Not ‘lone wolves’ after all: How ISIL is engineering terror plots far away from their targets
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be ISIL’s first strike on Indian soil.
They vetted each new member of the cell as Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here in June, ISIL’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIL whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, ISIL handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.
For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationalities of their ISIL interlocutors, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.
As a result, remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Texas, were initially labeled the work of “lone wolves,” with no operational ties to ISIL, and only later was direct communication with the group discovered.
While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Close examination of both successful and unsuccessful plots carried out in ISIL’s name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group.
Yazdani’s case presents one of the most detailed accounts of how ISIL is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
One of ISIL’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on how to reach Syria, was Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.
ISIL militants in a commandeered Iraqi security forces armoured vehicle in Mosul, Iraq, in 2014
By 2015, al-Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.
Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.
But by late spring 2015, they were considered enough of a threat that both U.S. and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.
Among them was al-Amrik, who was killed along with his wife on April 22 when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of ISIL’ “external attack planners” who “actively sought to harm Western interests.”
Emanuel Lutchman of Rochester, N.Y.
The Defense Department’s account showed, moreover, that the handler had been involved in far more than just the Hyderabad case, planning attacks on three continents.
At the same time that he was recruiting Yazdani, al-Amriki was grooming attackers in Canada and Britain, as well as at least three other young men in suburbs across the United States, according to court records. They included a former member of the Army National Guard living in Virginia; a warehouse worker from Columbus, Ohio; and Emanuel L. Lutchman, a 25-year-old in Rochester, New York.
Looking for ways to get to Syria, Lutchman reached out to al-Amriki on Dec. 25, 2015, asking what it was like to live inside territory controlled by the group. “Dream come true,” al-Amriki responded, before telling the young man that the Syrian border had been closed, according to the criminal complaint.
Instead, the handler suggested Lutchman carry out an attack right at home on New Year’s Eve — less than a week after their first exchange. Plan an “operation” and kill “1000000s of kuffar,” al-Amriki instructed him, using a derogatory Arabic word meaning infidel. Over the course of several chats via the Telegram service, they planned how Lutchman would attack a bar serving craft beer to celebrate the holiday, prosecutors say.
The two men discussed recruiting three other “brothers” to take part. They stayed in contact as Lutchman went to Wal-Mart, where he spent $40 on two ski masks, two knives, a machete, zip-ties, duct tape and latex gloves. He planned to abduct one of the bar’s customers and videotape himself killing the victim, prosecutors say.
And they exchanged a flurry of messages, as the 25-year-old began to voice doubts and the handler assumed the role of therapist, patiently listening and reassuring him.
Lutchman was arrested at his home the day before his planned attack on Merchants Grill in Rochester, outed by the accomplice he had recruited, who turned out to be an FBI informant.
At the time of his arrest, Lutchman had been communicating with the handler for a total of five days. It appears he never heard his handler’s voice, or saw so much as photograph of him, according to the court filings.
By late 2015, travel to Syria had become treacherous. Intelligence services on both sides of the Atlantic were getting better at identifying aspiring jihadis, arresting dozens as they prepared to board flights for Istanbul in hopes of crossing into Syria.
At first, ISIL operatives instructed recruits to throw off law enforcement by taking more indirect routes. They also began urging followers to head to other ISIL colonies, including in Libya.
That was what law enforcement officials said a young man from Columbus, Ohio, Aaron T. Daniels, was trying to do in November, when he was arrested while trying to board a United Airlines flight to Houston, from where he would travel to Port of Spain, Trinidad and Tobago, before continuing toward Libya.
This undated file image posted on a militant website on Tuesday, Jan. 14, 2014, which has been verified and is consistent with other AP reporting, shows fighters from the al-Qaida linked Islamic State of Iraq and the Levant (ISIL), now called the Islamic State group, marching in Raqqa, Syria
No longer describing the journey to Syria as a spiritual necessity, ISIL announced last year that those who could not reach the caliphate should attack at home.
“If the tyrants have closed in your faces the door of hijrah, then open in their face the door of jihad,” the group’s spokesman, Abu Muhammad al-Adnani, said in a message released in May.
At the time al-Amriki was killed in April, he had been exchanging messages with Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.
One of eight children, Yazdani, 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.
A bazaar in the old city quarter of Hyderabad, India
While abroad, he began watching ISIL online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.
“Since then, I was inclined to join Islamic State and work for the cause of religion,” Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by The Times and was first reported by NDTV, a New Delhi-based television company.
He logged into Twitter and searched the hashtags [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.], the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with al-Amriki.
“I created a Telegram ID,” Yazdani told investigators, “and sought his guidance to reach Syria.”
After months of frustrating and failed attempts to help Yazdani get a visa, al-Amriki’s directions changed course: “He asked me to work for IS by staying in India itself.”
It was a period in which ISIL was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge.
Just before his death, al-Amriki handed off Yazdani to a different handler, known only by his Telegram screen name, “WindsofVictory.” His identity has not yet been confirmed by Indian officials, though they believe he is Indian because he spoke fluent Hindi.
Mohammed Ishaq Yazdani, a brother of two men accused of plotting to carry out a terrorist attack in the name of the Islamic State group, at home in Hyderabad, India
The new handler guided the eight-member cell as it took shape, exchanging messages with Yazdani as the engineer recruited his family members and friends. They named themselves “Jund-ul-Khilafa-Fi-Bilad-Hind,” the Army of the Caliphate in India, according to the interrogation records, which misspelled part of the Arabic name.
At the end of May, Yazdani received a message telling him to go to the Nanded Airport, about 200 miles away. He and an accomplice, Habeeb Mohammed, 31, drove all night. After they reached the airport the next morning, the handler told them to head to the Railway Division Office. Near that office, he said, they would see a plastic bag hanging from a tree, according to the transcripts of the men’s interrogations.
“It was informed by the handler that opposite to DRM office, there are two trees and on one of the trees there would be a white color polyethylene sheet (used for wrapping fragile articles),” Mohammed told investigators. “We spotted the place, and I, first on the pretext of urinating, went to check for the consignment.”
When they opened the bag, they found two pistols and 20 bullets, according to their account to law enforcement. It was one of at least four drops the handler set up for them.
The location where terror plotters were reportedly instructed to collect a bag of ammonium nitrate by their handlers, outside Hyderabad, India, Dec. 12, 201
Because the pistols were rusted, they say the handler instructed them to travel to the railway station in the city of Ajmer, about 600 miles to the north. This time they were told to bring 65,000 rupees — around $1,000 — and leave it near the railway track sealed in a plastic bag, which would be picked up and used as payment for weapons.
Because the communication always had to go through the handler, the members of the Hyderabad cell never directly interacted with the arms seller. When they were arrested, they could not provide any clues as to who had left the contraband, Indian investigators said.
The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork.
As soon as Yazdani indicated he was willing to undertake an attack, the handler instructed him to download ChatSecure, a messaging app to be used when they spoke by phone. When he used his laptop, he was told to contact the handler via Pidgin, another encrypted tool. He was told to create an account with Tutanota, a secure email service. And the handler taught Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive.
Aman Nagar B, a slum where Mohammed Ibrahim Yazdani grew up in the old city quarter of Hyderabad, India, Dec. 12, 2016.
Once that system was in place, the handler told Yazdani to prepare a handwritten oath of allegiance, known as a “bayah,” to ISIL’ leader.
Members of the cell signed it using their noms de guerre, and Yazdani was told to scan it to his laptop, using Tails to obscure the operation. Next, he was told to upload it to gulf-up.com, which allows users to upload files and produces a URL that can be shared with a third party. The link to the URL was to be sent via the secure email.
By methodically working through URLs archived on the website, The Times was able to find the image of the one-page handwritten document containing the Indian men’s pledge of allegiance to ISIS. The file was uploaded around the time Yazdani told investigators he had done so, and the document matched his description of the wording he had disclosed to the authorities. Until they were alerted to its existence, Indian investigators were not aware that the document was still archived on the website, they said.
The men’s families have denied that they played any role in a terrorist plot, and accuse the authorities of planting evidence against them.
One Indian investigator, speaking on the condition of anonymity because he was not authorized to brief reporters, said officials were able to crack the full extent of the case only because Yazdani and his accomplices confessed during interrogation, divulging the passwords to their accounts after their arrests last summer.
Though the Hyderabad case is among the most detailed in showing how Syria-based handlers directly facilitated terrorist attacks abroad, it is neither the first, nor the only one. Investigation documents from Europe show that a growing share of attacks bear signs of contact with the ISIS stronghold, even though the attacker was initially described as acting alone.
The first time officials in Europe described an attack as having been “télécommandé,” or remote-controlled, was in spring 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.
When the police searched his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.
“OK, brother, now pay attention,” one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop.
Blood stains and a rescue blanket are seen through the windows of a train in Germany after a 17-year-old Afghan armed with an ax and a knife attacked passengers
“Search among the cars that are parked there near the big road and look for a Renault Mégane,” the message said. “Look at the front right tire — you’ll find the keys placed on top.”
The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.
Later, French investigators said they had found that Ghlam’s handlers were French citizens who had traveled to Syria to join ISIL. They, in turn, tapped their criminal network back in France to arrange the logistics of Ghlam’s plot.
Seamus Hughes, deputy director of the Program on Extremism at George Washington University, said the handlers were essentially “quarterbacking” the attack: “They’re from there, so they can essentially tell someone, ‘OK, go 10 yards and go this way.”
French police officers stand guard in front of the Saint-Etienne-du-Rouvray's city hall, Normandy, France, after an attack on a church that left a priest dead, Tuesday, July 26, 2016
Wiretaps, interrogation records and transcripts of chats recovered on suspects’ phones and laptops show that this level of guidance has occurred all over the world.
In Germany, a man who set off a bomb outside a concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their attacks. The teenager’s handler urged him to use a car instead of an ax — “The damage would be much greater,” the handler advised — but the young man said he did not have a driving permit. “I want to enter paradise tonight,” he said, according to a transcript obtained by a German newspaper.
In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair had not known each other, and according to the investigative file, the handler introduced them, organizing for them to meet days before the attack. Intelligence records obtained by The Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.
And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with ISIL handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.
In several investigations, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
National Highway 65 near Hyderabad
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested had been turned back from Turkey, French prosecutors said.
And it was human error that finally led to the arrest of al-Amriki’s followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mohammed’s home.
In his bedroom, they found the half-cooked explosive in his refrigerator.
For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be ISIL’s first strike on Indian soil.
They vetted each new member of the cell as Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.
And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.
Until just moments before the arrest of the Indian cell, here in June, ISIL’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.
As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by ISIL whose only connection to the would-be attacker is the internet.
In the most basic enabled attacks, ISIL handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws in order to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.
For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationalities of their ISIL interlocutors, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.
As a result, remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Texas, were initially labeled the work of “lone wolves,” with no operational ties to ISIL, and only later was direct communication with the group discovered.
While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.
Close examination of both successful and unsuccessful plots carried out in ISIL’s name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group.
Yazdani’s case presents one of the most detailed accounts of how ISIL is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.
One of ISIL’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on how to reach Syria, was Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.
ISIL militants in a commandeered Iraqi security forces armoured vehicle in Mosul, Iraq, in 2014
By 2015, al-Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.
Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.
But by late spring 2015, they were considered enough of a threat that both U.S. and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.
Among them was al-Amrik, who was killed along with his wife on April 22 when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of ISIL’ “external attack planners” who “actively sought to harm Western interests.”
Emanuel Lutchman of Rochester, N.Y.
The Defense Department’s account showed, moreover, that the handler had been involved in far more than just the Hyderabad case, planning attacks on three continents.
At the same time that he was recruiting Yazdani, al-Amriki was grooming attackers in Canada and Britain, as well as at least three other young men in suburbs across the United States, according to court records. They included a former member of the Army National Guard living in Virginia; a warehouse worker from Columbus, Ohio; and Emanuel L. Lutchman, a 25-year-old in Rochester, New York.
Looking for ways to get to Syria, Lutchman reached out to al-Amriki on Dec. 25, 2015, asking what it was like to live inside territory controlled by the group. “Dream come true,” al-Amriki responded, before telling the young man that the Syrian border had been closed, according to the criminal complaint.
Instead, the handler suggested Lutchman carry out an attack right at home on New Year’s Eve — less than a week after their first exchange. Plan an “operation” and kill “1000000s of kuffar,” al-Amriki instructed him, using a derogatory Arabic word meaning infidel. Over the course of several chats via the Telegram service, they planned how Lutchman would attack a bar serving craft beer to celebrate the holiday, prosecutors say.
The two men discussed recruiting three other “brothers” to take part. They stayed in contact as Lutchman went to Wal-Mart, where he spent $40 on two ski masks, two knives, a machete, zip-ties, duct tape and latex gloves. He planned to abduct one of the bar’s customers and videotape himself killing the victim, prosecutors say.
And they exchanged a flurry of messages, as the 25-year-old began to voice doubts and the handler assumed the role of therapist, patiently listening and reassuring him.
Lutchman was arrested at his home the day before his planned attack on Merchants Grill in Rochester, outed by the accomplice he had recruited, who turned out to be an FBI informant.
At the time of his arrest, Lutchman had been communicating with the handler for a total of five days. It appears he never heard his handler’s voice, or saw so much as photograph of him, according to the court filings.
By late 2015, travel to Syria had become treacherous. Intelligence services on both sides of the Atlantic were getting better at identifying aspiring jihadis, arresting dozens as they prepared to board flights for Istanbul in hopes of crossing into Syria.
At first, ISIL operatives instructed recruits to throw off law enforcement by taking more indirect routes. They also began urging followers to head to other ISIL colonies, including in Libya.
That was what law enforcement officials said a young man from Columbus, Ohio, Aaron T. Daniels, was trying to do in November, when he was arrested while trying to board a United Airlines flight to Houston, from where he would travel to Port of Spain, Trinidad and Tobago, before continuing toward Libya.
This undated file image posted on a militant website on Tuesday, Jan. 14, 2014, which has been verified and is consistent with other AP reporting, shows fighters from the al-Qaida linked Islamic State of Iraq and the Levant (ISIL), now called the Islamic State group, marching in Raqqa, Syria
No longer describing the journey to Syria as a spiritual necessity, ISIL announced last year that those who could not reach the caliphate should attack at home.
“If the tyrants have closed in your faces the door of hijrah, then open in their face the door of jihad,” the group’s spokesman, Abu Muhammad al-Adnani, said in a message released in May.
At the time al-Amriki was killed in April, he had been exchanging messages with Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.
One of eight children, Yazdani, 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.
A bazaar in the old city quarter of Hyderabad, India
While abroad, he began watching ISIL online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.
“Since then, I was inclined to join Islamic State and work for the cause of religion,” Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by The Times and was first reported by NDTV, a New Delhi-based television company.
He logged into Twitter and searched the hashtags [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.], the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with al-Amriki.
“I created a Telegram ID,” Yazdani told investigators, “and sought his guidance to reach Syria.”
After months of frustrating and failed attempts to help Yazdani get a visa, al-Amriki’s directions changed course: “He asked me to work for IS by staying in India itself.”
It was a period in which ISIL was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge.
Just before his death, al-Amriki handed off Yazdani to a different handler, known only by his Telegram screen name, “WindsofVictory.” His identity has not yet been confirmed by Indian officials, though they believe he is Indian because he spoke fluent Hindi.
Mohammed Ishaq Yazdani, a brother of two men accused of plotting to carry out a terrorist attack in the name of the Islamic State group, at home in Hyderabad, India
The new handler guided the eight-member cell as it took shape, exchanging messages with Yazdani as the engineer recruited his family members and friends. They named themselves “Jund-ul-Khilafa-Fi-Bilad-Hind,” the Army of the Caliphate in India, according to the interrogation records, which misspelled part of the Arabic name.
At the end of May, Yazdani received a message telling him to go to the Nanded Airport, about 200 miles away. He and an accomplice, Habeeb Mohammed, 31, drove all night. After they reached the airport the next morning, the handler told them to head to the Railway Division Office. Near that office, he said, they would see a plastic bag hanging from a tree, according to the transcripts of the men’s interrogations.
“It was informed by the handler that opposite to DRM office, there are two trees and on one of the trees there would be a white color polyethylene sheet (used for wrapping fragile articles),” Mohammed told investigators. “We spotted the place, and I, first on the pretext of urinating, went to check for the consignment.”
When they opened the bag, they found two pistols and 20 bullets, according to their account to law enforcement. It was one of at least four drops the handler set up for them.
The location where terror plotters were reportedly instructed to collect a bag of ammonium nitrate by their handlers, outside Hyderabad, India, Dec. 12, 201
Because the pistols were rusted, they say the handler instructed them to travel to the railway station in the city of Ajmer, about 600 miles to the north. This time they were told to bring 65,000 rupees — around $1,000 — and leave it near the railway track sealed in a plastic bag, which would be picked up and used as payment for weapons.
Because the communication always had to go through the handler, the members of the Hyderabad cell never directly interacted with the arms seller. When they were arrested, they could not provide any clues as to who had left the contraband, Indian investigators said.
The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork.
As soon as Yazdani indicated he was willing to undertake an attack, the handler instructed him to download ChatSecure, a messaging app to be used when they spoke by phone. When he used his laptop, he was told to contact the handler via Pidgin, another encrypted tool. He was told to create an account with Tutanota, a secure email service. And the handler taught Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive.
Aman Nagar B, a slum where Mohammed Ibrahim Yazdani grew up in the old city quarter of Hyderabad, India, Dec. 12, 2016.
Once that system was in place, the handler told Yazdani to prepare a handwritten oath of allegiance, known as a “bayah,” to ISIL’ leader.
Members of the cell signed it using their noms de guerre, and Yazdani was told to scan it to his laptop, using Tails to obscure the operation. Next, he was told to upload it to gulf-up.com, which allows users to upload files and produces a URL that can be shared with a third party. The link to the URL was to be sent via the secure email.
By methodically working through URLs archived on the website, The Times was able to find the image of the one-page handwritten document containing the Indian men’s pledge of allegiance to ISIS. The file was uploaded around the time Yazdani told investigators he had done so, and the document matched his description of the wording he had disclosed to the authorities. Until they were alerted to its existence, Indian investigators were not aware that the document was still archived on the website, they said.
The men’s families have denied that they played any role in a terrorist plot, and accuse the authorities of planting evidence against them.
One Indian investigator, speaking on the condition of anonymity because he was not authorized to brief reporters, said officials were able to crack the full extent of the case only because Yazdani and his accomplices confessed during interrogation, divulging the passwords to their accounts after their arrests last summer.
Though the Hyderabad case is among the most detailed in showing how Syria-based handlers directly facilitated terrorist attacks abroad, it is neither the first, nor the only one. Investigation documents from Europe show that a growing share of attacks bear signs of contact with the ISIS stronghold, even though the attacker was initially described as acting alone.
The first time officials in Europe described an attack as having been “télécommandé,” or remote-controlled, was in spring 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.
When the police searched his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.
“OK, brother, now pay attention,” one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop.
Blood stains and a rescue blanket are seen through the windows of a train in Germany after a 17-year-old Afghan armed with an ax and a knife attacked passengers
“Search among the cars that are parked there near the big road and look for a Renault Mégane,” the message said. “Look at the front right tire — you’ll find the keys placed on top.”
The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.
Later, French investigators said they had found that Ghlam’s handlers were French citizens who had traveled to Syria to join ISIL. They, in turn, tapped their criminal network back in France to arrange the logistics of Ghlam’s plot.
Seamus Hughes, deputy director of the Program on Extremism at George Washington University, said the handlers were essentially “quarterbacking” the attack: “They’re from there, so they can essentially tell someone, ‘OK, go 10 yards and go this way.”
French police officers stand guard in front of the Saint-Etienne-du-Rouvray's city hall, Normandy, France, after an attack on a church that left a priest dead, Tuesday, July 26, 2016
Wiretaps, interrogation records and transcripts of chats recovered on suspects’ phones and laptops show that this level of guidance has occurred all over the world.
In Germany, a man who set off a bomb outside a concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their attacks. The teenager’s handler urged him to use a car instead of an ax — “The damage would be much greater,” the handler advised — but the young man said he did not have a driving permit. “I want to enter paradise tonight,” he said, according to a transcript obtained by a German newspaper.
In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair had not known each other, and according to the investigative file, the handler introduced them, organizing for them to meet days before the attack. Intelligence records obtained by The Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.
And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with ISIL handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.
In several investigations, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.
National Highway 65 near Hyderabad
Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested had been turned back from Turkey, French prosecutors said.
And it was human error that finally led to the arrest of al-Amriki’s followers in Hyderabad.
The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.
They returned to Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Yazdani lamented, according to the transcript of his interrogation.
They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”
By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mohammed’s home.
In his bedroom, they found the half-cooked explosive in his refrigerator.
Today at 7:52 am by Rocky
» utube 3/28/24 MM&C Iraqi Dinar - IQD Update - SWIFT - Purchasing Power - Urban Renaissance - Releas
Today at 7:51 am by Rocky
» Al-Mandalawi: Iraq is witnessing competition between major companies...and the House of Representati
Today at 7:49 am by Rocky
» The President of the Republic stresses the importance of the role of programmers in developing the w
Today at 7:46 am by Rocky
» The Minister of Industry and Minerals follows up on the technical and production performance of the
Today at 7:45 am by Rocky
» The Minister of Finance is following up on the field the progress of the newly implemented ASYCUDA s
Today at 7:44 am by Rocky
» Statistics: There are more than 15 million bank accounts in Iraq
Today at 7:42 am by Rocky
» Representative: One paragraph hinders the passage of a general amnesty within the House of Represent
Today at 7:37 am by Rocky
» Parliamentary Finance: “The draft federal budget law will be devoid of new job grades.”
Today at 7:36 am by Rocky
» Parliamentary action to resolve the fate of “food security contracts” in 15 governorates
Today at 7:35 am by Rocky
» 300 factories turned into "iron scrap" in Diyala
Today at 7:34 am by Rocky
» A deputy expects the dollar exchange rate to reach 140 Iraqi dinars
Today at 7:32 am by Rocky
» Al-Yasiri: The American administration is working hard to destroy the Iraqi economy
Today at 7:31 am by Rocky
» Infographic: The highest annual salaries of leaders of Arab countries
Today at 7:30 am by Rocky
» Communications announces that the electronic signature project has reached advanced stages
Today at 7:29 am by Rocky
» Parliamentary Integrity presents a file related to Kuwaiti violations of Iraqi oil
Today at 7:27 am by Rocky
» Parliamentary move to include amendments to Parliament’s internal regulations on the agenda (documen
Today at 7:25 am by Rocky
» The Iraqi President urges the Minister of Finance to expedite the payment of salaries to the Kurdist
Today at 7:23 am by Rocky
» Central Bank of Iraq sales exceeded $251 million at today’s auction
Today at 7:21 am by Rocky
» The Foreign Minister questions the "Iraqi resistance" attacks against Israel: the other side did not
Today at 7:20 am by Rocky
» The Minister of Labor announces progress in the electronic payment system
Today at 7:17 am by Rocky
» Interior Ministry: For the first time, we controlled the smuggling of petroleum derivatives by 98 pe
Today at 7:16 am by Rocky
» International companies offer offers to invest in the Dhi Qar marshes.. What distinguishes them?
Today at 7:15 am by Rocky
» “Tough” comments on interest rates raise the dollar globally
Today at 7:14 am by Rocky
» Iraq is the fifth largest oil supplier to South Korea in a month
Today at 7:12 am by Rocky
» Recovering more than 100 billion as a result of more than 200,000 employees on social welfare
Today at 7:11 am by Rocky
» The Sudanese consultant announces the completion of Baghdad Metro track designs
Today at 7:08 am by Rocky
» Al-Sudani stresses ending the problem of triple-shift schools
Today at 7:07 am by Rocky
» Iraq begins building two new tankers to transport petroleum products
Today at 7:06 am by Rocky
» Forming a council for “competition and preventing monopoly”
Today at 7:04 am by Rocky
» Features of an Iraqi-Turkish agreement regarding the status of the Kurdistan Workers’ Party
Today at 7:02 am by Rocky
» {Al-Buzrajiya} between the hammer of fraud and the power of the owners
Today at 7:01 am by Rocky
» Ministry of Oil: The gas sector is witnessing great development
Today at 6:59 am by Rocky
» An agreement with Britain in the field of securities
Today at 6:58 am by Rocky
» Discussions between Baghdad and Ankara to open a new port
Today at 6:57 am by Rocky
» Trade: About 11 million citizens updated their new card information
Today at 6:56 am by Rocky
» Electronic payment is sustainable growth
Today at 6:55 am by Rocky
» Experts: Iraq qualifies to be an important tourist country
Today at 6:54 am by Rocky
» Amending the Health Professions Law “robs” scientists of the central appointment 3 years after it wa
Today at 5:20 am by Rocky
» Is the “blessings package” that Erbil paid to the citizens of Kurdistan related to the elections?
Today at 5:19 am by Rocky
» Exceeded 5,000 projects.. Allocating 10 trillion dinars to support governorate reconstruction plans
Today at 5:18 am by Rocky
» “His need no longer exists.” Parliamentary Finance confirms the necessity of returning the retiremen
Today at 5:17 am by Rocky
» To communicate with the bases... 12 directives from Al-Sadr, including blocking numbers for non-gove
Today at 5:15 am by Rocky
» In an interview with "Baghdad Today"... an Iranian researcher reveals the importance of Haniyeh's vi
Today at 5:14 am by Rocky
» After it was 63 trillion in 2023... the 2024 budget deficit will rise to 80 trillion dinars
Today at 5:13 am by Rocky
» Parliament reveals the date of the first evaluation of the governors and determines the party respon
Today at 5:11 am by Rocky
» The President of the Republic informs Al-Araji and Al-Basri: Momentum must be mobilized to eliminate
Today at 5:10 am by Rocky
» Can the Federal Court sue others? A legal clarification of its response mechanism to abuse
Today at 5:09 am by Rocky
» Despite promises to soon stop burning gas.. What is the secret behind Iraq renewing the Iranian gas
Today at 5:07 am by Rocky
» Advisor to Al-Sudani: The dollar is on the way to further decline, and 70% of Iraqi traders have ent
Today at 5:06 am by Rocky
» Iraq exported more than 99 million barrels of oil last February
Today at 5:04 am by Rocky
» Barzani “gives good news” to Kurdistan employees: salaries, land, and loan exemptions
Today at 5:03 am by Rocky
» Alia Nassif: Nour Zuhair returned to the port of Umm Qasr to make deals.. An influential Shiite forc
Today at 5:02 am by Rocky
» The Prime Minister announces the movement of nearly 500 stalled projects
Today at 5:00 am by Rocky
» A government strategy to enhance investments.. Iraq is on the verge of a new era of economic develop
Today at 4:59 am by Rocky
» Ranging between 20% and 50%.. The Kurdistan government decides to reduce service fees, customs dutie
Today at 4:58 am by Rocky
» Al-Sudani: The reform approach in the security services is an integral part of reform in other secto
Today at 4:56 am by Rocky
» Everyone in Iraq wants the Sudanese visit to Washington to be successful, even the factions!
Today at 4:55 am by Rocky
» Sources and experts expect the agenda.. in his bag is the Baghdad dollar and the factions’ truce, bu
Today at 4:54 am by Rocky
» The decision to raise gasoline prices arouses the ire of drivers...a reminder of the large demonstra
Today at 4:53 am by Rocky
» Parliamentary services: 3 important hospitals in Baghdad will enter service at the end of the year
Today at 4:52 am by Rocky
» Iraq signs a contract to supply Iranian gas for a period of five years
Today at 4:50 am by Rocky
» Parliament adds a voting paragraph on amending the Penal Code to its agenda
Today at 4:49 am by Rocky
» His political advisor: We are not afraid of Sudanese entering the elections alone
Today at 4:48 am by Rocky
» Parliamentary services explain the reasons for the rise in real estate prices in Baghdad
Today at 4:46 am by Rocky
» Attia, criticizing the government's decisions: "The citizen's feathers will be ruffled without servi
Today at 4:45 am by Rocky
» Parliamentary Communications: Zain Iraq and Asiacell did not pay their debts
Today at 4:44 am by Rocky
» The Governor of Karbala announces the imminent establishment of the largest industrial city in the c
Today at 4:43 am by Rocky
» A government determination to end the issue of displaced persons in the middle of this year
Today at 4:42 am by Rocky
» Iraq buys gas from Kurdistan to generate electricity
Today at 4:41 am by Rocky
» Parliamentary signatures to include an amendment to the internal regulations to decide the choice of
Today at 4:40 am by Rocky
» In Basra.. a demonstration against foreign workers in Iraqi companies (video)
Today at 4:38 am by Rocky
» Al-Samarrai: Presidency of Parliament is an entitlement to the constituents, and calling it a “frame
Today at 4:36 am by Rocky
» Electronic food supplies in 6 governorates... covering 11 million Iraqis and “writing off” about 700
Today at 4:34 am by Rocky
» Corruption of the Ministry of Transport.. Representatives express their surprise at the minister’s s
Today at 4:32 am by Rocky
» The biggest supporter of the invasion of Iraq.. The death of former US Senator Joe Lieberman
Today at 4:31 am by Rocky
» Iraq is ranked “late.” A list of the most and least safe Arab countries for women
Today at 4:30 am by Rocky
» The Council of Ministers exempts the Gulf Interconnection Authority from guarantee fees: it is a gov
Yesterday at 7:48 am by Rocky
» The Iraqi government raises the size of the 2024 budget, and Parliament is “surprised”
Yesterday at 7:46 am by Rocky
» Popular Movement: We have many economic options away from American hegemony
Yesterday at 7:42 am by Rocky
» The Oil Parliament stresses the need to transfer part of the revenues to the producing governorates
Yesterday at 7:41 am by Rocky
» It will cover 14 regions in eastern Iraq.. A deputy reveals the “border electricity” project
Yesterday at 7:40 am by Rocky
» Experts Warn Mass Migration Threatens US Food Security
Yesterday at 7:37 am by Bama Diva
» Al-Fateh: America occupies Iraq through agreements
Yesterday at 7:37 am by Rocky
» Anger in Iraq over a "sudden decision"... and a reminder of a "general strike" that paralyzed the co
Yesterday at 7:34 am by Rocky
» Parliamentary Committee: Parliament is discussing today a decision that “disturbed” the Iraqis
Yesterday at 7:33 am by Rocky
» Ministry of Electricity: Our production will reach 27 thousand megawatts by May
Yesterday at 7:31 am by Rocky
» Diagnosing the “most important” problems in the oil file between Baghdad and Erbil.. What is the rel
Yesterday at 7:30 am by Rocky
» The Iraqi Fiqh Academy and the Sunni Endowment issue a fatwa to pay Zakat al-Fitr
Yesterday at 7:28 am by Rocky
» The National Bank of Iraq continues its digital transformation by launching its new banking system a
Yesterday at 7:26 am by Rocky
» Parliamentary Investment and the Central Bank are discussing the housing initiative
Yesterday at 7:25 am by Rocky
» The Prime Minister announces the restart of 500 suspended projects
Yesterday at 7:23 am by Rocky
» Al-Barti assesses the region's employees: Your salaries are insured and will be paid after resettlem
Yesterday at 7:21 am by Rocky
» Iraqi-American discussions in anticipation of the Sudanese visit
Yesterday at 7:20 am by Rocky
» Iraq and Turkey hold meetings in Ankara to discuss technical issues related to the development road
Yesterday at 7:17 am by Rocky
» A government parliamentary agreement to support budget revenues and governorate allocations for inve
Yesterday at 7:16 am by Rocky
» Oil: The gas sector is witnessing great development
Yesterday at 7:15 am by Rocky
» A Kurdish-French agreement to develop trade and economic relations
Yesterday at 7:13 am by Rocky
» Exchange companies in Mosul demand that they be entered into the currency selling window
Yesterday at 7:12 am by Rocky