Replies

Here is an old 2002 article about IH that will tell everyone who Casey is over at IH and who she is not. That question was asked yesterday and speculated about today. Now, back to my dinner! Later, all.

***

Keyboarding Counterspies: Citizen Sleuths Scour Web for Tracks of al Qaeda
By Matthew Cole, Special to Congressional Quarterly
Call him cyber sleuth.

In the days following the World Trade Center and Pentagon attacks, Jon Messner, a 45-year-old internet entrepreneur, began closely following news reports about a web site said to be affiliated with al Qaeda. Its name was al-Neda.com, or "the Call."

He decided to poke around, internet-style.

From his apartment in Ocean City, Md., where he runs his own Web-hosting business, Messner used his skills to track down and investigate the al-Neda.com site.

There were some odd things about it, starting with false contact information on the site supplied by its administrator. The false information was a violation of Web domain registration rules, so Messner notified the registration company, called Tucows. He then stepped in and purchased the rights to the domain name.

Now, with access to al-Neda.com, Messner could immediately track all movements to and from the site — until, that is, he was discovered by its original proprietors.

The site quickly went inactive.

Messner called the FBI. He told the agents about his feat, and then volunteered to help them find and track individuals and any other sites linked to al-Neda.com.

Five days later, an FBI computer specialist reached out to Messner.

Messner declined to provide details about what they discussed, but shortly thereafter he created a Web site called ItsHappening.com. And in the 15 months since the Sept. 11, 2001 attacks, ItsHappening.com has become an Internet hotbed of like minded cyber sleuths who spend hours of their own time trying to track down terrorists on the Web.

His site has attracted a diverse breed of conspiracy and intelligence buffs, ranging from unemployed housewives to computer engineering students.

Clearly, Messner has tapped into a grass roots desire among computer geeks around the country to enlist — digitally, at least — in the war on terror.

A scan of the site reflects some of the typical Web chat-room drivel — vulgarities, childish arguments between chatters and conspiratorial missives. Yet the site also has sections with breaking news and intelligent foreign affairs discussions.

The common bond among regular visitors is a belief that somewhere on the Internet the secrets of clandestine al Qaeda or Hezbollah cells are available to any and all who can read Arabic.

Messner, who uses the handle "Regis," and his fellow cyber sleuths schedule their day around their log in.

They scour endless pages of Arabic posted on extremist web sites, using a Web-based translator subscription tool, looking for intelligence to prevent another large attack.

While the devoted members of ItsHappening believe strongly in their mission, some in the professional intelligence community see the Web site as more of a hobby shop for computer geeks than serious intelligence gathering.

Marginal At Best?
Some intelligence experts are still trying to determine how much helpful assistance Messner and others provide the FBI and CIA.

Some former intelligence officials say it's not clear the kind of activities Messner and his cohorts carry out could put a dent in al Qaeda. Current government sources, meanwhile, would not comment on the validity, or usefulness, of the citizen effort.

FBI spokesman Steven Barry demurred when asked whether intelligence tips from ItsHappening.com users are helpful.

"I'm not going to say it isn't valuable," Barry said. "We continue to welcome any and all public assistance in the fight on terrorism."

But Barry said tips gleaned from al Qaeda propaganda are similar to getting a tip that a "suspicious looking Middle Eastern man was seen on a street and calling it in to us." Anything coming from an unsecured Web site has limited intelligence value, he said.

Messner spends, by his own account, most of his day tracking through sites like jihad.net and al-mojahedoon.net, hoping to find references to future plans.

"My initial intention was not to fight terrorism," Messner said in an interview last week. "It was to learn more about it. I just wanted answers like, ‘Why?' Now I do it in the possible hopes of preventing another attack."

The Web sites scanned by ItsHappening users act as a news forum for jihadists and al Qaeda sympathizers. A quick scan of the Arabic-language sites shows backgrounds of Kalishnakov AK-47 rifles and images of a triumphant Osama bin Laden.

Along the right side of the Mojahadoon.net page are several still photos of Sept. 11 hijackers and East African embassy suicide bombers along with Koranic scriptures. The scriptures are posted in an attempt to justify terrorist attacks and the conquering of U.S. and Israeli interests in the Middle East.

With a translator tool, these postings are easy to read. Discerning their meaning requires little intelligence training.

Although Messner had no experience or training in intelligence prior to his al-Neda.com investigation, his advanced computer skills have become a sleuthing asset. Back in Sept. 2001, he used "snap-back" software, giving him a virtual map of every Web site that a user linked to or from the original al-Neda site. It gave him the potential to follow individuals associated and interested in al Qaeda.

Meanwhile, he says he is amazed at the different types of people who have gravitated to the ItsHappening site.

One such individual is Karen Britto, aka "Casey Britton." Britto is a 43-year-old unemployed mother of three. An information technology specialist living in Toronto, Britto got hooked on ItsHappening.com while looking for employment. She says she had never been part of a Web community prior to then.

Britto also has a personal connection to the Sept. 11 terrorist attacks. She worked for an online financial publication housed near Ground Zero in lower Manhattan. The economic fallout of the attacks forced the publication to lay her off last year, and she stumbled upon ItsHappening.com while looking for terrorism information.

Since then, Britto's day centers on her computer, with pauses in between to care for her children. She logs in day and night to discuss Iraqi military capabilities or the effects of nerve gas.

"My biggest concern about these [terrorist] web sites are the praises of death," Britton said.

She describes her four to five hours a day scouring Arabic message boards as "assisting the public”

“It gives me a sense of being productive and active in a community," she said.

Three weeks ago, Britto discovered a post on Mojahadeen.net, a Web site which is now defunct, detailing how to avoid electronic surveillance of cell phones.

"I sent that link to the FBI because I thought it was important," Britto said.

Nothing came of the tip, as far as she knows.

Cyberspace Megaphones
Vincent Cannistraro, former CIA counter-terrorism chief, is not convinced of the importance of such finds. He thinks al Qaeda and other terrorist organizations use their Web sites for spreading their message, not operational communications.

"These sites are outlets of propaganda," Cannistraro said. Cyber sleuths, like Britto, he said, "don't have the other pieces of the puzzle. They are working in a vacuum — they have no context, no understanding of the cultural background.

“You have to understand how to value something,” Cannistratro added, “and that takes training and analytic skills."

Even some of ItsHappening.com’s dedicated users feel the same way.

Jonathan Williams, aka "Analyst," says the likelihood of a terrorist providing a plan of attack on an unsecured Arabic Web site is far-fetched

"I don't think it's terribly likely," said Williams, a 34-year-old graduate computer-engineering student from Iowa, "that we could find something of value on these web forums. But it is interesting to see firsthand the sentiment and hatred."

The site has its share of "quacks" and crazies, Williams says. "There are a lot of illusions about finding someone that is part of a terrorist group. You can almost see someone hunkering down in their bunker, bracing for another attack."

Williams, unlike Britto or Messner, has an intelligence background. Earlier this year, he said he applied for a position at the National Security Agency as a crypto-analyst. He declined to take an NSA offer after going through the background process, he said.

But he still wanted to pitch in.

"After 9/11, I think I share a sentiment with many people to try to help out somehow,” he said. “Additionally, there's a certain fascination to seeing the other side live and in color; sort of like the fascination of watching a train wreck."

Williams believes he found something important a few weeks ago on a Web site with only an IP address — which appears as a series of numbers rather than words in the Web address line.

The site counter on the bottom of the main page tallies nearly 11 million hits. With the help of George Maschke, a friend who is a former Defense Intelligence Agency officer, Williams translated the Web site and discovered a recruiting pitch to Muslims working at or near U.S. military installations on the Arabian Peninsula.

The four-page post asked its readers for information involving military fueling locations, weapons storage, and General Tommy Frank's quarters in Qatar. It also lists in detail various bits of intelligence that could be helpful in planning attacks on American installations.

It also expressed rage about the U.S. presence in the region.

Help or Hype?
"There may be some value in what these people are finding," said former CIA and State Department terrorism expert Larry Johnson of such amateur sleuthing, "but most of it is just hype."

Johnson, who works in risk management and private intelligence, was the deputy director for the State Department’s Office of Counterterrorism. He said there is some chance, however small, that a member of al Qaeda would post something on a public site with useful information. But the problem, he said, is that cyber sleuths do not have enough background in electronic encryption to find anything of value.

"You have to take these people and their claims with a grain of salt," Johnson said.

Whether the cyber sleuths ever come up with anything worthwhile for the FBI may never be known. Messner is sure he found something of value last Friday.

Shortly after waking up, he noticed that al-Neda.com had gone online after months of dormancy. Going through the site, he said he found 23 encrypted images. Using StegDetect software, he was alerted to the presence of hidden files within images of U.S. military planes, pictures of Osama bin Laden, and al Qaeda soldiers firing shoulder-held surface-to-air missiles from the back of a pick-up truck in Afghanistan. Messner said he immediately contacted a source within the FBI who he knew from the original al-Neda.com hijack.

The FBI won’t comment. But Messner's continued obsession with tracing these sites, highlights something else: the efforts some Americans are willing to expend, if only to feel a part of the war on terrorism.

For his own part, Williams acknowledges that the time he spends poking around the Web for al Qaeda is scintillating.

"There is a healthy dose of fun and mystery involved," he said.

“I certainly hope there is nothing we're looking at that the government is not also monitoring."

Source: CQ Homeland Security

© 2002 Congressional Quarterly Inc. All Rights Reserved