Not âLone Wolvesâ After All: How ISIS Guides Plots by Remote Control
By Rukmini Callimachi, NY Times, Feb. 4, 2017
HYDERABAD, India--When the Islamic State identified a promising young recruit willing to carry out an attack in one of Indiaâs major tech hubs, the group made sure to arrange everything down to the bullets he needed to kill victims.
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be the Islamic Stateâs first strike on Indian soil.
They vetted each new member of the cell as Mr. Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the groupâs virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here last June, the Islamic Stateâs cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Mr. Yazdaniâs offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by the Islamic State whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, Islamic State handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left to be left in a bag swinging from the branches of a tree.
For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationality of their interlocutors inside the Islamic State, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.
As a result, any remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Tex., were initially labeled the work of âlone wolves,â with no operational ties to the Islamic State, and only later was direct communication with the group discovered.
In at least 10 executed attacks, officials have found that the assailant was in direct communication with planners from the Islamic State.
While the trail of many of these plots led back to planners living in Syria, the very nature of the groupâs method of remote plotting means there is little dependence on its maintaining a safe haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Close examination of both successful and unsuccessful plots carried out in the Islamic Stateâs name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group, which is also known as ISIS, ISIL or Daesh.
âThey are virtual coaches who are providing guidance and encouragement throughout the process--from radicalization to recruitment into a specific plot,â said Nathaniel Barr, a terrorism analyst at the Foundation for Defense of Democracies, who along with Daveed Gartenstein-Ross wrote one of the first articles discussing the virtual plotters.
âIf you look at the communications between the attackers and the virtual plotters, you will see that there is a direct line of communication to the point where they are egging them on minutes, even seconds, before the individual carries out an attack.â
Detailing this kind of plot direction has become a critical focus of counterterrorism officials in the United States and Europe, as they try to track terror planners who pose a lasting threat and to unravel the criminal networks that the group uses as middlemen to facilitate attacks.
Mr. Yazdaniâs case presents one of the most detailed accounts to date of how the Islamic State is exporting terrorism virtually. This style of attack has allowed the terrorist groupâs reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
âI fear this is the future of ISIS,â said Bridget Moreng, an analyst whose research on the virtual plotters was recently published in Foreign Affairs.
Investigation documents from Europe show that a growing share of attacks bear signs of contact with the Islamic Stateâs stronghold, even though the attacker was initially described as acting alone.
The first time that officials in Europe described an attack as having been âtĂ©lĂ©commandĂ©,â or remote-controlled, was in the spring of 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.
When the police conducted a search of his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.
âOK, brother, now pay attention,â one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop. âSearch among the cars that are parked there near the big road and look for a Renault MĂ©gane,â the message said. âLook at the front right tire--youâll find the keys placed on top.â
The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.
Later, French investigators said they had found that Mr. Ghlamâs handlers were French citizens who had traveled to Syria to join the Islamic State. They, in turn, tapped their criminal network back in France in order to arrange the logistics of Mr. Ghlamâs plot.
Seamus Hughes, the deputy director of the Program on Extremism at George Washington University, said the handlers were essentially âquarterbackingâ the attack: âTheyâre from there, so they can essentially tell someone, âO.K., go 10 yards and go this way.â
Wiretaps, interrogation records and transcripts of chats recovered on suspectsâ phones and laptops show that this level of guidance has occurred all over the world.
In Germany, a man who set off a bomb outside a music concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their respective attacks. The teenagerâs handler urged him to use a car instead of an ax--âThe damage would be much greater,â the handler advised--but the young man said he did not have a driving permit. âI want to enter paradise tonight,â the teenager said, according to a transcript obtained by a German newspaper.
In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair did not know each other, and according to the investigative file, the handler had introduced them, organizing for them to meet days before the attack. Intelligence records obtained by the Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.
And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with Islamic State handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.
In several, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in the city of Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested so far had been turned back from Turkey, French prosecutors said.
While a reliance on local amateurs has allowed the Islamic State to announce that it can stage terrorism around the world, it has also led to many failed attacks.
Instead of opening fire on a church, Mr. Ghlam shot himself in the leg. Instead of laying waste to a music festival this summer, the Islamic State recruit in Germany detonated his bomb prematurely, killing only himself.
The same thing happened the day before the end of Ramadan on July 2 inside a police compound in Indonesia, where another remotely guided attacker hit the switch on his crudely assembled suicide vest.
âHe didnât even knock over the flowerpot on the ledge next to where he blew himself up,â said Sidney Jones, director of the Institute for Policy Analysis of Conflict.
Indonesian officials say that the suicide bomber had been incited to attack by Bahrun Naim, a 33-year-old Indonesian man who is now one of the Islamic Stateâs most prolific cyberplanners, operating from the groupâs capital in Raqqa, Syria.
Initially, Mr. Naim wired money to families in Indonesia to pay for travel to Syria, officials said. Later, the bank transfers he sent were to be used to buy the chemicals needed to build explosives, according to the interrogation records of his recruits.
In just over a year, the young men he guided attempted at least six attacks, targeting a police post, a Buddhist temple and a church, as well as foreigners visiting the country. In November, a college dropout who was being guided by Mr. Naim was arrested as he prepared to attack the Malaysian Embassy. In his home, the police recovered a quantity of explosives that could have resulted in a blast twice as powerful as the 2002 Bali bombing, which killed 202 people, the police spokesman told local news media.
Yet nearly all of the plots attributed to Mr. Naim have failed. And it was human error that finally led to the arrest of Amrikiâs followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mr. Mohammedâs home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. âWe could not succeed in making powder, as it became jellylike paste,â Mr. Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to âcook the rice.â
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mr. Mohammedâs home.
In his bedroom, they found the half-cooked explosive inside his refrigerator.
