|
 Me
and Terrorist 007
Tracking a terrorist through cyberspace...
[by Laura Mansfield] 3/10/06
It’s been
two years since I first locked horns with a cyber jihadi by
the name of Terrorist 007.
I was working
as the assistant director for the Northeast Intelligence Network
(NEIN) and a writer for World Net Daily when I ran into Terrorist
007, or Irhabi 007, on the old Ansar forum, an Arabic language
message board frequently used by Al Qaeda sympathizers. (I've
since left NEIN and am now on my own at LauraMansfield.com.)
Irhabi 007
was bragging about his hacking abilities, in an attempt to
weasel his way into the “in crowd” of vetted jihadis. Over
the next few months, I watched as Terrorist 007 began to establish
himself as an expert, and gain the respect of the fellow jihadis.
My friend Jill
St. Claire and I began building a dossier on 007, just
as we were doing on Abu Banan, the apparent director of Global
Islamic Media.
Contributor
Laura
Mansfield
Laura Mansfield is a writer and commentator on issues regarding the Middle
East, Islam, and Radical Islamic Terrorism.
Subscribers
to her Strategic
Translations and Analysis service include major
libraries in the US, the UK, Germany, and Italy; various
US and UK governmental and intelligence agencies; law
enforcement agencies in the US, UK, Italy, and Germany;
and many Fortune 500 companies.
She
is a regular subject matter consultant for news agencies
in the UK, the US, Germany, Italy, and Israel. [go
to Mansfield index]
[go to Mansfield website]
|
One
Nation Under Allah
by
Laura Mansfield
|
Inshallah
by
Laura Mansfield
|
One thing
that stood out about Terrorist 007 initially was that he posted
primarily in English. He was apparently learning Arabic, because
over the next two years, he began to shift to posting more
and more in Arabic.
As time went
on, 007 became more and more brazen. He began to post links
to cracked commercial software programs, as well as to various
jihadi audio and video propaganda files. He gradually began
to expand into posting detailed instructional material on making
suicide bomb vests, improvised explosive devices, and other
terrorist tools.
007 was always
one of the first to post links to Voice of Jihad (Sawt al Jihad)
and Al Battar, publications created by Al Qaeda of the Arabian
Peninsula (Saudi Arabia) and distributed by Global Islamic
Media.
Over the
months, it appeared that 007 was making inroads into an “inner
circle” of internet jihadis, including Abu Banan.
007’s identity
was elusive. At times he claimed to be in the United States;
other times he claimed to be in the UK. His tendency to use
British spellings of words led credence to theories that he
was in the UK.
As time went
on, Terrorist 007 continued to amass a huge collection of Al
Qaeda propaganda films, and as one website after another was
pulled down by authorities, he began to appropriate server
space belonging to unsuspecting companies and institutions
who left open doors on their webservers by enabling anonymous
FTP uploads. One of the first to be appropriated by 007 was
a server at George Washington University in Washington DC.
When Nick
Berg was beheaded in Iraq in April 2004, Irhabi 007 had one
of the most extensive collections of links to videos of the
beheading.
The bandwidth
storm that followed the release of the beheading video combined
with the public outcry over the brutality of the murder brought
down the Ansar website as well as several other jihadi forums;
others went to a password protected mode to limit access.
By the time
American hostage Paul Johnson was kidnapped and beheaded in
Saudi Arabia in June, 007 was an integral part of the network
responsible for distributing the video films, “borrowing” server
space from an unsuspecting California company, slipping in
through the anonymous FTP security hole.
It was only
a few weeks later that I discovered Terrorist 007 “borrowing” web
space from the State of Arkansas. I made the discovery during
my weekly terrorist update on Ernie Brown’s syndicated radio
show America at Night while checking jihadi sites for last
minute updates.
When I noticed
that 007 was posting jihadi material on the servers of the
Arkansas Department of Transportation, I immediately notified
the authorities through the chain of command at the Northeast
Intelligence Network
But since
that rarely brought any results, I also went directly to the
media, tipping off a friend at CNN about my find.
The initial
press release from NEIN has been removed from their servers,
but can be accessed through their Google cache here
A more extensive
set of links that NEIN published is located here
Among them
were files highly sought after by jihadis, including the al-Qaida
films "Badr al Riyadh," "American Hell in Iraq," "Russian Hell," "Martyrs
of the Confrontation" and "Wills of Martyrs." Other files posted
included the beheading video of Nick Berg, as well as audio
and video clips of various al-Qaida leaders, including Osama
Bin Laden, Ayman al-Zawahiri and Abu Musa'ab al-Zarqawi.
The files
were located at ftp://www.ahtd.state.ar.us/
incoming/GIS/007 and at ftp://www.ahtd.state.ar.us/ incoming/GIS/ALQA3EDAH
Within hours,
the FBI had confiscated the server. The ensuing publicity brought
me to the attention of Terrorist 007. He began posting to me
in English on the jihadi forums, and at one point he even told
his cyber friends that he planned to find me and marry me.
In late summer
of 2004, 007 informed his buddies on the boards that he was
going to be going on a trip to the Bahamas, and advised them
not to worry about his absence from the boards. In a couple
of weeks, true to his word, Terrorist 007 was back on the boards.
He began
expanding his horizons, putting up numerous websites containing
extensive libraries of both propaganda videos and audios, and
of instructional materials teaching terrorism techniques, how
to make more and more destructive killing devices, and basic
hacking techniques as well. For many months, Terrorist 007
was a source of “WAREZ”, pirated commercial software. At one
point, the ever helpful 007 posted ripped copies of Arabic
language translation software to help those who needed assistance
in translation!
By spring
of 2005, 007 was feeling the bandwidth pinch again, and began
stealing credit card numbers to use in purchasing domain names
and web hosting for his websites. His favorite technique seemed
to be keystroke loggers. On many occasions, my virus protection
intercepted attempts by 007 to download a keystroke logger
to my company as I monitored his websites.
In May and
June 2005, 007 had posted maps of the London transit system,
as well as photographs of various tube terminals in London
on his websites. It is unknown at this time if there was any
connection between these posts and the London bombings in July
2005.
Then, last
fall, shortly after Joel Hinnrichs committed suicide with an
explosives vest at Oklahoma University, Terrorist 007 abruptly
disappeared. Some analysts even speculated that Hinnrichs was
007, although that seemed unlikely. It seemed more likely that
007 had disappeared from view, and was actually using a cyber
alias. This theory gained credibility after law enforcement
discovered that Hinnrichs had downloaded the instructions for
creating his explosives from one of 007’s websites.
His absence
was noted on the jihadi boards; many of his fellow jihadis
speculated that he had gone to Iraq to participate in the jihad
there.
What we know
now is that Terrorist 007 was arrested in October 2005 near
London. His real name is Younis Tsouli. His arrest came as
part of a series of arrests that began with a raid in Bosnia.
Tsouli had apparently been in email contact with the men arrested
in that terror raid, and in late October, British police arrested
Tsouli and two other men under the Terrorism Act.
Tsouli was
charged with ten charges “including conspiracy to murder, conspiracy
to cause an explosion, conspiracy to obtain money by deception,
fundraising and possession of articles for terrorist purposes.” Police
allege that Tsouli and his coherts intended to detonate a huge
car bomb in central London.
A senior
Scotland Yard source said: "We are convinced that if we had
not acted swiftly a massive bomb, designed to kill and maim
hundreds of innocent people, would have been set off in London,
probably before the end of the year and possibly during the
Christmas rush."
According
to the Sunday Mirror, the Tsouli is accused of the following:
- Possession
of a video showing how to make a car bomb.
- Possession
a video showing a number of places in Washington DC and including
a CRBN (chemical, radiological, biological and nuclear) vehicle.
- Conspiracy
to murder.
- Conspiracy
to cause an explosion.
- Conspiracy
to cause a public nuisance, conspiracy to obtain money by
deception and other offences under the Terrorism Act.
As
law enforcement began to examine Tsouli’s computer, they
found pictures of several locations in Washington D.C.,
according to Scotland Yard, as well as computerized slides
demonstrating how to make a car bomb and a DVD explaining
how to create a suicide bomber belt.
From
other information on the computer, police realized that
they had managed to finally apprehend the elusive Terrorist
007.
The
role that Irhabi 007 played in the growth of the global
jihad should not be underestimated. He was very active
in recruiting new members to the jihad, and provided
valuable expertise to the group. His tutorials on how
jihadis can conceal themselves through the use of anonymous
proxy servers have no doubt helped many terrorists elude
detection over the last several years.
The
instructional material he provided has almost certainly
resulted in the deaths of innocents.
Terrorist
007 is now in custody. But dozens of his followers remain,
and several have already begun to carry on where he left
off.-one-
Related
links:
- World
Net Daily: Al-Qaida hijacks Arkansas website: Violent
propaganda distributed via government system
- Washington
Post: Al Qaeda Messages Posted on U.S. Server
- WashIngton
Times: Al-Qaida hacker hits Arkansas system
- San
Francisco Chronicle: Iraq's tech-savvy insurgents are
finding supporters and luring suicide-bomber recruits
over the Internet
copyright
2006 Laura Mansfield
§
|
