An ISIS leader imprisoned in Germany offers some jailhouse insight into how the terrorist group mixes inspiration with command-and-control. The traditional C2 and operational planning is largely provided by a unit called “Emni,” which recruits, vets, and delivers fighters across an international ratline. Control remains relatively loose, but the general direction seems sufficient to meet ISIS requirements. Emni is likely to grow in importance as ISIS loses ground in its core territories.

Citizen Lab continues its description of state surveillance tools deployed in cyberspace. Part of the growth in this sector is explained by rising Islamist terrorism. Foreign Affairs notes a European reassessment of NSA—upward—as that threat rises.

Three more leaders of the US Democratic National Committee have resigned over the emails published recently by WikiLeaks. Security firms have begun explaining the use of sockpuppets, fronts, and other tools by Russia in the cause of plausible deniability. Concern over disruption of this year’s US elections grows.

Yahoo is investigating the claims by “Peace” that he’s offering a large trove of Yahoo credentials—200,000,000 of them—on the black market.

University of Michigan researchers add to worries about automotive cyber vulnerabilities. They promise a proof-of-concept hack against the brakes and accelerator of an 18-wheeler next week.

In crime news, media outlets are warned of a coming wave of denial-of-service attacks. And the ransomware black market appears to have matured. US county governments in California and Iowa are among the more recent victims.

Google improves Android warnings of suspicious activity.