Not ‘lone wolves’ after all: How ISIL is engineering terror plots far away from their targets
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be ISIL’s first strike on Indian soil.
They vetted each new member of the cell as Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here in June, ISIL’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIL whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, ISIL handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.
For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationalities of their ISIL interlocutors, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.
As a result, remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Texas, were initially labeled the work of “lone wolves,” with no operational ties to ISIL, and only later was direct communication with the group discovered.
While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Close examination of both successful and unsuccessful plots carried out in ISIL’s name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group.
Yazdani’s case presents one of the most detailed accounts of how ISIL is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
One of ISIL’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on how to reach Syria, was Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.
ISIL militants in a commandeered Iraqi security forces armoured vehicle in Mosul, Iraq, in 2014
By 2015, al-Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.
Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.
But by late spring 2015, they were considered enough of a threat that both U.S. and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.
Among them was al-Amrik, who was killed along with his wife on April 22 when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of ISIL’ “external attack planners” who “actively sought to harm Western interests.”
Emanuel Lutchman of Rochester, N.Y.
The Defense Department’s account showed, moreover, that the handler had been involved in far more than just the Hyderabad case, planning attacks on three continents.
At the same time that he was recruiting Yazdani, al-Amriki was grooming attackers in Canada and Britain, as well as at least three other young men in suburbs across the United States, according to court records. They included a former member of the Army National Guard living in Virginia; a warehouse worker from Columbus, Ohio; and Emanuel L. Lutchman, a 25-year-old in Rochester, New York.
Looking for ways to get to Syria, Lutchman reached out to al-Amriki on Dec. 25, 2015, asking what it was like to live inside territory controlled by the group. “Dream come true,” al-Amriki responded, before telling the young man that the Syrian border had been closed, according to the criminal complaint.
Instead, the handler suggested Lutchman carry out an attack right at home on New Year’s Eve — less than a week after their first exchange. Plan an “operation” and kill “1000000s of kuffar,” al-Amriki instructed him, using a derogatory Arabic word meaning infidel. Over the course of several chats via the Telegram service, they planned how Lutchman would attack a bar serving craft beer to celebrate the holiday, prosecutors say.
The two men discussed recruiting three other “brothers” to take part. They stayed in contact as Lutchman went to Wal-Mart, where he spent $40 on two ski masks, two knives, a machete, zip-ties, duct tape and latex gloves. He planned to abduct one of the bar’s customers and videotape himself killing the victim, prosecutors say.
And they exchanged a flurry of messages, as the 25-year-old began to voice doubts and the handler assumed the role of therapist, patiently listening and reassuring him.
Lutchman was arrested at his home the day before his planned attack on Merchants Grill in Rochester, outed by the accomplice he had recruited, who turned out to be an FBI informant.
At the time of his arrest, Lutchman had been communicating with the handler for a total of five days. It appears he never heard his handler’s voice, or saw so much as photograph of him, according to the court filings.
By late 2015, travel to Syria had become treacherous. Intelligence services on both sides of the Atlantic were getting better at identifying aspiring jihadis, arresting dozens as they prepared to board flights for Istanbul in hopes of crossing into Syria.
At first, ISIL operatives instructed recruits to throw off law enforcement by taking more indirect routes. They also began urging followers to head to other ISIL colonies, including in Libya.
That was what law enforcement officials said a young man from Columbus, Ohio, Aaron T. Daniels, was trying to do in November, when he was arrested while trying to board a United Airlines flight to Houston, from where he would travel to Port of Spain, Trinidad and Tobago, before continuing toward Libya.
This undated file image posted on a militant website on Tuesday, Jan. 14, 2014, which has been verified and is consistent with other AP reporting, shows fighters from the al-Qaida linked Islamic State of Iraq and the Levant (ISIL), now called the Islamic State group, marching in Raqqa, Syria
No longer describing the journey to Syria as a spiritual necessity, ISIL announced last year that those who could not reach the caliphate should attack at home.
“If the tyrants have closed in your faces the door of hijrah, then open in their face the door of jihad,” the group’s spokesman, Abu Muhammad al-Adnani, said in a message released in May.
At the time al-Amriki was killed in April, he had been exchanging messages with Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.
One of eight children, Yazdani, 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.
A bazaar in the old city quarter of Hyderabad, India
While abroad, he began watching ISIL online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.
“Since then, I was inclined to join Islamic State and work for the cause of religion,” Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by The Times and was first reported by NDTV, a New Delhi-based television company.
He logged into Twitter and searched the hashtags [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.], the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with al-Amriki.
“I created a Telegram ID,” Yazdani told investigators, “and sought his guidance to reach Syria.”
After months of frustrating and failed attempts to help Yazdani get a visa, al-Amriki’s directions changed course: “He asked me to work for IS by staying in India itself.”
It was a period in which ISIL was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge.
Just before his death, al-Amriki handed off Yazdani to a different handler, known only by his Telegram screen name, “WindsofVictory.” His identity has not yet been confirmed by Indian officials, though they believe he is Indian because he spoke fluent Hindi.
Mohammed Ishaq Yazdani, a brother of two men accused of plotting to carry out a terrorist attack in the name of the Islamic State group, at home in Hyderabad, India
The new handler guided the eight-member cell as it took shape, exchanging messages with Yazdani as the engineer recruited his family members and friends. They named themselves “Jund-ul-Khilafa-Fi-Bilad-Hind,” the Army of the Caliphate in India, according to the interrogation records, which misspelled part of the Arabic name.
At the end of May, Yazdani received a message telling him to go to the Nanded Airport, about 200 miles away. He and an accomplice, Habeeb Mohammed, 31, drove all night. After they reached the airport the next morning, the handler told them to head to the Railway Division Office. Near that office, he said, they would see a plastic bag hanging from a tree, according to the transcripts of the men’s interrogations.
“It was informed by the handler that opposite to DRM office, there are two trees and on one of the trees there would be a white color polyethylene sheet (used for wrapping fragile articles),” Mohammed told investigators. “We spotted the place, and I, first on the pretext of urinating, went to check for the consignment.”
When they opened the bag, they found two pistols and 20 bullets, according to their account to law enforcement. It was one of at least four drops the handler set up for them.
The location where terror plotters were reportedly instructed to collect a bag of ammonium nitrate by their handlers, outside Hyderabad, India, Dec. 12, 201
Because the pistols were rusted, they say the handler instructed them to travel to the railway station in the city of Ajmer, about 600 miles to the north. This time they were told to bring 65,000 rupees — around $1,000 — and leave it near the railway track sealed in a plastic bag, which would be picked up and used as payment for weapons.
Because the communication always had to go through the handler, the members of the Hyderabad cell never directly interacted with the arms seller. When they were arrested, they could not provide any clues as to who had left the contraband, Indian investigators said.
The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork.
As soon as Yazdani indicated he was willing to undertake an attack, the handler instructed him to download ChatSecure, a messaging app to be used when they spoke by phone. When he used his laptop, he was told to contact the handler via Pidgin, another encrypted tool. He was told to create an account with Tutanota, a secure email service. And the handler taught Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive.
Aman Nagar B, a slum where Mohammed Ibrahim Yazdani grew up in the old city quarter of Hyderabad, India, Dec. 12, 2016.
Once that system was in place, the handler told Yazdani to prepare a handwritten oath of allegiance, known as a “bayah,” to ISIL’ leader.
Members of the cell signed it using their noms de guerre, and Yazdani was told to scan it to his laptop, using Tails to obscure the operation. Next, he was told to upload it to gulf-up.com, which allows users to upload files and produces a URL that can be shared with a third party. The link to the URL was to be sent via the secure email.
By methodically working through URLs archived on the website, The Times was able to find the image of the one-page handwritten document containing the Indian men’s pledge of allegiance to ISIS. The file was uploaded around the time Yazdani told investigators he had done so, and the document matched his description of the wording he had disclosed to the authorities. Until they were alerted to its existence, Indian investigators were not aware that the document was still archived on the website, they said.
The men’s families have denied that they played any role in a terrorist plot, and accuse the authorities of planting evidence against them.
One Indian investigator, speaking on the condition of anonymity because he was not authorized to brief reporters, said officials were able to crack the full extent of the case only because Yazdani and his accomplices confessed during interrogation, divulging the passwords to their accounts after their arrests last summer.
Though the Hyderabad case is among the most detailed in showing how Syria-based handlers directly facilitated terrorist attacks abroad, it is neither the first, nor the only one. Investigation documents from Europe show that a growing share of attacks bear signs of contact with the ISIS stronghold, even though the attacker was initially described as acting alone.
The first time officials in Europe described an attack as having been “télécommandé,” or remote-controlled, was in spring 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.
When the police searched his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.
“OK, brother, now pay attention,” one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop.
Blood stains and a rescue blanket are seen through the windows of a train in Germany after a 17-year-old Afghan armed with an ax and a knife attacked passengers
“Search among the cars that are parked there near the big road and look for a Renault Mégane,” the message said. “Look at the front right tire — you’ll find the keys placed on top.”
The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.
Later, French investigators said they had found that Ghlam’s handlers were French citizens who had traveled to Syria to join ISIL. They, in turn, tapped their criminal network back in France to arrange the logistics of Ghlam’s plot.
Seamus Hughes, deputy director of the Program on Extremism at George Washington University, said the handlers were essentially “quarterbacking” the attack: “They’re from there, so they can essentially tell someone, ‘OK, go 10 yards and go this way.”
French police officers stand guard in front of the Saint-Etienne-du-Rouvray's city hall, Normandy, France, after an attack on a church that left a priest dead, Tuesday, July 26, 2016
Wiretaps, interrogation records and transcripts of chats recovered on suspects’ phones and laptops show that this level of guidance has occurred all over the world.
In Germany, a man who set off a bomb outside a concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their attacks. The teenager’s handler urged him to use a car instead of an ax — “The damage would be much greater,” the handler advised — but the young man said he did not have a driving permit. “I want to enter paradise tonight,” he said, according to a transcript obtained by a German newspaper.
In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair had not known each other, and according to the investigative file, the handler introduced them, organizing for them to meet days before the attack. Intelligence records obtained by The Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.
And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with ISIL handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.
In several investigations, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
National Highway 65 near Hyderabad
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested had been turned back from Turkey, French prosecutors said.
And it was human error that finally led to the arrest of al-Amriki’s followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mohammed’s home.
In his bedroom, they found the half-cooked explosive in his refrigerator.
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be ISIL’s first strike on Indian soil.
They vetted each new member of the cell as Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here in June, ISIL’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIL whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, ISIL handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.
For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationalities of their ISIL interlocutors, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.
As a result, remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Texas, were initially labeled the work of “lone wolves,” with no operational ties to ISIL, and only later was direct communication with the group discovered.
While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Close examination of both successful and unsuccessful plots carried out in ISIL’s name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group.
Yazdani’s case presents one of the most detailed accounts of how ISIL is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
One of ISIL’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on how to reach Syria, was Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.
ISIL militants in a commandeered Iraqi security forces armoured vehicle in Mosul, Iraq, in 2014
By 2015, al-Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.
Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.
But by late spring 2015, they were considered enough of a threat that both U.S. and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.
Among them was al-Amrik, who was killed along with his wife on April 22 when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of ISIL’ “external attack planners” who “actively sought to harm Western interests.”
Emanuel Lutchman of Rochester, N.Y.
The Defense Department’s account showed, moreover, that the handler had been involved in far more than just the Hyderabad case, planning attacks on three continents.
At the same time that he was recruiting Yazdani, al-Amriki was grooming attackers in Canada and Britain, as well as at least three other young men in suburbs across the United States, according to court records. They included a former member of the Army National Guard living in Virginia; a warehouse worker from Columbus, Ohio; and Emanuel L. Lutchman, a 25-year-old in Rochester, New York.
Looking for ways to get to Syria, Lutchman reached out to al-Amriki on Dec. 25, 2015, asking what it was like to live inside territory controlled by the group. “Dream come true,” al-Amriki responded, before telling the young man that the Syrian border had been closed, according to the criminal complaint.
Instead, the handler suggested Lutchman carry out an attack right at home on New Year’s Eve — less than a week after their first exchange. Plan an “operation” and kill “1000000s of kuffar,” al-Amriki instructed him, using a derogatory Arabic word meaning infidel. Over the course of several chats via the Telegram service, they planned how Lutchman would attack a bar serving craft beer to celebrate the holiday, prosecutors say.
The two men discussed recruiting three other “brothers” to take part. They stayed in contact as Lutchman went to Wal-Mart, where he spent $40 on two ski masks, two knives, a machete, zip-ties, duct tape and latex gloves. He planned to abduct one of the bar’s customers and videotape himself killing the victim, prosecutors say.
And they exchanged a flurry of messages, as the 25-year-old began to voice doubts and the handler assumed the role of therapist, patiently listening and reassuring him.
Lutchman was arrested at his home the day before his planned attack on Merchants Grill in Rochester, outed by the accomplice he had recruited, who turned out to be an FBI informant.
At the time of his arrest, Lutchman had been communicating with the handler for a total of five days. It appears he never heard his handler’s voice, or saw so much as photograph of him, according to the court filings.
By late 2015, travel to Syria had become treacherous. Intelligence services on both sides of the Atlantic were getting better at identifying aspiring jihadis, arresting dozens as they prepared to board flights for Istanbul in hopes of crossing into Syria.
At first, ISIL operatives instructed recruits to throw off law enforcement by taking more indirect routes. They also began urging followers to head to other ISIL colonies, including in Libya.
That was what law enforcement officials said a young man from Columbus, Ohio, Aaron T. Daniels, was trying to do in November, when he was arrested while trying to board a United Airlines flight to Houston, from where he would travel to Port of Spain, Trinidad and Tobago, before continuing toward Libya.
This undated file image posted on a militant website on Tuesday, Jan. 14, 2014, which has been verified and is consistent with other AP reporting, shows fighters from the al-Qaida linked Islamic State of Iraq and the Levant (ISIL), now called the Islamic State group, marching in Raqqa, Syria
No longer describing the journey to Syria as a spiritual necessity, ISIL announced last year that those who could not reach the caliphate should attack at home.
“If the tyrants have closed in your faces the door of hijrah, then open in their face the door of jihad,” the group’s spokesman, Abu Muhammad al-Adnani, said in a message released in May.
At the time al-Amriki was killed in April, he had been exchanging messages with Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.
One of eight children, Yazdani, 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.
A bazaar in the old city quarter of Hyderabad, India
While abroad, he began watching ISIL online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.
“Since then, I was inclined to join Islamic State and work for the cause of religion,” Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by The Times and was first reported by NDTV, a New Delhi-based television company.
He logged into Twitter and searched the hashtags [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.], the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with al-Amriki.
“I created a Telegram ID,” Yazdani told investigators, “and sought his guidance to reach Syria.”
After months of frustrating and failed attempts to help Yazdani get a visa, al-Amriki’s directions changed course: “He asked me to work for IS by staying in India itself.”
It was a period in which ISIL was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge.
Just before his death, al-Amriki handed off Yazdani to a different handler, known only by his Telegram screen name, “WindsofVictory.” His identity has not yet been confirmed by Indian officials, though they believe he is Indian because he spoke fluent Hindi.
Mohammed Ishaq Yazdani, a brother of two men accused of plotting to carry out a terrorist attack in the name of the Islamic State group, at home in Hyderabad, India
The new handler guided the eight-member cell as it took shape, exchanging messages with Yazdani as the engineer recruited his family members and friends. They named themselves “Jund-ul-Khilafa-Fi-Bilad-Hind,” the Army of the Caliphate in India, according to the interrogation records, which misspelled part of the Arabic name.
At the end of May, Yazdani received a message telling him to go to the Nanded Airport, about 200 miles away. He and an accomplice, Habeeb Mohammed, 31, drove all night. After they reached the airport the next morning, the handler told them to head to the Railway Division Office. Near that office, he said, they would see a plastic bag hanging from a tree, according to the transcripts of the men’s interrogations.
“It was informed by the handler that opposite to DRM office, there are two trees and on one of the trees there would be a white color polyethylene sheet (used for wrapping fragile articles),” Mohammed told investigators. “We spotted the place, and I, first on the pretext of urinating, went to check for the consignment.”
When they opened the bag, they found two pistols and 20 bullets, according to their account to law enforcement. It was one of at least four drops the handler set up for them.
The location where terror plotters were reportedly instructed to collect a bag of ammonium nitrate by their handlers, outside Hyderabad, India, Dec. 12, 201
Because the pistols were rusted, they say the handler instructed them to travel to the railway station in the city of Ajmer, about 600 miles to the north. This time they were told to bring 65,000 rupees — around $1,000 — and leave it near the railway track sealed in a plastic bag, which would be picked up and used as payment for weapons.
Because the communication always had to go through the handler, the members of the Hyderabad cell never directly interacted with the arms seller. When they were arrested, they could not provide any clues as to who had left the contraband, Indian investigators said.
The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork.
As soon as Yazdani indicated he was willing to undertake an attack, the handler instructed him to download ChatSecure, a messaging app to be used when they spoke by phone. When he used his laptop, he was told to contact the handler via Pidgin, another encrypted tool. He was told to create an account with Tutanota, a secure email service. And the handler taught Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive.
Aman Nagar B, a slum where Mohammed Ibrahim Yazdani grew up in the old city quarter of Hyderabad, India, Dec. 12, 2016.
Once that system was in place, the handler told Yazdani to prepare a handwritten oath of allegiance, known as a “bayah,” to ISIL’ leader.
Members of the cell signed it using their noms de guerre, and Yazdani was told to scan it to his laptop, using Tails to obscure the operation. Next, he was told to upload it to gulf-up.com, which allows users to upload files and produces a URL that can be shared with a third party. The link to the URL was to be sent via the secure email.
By methodically working through URLs archived on the website, The Times was able to find the image of the one-page handwritten document containing the Indian men’s pledge of allegiance to ISIS. The file was uploaded around the time Yazdani told investigators he had done so, and the document matched his description of the wording he had disclosed to the authorities. Until they were alerted to its existence, Indian investigators were not aware that the document was still archived on the website, they said.
The men’s families have denied that they played any role in a terrorist plot, and accuse the authorities of planting evidence against them.
One Indian investigator, speaking on the condition of anonymity because he was not authorized to brief reporters, said officials were able to crack the full extent of the case only because Yazdani and his accomplices confessed during interrogation, divulging the passwords to their accounts after their arrests last summer.
Though the Hyderabad case is among the most detailed in showing how Syria-based handlers directly facilitated terrorist attacks abroad, it is neither the first, nor the only one. Investigation documents from Europe show that a growing share of attacks bear signs of contact with the ISIS stronghold, even though the attacker was initially described as acting alone.
The first time officials in Europe described an attack as having been “télécommandé,” or remote-controlled, was in spring 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.
When the police searched his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.
“OK, brother, now pay attention,” one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop.
Blood stains and a rescue blanket are seen through the windows of a train in Germany after a 17-year-old Afghan armed with an ax and a knife attacked passengers
“Search among the cars that are parked there near the big road and look for a Renault Mégane,” the message said. “Look at the front right tire — you’ll find the keys placed on top.”
The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.
Later, French investigators said they had found that Ghlam’s handlers were French citizens who had traveled to Syria to join ISIL. They, in turn, tapped their criminal network back in France to arrange the logistics of Ghlam’s plot.
Seamus Hughes, deputy director of the Program on Extremism at George Washington University, said the handlers were essentially “quarterbacking” the attack: “They’re from there, so they can essentially tell someone, ‘OK, go 10 yards and go this way.”
French police officers stand guard in front of the Saint-Etienne-du-Rouvray's city hall, Normandy, France, after an attack on a church that left a priest dead, Tuesday, July 26, 2016
Wiretaps, interrogation records and transcripts of chats recovered on suspects’ phones and laptops show that this level of guidance has occurred all over the world.
In Germany, a man who set off a bomb outside a concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their attacks. The teenager’s handler urged him to use a car instead of an ax — “The damage would be much greater,” the handler advised — but the young man said he did not have a driving permit. “I want to enter paradise tonight,” he said, according to a transcript obtained by a German newspaper.
In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair had not known each other, and according to the investigative file, the handler introduced them, organizing for them to meet days before the attack. Intelligence records obtained by The Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.
And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with ISIL handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.
In several investigations, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
National Highway 65 near Hyderabad
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested had been turned back from Turkey, French prosecutors said.
And it was human error that finally led to the arrest of al-Amriki’s followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mohammed’s home.
In his bedroom, they found the half-cooked explosive in his refrigerator.
Today at 6:05 am by Rocky
» The Supreme Anti-Corruption Commission demands Nineveh for the contracts concluded by “Najm Al-Jubou
Today at 6:04 am by Rocky
» Al-Khanjar, Al-Samarrai, and Abu Mazen are hosted by Shaalan Al-Karim to discuss accelerating the se
Today at 6:03 am by Rocky
» Iraq asks the countries of the world to respond to its requests to extradite wanted persons: We have
Today at 6:02 am by Rocky
» “It is coming soon.” The Sudanese advisor sets the date for the referral of the Baghdad metro and th
Today at 6:01 am by Rocky
» Al-Mubarqa: Iraq reserves its full right to respond to the Australian behavior
Today at 6:00 am by Rocky
» Dollar exchange rates on Iraqi stock exchanges... recorded a decline, and this is the list
Today at 5:58 am by Rocky
» Mr. Al-Sadr supports the position of American university students
Today at 5:56 am by Rocky
» Iraqis are ranked 7th in the Arab world on the list of those most seeking immigration to America. He
Today at 5:55 am by Rocky
» The UAE company ADNOC resorts to Iraqi oil. Find out the reasons
Today at 5:53 am by Rocky
» Soon.. 3 new hospitals will open in Baghdad
Today at 5:52 am by Rocky
» Sponsored by Al-Sudani...the opening of the Arab Labor Conference in its fiftieth session in Baghdad
Today at 5:51 am by Rocky
» Al-Shammari chairs a meeting at the controlling headquarters to review the results of the security o
Today at 5:49 am by Rocky
» Arab Labor Organization: We commend Iraq's interest in the Arab Labor Conference
Today at 5:48 am by Rocky
» Al-Sudani: The development road project will provide many job opportunities
Today at 5:47 am by Rocky
» utube MM&C 4/26/24 Iraqi Dinar - US Treasury Exchange Rates- Focus - Banking Partnerships - Rate C
Yesterday at 6:11 pm by Rocky
» Sudanese advisor criticizes Kuwaiti analyzes regarding the development road project
Yesterday at 3:21 pm by Rocky
» Al-Mandalawi stresses the need to strengthen economic and trade cooperation between Iraq and Poland
Yesterday at 3:04 pm by Rocky
» Power maneuvers: America provides defensive weapons to Kurdistan in exchange for withholding from Ba
Yesterday at 11:26 am by Rocky
» Kuwait is drilling an oil well near Umm Qasr, towards Iraqi territory
Yesterday at 11:24 am by Rocky
» In the document... the first Iraqi ministry identifies the obstacles to changing the new official wo
Yesterday at 11:22 am by Rocky
» Italian Institute: Iraq is stuck in its own crises, including Baghdad’s efforts to undermine the “au
Yesterday at 11:21 am by Rocky
» The head of the Integrity Commission announces the holding of an international Interpol conference i
Yesterday at 11:18 am by Rocky
» Planning: Iraqi companies are not efficient in conducting the population census
Yesterday at 11:14 am by Rocky
» utube MM&C 4/24/24 Support - USA- Turkey - Timing- Currency Value - Tabled
Yesterday at 9:08 am by Rocky
» MM&C 4/25/24 National Bank of Iraq goes live with Temenos core banking and payments
Yesterday at 9:06 am by Rocky
» A banking official indicates a "danger" to Iraq by depriving more than half of its banks of dollars
Yesterday at 8:55 am by Rocky
» With the participation of the Association of Private Banks, investment opportunities are on the tabl
Yesterday at 8:45 am by Rocky
» Within a month... an Iranian border crossing recorded a noticeable increase in exports of goods to I
Yesterday at 8:44 am by Rocky
» The Association of Private Banks appreciates the efforts of the government and the Central Bank to c
Yesterday at 8:43 am by Rocky
» Al-Maliki's coalition presents a third candidate for the position of governor of Diyala
Yesterday at 7:57 am by Rocky
» Arab gathering: The Kirkuk problem is getting complicated and the Sudanese must intervene
Yesterday at 7:56 am by Rocky
» Next week.. a Kurdish delegation will visit Baghdad to meet with the Minister of Finance
Yesterday at 7:54 am by Rocky
» Under the pretext of salaries... Al-Party refrains from handing over port revenues to Baghdad
Yesterday at 7:53 am by Rocky
» Association of Banks: For the first time, we are witnessing a clear targeting of depriving half of t
Yesterday at 7:51 am by Rocky
» Parliament does not know the reason for the delay in sending the 2024 budget schedules: Voting takes
Yesterday at 7:49 am by Rocky
» Applicants for the 2024 Hajj are demanding that the Central Bank secure the dollar for them through
Yesterday at 6:09 am by Rocky
» Governmental and private banks will showcase their services tomorrow during Financial Inclusion Week
Yesterday at 6:08 am by Rocky
» Iraq's oil exports rise despite OPEC+ cuts
Yesterday at 6:06 am by Rocky
» A study explodes a "surprise"... Iraq is among the countries that export oil to "Israel": How is the
Yesterday at 6:04 am by Rocky
» Al-Araji emphasizes working to strengthen national identity
Yesterday at 6:02 am by Rocky
» Al-Sudani visits Saudi Arabia to participate in the World Economic Forum in Riyadh
Yesterday at 6:01 am by Rocky
» Iraq is talking about producing one million additional liters of gasoline
Yesterday at 5:59 am by Rocky
» The Council of Ministers approves the implementation of the Baghdad Metro project
Yesterday at 5:56 am by Rocky
» Minister of Commerce: We formed a joint economic committee with Türkiye
Yesterday at 5:55 am by Rocky
» Resources: Government measures have contributed to improving the water situation in Iraq
Yesterday at 5:53 am by Rocky
» Parliamentary Finance: Baghdad will continue to send salaries to the region’s employees until settle
Yesterday at 5:51 am by Rocky
» A parliamentarian describes the corruption of Iraqi ports as “ghouls” and reveals the involvement of
Yesterday at 5:49 am by Rocky
» Obelisk Hour: Basra is the subject of political conflict and ambiguity over the fate of the funds al
Yesterday at 5:48 am by Rocky
» Turkmen leader: An agreement on the local government of Kirkuk is near
Yesterday at 5:45 am by Rocky
» Anbar calls for the operation of its factories despite financial obstacles
Yesterday at 5:44 am by Rocky
» Turki: The crisis of the Presidency of Parliament prompted the Sunnis to amend the Council’s interna
Yesterday at 5:43 am by Rocky
» The Agriculture Committee confirms the existence of Iraqi-Turkish-Iranian discussions on water
Yesterday at 5:42 am by Rocky
» Resources diagnose the challenges facing the water file in Iraq
Yesterday at 5:38 am by Rocky
» Parliament pledges to the Interior Ministry: We will transfer money to buy weapons from citizens
Yesterday at 5:33 am by Rocky
» Al-Issawi is the closest.. Parliament sets the date for deciding the choice of the new president
Yesterday at 5:31 am by Rocky
» Deputy: Iraq's investments have risen and need a comprehensive review of previous years
Yesterday at 5:30 am by Rocky
» Iraqis consume 7 billion eggs annually and import about $900 million
Yesterday at 5:28 am by Rocky
» The Iranian role complicates attempts at open cooperation between Iraq and Turkey. Turkey is trying
Yesterday at 5:26 am by Rocky
» Move in Iran to obtain $242 billion from Iraq in compensation for the eight-year war
Yesterday at 5:25 am by Rocky
» 12 decisions from the Council of Ministers regarding the Baghdad Metro and Najaf-Karbala train proje
Yesterday at 5:23 am by Rocky
» Sudanese Advisor: The path to development has begun... the Baka and the militias “we silence them wi
Yesterday at 5:21 am by Rocky
» Not from Kurdistan.. How did Iraq become a source of oil for “Israeli tanks”?
Yesterday at 5:19 am by Rocky
» Parliamentary Agriculture criticizes the Sudanese and Erdogan agreement: Türkiye will control water
Yesterday at 5:16 am by Rocky
» The Iraqi government issues new decisions
Thu Apr 25, 2024 3:35 pm by Rocky
» The story of “reduced oil” to Jordan, from “compulsion” to mutual benefit.. Is there a loss?
Thu Apr 25, 2024 3:33 pm by Rocky
» The Council of Ministers takes 12 decisions for the Baghdad Metro and the Najaf-Karbala train
Thu Apr 25, 2024 3:32 pm by Rocky
» utube MM&C 4/23/24 Iraqi Dinar - IQD Update - Development Road Project - Saviour of Global Banking
Thu Apr 25, 2024 11:18 am by Rocky
» Kidney from pig transplanted into deathly ill New Jersey woman — and begins working almost immediat
Thu Apr 25, 2024 11:15 am by Bama Diva
» The most difficult option.. Warnings of the danger of floating the Iraqi dinar without achieving an
Thu Apr 25, 2024 10:48 am by Rocky
» Trade from the “Economic Committee” with Türkiye: It will overcome all obstacles facing the traders
Thu Apr 25, 2024 10:46 am by Rocky
» Washington's hope for stable relations with Baghdad clashes with Iraqi parties' rejection of the Ame
Thu Apr 25, 2024 10:41 am by Rocky
» Karim Badr: Development is America’s will to kill silk
Thu Apr 25, 2024 10:36 am by Rocky
» Oil: Opening of a new port for liquid gas for vehicles in Baghdad
Thu Apr 25, 2024 10:33 am by Rocky
» A media advisor warns of corruption in a draft law on the Parliament’s agenda
Thu Apr 25, 2024 10:21 am by Rocky
» Economist: There is serious work to lift US sanctions on Iraqi banks
Thu Apr 25, 2024 10:16 am by Rocky
» Will the agreements signed with the US Treasury reflect positively on the exchange rates?
Thu Apr 25, 2024 8:52 am by Rocky
» Iraq continues its quest to join the World Trade Organization
Thu Apr 25, 2024 8:51 am by Rocky
» Iraq completes the completion of the files for the initial offer of goods and services to join the W
Thu Apr 25, 2024 8:50 am by Rocky
» Economist: Travelers' dollars are leaking into the parallel market...and this is what the Central Ba
Thu Apr 25, 2024 8:32 am by Rocky
» President of the Federal Court: It is not permissible to force anyone to join any party, and the pol
Thu Apr 25, 2024 8:30 am by Rocky
» The Council of Ministers holds its session headed by Al-Sudani
Thu Apr 25, 2024 8:27 am by Rocky
» America weakens Baghdad...and increases Kurdistan's military capabilities
Thu Apr 25, 2024 8:26 am by Rocky
» The Iraqi government plans to build 10,000 schools throughout the country
Thu Apr 25, 2024 8:23 am by Rocky
» American threats close the Iraqi Stock Exchange at a loss
Thu Apr 25, 2024 8:21 am by Rocky
» Increase in external transfers at the Central Bank
Thu Apr 25, 2024 8:20 am by Rocky
» Al-Maliki calls on Britain to cancel restrictions on the entry of its companies into Iraq
Thu Apr 25, 2024 8:18 am by Rocky
» Planning and the European Union are discussing signing a number of agreements in the development, en
Thu Apr 25, 2024 8:16 am by Rocky
» Parliament talks about the mechanism for recovering smuggled funds and hints at the next stage
Thu Apr 25, 2024 8:13 am by Rocky
» Interior Ministry: The number of completed national cards reached 37 million cards
Thu Apr 25, 2024 8:06 am by Rocky
» Amnesty International: Violations of freedom and human rights continue in Iraq and the Kurdistan Reg
Thu Apr 25, 2024 8:04 am by Rocky
» Parliamentary Oil: The government is proceeding with the decision to raise the price of improved gas
Thu Apr 25, 2024 8:03 am by Rocky
» A parliamentary committee in Basra to investigate violations of the port company and the local gover
Thu Apr 25, 2024 8:00 am by Rocky
» Revealing the 10 most important American exports to Iraq
Thu Apr 25, 2024 6:31 am by Rocky
» A noticeable increase in the rate of Iraq's import of Chinese cooling devices
Thu Apr 25, 2024 6:30 am by Rocky
» Prime Minister: Working on projects without completing the infrastructure is a waste of money
Thu Apr 25, 2024 6:28 am by Rocky
» Iraq.. Extending the deadline for registration procedures on plots of land
Thu Apr 25, 2024 6:27 am by Rocky
» What is the main purpose of conducting the population census in Iraq?
Thu Apr 25, 2024 6:25 am by Rocky
» A plan to transform Iraq from a barren land to green with 5 million trees
Thu Apr 25, 2024 6:24 am by Rocky