In the aftermath of the Islamic State's attacks across Paris on Nov. 13, 2015, French investigators were stumped about how the slaughter of 130 people had been planned, even though the authorities had the terrorists' mobile phones.
The reason was the perpetrators had, for the first time, used encrypted messaging apps, such as Telegram or WhatsApp, that could not be cracked by French authorities, the Americans or anyone else.
It was a turning point, and a deadly one, in the Islamic State's war of terror against the West and its enemies around the globe.
"We cannot penetrate into certain conversations," François Molins, a former chief prosecutor in Paris, lamented at the time. "We are dealing with this gigantic black hole, a dark zone where there are just so many dangerous things going on."
Since then, the Islamic State terror campaign has escalated sharply under the group's shadowy but innovative intelligence apparatus, headed by veteran Islamists and some of Saddam Hussein's top security operatives.
The inner workings of the jihadists' apparatus are only now coming to light through the interrogation of defectors and intelligence on senior IS leaders and digital data captured in covert raids by special forces of the U.S.-led coalition.
The key to it all is the Amniyat al-Kharji, the external operations arm of IS's intelligence and security organization. It inspires and controls attacks by individual supporters known as "lone wolves" but it also organizes and directs trained infiltrators to mount coordinated attacks that are invariably more lethal and morale-sapping, such as the bomb and gun strikes against several targets in Paris.
The key to Amniyat al-Kharji's growing abilities to organize, plan and execute sophisticated attacks is its hijacking of the Internet and the evolution of end-to-end encryption on the Internet and mobile devices that is impervious to tracking by intelligence services. European counterterrorism officials call IS operations in which online handlers guide terrorists to their targets as being "remote-controlled."
The Amniyat's increasingly sophisticated killing machine and its encryption system has allowed IS to transform the mechanics of terror from unfocused and random attacks by individuals into a deadly efficient network of cells directed by Amniyat's team of handlers.
Western intelligence services fear this may well escalate from gun and bomb attacks and driving lorries into crowds, to car bombings and possibly even chemical weapons strikes.
A Western security source said that an IS defector, born in Germany but raised in Britain and known as Abu Khaled, has claimed the Amniyat plans to use women suicide bombers. Recent security swoops in Tunisia have added weight to that claim with the arrest of several women who were allegedly preparing for suicide operations.
Rachid Kassim, one of the Amniyat's principal terrorist coordinators who focuses primarily on France, seems to be active in this endeavor. In September 2016, three women, ages 19, 23 and 39, were arrested in connection with a failed attempt to blow up a car packed with gas canisters and jerry cans of diesel near Notre Dame Cathedral in Paris, a major tourist attraction. The plot was directed by Kassim.
Some in the intelligence community blame U.S. whistle-blower Edward Snowden, who in 2013 unveiled the secrets of U.S. penetration of cyberspace, for revealing to militant groups how they could thwart electronic surveillance and have a safe means of operational communications. This gave IS a vital and highly lethal edge in its clandestine operations that U.S. and other intelligence services have been unable to combat or neutralize.
According to Edward Jay Epstein, author of the book How America Lost Its Secrets: Edward Snowden, the Man and the Theft, "Snowden also aided potential terrorists by offering specific tips about secret sources and methods used by both (the U.S. National Security Agency) and its British counterpart, the Government Communications Headquarters."
The Amniyat was headed by Muhammad al-Adnani, a 39-year-old Syrian and one of IS's top operatives, chief strategist and propagandist with a $5 million bounty on his head, until he was killed in a U.S. airstrike in Syria on Aug. 30, 2016,
On Dec. 5, IS announced that he had been succeeded as propaganda chief by someone identified only by the nom de guerre Abu Hassan al-Muhajir, whose appearance and whereabouts Western intelligence experts say are not known.
Whether Muhajir also took over the Amniyat as well is not clear but his first announcement was to echo Adnani's infamous September 2014 call on IS supporters everywhere to attack Western kuffar — disbelievers — wherever they were to be found.
One supporter who had acted on Adnani's appeal was Anis Amri, a Tunisian who drove a hijacked 25-ton lorry through a crowded Christmas market in Berlin on Dec. 19, killing 12 people and injuring dozens more.
Western intelligence sources say he had communicated with the Amniyat at least once using Telegram before he embarked on his killing spree.
"Although much remains unknown about Amri's case, it bears many of the hallmarks of ISIL's 'virtual planner' model of managing lone attackers," observed terrorism specialist Daveed Gartenstein-Ross of the Washington-based Foundation for the Defense of Democracies, using another acronym for IS.
"The virtual planner model has revolutionized jihadist external operations. ISIL has taken advantage of recent advances in online communications and encryption to engineer a process by which the group's top operatives can directly guide lone attackers, playing an intimate role in the conceptualization, target selection, timing and execution of attacks," he explained in a Jan. 4 analysis.
"Virtual planners can offer operatives the same services once provided by physical networks. This model has helped transform lone attackers who rely heavily on the Internet from the bungling wannabes of a decade ago into something more dangerous."
Al-Qaida, which engaged in complex attacks such as the multiple suicide hijackings of Sept. 11, 2001, which required months of preparation, did not have access to the technology available to IS.
So far as is known, IS has not attempted such ambitious operations as 9/11 or the thwarted January 2006 al-Qaida plot to blow up 10 U.S.-bound airliners over the Atlantic — a rerun of a foiled 1995 plot known as Operation Bojinka, linked to al-Qaida, to destroy up to 12 U.S. airliners over the Pacific.
But, Gartenstein-Ross and others fear that it may just be a matter of time before Amniyat al-Kharji gravitates toward such potentially catastrophic plots. "ISIL has demonstrated an unprecedented ability to coordinate sustained campaigns in various theaters across the globe," he acknowledged.
Intelligence officials say the tactic of using heavy trucks to ram crowds of civilians, such as the July 14 attack on a Bastille Day crowd in the Mediterranean city of Nice that killed 84 people and the Christmas market attack in Berlin involved encrypted guidance by IS handlers in Syria.
They were probably in the northern city of Raqqa, de facto capital of IS's Islamic caliphate, or al-Bab, where Western intelligence says Amniyat has a particularly active command center.
"Most of ISIL's prominent virtual planners appear to be based in the group's 'caliphate' in Syria and Iraq, in large part due to proximity and access to ISIL's top leadership," Gartenstein-Ross said.
"But since the main equipment that virtual planners require is an Internet connection and good encryption, they could theoretically operate from other geographic locations.
"Being geographically dispersed carries greater risk of detection, but particularly as ISIL continues to decline as a territorial entity, the emergence of prominent virtual planners operating from outside the Syria-Iraq theater is likely."
Analyst Bridget Moreng, writing in the journal Foreign Affairs in September 2016, observed that "although ISIS's territorial holdings continue to dwindle, the threat it poses does not.
"ISIS has proven itself to be an endlessly adaptive organization, utilizing creative measures to shape-shift in its response to external pressures.
"As the group's territory shrinks and its leadership is picked off by U.S.-led airstrikes, ISIS will rely increasingly on its 'virtual planners' — members who operate in the dark spaces of the Internet — to inspire and coordinate attacks abroad."
This article originally appeared at The Arab Weekly.