The Internet is an essential tool for terrorists and their sympathizers, who utilize this global network to spread propaganda, raise funds, recruit and otherwise communicate. In some cases, however, terrorist sympathizers are motivated to do more than use the Internet to reinforce extremist ideologies and goals, opting instead to move beyond the confines and relative safety of their computers and carry out real world terrorist acts themselves.
The saga of Younis Tsouli, a 22-year-old British national arrested near London in October 2005 for allegedly plotting a terrorist attack, illustrates the growing threat posed by terrorist sympathizers seeking to engage in activity beyond cyberspace.
Three years before his arrest, Tsouli began a string of online activity that would gain the attention of law enforcement officials and experts around the world. He was known only by his cyber alter-ego, Irhabi007 (Arabic for “Terrorist 007”).
Irhabi007 emerged on jihadist Internet forums in 2003, claiming to have in-depth knowledge of Internet security. He often bragged – in English and some broken Arabic – about being skilled at hacking (breaking into computer systems) and cracking (getting past security protected software), and saying he could teach others how to hide themselves from detection.
One way Irhabi007 demonstrated his computer skills was by breaking into unprotected Web servers and using File Transfer Protocol (FTP), a mechanism for transferring files over the Internet, to post terror-related files. This technique enabled others to quickly access the large files he posted onto hacked servers. Among the files Irhabi007 distributed through this method were audio and video clips of Al Qaeda’s leadership, including Osama bin Laden, Ayman al Zawahiri and Abu Musab al Zarqawi.
Irhabi007 also used free Web hosting services, some of which are located in the United States, to create new Web sites. Due to the limited bandwidth (the amount and speed data can be transmitted) generally offered by free hosting services, Irhabi007 primarily used these services to post links to materials located on other servers, including the various FTP sites he had hijacked.
Several of the Web addresses he created were variations of his online nickname, like “erhabi,” “007irhabi,” and “irhaby007;” he named two of his other sites “alqa3edah” (like Al Qaeda) and “deadzionists.” Visitors to these sites were able to access links to weapons manuals and audio and video clips in support of Al Qaeda’s efforts in Iraq and Europe, including videos of Americans being beheaded in Iraq.
In order to take advantage of better Web hosting services, which are available to paying customers, Irhabi007 began to steal people’s credit card information and identities in the summer of 2005. One of the sites he created with stolen information was called “alerhaab.” He claimed that “alerhaab” was being used by an actual terrorist group to post jihadist materials, but the site’s registration information listed a British woman living in the London area – without her knowledge. This site could be traced back to Irhabi007 because the e-mail address listed in the registration was not the British woman’s, but rather an address used by Irhabi007. He repeated this patter of registering Web sites with stolen information several times. For example, the “irhaab007” site was registered to a member of the US Army Reserve living in Pennsylvania.
In July 2004, Irhabi007’s online exploits came to the attention of the FBI when he hacked an FTP server operated by the Arkansas Highway and Transportation Department and transformed it into an Al Qaeda message board. He posted dozens of jihadist audio and video files so that others could freely download them. These files included videos made by an Al Qaeda affiliate group in Saudi Arabia responsible for attacking housing used by foreign workers in the Kingdom in November 2003.
In August 2004, Irhabi007 caught the attention of Austrian law enforcement for posting a map of an underground garage in Vienna. Around that time, authorities in the United States and the United Kingdom, as well as experts outside the government, were able to narrow down his location to England by using various tracking methods.
Despite his vast online activity, there was still little information about Irhabi007’s true identity. That changed in the fall of 2005 when two men in Bosnia were arrested in connection to an alleged terror plot.
In October 2005, Bosnian police arrested Mirsad Bektasevic, a 19-year-old Swedish citizen, and Cesur Abdulkadir, an 18-year-old Turkish national, in Sarajevo on suspicion of plotting a terrorist attack (neither has been formally charged). During a search of the apartment they shared, police found a suicide bomber belt, explosives, firearms and other military equipment. A videotape of masked men begging God’s forgiveness for a sacrifice they were planning was also found in the apartment. Masks found in the apartment seem to match those worn in the video and authorities suspect Bektasevic and Abdulkadir of being the men on the tape.
Bektasevic’s lawyer indicated that his client was interrogated by American, British, Danish and Swedish investigators. Authorities in Denmark reportedly used the information they received from Sarajevo police to take seven suspects into custody in October 2005. The suspects have not been charged, but Copenhagen police suspect they are affiliated with a terror network that planned an attack in Europe.
Phone and e-mail records uncovered in the Bosnian raid also led British police to arrest Younis Tsouli, Waseem Mughal, 22, and Tariq Al-Daour, 19, in late October near London; all three were charged a month later under the UK Terrorism Act. Tsouli and Mughal are charged with 10 offenses, including conspiracy to murder, conspiracy to cause an explosion, conspiracy to obtain money by deception, fundraising and possession of articles for terrorist purposes.
Police seized a computer hard drive belonging to Tsouli, containing pictures of several locations in Washington D.C., according to Scotland Yard. Tsouli is also charged with possessing computerized slides demonstrating how to make a car bomb and a DVD explaining how to create a suicide bomber belt.
Other information uncovered on Tsouli’s computer indicating to police that they had in their custody none other then the infamous Irhabi007.
Using the cyber alter-ego Irhabi007, Tsouli was able to distribute various jihadist materials through the Internet for almost three years. Had not the Bosnian investigation which ultimately led authorities to arrest Tsouli occurred, Irhabi007 could still be using his expertise on the Internet to share jihadist propaganda and advance his own extremist beliefs. The arrest likely prevented Irhabi007 from carrying out a real world attack.