‘Lone wolves’ may be remotely controlled
ISIS cyberplanners instruct, guide recruits to strike where they live
HYDERABAD, India — When the Islamic State identified a promising young recruit willing to carry out an attack in one of India’s major tech hubs, the group made sure to arrange everything down to the bullets he needed to kill victims.
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be the Islamic State’s first strike on Indian soil.
They vetted each new member of the cell as Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here in June, the Islamic State’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by the New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIS whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, ISIS handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.
While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Virtual plotters
Yazdani’s case presents one of the most detailed accounts to date of how ISIS is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
One of the Islamic State’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on howto reach Syria, was Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.
By 2015, Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.
Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.
But by late spring 2015, they were considered enough of a threat that both U.S. and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.
Among them was alAmriki himself, who was killed along with his wife on April 22, when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of ISIS’ “external attack planners” who “actively sought to harm Western interests.”
At the time al-Amriki was killed, he had been exchanging messages with Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.
Refining its methods
One of eight children, Yazdani, 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.
While abroad, he began watching ISIS online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.
“Since then, I was inclined to join Islamic State and work for the cause of religion,” Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by the Times and was first reported by NDTV, a New Delhi-based television company.
He logged into Twitter and searched the hashtags #ISIS and #Khilafa, the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with al-Amriki.
“I created a Telegram ID,” Yazdani told investigators, “and sought his guidance to reach Syria.”
After months of frustrating and failed attempts to help Yazdani get a visa, al-Amriki’s directions changed course: “He asked me to work for (ISIS) by staying in India itself.”
It was a period in which ISIS was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge.
In several investigations, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by authorities in the home country or turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in the city of Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested had been turned back from Turkey, French prosecutors said.
Many failed attacks
While a reliance on local amateurs has allowed ISIS to announce that it can stage terrorism around the world, it also has led to many failed attacks.
It was human error that finally led to the arrest of al-Amriki’s followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mohammed’s home.
In his bedroom, they found the half-cooked explosive in his refrigerator.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIS whose only connection to the would-be attacker is the internet.