‘Virtual planners’ of ISIS on the dark side of the internet

Sunday 22/01/2017
A 3D printed logo of Twitter and an Islamic State flag are seen in this picture illustration taken February 18th, 2016. (Reuters)

Beirut - In the aftermath of the Islamic State’s attacks across Paris on November 13th, 2015, French investigators were stumped about how the slaughter of 130 people had been planned, even though the authorities had the ter­rorists’ mobile phones.
The reason was the perpetrators had, for the first time, used en­crypted messaging apps, such as Telegram or WhatsApp, that could not be cracked by French authori­ties, the Americans or anyone else.
It was a turning point, and a dead­ly one, in the Islamic State’s war of terror against the West and its en­emies around the globe.
“We cannot penetrate into certain conversations,” lamented François Molins a former chief prosecutor in Paris, at the time. “We are dealing with this gigantic black hole, a dark zone where there are just so many dangerous things going on.”
Since then, the Islamic State (ISIS) terror campaign has escalated sharply under the group’s shadowy but innovative intelligence appa­ratus, headed by veteran Islamists and some of Saddam Hussein’s top security operatives.
The inner workings of the jihad­ists’ apparatus are only now coming to light through the interrogation of defectors and intelligence on senior ISIS leaders and digital data captured in covert raids by special forces of the US-led coalition.
The key to it all is the Amniyat al-Kharji, the external operations arm of ISIS’s intelligence and se­curity organisation. It inspires and controls attacks by individual sup­porters known as “lone wolves” but it also organises and directs trained infiltrators to mount coordinated attacks that are invariably more le­thal and morale-sapping, such as the bomb and gun strikes against several targets in Paris.
The key to Amniyat al-Kharji’s growing abilities to organise, plan and execute sophisticated attacks is its hijacking of the internet and the evolution of end-to-end encryption on the internet and mobile devices that is impervious to tracking by in­telligence services. European coun­terterrorism officials call ISIS op­erations in which online handlers guide terrorists to their targets as being “remote-controlled”.
The Amniyat’s increasingly so­phisticated killing machine and its encryption system has allowed ISIS to transform the mechanics of ter­ror from unfocused and random at­tacks by individuals into a deadly ef­ficient network of cells directed by Amniyat’s team of handlers.
Western intelligence services fear this may well escalate from gun and bomb attacks and driving lorries into crowds, to car bombings and possibly even chemical weapons strikes.
A Western security source said that an ISIS defector, born in Germa­ny but raised in Britain and known as Abu Khaled, has claimed the Am­niyat plans to use women suicide bombers. Recent security swoops in Tunisia have added weight to that claim with the arrest of several women who were allegedly prepar­ing for suicide operations.
Rachid Kassim, one of the Amni­yat’s principal terrorist coordinators who focuses primarily on France, seems to be active in this endeav­our. In September 2016, three wom­en, aged 19, 23 and 39, were arrested in connection with a failed attempt to blow up a car packed with gas canisters and jerry cans of diesel near Notre Dame Cathedral in Paris, a major tourist attraction. The plot was directed by Kassim.
Some in the intelligence com­munity blame US whistle-blower Edward Snowden, who in 2013 un­veiled the secrets of US penetration of cyberspace, for revealing to mili­tant groups how they could thwart electronic surveillance and have a safe means of operational commu­nications. This gave ISIS a vital and highly lethal edge in its clandestine operations that US and other intelli­gence services have been unable to combat or neutralise.
According to Edward Jay Epstein, author of the book How America Lost Its Secrets: Edward Snowden, the Man and the Theft: “Snowden also aided potential terrorists by offering specific tips about secret sources and methods used by both (the US National Security Agency) and its British counterpart, the Gov­ernment Communications Head­quarters.”
The Amniyat was headed by Mu­hammad al-Adnani, a 39-year-old Syrian and one of ISIS’s top opera­tives, chief strategist and propagan­dist with a $5 million US bounty on his head, until he was killed in a US air strike in Syria on August 30th, 2016,
On December 5th, ISIS an­nounced that he had been succeed­ed as propaganda chief by someone identified only by the nom de guerre Abu Hassan al-Muhajir, whose ap­pearance and whereabouts West­ern intelligence experts say are not known.
Whether Muhajir also took over the Amniyat as well is not clear but his first announcement was to echo Adnani’s infamous September 2014 call on ISIS supporters everywhere to attack Western kuffar — disbe­lievers — wherever they were to be found.
One supporter who had acted on Adnani’s appeal was Anis Amri, a Tunisian who drove a hijacked 25-tonne lorry through a crowded Christmas market in Berlin on De­cember 19th, killing 12 people and injuring dozens more.
Western intelligence sources say he had communicated with the Am­niyat at least once using Telegram before he embarked on his killing spree.
“Although much remains un­known about Amri’s case, it bears many of the hallmarks of ISIL’s ‘vir­tual planner’ model of managing lone attackers,” observed terrorism specialist Daveed Gartenstein-Ross of the Washington-based Founda­tion for the Defense of Democra­cies, using another acronym for ISIS.
“The virtual planner model has revolutionised jihadist external operations. ISIL has taken advan­tage of recent advances in online communications and encryption to engineer a process by which the group’s top operatives can directly guide lone attackers, playing an intimate role in the conceptualisa­tion, target selection, timing and execution of attacks,” he explained in a January 4th analysis.
“Virtual planners can offer opera­tives the same services once pro­vided by physical networks. This model has helped transform lone attackers who rely heavily on the Internet from the bungling wan­nabes of a decade ago into some­thing more dangerous.”
Al-Qaeda, which engaged in com­plex attacks such as the multiple suicide hijackings of September 11th, 2001, which required months of preparation, did not have access to the technology available to ISIS.
So far as is known, ISIS has not attempted such ambitious opera­tions as 9/11 or the thwarted Janu­ary 2006 al-Qaeda plot to blow up ten US-bound airliners over the At­lantic — a rerun of a foiled 1995 plot known as Operation Bojinka, linked to al-Qaeda, to destroy up to 12 US airliners over the Pacific.
But, Gartenstein-Ross and others fear that it may just be a matter of time before Amniyat al-Kharji grav­itates towards such potentially cat­astrophic plots. “ISIL has demon­strated an unprecedented ability to coordinate sustained campaigns in various theatres across the globe,” he acknowledged.
Intelligence officials say the tactic of using heavy trucks to ram crowds of civilians, such as the July 14th at­tack on a Bastille Day crowd in the Mediterranean city of Nice that killed 84 people and the Christmas market attack in Berlin involved en­crypted guidance by ISIS handlers in Syria.
They were probably in the north­ern city of Raqqa, de facto capital of ISIS’s Islamic caliphate, or al-Bab, where Western intelligence says Amniyat has a particularly active command centre.
“Most of ISIL’s prominent virtual planners appear to be based in the group’s ‘caliphate’ in Syria and Iraq, in large part due to proximity and access to ISIL’s top leadership,” Gar­tenstein-Ross said.
“But since the main equipment that virtual planners require is an internet connection and good en­cryption, they could theoretically operate from other geographic loca­tions.
“Being geographically dispersed carries greater risk of detection, but particularly as ISIL continues to decline as a territorial entity, the emergence of prominent virtual planners operating from outside the Syria-Iraq theatre is likely.”
Analyst Bridget Moreng, writ­ing in the journal Foreign Affairs in September 2016, observed that “although ISIS’s territorial holdings continue to dwindle, the threat it poses does not.
“ISIS has proven itself to be an endlessly adaptive organisa­tion, utilising creative measures to shape-shift in its response to exter­nal pressures.
“As the group’s territory shrinks and its leadership is picked off by US-led air strikes, ISIS will rely in­creasingly on its ‘virtual planners’ — members who operate in the dark spaces of the Internet — to inspire and coordinate attacks abroad.”