'Virtual planners' of Islamic State on dark side of the Internet

In the aftermath of the Islamic State's attacks across Paris on Nov. 13, 2015, French investigators were stumped about how the slaughter of 130 people had been planned, even though the authorities had the ter­rorists' mobile phones.

The reason was the perpetrators had, for the first time, used en­crypted messaging apps, such as Telegram or WhatsApp, that could not be cracked by French authori­ties, the Americans or anyone else.

It was a turning point, and a dead­ly one, in the Islamic State's war of terror against the West and its en­emies around the globe.

"We cannot penetrate into certain conversations," François Molins, a former chief prosecutor in Paris, lamented at the time. "We are dealing with this gigantic black hole, a dark zone where there are just so many dangerous things going on."

Since then, the Islamic State terror campaign has escalated sharply under the group's shadowy but innovative intelligence appa­ratus, headed by veteran Islamists and some of Saddam Hussein's top security operatives.

The inner workings of the jihad­ists' apparatus are only now coming to light through the interrogation of defectors and intelligence on senior IS leaders and digital data captured in covert raids by special forces of the U.S.-led coalition.

The key to it all is the Amniyat al-Kharji, the external operations arm of IS's intelligence and se­curity organization. It inspires and controls attacks by individual sup­porters known as "lone wolves" but it also organizes and directs trained infiltrators to mount coordinated attacks that are invariably more le­thal and morale-sapping, such as the bomb and gun strikes against several targets in Paris.

The key to Amniyat al-Kharji's growing abilities to organize, plan and execute sophisticated attacks is its hijacking of the Internet and the evolution of end-to-end encryption on the Internet and mobile devices that is impervious to tracking by in­telligence services. European coun­terterrorism officials call IS op­erations in which online handlers guide terrorists to their targets as being "remote-controlled."

The Amniyat's increasingly so­phisticated killing machine and its encryption system has allowed IS to transform the mechanics of ter­ror from unfocused and random at­tacks by individuals into a deadly ef­ficient network of cells directed by Amniyat's team of handlers.

Western intelligence services fear this may well escalate from gun and bomb attacks and driving lorries into crowds, to car bombings and possibly even chemical weapons strikes.

A Western security source said that an IS defector, born in Germa­ny but raised in Britain and known as Abu Khaled, has claimed the Am­niyat plans to use women suicide bombers. Recent security swoops in Tunisia have added weight to that claim with the arrest of several women who were allegedly prepar­ing for suicide operations.

Rachid Kassim, one of the Amni­yat's principal terrorist coordinators who focuses primarily on France, seems to be active in this endeav­or. In September 2016, three wom­en, ages 19, 23 and 39, were arrested in connection with a failed attempt to blow up a car packed with gas canisters and jerry cans of diesel near Notre Dame Cathedral in Paris, a major tourist attraction. The plot was directed by Kassim.

Some in the intelligence com­munity blame U.S. whistle-blower Edward Snowden, who in 2013 un­veiled the secrets of U.S. penetration of cyberspace, for revealing to mili­tant groups how they could thwart electronic surveillance and have a safe means of operational commu­nications. This gave IS a vital and highly lethal edge in its clandestine operations that U.S. and other intelli­gence services have been unable to combat or neutralize.

According to Edward Jay Epstein, author of the book How America Lost Its Secrets: Edward Snowden, the Man and the Theft, "Snowden also aided potential terrorists by offering specific tips about secret sources and methods used by both (the U.S. National Security Agency) and its British counterpart, the Gov­ernment Communications Head­quarters."

The Amniyat was headed by Mu­hammad al-Adnani, a 39-year-old Syrian and one of IS's top opera­tives, chief strategist and propagan­dist with a $5 million bounty on his head, until he was killed in a U.S. airstrike in Syria on Aug. 30, 2016,

On Dec. 5, IS an­nounced that he had been succeed­ed as propaganda chief by someone identified only by the nom de guerre Abu Hassan al-Muhajir, whose ap­pearance and whereabouts West­ern intelligence experts say are not known.

Whether Muhajir also took over the Amniyat as well is not clear but his first announcement was to echo Adnani's infamous September 2014 call on IS supporters everywhere to attack Western kuffar — disbe­lievers — wherever they were to be found.

One supporter who had acted on Adnani's appeal was Anis Amri, a Tunisian who drove a hijacked 25-ton lorry through a crowded Christmas market in Berlin on De­c. 19, killing 12 people and injuring dozens more.

Western intelligence sources say he had communicated with the Am­niyat at least once using Telegram before he embarked on his killing spree.

"Although much remains un­known about Amri's case, it bears many of the hallmarks of ISIL's 'vir­tual planner' model of managing lone attackers," observed terrorism specialist Daveed Gartenstein-Ross of the Washington-based Founda­tion for the Defense of Democra­cies, using another acronym for IS.

"The virtual planner model has revolutionized jihadist external operations. ISIL has taken advan­tage of recent advances in online communications and encryption to engineer a process by which the group's top operatives can directly guide lone attackers, playing an intimate role in the conceptualiza­tion, target selection, timing and execution of attacks," he explained in a Jan. 4 analysis.

"Virtual planners can offer opera­tives the same services once pro­vided by physical networks. This model has helped transform lone attackers who rely heavily on the Internet from the bungling wan­nabes of a decade ago into some­thing more dangerous."

Al-Qaida, which engaged in com­plex attacks such as the multiple suicide hijackings of Sept. 11, 2001, which required months of preparation, did not have access to the technology available to IS.

So far as is known, IS has not attempted such ambitious opera­tions as 9/11 or the thwarted Janu­ary 2006 al-Qaida plot to blow up 10 U.S.-bound airliners over the At­lantic — a rerun of a foiled 1995 plot known as Operation Bojinka, linked to al-Qaida, to destroy up to 12 U.S. airliners over the Pacific.

But, Gartenstein-Ross and others fear that it may just be a matter of time before Amniyat al-Kharji grav­itates toward such potentially cat­astrophic plots. "ISIL has demon­strated an unprecedented ability to coordinate sustained campaigns in various theaters across the globe," he acknowledged.

Intelligence officials say the tactic of using heavy trucks to ram crowds of civilians, such as the July 14 at­tack on a Bastille Day crowd in the Mediterranean city of Nice that killed 84 people and the Christmas market attack in Berlin involved en­crypted guidance by IS handlers in Syria.

They were probably in the north­ern city of Raqqa, de facto capital of IS's Islamic caliphate, or al-Bab, where Western intelligence says Amniyat has a particularly active command center.

"Most of ISIL's prominent virtual planners appear to be based in the group's 'caliphate' in Syria and Iraq, in large part due to proximity and access to ISIL's top leadership," Gar­tenstein-Ross said.

"But since the main equipment that virtual planners require is an Internet connection and good en­cryption, they could theoretically operate from other geographic loca­tions.

"Being geographically dispersed carries greater risk of detection, but particularly as ISIL continues to decline as a territorial entity, the emergence of prominent virtual planners operating from outside the Syria-Iraq theater is likely."

Analyst Bridget Moreng, writ­ing in the journal Foreign Affairs in September 2016, observed that "although ISIS's territorial holdings continue to dwindle, the threat it poses does not.

"ISIS has proven itself to be an endlessly adaptive organiza­tion, utilizing creative measures to shape-shift in its response to exter­nal pressures.

"As the group's territory shrinks and its leadership is picked off by U.S.-led airstrikes, ISIS will rely in­creasingly on its 'virtual planners' — members who operate in the dark spaces of the Internet — to inspire and coordinate attacks abroad."

This article originally appeared at The Arab Weekly.