa May’s Conservatives and political parties said they would resume campaigning in the coming days.

SOLDIERS ON THE STREETS

The Manchester bombing was the deadliest attack in Britain since July 2005, when four British Muslim suicide bombers killed 52 people in coordinated attacks on London’s transport network.

Rudd said up to 3,800 soldiers could be deployed on Britain’s streets, taking on guard duties to free up police to focus on patrols and investigation. An initial deployment of 984 had been ordered, first in London and then elsewhere.

Soldiers were seen at the Houses of Parliament, Prime Minister Theresa May’s Downing Street residence and at London police headquarters at New Scotland Yard.

A source close to the investigation into the bombing told Reuters that the focus was on whether Abedi had received help in putting together the bomb and on where it had been done.

The BBC reported that security services thought the bomb was too sophisticated for Abedi to have built by himself.

Police arrested three people in South Manchester and another in Wigan, a town 17 miles to the west of the city on Wednesday, bringing the total number of arrests related to the attack to five. Police said they were assessing a package carried by the man in Wigan.

A man arrested on Tuesday was reported by British and U.S. media to be Abedi’s brother. A different brother was also arrested in Tripoli on suspicion of links to Islamic State, local counter-terrorism police said.

Police also said that they had searched an address in central Manchester as part of the investigation.

In London, the Changing of the Guard ceremony at Buckingham Palace, a draw for tourists, was canceled because it requires support from police officers, which authorities decided was not a good use of police resources given the threat level.

Chelsea soccer club said it had canceled a victory parade that had been scheduled to take place on Sunday to celebrate its Premier League title.

Several high-profile sporting events are coming up in Britain, including the soccer FA Cup final at London’s Wembley Stadium and the English rugby club competition final at Twickenham on Saturday and the UEFA Champions League final at Cardiff’s Millennium Stadium on June 3.

U.S. LEAKS “IRRITATING”

Britain also has a national election scheduled for June 8. All campaigning was suspended after the attack, although major parties said they would resume some activities on Thursday and national-level campaigning on Friday.

The government said a minute’s silence would be held at all official buildings at 1000 GMT on Thursday.

Greater Manchester Police said they were now confident they knew the identity of all the people who lost their lives and had made contact with all the families. They said they would formally name the victims after forensic post-mortems, which would take four or five days.

The bombing also left 64 people wounded, of whom 20 were receiving critical care for highly traumatic injuries to major organs and to limbs, a health official said.

Rudd was asked by the BBC about the fact that information about Abedi, including his name, had come out of the United States before it was cleared by British authorities.

“The British police have been very clear that they want to control the flow of information in order to protect operational integrity, the element of surprise, so it is irritating if it gets released from other sources, and I have been very clear with our friends that should not happen again.”

France, which has repeatedly been hit by devastating militant attacks since 2015, extended emergency powers.

(Additional reporting by Guy Faulconbridge, Costas Pitas, Kate Holton and Kylie MacLellan in London, Writing by Estelle Shirbon and William James, Editing by Angus MacSwan)

North American leagues urge vigilance after Manchester attack

A man looks at flowers for the victims of the Manchester Arena attack in central Manchester, Britain May 23, 2017. REUTERS/Stefan Wermuth

By Rory Carroll

(Reuters) – North America’s major sports leagues have strict safety procedures at their arenas but have urged fans attending games to be vigilant following Monday’s suicide bombing at a pop concert in Manchester, England, officials said on Tuesday.

The attack, which killed 22 people, has raised concerns in the U.S. ahead of the Memorial Day holiday weekend, when fans flock to baseball stadiums to kick off the summer.

It also comes during the playoffs for the National Hockey League (NHL) and National Basketball Association (NBA), high-profile games that typically take place before sold-out crowds.

“We already have a very thorough and detailed security plan in place at all of our arenas to ensure the safety of our fans,” said Bill Daly, deputy commissioner of the NHL.

“Obviously, with yesterday’s events, arenas have been reminded to re-double their efforts and to maximize their vigilance”

The league requests that anyone attending a game report anything that they observe as suspicious or out of the ordinary to law enforcement, security or arena personnel, he said.

An NBA official echoed that sentiment.

“We are in communication with the appropriate authorities and taking all necessary precautions to ensure the safety of our fans, teams and staff,” said Mike Bass, an NBA spokesman.

League officials typically do not share the specifics of their security measures for safety reasons.

The attacker in Manchester targeted Europe’s largest indoor arena, which was full to its 21,000 capacity, about the size of most NHL and NBA arenas.

Major League Baseball, which recently began its season and mostly plays its games in outdoor stadiums that are larger than NHL and NBA arenas, has a similar approach to fellow leagues.

“Fan safety and ballpark security are always our top priorities, and we will continue to do everything possible to provide a safe environment for our fans,” the league said in a statement to Reuters.

The National Football League, which has some stadiums that hold more than 80,000 people, is currently in its off-season.

(Editing by Ken Ferris)

British police name suicide bomber, May condemns ‘sickening’ attack

A girl leaves flowers for the victims of an attack on concert goers at Manchester Arena, in central Manchester, Britain May 23, 2017. REUTERS/Peter Nicholls

By Michael Holden and Andy Bruce

MANCHESTER, England (Reuters) – British police on Tuesday identified the suicide bomber who killed 22 people, including children, in an attack on a crowded concert hall in Manchester, and said they were trying to establish whether he had acted alone or with help from others.

The man suspected of carrying out Britain’s deadliest bombing in nearly 12 years was named as Salman Abedi, aged 22, but police declined to give further details about him.

U.S. security sources, citing British intelligence officials, said he was born in Manchester in 1994 to parents of Libyan origin. He is believed to have traveled by train from London before the attack, they said.

“Our priority, along with the police counter-terrorism network and our security partners, is to continue to establish whether he was acting alone or working as part of a wider network,” Manchester Police Chief Constable Ian Hopkins said.

The attacker set off his improvised bomb as crowds streamed out of the Manchester Arena after a pop concert by Ariana Grande, a U.S. singer who is especially popular with teenage girls.

“All acts of terrorism are cowardly,” Prime Minister Theresa May said outside her Downing Street office after a meeting with security and intelligence chiefs.

“But this attack stands out for its appalling sickening cowardice, deliberately targeting innocent, defenseless children and young people who should have been enjoying one of the most memorable nights of their lives.”

Islamic State, now being driven from territories in Syria and Iraq by Western-backed armed forces, claimed responsibility for what it called a revenge attack against “Crusaders”, but there appeared to be contradictions in its account of the operation.

Police raided houses in Manchester and arrested a 23-year-old man.

FRANTIC SEARCHES

Witnesses related the horror of the blast, which unleashed a stampede just as the concert ended at Europe’s largest indoor arena, full to its capacity of 21,000.

“We ran and people were screaming around us and pushing on the stairs to go outside and people were falling down, girls were crying, and we saw these women being treated by paramedics having open wounds on their legs … it was just chaos,” said Sebastian Diaz, 19. “It was literally just a minute after it ended, the lights came on and the bomb went off.”

A video posted on Twitter showed fans, many of them young, screaming and running from the venue. Dozens of parents frantically searched for their children, posting photos and pleading for information on social media.

Singer Grande, 23, said on Twitter she was devastated: “broken. from the bottom of my heart, i am so so sorry. i don’t have words.”

The attack was the deadliest in the UK since four British Muslims killed 52 people in suicide bombings on London’s transport system in 2005. But it will have reverberations far beyond British shores.

Attacks in cities including Paris, Nice, Brussels, St Petersburg, Berlin and London have shocked Europeans already anxious over security challenges from mass immigration and pockets of domestic Islamist radicalism. Islamic State has repeatedly called for attacks as retaliation for Western involvement in the conflicts in Syria and Iraq.

While claiming responsibility on its Telegram account, the group appeared to contradict the police description of a suicide bomber. It suggested explosive devices were placed “in the midst of the gatherings of the Crusaders”.

“What comes next will be more severe on the worshippers of the cross,” the Telegram posting said.

It did not name the bomber, as it usually does in attacks it has ordered, and appeared also to contradict a posting on another Islamic State account, Amaq, which spoke of “a group of attackers”. That reference, however, was later removed.

“DEPRAVED”

May said security services were working to see if a wider group was involved in the attack, which fell less than three weeks before a national election. Campaigning was suspended as a mark of respect.

May spoke to U.S. President Donald Trump, French President Emmanuel Macron and several other foreign leaders on Tuesday about the attack, her spokesman said. She also visited the police headquarters and a children’s hospital in Manchester.

The White House said Trump had agreed with May during their telephone conversation that the attack was “particularly wanton and depraved”.

Macron and senior French ministers walked to the British embassy in Paris to sign the condolence book.

German Chancellor Angela Merkel said it “will only strengthen our resolve to…work with our British friends against those who plan and carry out such inhumane deeds”.

The U.N. Security Council condemned “the barbaric and cowardly terrorist attack” and expressed solidarity with Britain in the fight against terrorism.

Queen Elizabeth held a minute’s silence at a garden party at Buckingham Palace in London.

Manchester remained on high alert, with additional armed police drafted in. London Mayor Sadiq Khan said more police had been ordered onto the streets of the British capital.

Police raided a property in the Manchester district of Fallowfield where they carried out a controlled explosion. Witnesses in another area, Whalley Range, said armed police had surrounded a newly built apartment block on a usually quiet tree-lined street.

On Tuesday evening thousands of people attended a vigil for the dead in central Manchester.

British police do not routinely carry firearms, but London police said extra armed officers would be deployed at this weekend’s soccer cup final at Wembley and rugby at Twickenham. Security would be reviewed also for smaller events.

In March, a British-born convert to Islam plowed a car into pedestrians on London’s Westminster Bridge, killing four people before stabbing to death a police officer who was on the grounds of parliament. The man was shot dead at the scene.

In 2015, Pakistani student Abid Naseer was convicted in a U.S. court of conspiring with al Qaeda to blow up the Arndale shopping center in the center of Manchester in April 2009.

(Additional reporting by Alistair Smout, Kate Holton, David Milliken, Elizabeth Piper, Paul Sandle and Costas Pitas in LONDON, Mark Hosenball in LOS ANGELES, John Walcott in WASHINGTON, D.C., Leela de Kretser in NEW YORK, Omar Fahmy in CAIRO and Ben Blanchard in BEIJING; writing by Guy Faulconbridge, Nick Tattersall and Gareth Jones; editing by Mark Trevelyan)

Suicide bomber kills at least 22, including children, at Ariana Grande concert in Britain

People walk out of a support centre at Manchester City's Etihad Stadium, Manchester, Britain, May 23, 2017. REUTERS/Jon Super

By Michael Holden and Andrew Yates

MANCHESTER, England (Reuters) – A suicide bomber killed at least 22 people and wounded 59 at a packed concert hall in the English city of Manchester in what Prime Minister Theresa May called a sickening act targeting children and young people.

May said police believed they knew the identity of the bomber and police then said a 23-year-old man had been arrested in connection with the attack carried out late on Monday evening as people began leaving a concert given by Ariana Grande, a U.S. singer who attracts a large number of young and teenage fans.

“All acts of terrorism are cowardly…but this attack stands out for its appalling sickening cowardice, deliberately targeting innocent, defenseless children and young people who should have been enjoying one of the most memorable nights of their lives,” May said outside her Downing Street office in London.

“The attempt to divide us met countless acts of kindness that brought people closer together.”

The northern English city remained on high alert. A Reuters witnesses said they heard a “big bang” at Manchester’s Arndale shopping mall and saw people running from the building. Police said they were dealing with an incident inside. The shopping center reopened soon afterward, a Reuters witness said.

London Mayor Sadiq Khan said more police had been ordered onto the streets of the British capital.

Monday’s attack was the deadliest in Britain since four British Muslims killed 52 people in suicide bombings on London’s transport system in 2005. But it will have reverberations far beyond British shores.

Attacks in cities including Paris, Nice, Brussels, St Petersburg, Berlin and London have shocked Europeans already anxious over security challenges from mass immigration and pockets of domestic Islamist radicalism. The Islamic State militant group has called for attacks as retaliation for Western involvement in the conflicts in Syria and Iraq.

Witnesses related the horror of the Manchester blast, which unleashed a stampede just as the concert ended at what is Europe’s largest indoor arena, full to a capacity of 21,000.

“We ran and people were screaming around us and pushing on the stairs to go outside and people were falling down, girls were crying, and we saw these women being treated by paramedics having open wounds on their legs … it was just chaos,” said Sebastian Diaz, 19. “It was literally just a minute after it ended, the lights came on and the bomb went off.”

U.S. President Donald Trump described the attack as the work of “evil losers”. German Chancellor Angela Merkel said it “will only strengthen our resolve to…work with our British friends against those who plan and carry out such inhumane deeds.”

A source with knowledge of the situation said the bomber’s explosives were packed with metal and bolts. At least 19 of those wounded were in a critical condition, the source said.

A video posted on Twitter showed fans, many of them young, screaming and running from the venue. Dozens of parents frantically searched for their children, posting photos and pleading for information on social media.

“We were making our way out and when we were right by the door there was a massive explosion and everybody was screaming,” concert-goer Catherine Macfarlane told Reuters.

“It was a huge explosion – you could feel it in your chest.”

Singer Ariana Grande, 23, said on Twitter: “broken. from the bottom of my heart, i am so so sorry. i don’t have words.” May, who faces an election in two-and-a-half weeks, said her thoughts were with the victims and their families. She and Jeremy Corbyn, the leader of the opposition Labour Party, agreed to suspend campaigning ahead of the June 8 vote.

SUICIDE BOMBER?

There was no immediate claim of responsibility for the bombing, but U.S. officials drew parallels to the coordinated attacks in November 2015 by Islamist militants on the Bataclan concert hall and other sites in Paris that killed 130 people.

“It clearly bears the hallmark of Daesh (Islamic State),” said former French intelligence agent Claude Moniquet, now a Brussels-based security consultant, “because Ariana Grande is a young singer who attracts a very young audience, teenagers.

“So very clearly the aim was to do as much harm as possible, to shock British society as much as possible.”

Islamic State supporters took to social media to celebrate the blast and some encouraged similar attacks elsewhere.

Britain is on its second-highest alert level of “severe”, meaning an attack by militants is considered highly likely.

British counter-terrorism police have said they are making on average an arrest every day in connection with suspected terrorism.

In March, a British-born convert to Islam plowed a car into pedestrians on London’s Westminster Bridge, killing four people before stabbing to death a police officer who was on the grounds of parliament. The man was shot dead at the scene.

In 2015, Pakistani student Abid Naseer was convicted in a U.S. court of conspiring with al Qaeda to blow up the Arndale shopping center in the center of Manchester in April 2009.

PARENTS’ ANGUISH

Desperate parents and friends used social media to search for loved ones who attended Monday’s concert while the wounded were being treated at six hospitals across Manchester.

“Everyone pls share this, my little sister Emma was at the Ari concert tonight in #Manchester and she isn’t answering her phone, pls help me,” said one message posted alongside a picture of a blonde girl with flowers in her hair.

Paula Robinson, 48, from West Dalton about 40 miles east of Manchester, said she was at the train station next to the arena with her husband when she felt the explosion and saw dozens of teenage girls screaming and running away from arena.

“We ran out,” Robinson told Reuters. “It was literally seconds after the explosion. I got the teens to run with me.”

Robinson took dozens of teenage girls to the nearby Holiday Inn Express hotel and tweeted out her phone number to worried parents, telling them to meet her there. She said her phone had not stopped ringing since her tweet.

“Parents were frantic running about trying to get to their children,” she said. “There were lots of lots children at Holiday Inn.”

(Additional Reporting by Alistair Smout, Kate Holton, David Milliken, Elizabeth Piper, Paul Sandle and Costas Pitas in LONDON, Mark Hosenball in LOS ANGELES, John Walcott in WASHINGTON, D.C., Leela de Kretser in NEW YORK, Mostafa Hashem in CAIRO, and Ben Blanchard in BEIJING; Writing by Guy Faulconbridge and Nick Tattersall; Editing by Ralph Boulton/Mark Heinrich)

Global cyber attack slows but experts see risk of fresh strikes

An ambulance waits outside the emergency department at St Thomas' Hospital in central London, Britain May 12, 2017. REUTERS/Stefan Wermuth

By Jeremy Wagstaff and Eric Auchard

SINGAPORE/FRANKFURT (Reuters) – A global cyber attack described as unprecedented in scale forced a major European automaker to halt some production lines while hitting schools in China and hospitals in Indonesia on Saturday, though it appeared to die down a day after its launch.

Capitalizing on spying tools believed to have been developed by the U.S. National Security Agency, the cyber assault has infected tens of thousands of computers in nearly 100 countries, with Britain’s health system suffering the worst disruptions.

Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that seemed to contain invoices, job offers, security warnings and other legitimate files.

Once inside the targeted network, so-called ransomware made use of recently revealed spy tools to silently infect other out-of-date machines without any human intervention. This, security experts said, marked an unprecedented escalation in the risk of fresh attacks spreading in the coming days and weeks.

The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Researchers observed some victims paying via the digital currency bitcoin, though no one knows how much may have been transferred to extortionists because of the largely anonymous nature of such transactions.

Researchers with security software maker Avast said they had observed 126,534 ransomware infections in 99 countries, with Russia, Ukraine and Taiwan the top targets.

The hackers, who have not come forward to claim responsibility or otherwise been identified, took advantage of a worm, or self-spreading malware, by exploiting a piece of NSA spy code known as “Eternal Blue” that was released last month by a hackers group known as the Shadow Brokers, according to researchers with several private cyber security firms.

Renault said it had halted auto production at several sites including Sandouville in northwestern France and Renault-owned Dacia plants in Romania on Saturday to prevent the spread of ransomware in its systems.

Nissan’s manufacturing plant in Sunderland, northeast England, was also affected by the cyber assault though “there has been no major impact on our business”, a spokesman for the Japanese carmaker said.German rail operator Deutsche Bahn [DBN.UL] said some electronic signs at stations announcing arrivals and departures were infected, with travelers posting pictures showing some bearing a message demanding a cash payment to restore access.

“UNPRECEDENTED” ATTACK EASES

Europol’s European Cybercrime Center said it was working closely with country investigators and private security firms to combat the threat and help victims. “The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits,” it said in a statement.

Some experts said the threat had receded for now, in part because a British-based researcher, who declined to give his name, registered a domain that he noticed the malware was trying to connect to, and so limited the worm’s spread.

“We are on a downward slope, the infections are extremely few, because the malware is not able to connect to the registered domain,” said Vikram Thakur, principal research manager at Symantec.

“The numbers are extremely low and coming down fast.”

But the attackers may yet tweak the code and restart the cycle. The researcher in Britain widely credited with foiling the ransomware’s proliferation told Reuters he had not seen any such tweaks yet, “but they will (happen).”

Researchers said the worm deployed in the latest attack, or similar tools released by Shadow Brokers, are likely to be used for fresh assaults not just with ransomware but other malware to break into firms, seize control of networks and steal data.

Finance chiefs from the Group of Seven rich countries were to commit on Saturday to joining forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Italy.

“Appropriate economy-wide policy responses are needed,” the ministers said in their draft statement, seen by Reuters.

HOSPITALS IN FIRING LINE

In Asia, some hospitals, schools, universities and other institutions were affected, though the full extent of the damage is not yet known because it is the weekend.

“I believe many companies have not yet noticed,” said William Saito, a cyber security adviser to Japan’s government. “Things could likely emerge on Monday” as staff return to work.

China’s information security watchdog said “a portion” of Windows systems users in the country were infected, according to a notice posted on the official Weibo page of the Beijing branch of the Public Security Bureau on Saturday. Xinhua state news agency said some secondary schools and universities were hit.

In Vietnam, Vu Ngoc Son, a director of Bkav Anti Malware, said dozens of cases of infection had been reported there, but he declined to identify any of the victims.

South Korea’s Yonhap news agency reported a university hospital had been affected, while a communications official in Indonesia said two hospitals there had been hit.

The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday.

International shipper FedEx Corp said some of its Windows computers were also breached. “We are implementing remediation steps as quickly as possible,” a FedEx statement said.

Telecommunications company Telefonica was among many targets in Spain. Portugal Telecom and Telefonica Argentina both said they were also targeted.

Only a small number of U.S.-headquartered organizations were hit because the hackers appear to have begun the campaign by focusing on targets in Europe, said Thakur.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, he added.

MICROSOFT BOLSTERS WINDOWS DEFENCES

Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.

“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.

The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the U.S. spy agency.

The attack targeted Windows computers that had not installed patches released by Microsoft in March, or older machines running software that Microsoft no longer supports and for which patches did not exist, including the 16-year-old Windows XP system, researchers said.

Microsoft said it pushed out automatic Windows updates to defend existing clients from WannaCry. It had issued a patch on March 14 to protect them from Eternal Blue. Late on Friday, Microsoft also released patches for a range of long discontinued software, including Windows XP and Windows Server 2003.

“Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt,” Microsoft said in a statement on Friday, adding it was working with customers to provide additional assistance.

POLITICALLY SENSITIVE TIMING

The spread of the ransomware capped a week of cyber turmoil in Europe that began when hackers posted a trove of campaign documents tied to French candidate Emmanuel Macron just before a run-off vote in which he was elected president of France.

On Wednesday, hackers disrupted the websites of several French media companies and aerospace giant Airbus. The hack happened four weeks before a British general election in which national security and the management of the state-run National Health Service are important issues.

Authorities in Britain have been braced for cyber attacks in the run-up to the election, as happened during last year’s U.S. election and on the eve of the French run-off vote on May 7.

But those attacks – blamed on Russia, which has repeatedly denied them – followed a different modus operandi involving penetrating the accounts of individuals and political organizations and then releasing hacked material online.

On Friday, Russia’s interior and emergencies ministries, as well as its biggest bank, Sberbank, said they were targeted by ransomware. The interior ministry said about 1,000 computers had been infected but it had localized the virus.

Although cyber extortion cases have been rising for several years, they have to date affected small- to mid-sized organizations. “Seeing a large telco like Telefonica get hit is going to get everybody worried,” said Chris Wysopal, chief technology officer with cyber security firm Veracode.

(Additional reporting by Kiyoshi Takenaka, Jim Finkle, Eric Auchard, Jose Rodriguez, Alistair Smout, Andrea Shalal, Jack Stubbs, Antonella Cinelli, Dustin Volz, Kate Holton, Andy Bruce, Michael Holden, David Milliken, Rosalba O’Brien, Julien Toyer, Tim Hepher, Luiza Ilie, Patricia Rua, Axel Bugge, Sabine Siebold and Eric Walsh, Engen Tham, Fransiska Nangoy, Soyoung Kim, Mai Nguyen; editing by Mark Heinrich)

UK government in dark over who behind cyber attack

FILE PHOTO: A National Health Service (NHS) sign is seen in the grounds of St Thomas' Hospital, in front of the Houses of Parliament in London June 7, 2011. REUTERS/Toby Melville/File Photo

LONDON (Reuters) – The British government does not yet know who was behind Friday’s global cyber attack that disrupted the country’s health system, interior minister Amber Rudd said on Saturday.

“We’re not able to tell you who’s behind the attack. That work is still ongoing,” she told BBC radio.

She said Britain’s National Cyber Security Center was working with the country’s health service to ensure the attack was contained, while the National Crime Agency was working with them to find out where it came from.

Rudd said the government did not know if the attack was directed by a foreign government.

On Friday, cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files. Nearly 100 countries were impacted.

Rudd said the attack was not specifically targeted at Britain’s health service.

“(The virus) feels random in terms of where it’s gone to and where it’s been opened,” she said.

Though 45 health service organizations in England and Scotland were affected by malicious software, no patient data has been accessed or transferred, said Rudd.

The minister said lessons had to be learned from the attack.

“There will be lessons to learn … Why is it certain regions are affected more than others? Is it to do with the software? Is it to do with better IT?”

Separately on Saturday, finance chiefs from the Group of Seven rich countries will commit to join forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Bari, Italy.

(Reporting by James Davey; Editing by Mark Potter)

Global cyber attack fuels concern about U.S. vulnerability disclosures

An undated aerial handout photo shows the National Security Agency (NSA) headquarters building in Fort Meade, Maryland. NSA/Handout via REUTERS

By Dustin Volz

WASHINGTON (Reuters) – A global cyber attack on Friday renewed concerns about whether the U.S. National Security Agency and other countries’ intelligence services too often hoard software vulnerabilities for offensive purposes, rather than quickly alerting technology companies to such flaws.

Hacking tools believed to belong to the NSA that were leaked online last month appear to be the root cause of a major cyber attack unfurling throughout Europe and beyond, security researchers said, stoking fears that the spy agency’s powerful cyber weapons had been stolen and repurposed by hackers with nefarious goals.

Some cyber security experts and privacy advocates said the massive attack reflected a flawed approach by the United States to dedicate more cyber resources to offense rather than defense, a practice they argued makes the internet less secure.

Across the U.S. federal government, about 90 percent of all spending on cyber programs is dedicated to offensive efforts, including penetrating the computer systems of adversaries, listening to communications and developing the means to disable or degrade infrastructure, senior intelligence officials told Reuters in March. (http://reut.rs/2o7qHqN)

“These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world,” Patrick Toomey, a staff attorney with the American Civil Liberties Union, said in a statement.

The NSA did not respond to a request for comment.

Hospitals and doctors’ surgeries in parts of England on Friday were forced to turn away patients and cancel appointments after they were infected with the “ransomware”, which scrambled data on computers and demanded payments of $300 to $600 to restore access.

Security software maker Avast said it had observed more than 57,000 infections in 99 countries. Russia, Ukraine and Taiwan were the top targets, it said.

Private security firms identified the virus as a new variant of ‘WannaCry’ ransomware with the ability to automatically spread across large networks by exploiting a bug in Microsoft Corp’s Windows operating system.

Security experts said the ransomware used in the attacks leveraged a hacking tool found in a leak of documents in April by a group known as Shadow Brokers.

At the time, Microsoft acknowledged the vulnerabilities and said they had been patched in a series of earlier updates pushed to customers, the most recent of which had been rolled out only a month earlier in March. But the episode prompted concerns about whether the tools could be leveraged by hackers to attack unpatched systems.

In a statement, a Microsoft spokesman said on Friday its engineers had provided additional detection and protection services against the WannaCry malware and that it was working with customers to provide additional assistance. The spokesman reiterated that customers who have Windows Updates enabled and use the company’s free antivirus software are protected.

Shadow Brokers first emerged last year and began dumping tranches of documents that it said belonged to the NSA, though the files appeared at least a few years old.

Over time, western researchers have grown more confident that Russia may be behind Shadow Brokers and possibly other recent disclosures of sensitive information about cyber capabilities that have been pilfered from U.S. intelligence agencies.

Some researchers cast blame not on the NSA but on the hospitals and other customers that appeared to leave themselves open to attack.

“The main problem here is organizations taking more than eight weeks to patch once Microsoft released the update,” said Chris Wysopal, chief technology officer at the cyber firm Veracode. “Eight weeks is plenty of time for a criminal organization to develop a sophisticated attack on software and launch it on a wide scale.”

Former intelligence contractor Edward Snowden, who in 2013 leaked documents to journalists revealing the existence of broad U.S. surveillance programs, said on Twitter the NSA had built attack tools targeting U.S. software that “now threatens the lives of hospital patients.”

“Despite warnings, (NSA) built dangerous attack tools that could target Western software,” Snowden said. “Today we see the cost.”

(This version of the story has been refiled to correct spelling of hoard in first paragraph)

(Reporting by Dustin Volz; Editing by Lisa Shumaker)

Global cyber attack hits hospitals and companies, threat seen fading for now

An ambulance waits outside the emergency department at St Thomas' Hospital in central London, Britain May 12, 2017. REUTERS/Stefan Wermuth

By Jeremy Wagstaff and Costas Pitas

SINGAPORE/LONDON (Reuters) – A global cyber attack leveraging hacking tools believed to have been developed by the U.S. National Security Agency has infected tens of thousands of computers in nearly 100 countries, disrupting Britain’s health system and global shipper FedEx.

Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.

The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Security researchers said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortionists.

Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries, with Russia, Ukraine and Taiwan the top targets.

Some experts said the threat had receded for now, in part because a British-based researcher, who declined to give his name, registered a domain that he noticed the malware was trying to connect to, limiting the worm’s spread.

“We are on a downward slope, the infections are extremely few, because the malware is not able to connect to the registered domain,” said Vikram Thakur, principal research manager at Symantec.

“The numbers are extremely low and coming down fast.”

But the attackers may yet tweak the code and restart the cycle. The British-based researcher who may have foiled the ransomware’s spread told Reuters he had not seen any such tweaks yet, “but they will.”

Finance chiefs from the Group of Seven rich countries will commit on Saturday to join forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Italy.

“Appropriate economy-wide policy responses are needed,” the ministers said in their draft statement, seen by Reuters.

HOSPITALS IN FIRING LINE

In Asia, some hospitals, schools, universities and other institutions were affected, although the full extent of the damage is not yet known because it is the weekend.

“I believe many companies have not yet noticed,” said William Saito, a cyber security adviser to Japan’s government.

“Things could likely emerge on Monday.”

China’s official Xinhua news agency said some secondary schools and universities had been affected, without specifying how many or identifying them.

In Vietnam, Vu Ngoc Son, a director of Bkav Anti Malware, said dozens of cases of infection had been reported there, but he declined to identify any of the victims.

South Korea’s Yonhap news agency reported a university hospital had been affected, while a communications official in Indonesia said two hospitals there had been affected.

The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday.

International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.

Telecommunications company Telefonica was among many targets in Spain. Portugal Telecom and Telefonica Argentina both said they were also targeted.

Only a small number of U.S.-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Thakur.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur added.

MICROSOFT UPS DEFENSES

The U.S. Department of Homeland Security said it was sharing information with domestic and foreign partners and was ready to lend technical support.

Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.

The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm”, or self spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cyber security firms said.

“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.

The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the U.S. spy agency.

Microsoft said it was pushing out automatic Windows updates to defend clients from WannaCry. It issued a patch on March 14 to protect them from Eternal Blue.

“Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt,” Microsoft said in a statement on Friday, adding it was working with customers to provide additional assistance.

SENSITIVE TIMING

The spread of the ransomware capped a week of cyber turmoil in Europe that began the previous week when hackers posted a trove of campaign documents tied to French candidate Emmanuel Macron just before a run-off vote in which he was elected president of France.

On Wednesday, hackers disrupted the websites of several French media companies and aerospace giant Airbus.The hack happened four weeks before a British general election in which national security and the management of the state-run National Health Service are important issues.

The British government did not know who was behind the attack but its National Crime Agency was working to find out, interior minister Amber Rudd said.

Authorities in Britain have been braced for cyber attacks in the run-up to the election, as happened during last year’s U.S. election and on the eve of the French one.

But those attacks – blamed on Russia, which has repeatedly denied them – followed a different modus operandi involving penetrating the accounts of individuals and political organizations and then releasing hacked material online.

On Friday, Russia’s interior and emergencies ministries, as well as its biggest bank, Sberbank, said they were targeted. The interior ministry said about 1,000 computers had been infected but it had localized the virus.

Although cyber extortion cases have been rising for several years, they have to date affected small-to-mid sized organizations.

“Seeing a large telco like Telefonica get hit is going to get everybody worried,” said Chris Wysopal, chief technology officer with cyber security firm Veracode.

(Additional reporting by Kiyoshi Takenaka, Jim Finkle, Eric Auchard, Jose Rodriguez, Alistair Smout, Andrea Shalal, Jack Stubbs, Antonella Cinelli, Dustin Volz, Kate Holton, Andy Bruce, Michael Holden, David Milliken, Rosalba O’Brien, Julien Toyer, Tim Hepher, Luiza Ilie, Patricia Rua, Axel Bugge, Sabine Siebold and Eric Walsh, Engen Tham, Fransiska Nangoy, Soyoung Kim, Mai Nguyen; Editing by Rob Birsel and Mike Collett-White)

English hospitals say hit by suspected national cyber attack

FILE PHOTO: A National Health Service (NHS) sign is seen in the grounds of St Thomas' Hospital, in front of the Houses of Parliament in London June 7, 2011. REUTERS/Toby Melville/File Photo

By Costas Pitas and Alistair Smout

LONDON (Reuters) – Hospitals across England were being forced to divert emergency cases on Friday after suffering a suspected national cyber attack.

Among them was the Barts Health group which manages major central London hospitals including The Royal London and St Bartholomew’s.

“We are experiencing a major IT disruption and there are delays at all of our hospitals,” it said.

“We have activated our major incident plan to make sure we can maintain the safety and welfare of patients. Ambulances are being diverted to neighboring hospitals.”

Patients requiring emergency treatment across England were diverted away from the hospitals affected and the public was advised to only seek medical care for acute medical conditions.

Reuters was unable to independently verify whether the hospitals were the subject of a concerted cyber attack ahead of the June 8 election.

Britain’s National Crime Agency said it was aware of the reports of a cyber attack but made no further comment.

The National Health Service (NHS) said it was responding to the incidents.

“We are aware of a cyber security incident and we are working on a response,” said a spokesman for NHS Digital, a division of the NHS which handles information technology issues.

There was no immediate comment from the Health Ministry.

Earlier on Friday, Spain’s government warned that a large number of companies had been attacked by cyber criminals who infected computers with malicious software known as “ransomware” that locks up computers and demands ransoms to restore access.

(Additional reporting by Kate Holton, Andy Bruce, Michael Holden and David Milliken; Writing by Guy Faulconbridge; editing by Stephen Addison)