The Threat Intel Coalition

The Threat Intel Coalition is a Special Interest Group (SIG) at the Forum for Incident Response and Security Teams (FIRST) that assists civil society in detecting and defending against targeted digital threats. Civil society organizations often lack information about the threats they face and the resources needed to prevent and mitigate intrusions. We aim to improve that situation and provide help in two ways. First, we link up civil society organizations facing a targeted threat to researchers at threat intelligence providers who provide assistance in a trusted and confidential setting. We have strong information sharing rules in place to protect the privacy of members and ensure civil society remains in control of who knows what about them. Second, we organize free training sessions and shared resources to support capacity building. Our members include researchers at all leading threat intelligence providers, civil society from around the world and academic experts. Membership is open to all civil society organizations and researchers willing to contribute.

The Threat Intel Coalition is a member of First

Focus Areas

Capacity Building

We create workshops, training and access to shared resources

Information Sharing & Assistance

We link civil society facing cyber threats to researchers who provide assistance and information in a trusted and confidential setting.

Become a Member

Community of Trust

we aim to build a community of trust among civil society organizations, academics and industry member to foster long term cooperation.

Co-Chairs

Dr. Lennart Maschmeyer

Co-Chair

Lennart Maschmeyer is a Senior Researcher at the Center for Security Studies at ETH Zurich. He holds a PhD in Political Science from the University of Toronto and an MPhil in International Relations from the University of Oxford. Lennart’s research examines how information technology impacts security competition and the exercise of power in world politics. Specifically, he explores the subversive nature of cyber operations and its strategic implications, as well as the role of non-state actors in cyber conflict.

Abir Ghattas

Co-Chair

Abir is the Director of Information Security at Human Rights Watch. She provides strategic and operational oversight for managing information security risks that HRW staff face in their work.
Abir’s work and research focuses on women rights, digital rights and the intersection of gender and tech. Abir sits on Article19‘s international board, OTF’s advisory council and the grant advisory board of AccessNow. She also founded HammamRadio, A feminist participatory radio, launched from Berlin where she is based.

Ben Read

Co-Chair

Benjamin Read is the Senior Manager for Cyber Espionage Analysis in FireEye’s Intelligence unit. His team leads tracks and reports on espionage groups from China, Russia, North Korea and many other countries. He was an analyst on the same team at iSIGHT Partners before it was acquired by FireEye in January 2016. Prior to iSIGHT, Mr. Read worked as a special assistant at the National Security Council’s European Affairs Directorate. While there, he supported the numerous presidential trips and meetings including the 2012 NATO Summit in Chicago.

Members

Academia/Research	Civil Society	Industry
Debora Irene Christine, United Nations University Macao Ernesto Perez Estevez, CEDIA Florian Egloff, ETH Zurich Gil Baram, Tel Aviv University Irene Poetranto, CitizenLab James Shires, U Leiden JD Work, Marine Corps University/Columbia U John Scott-Railton, Citizen Lab Lennart Maschmeyer, ETH Zurich Lilly Muller, Kings College London Masashi Crete-Nishihata, CitizenLab Matteo Bonfanti, ETH Zurich Myriam Dunn-Cavelty, ETH Zurich Ron Deibert, Citizen Lab Silas Cutler, Institute for Security and Technlogy Xander Bouwman, TU Delft	Abir Ghattas, Human Rights Watch Adli Wahid, APNIC Alexandra, Digital Defenders Andreas Muehlemann, Switch Andrej Petrovski, SHARE Foundation Andrew Cormack, JISC Anthony Sule, CCHub Artur Papyan, Media Diversity Institute Carlos Alvarez, ICANN Cooper Quintin, EFF Daniel Bedoya, AccessNow Danish Umar, Digital Rights Foundation Etienne Maynier, Amnesty International Hassen Selmi, AccessNow Ingrid Skoog, CDR Jamie Lord, CERT Jon Camfield, Internews Laurie A Tyzenhaus, CERT Lobsang Gyatso, TibCERT Neil Blazevich, Internews Neil Jenkins, CTA Nighat Dad, Digital Rights Foundation Paula Martins, APC Peter Micek, AccessNow Samuel Eibu, Defend Defenders Sani Abhilash, CERT-In Sekuloski Milan, Geneva Centre for the Democratic Control of Armed Forces Serge Droz, FIRST Stéphane Labarthe, Fundacion Karisma Tonu Tammer, CERT-EE Josh Levy, Center for Digital Resilience Runa Sandvik, Independent Security Researcher Thom Kaye, AccessNow Dustin Kramer, Independent Habeeb Adebisi, Co-Creation Hub, CiviCERT Simbiat Sadiq, Co-Creation Hub, cyber safe foundation	Alexandru Ciobanu, Amgen Anton Cherepanov, ESET Ben Read, Mandiant BGen (ret.) Robert Mazzolin, RHEA Group Camille Francois, Graphika Chetan Patel, Helaba Christopher McCown, VMWare Cristiana Kittner, Mandiant Cilas Cutler, Institute for Security and Technology Dlshad Othman, AWS Greg Lesnewich, Recorded Future Jamie Collier, Mandiant Jayce Nichols, Mandiant Jeremy Haas, Looking Glass Jill Sopko, Verizon Media Joshua Saxe, Sophos/Covid-19 CTC Juan Andres Guerrero-Saade, SentinelOne Lilian Teng, Verizon Marten Van Hoorenbeck, Zendesk Matt Dahl, CrowdStrike Mayo Yamasaki, NTT-CERT Mihai Chelalau, Amgen Mihai Molcuti, Amgen Nart Villeneuve, TrendMicro Pasquale Stirparo, Dragos Rainer Ginsberg, BASF RamPrabhu Murugeshan, Diageo Roderick Mooi, Sanren Ryan P. Miller, Target Shin Adachi, NTT-CERT Sylvain Martinez, Elysium Security Tim Preson, Bell Canada Tobias Ellenberger, Oneconsult Vaman Amarjeet Gokuldas Kini, WorldBank Winonna DeSombre Adam Caudle, Verizon James Motherway, GIAC Peter Lowe, DNS Filter Evan Wolff, Crowell