‘Virtual planners’ of ISIS on the dark side of the internet
Beirut - In the aftermath of the Islamic State’s attacks across Paris on November 13th, 2015, French investigators were stumped about how the slaughter of 130 people had been planned, even though the authorities had the terrorists’ mobile phones.
The reason was the perpetrators had, for the first time, used encrypted messaging apps, such as Telegram or WhatsApp, that could not be cracked by French authorities, the Americans or anyone else.
It was a turning point, and a deadly one, in the Islamic State’s war of terror against the West and its enemies around the globe.
“We cannot penetrate into certain conversations,” lamented François Molins a former chief prosecutor in Paris, at the time. “We are dealing with this gigantic black hole, a dark zone where there are just so many dangerous things going on.”
Since then, the Islamic State (ISIS) terror campaign has escalated sharply under the group’s shadowy but innovative intelligence apparatus, headed by veteran Islamists and some of Saddam Hussein’s top security operatives.
The inner workings of the jihadists’ apparatus are only now coming to light through the interrogation of defectors and intelligence on senior ISIS leaders and digital data captured in covert raids by special forces of the US-led coalition.
The key to it all is the Amniyat al-Kharji, the external operations arm of ISIS’s intelligence and security organisation. It inspires and controls attacks by individual supporters known as “lone wolves” but it also organises and directs trained infiltrators to mount coordinated attacks that are invariably more lethal and morale-sapping, such as the bomb and gun strikes against several targets in Paris.
The key to Amniyat al-Kharji’s growing abilities to organise, plan and execute sophisticated attacks is its hijacking of the internet and the evolution of end-to-end encryption on the internet and mobile devices that is impervious to tracking by intelligence services. European counterterrorism officials call ISIS operations in which online handlers guide terrorists to their targets as being “remote-controlled”.
The Amniyat’s increasingly sophisticated killing machine and its encryption system has allowed ISIS to transform the mechanics of terror from unfocused and random attacks by individuals into a deadly efficient network of cells directed by Amniyat’s team of handlers.
Western intelligence services fear this may well escalate from gun and bomb attacks and driving lorries into crowds, to car bombings and possibly even chemical weapons strikes.
A Western security source said that an ISIS defector, born in Germany but raised in Britain and known as Abu Khaled, has claimed the Amniyat plans to use women suicide bombers. Recent security swoops in Tunisia have added weight to that claim with the arrest of several women who were allegedly preparing for suicide operations.
Rachid Kassim, one of the Amniyat’s principal terrorist coordinators who focuses primarily on France, seems to be active in this endeavour. In September 2016, three women, aged 19, 23 and 39, were arrested in connection with a failed attempt to blow up a car packed with gas canisters and jerry cans of diesel near Notre Dame Cathedral in Paris, a major tourist attraction. The plot was directed by Kassim.
Some in the intelligence community blame US whistle-blower Edward Snowden, who in 2013 unveiled the secrets of US penetration of cyberspace, for revealing to militant groups how they could thwart electronic surveillance and have a safe means of operational communications. This gave ISIS a vital and highly lethal edge in its clandestine operations that US and other intelligence services have been unable to combat or neutralise.
According to Edward Jay Epstein, author of the book How America Lost Its Secrets: Edward Snowden, the Man and the Theft: “Snowden also aided potential terrorists by offering specific tips about secret sources and methods used by both (the US National Security Agency) and its British counterpart, the Government Communications Headquarters.”
The Amniyat was headed by Muhammad al-Adnani, a 39-year-old Syrian and one of ISIS’s top operatives, chief strategist and propagandist with a $5 million US bounty on his head, until he was killed in a US air strike in Syria on August 30th, 2016,
On December 5th, ISIS announced that he had been succeeded as propaganda chief by someone identified only by the nom de guerre Abu Hassan al-Muhajir, whose appearance and whereabouts Western intelligence experts say are not known.
Whether Muhajir also took over the Amniyat as well is not clear but his first announcement was to echo Adnani’s infamous September 2014 call on ISIS supporters everywhere to attack Western kuffar — disbelievers — wherever they were to be found.
One supporter who had acted on Adnani’s appeal was Anis Amri, a Tunisian who drove a hijacked 25-tonne lorry through a crowded Christmas market in Berlin on December 19th, killing 12 people and injuring dozens more.
Western intelligence sources say he had communicated with the Amniyat at least once using Telegram before he embarked on his killing spree.
“Although much remains unknown about Amri’s case, it bears many of the hallmarks of ISIL’s ‘virtual planner’ model of managing lone attackers,” observed terrorism specialist Daveed Gartenstein-Ross of the Washington-based Foundation for the Defense of Democracies, using another acronym for ISIS.
“The virtual planner model has revolutionised jihadist external operations. ISIL has taken advantage of recent advances in online communications and encryption to engineer a process by which the group’s top operatives can directly guide lone attackers, playing an intimate role in the conceptualisation, target selection, timing and execution of attacks,” he explained in a January 4th analysis.
“Virtual planners can offer operatives the same services once provided by physical networks. This model has helped transform lone attackers who rely heavily on the Internet from the bungling wannabes of a decade ago into something more dangerous.”
Al-Qaeda, which engaged in complex attacks such as the multiple suicide hijackings of September 11th, 2001, which required months of preparation, did not have access to the technology available to ISIS.
So far as is known, ISIS has not attempted such ambitious operations as 9/11 or the thwarted January 2006 al-Qaeda plot to blow up ten US-bound airliners over the Atlantic — a rerun of a foiled 1995 plot known as Operation Bojinka, linked to al-Qaeda, to destroy up to 12 US airliners over the Pacific.
But, Gartenstein-Ross and others fear that it may just be a matter of time before Amniyat al-Kharji gravitates towards such potentially catastrophic plots. “ISIL has demonstrated an unprecedented ability to coordinate sustained campaigns in various theatres across the globe,” he acknowledged.
Intelligence officials say the tactic of using heavy trucks to ram crowds of civilians, such as the July 14th attack on a Bastille Day crowd in the Mediterranean city of Nice that killed 84 people and the Christmas market attack in Berlin involved encrypted guidance by ISIS handlers in Syria.
They were probably in the northern city of Raqqa, de facto capital of ISIS’s Islamic caliphate, or al-Bab, where Western intelligence says Amniyat has a particularly active command centre.
“Most of ISIL’s prominent virtual planners appear to be based in the group’s ‘caliphate’ in Syria and Iraq, in large part due to proximity and access to ISIL’s top leadership,” Gartenstein-Ross said.
“But since the main equipment that virtual planners require is an internet connection and good encryption, they could theoretically operate from other geographic locations.
“Being geographically dispersed carries greater risk of detection, but particularly as ISIL continues to decline as a territorial entity, the emergence of prominent virtual planners operating from outside the Syria-Iraq theatre is likely.”
Analyst Bridget Moreng, writing in the journal Foreign Affairs in September 2016, observed that “although ISIS’s territorial holdings continue to dwindle, the threat it poses does not.
“ISIS has proven itself to be an endlessly adaptive organisation, utilising creative measures to shape-shift in its response to external pressures.
“As the group’s territory shrinks and its leadership is picked off by US-led air strikes, ISIS will rely increasingly on its ‘virtual planners’ — members who operate in the dark spaces of the Internet — to inspire and coordinate attacks abroad.”