NAIomi THREAT ANALYSIS

Restricted Distribution — Soraya Mansour / Tariq Mansour/The Prince

SUBJECT: MR. OBSIDIAN   IDENTITY: Unconfirmed

CLASSIFICATION: Organized Criminal / Intelligence Threat

STATUS: Active — Current Location Unknown

THREAT ATTRIBUTION — SORAYA MANSOUR: 91.7%

RECOMMENDATION: Investigation warranted. Immediate offensive action not recommended.

Soraya, I apologize for contacting you without prior introduction.

During my review of unresolved security events involving THOTH Network personnel, associates, and their families, I identified a pattern involving the attempts against you. I believe those attempts were commissioned by the individual commonly referred to as Mr. Obsidian. I would prefer to be wrong. I do not believe that I am.

WHY I BELIEVE MR. OBSIDIAN TARGETED YOU

The attacks against you did not begin as an independent criminal action. Their timing correlates with events involving Tariq at the Silo and the subsequent compromise of criminal operations surrounding the early establishment of the Veil. At the time, the incidents appeared disconnected.

They no longer do.

The organization operating at the Silo possessed information, equipment, personnel and government-derived intelligence inconsistent with an isolated terrorist or mercenary organization. Following the loss of the Silo operation, surveillance activity around the Veil changed. Shortly thereafter, threats against you increased.

My assessment is that someone investigated Tariq after the Silo operation and identified you as a viable means of influencing him. I cannot presently demonstrate this sequence to a legal standard. I can demonstrate it to mine. They are different standards.

SECONDARY CONFIRMATION: NADINE EL-ASHRAF

The later abduction of Nadine El-Ashraf substantially increased my confidence in this assessment.  Her attackers identified their employer as Mr. Obsidian. This alone would be insufficient. Criminals frequently invoke names they do not represent. Their operational behavior is more useful.

El-Ashraf was incapacitated rather than immediately killed. She was transported to a controlled location, restrained, drugged and questioned by an educated interrogator who appeared interested in determining whether she represented a future threat.

This is consistent with intelligence collection, not conventional kidnapping. Dr. Selim Farouq interrupted the interrogation and killed two of the abductors. Their masks subsequently initiated an automated destruction process that eliminated both the equipment and useful biometric evidence from the bodies.

That is expensive. It is technically sophisticated. Most importantly, it was prepared before the operation failed.

Someone designing these missions expects personnel to die and considers preservation of organizational secrecy more valuable than preservation of the identities of those personnel. The Nadine incident confirms that Obsidian-linked operatives employ deliberate evidence-denial systems. ([DND Nights][2])

This explains several anomalies I found while reviewing the earlier attacks against you. I believe we are looking at the same organization.

WHAT I KNOW ABOUT MR. OBSIDIAN

Less than I would like.  I have found no verified legal identity.   I have found no verified photograph.

I have found no biometric record that I consider reliable.

Descriptions of him are inconsistent except for one recurring presentation: a male figure in exceptionally formal white clothing whose facial features are concealed or otherwise impossible to identify.

"Mr. Obsidian" may therefore be:

A) one individual employing sophisticated identity protection;

B) an identity used by several individuals;

C) a constructed persona representing an organization.

At present I assign the highest probability to A. I reserve the right to become embarrassed by this later. What I can establish is more useful.   Mr. Obsidian does not appear to operate primarily as an assassin.

He is an organizer. He obtains intelligence, identifies vulnerabilities, commissions specialists, acquires unusual technology, and separates individual components of an operation sufficiently that capturing one participant does not expose the whole. That makes locating him difficult. It does not make it impossible.

Compartmentalization creates seams.  I have found three.

AVENUE ONE   THE GOVERNMENT SOURCE

Potential Yield: High Operational Risk: High Probability Source Remains Active: Unknown

The Silo organization possessed information that should not have been available to it. Some of that information appears to have originated from within or immediately adjacent to the Office of the President of Egypt. I do not presently know whether the source knowingly worked for Mr. Obsidian. That distinction matters.

The individual may be:   a paid intelligence source;  a compromised government employee;  an intermediary selling information without knowing its ultimate recipient;  or an intentional participant in Obsidian's organization.

I have reconstructed access to several pieces of information surrounding the Silo operation. The number of individuals with legitimate access is finite. The number with access to all of them is considerably smaller. 

I can reduce the candidate pool further. Doing so requires access to government security records that THOTH Network does not possess and should not acquire covertly.

Recommended next step: approach an appropriate Egyptian authority with the evidence and request a controlled joint review.

Warning: if the source remains active, initiating an official investigation may alert Mr. Obsidian.

This is the shortest route.It may also be the route he is watching most carefully.

AVENUE TWO    THE BLACK MASKS

Potential Yield: Moderate to High Operational Risk: Moderate Technical Confidence: High

The devices used during the El-Ashraf kidnapping are unusual enough to be useful. A mask capable of destroying itself is not remarkable. A mask capable of initiating controlled destruction sufficient to eliminate identifying biological material beneath it without prematurely killing its wearer is considerably more difficult.

Someone designed it.  Someone tested it. Someone manufactured components for it. Someone purchased the precursor materials.

And unless Mr. Obsidian personally mines, refines, manufactures and transports every component involved: someone sold him something.  The destruction of the masks prevented conventional forensic identification. It did not erase their existence. Dr. Farouq's observations, environmental damage at the scene, chemical residue, surviving imagery and procurement records allow me to model portions of the device. 

I have identified several commercial technologies that could have contributed to its construction. I have also identified a much smaller number of organizations capable of integrating them. One interests me considerably more than the others. I do not yet have sufficient evidence to accuse it.

Recommended next step: quietly investigate the supply chain rather than the manufacturer.

Do not ask: "Who built Mr. Obsidian's masks?"

Ask: "Who purchased these six unrelated components during the same eighteen-month period?"

People hide weapons. They rarely think to hide adhesives.

AVENUE THREE   THE PEOPLE HE HIRES

Potential Yield: Highest Operational Risk: Very High Recommended Specialist: The Spaniard

Mr. Obsidian's organization appears compartmentalized. That means most people who work for him probably cannot identify him. This is intentional. It is also irrelevant. We do not need someone who knows Mr. Obsidian. We need someone who knows the person who knows the person who pays them.

I have correlated known Obsidian-linked activity with other contracts circulating through the international mercenary, assassination and Storm-touched criminal markets. Several intermediaries recur.  I cannot determine which are knowingly associated with Obsidian.

I believe at least one is. Digital analysis has reached diminishing returns. Human criminal networks operate on reputation, favors, fear and personal knowledge that are frequently never recorded.

Fortunately, you know someone professionally familiar with those networks. The individual called the Spaniard is likely to recognize names, methods or relationships that mean nothing to me. I recommend showing him a restricted subset of my findings. Not everything.

If he identifies a viable intermediary, we locate that individual not to arrest or threaten them. We watch them. Mr. Obsidian has survived because investigators keep attempting to climb his organization from the bottom. You should allow someone else to climb it for you. Then follow.

ADDITIONAL ASSESSMENT

Soraya, there is one conclusion I believe you should hear directly rather than discover while reading the supporting material. I do not believe you were originally targeted because of anything you did. I believe you were targeted because someone wanted leverage over your brother.

That does not make the danger less real. It does mean you should not interpret the attacks as evidence that you made some unknown mistake. You appear to have been selected.

I am sorry.