Replies

November 15, 2004

On Osama's trail

Amateur sleuths scour the Web for jihadist plots. Sometimes they even find them.

MICHAEL SNIDER

On an uncommonly hot day in late September, the bucolic town of Norwood, Ont., population 1,300, seems light years away from suicide bombings and jihad warriors. But appearances can be deceiving. A few blocks south of Norwood's only stoplight, Brent Astley is hunting terrorists. A portly man with broad features and thick hair, Astley is the director of 7-Seas Global Intelligence, a small group of international amateur detectives who spend their days scouring the Internet for al-Qaeda's virtual fingerprints. When they find something suspicious -- a hint on a message board of a planned attack or the latest address of a fly-by-night militant website -- they tip off the authorities.

Yes, it sounds a bit far-fetched, especially when you first meet the 44-year-old unemployed software developer. He looks decidedly rumpled in wrinkled shorts and a short-sleeve shirt. He plies his trade on the second floor of his house (which he rather generously calls a fixer-upper), on a laptop so well-used the original black veneer has worn away to reveal the plastic underneath. But, again, appearances can be deceiving. Astley sinks into a ratty chair and nods at a website on his computer screen. "This is an individual who goes by the Net handle of Abu Banan," he says, scrolling down the page. "He's been called al-Qaeda's webmaster, and he's right here in Canada."

In the aftermath of Sept. 11, the Internet has emerged as a major weapon for extremists. Every known terror group uses it to expound ideology, recruit supporters and raise money. In response, a small but growing subculture of citizen warriors has volunteered to staunch this proliferation, fashioning themselves as resistance fighters rising up against a hostile force. Not surprisingly, most make little impact on the war on terror; what's noteworthy is that some actually have. In the two years since it formed, 7-Seas has helped put one extremist behind bars, and claims to have helped foil other terrorist plots. Astley says he maintains regular contact with intelligence agencies in Canada and the U.S., and last month spent a day lecturing members of a federal agency on 7-Seas' terrorist-tracking methods.

The inescapable question: why does he do it? "The seriousness of the threat became pretty obvious when I realized 9/11 was going to shape the rest of my life and my kids' life," says Astley, a father of three. "My dad was in World War II, my grandfather in World War I. Well, this is my war."

The sight has become tragically familiar. A man dressed in an orange jumpsuit kneels in front of kidnappers whose faces are covered with black ski masks, and pleads for his life. Then: a gruesome death by beheading. In the era of 24-hour news channels and weblogs, terrorists find it's no longer enough to dump a victim's body on the roadside and claim responsibility with a call to a local news station. Now, they want to control the message by distributing videos of their victims' final moments over the Net.

This "theatre of terror" is the latest gambit for gaining attention, says Gabriel Weimann, a communications professor at University of Haifa in Israel, who's been studying extremists' use of the Internet for seven years. "It used to be that hijacking a plane and holding passengers hostage did it," says Weimann, who has monitored more than 4,000 sites linked to militant groups. "Today it's executions. It is so dramatic, it is so cruel, nobody can ignore it." The videos also serve as recruiting tools, encouraging sympathetic Arabs to rise up against Western invaders, and as means of spreading fear among the enemy. "You can post the videos and they can be downloaded worldwide in seconds," says Weimann. It's a strategy tailor-made for the digital age.

Even before the wave of graphic videos, Muslim extremists had been using the Web as a virtual madrassa, providing disciples with manuals on how to make bombs, kidnap people and research targets. Since late 2003, for example, al-Qaeda has been publishing the online magazine al-Battar, which means "holy sword." A recent issue discusses a speech by Abu Musab al-Zarqawi, the most feared insurgent in Iraq, while the instructional section offers part two of a lesson on the use of pistols for assassination.

Intelligence agencies maintain constant watch over the Net, knowing that a surge in traffic or an encrypted message may hold the key to a plot. Intercepted emails led investigators to Wall Street Journal reporter Daniel Pearl's killers. And, in July, U.S. authorities alerted Italy after a third cryptic message appeared on a website known to be closely watched by Islamic terrorists. "The Internet obviously gained prominence after the invasion of Afghanistan," says Special Agent Kim Jensen, an FBI counterterrorism expert. "For the most part it's filled with propaganda and hyperbole, but once in a while something of substance comes along."

In December 2003, for example, an analyst at the private Norwegian Defense Research Establishment discovered a document entitled "Jihadi Iraq, Hopes and Dangers" on a Yahoo! forum called Global Islamic Media. It laid out a strategy for breaking up the U.S.-led coalition by directing attacks at America's allies, particularly Spain, which, it argued, could not tolerate major hits in the run-up to an election. "If its troops still remain in Iraq after these blows, the victory of the Socialist Party is almost secured, and the withdrawal of the Spanish forces will be on its electoral program." Two days before the March 2004 election, several bombs detonated in Madrid's Atocha train station, killing 191 people. Although the online paper dealt more with attacking Spanish soldiers in Iraq, its prediction came true nonetheless: the Socialists swept into power and pulled troops out of Iraq.

Stories like these spur amateurs to pore over forums, sites and blogs with the dedication of public avengers. And, on rare occasions, they hit pay dirt. Astley's group operated in secrecy ever since its eight members -- two in Canada, four in the U.S., and one each in Singapore and Australia -- met on a current-events message board after 9/11. That was until 7-Seas nabbed its first terrorist. National Guardsman Ryan Anderson, a 26-year-old Muslim convert, wanted to join al-Qaeda and fight in Iraq against the U.S. He left a posting on a website under the name Amir Abdul Rashid and was contacted by someone he thought was an al-Qaeda associate. Actually, it was Shannen Rossmiller, a small-town Montana judge and member of 7-Seas, posing as a Muslim extremist. It took four weeks, but Astley and Rossmiller tracked down "Amir Abdul Rashid" (see sidebar next page). In January, the group passed the information to the FBI, which arrested Anderson after a sting operation during which he offered to help train al-Qaeda fighters on the best ways to attack U.S. tanks.

Tracking terrorists is a laborious process. 7-Seas digs up information using search engines and data-mining programs, then converts it from Arabic into English. That's how it stumbled upon a series of postings that suggested a plot to attack Western compounds in Riyadh, Saudi Arabia. In the spring of 2003, the group found a message asking for addresses of Americans and Britons in Riyadh and southern Jeddah. The writer said he wished to reward the foreigners "as they do to our brothers in Palestine and Afghanistan." 7-Seas also saw postings discussing how to detonate bombs by cellphone. It passed the information to the FBI. A mere eight hours later, terrorists attacked compounds in Riyadh, killing 35 people, including nine foreigners. Investigators later discovered the bombs were detonated by cellphone. "We had sufficient information to prevent the attack," says Astley, "and if we had got it to the authorities a couple days earlier, it might have been enough to stop them."

Astley's main target now is Abu Banan, operator of the Global Islamic Media forum, which news reports have called the "de facto al-Qaeda website." The site comes and goes as its Web host is notified of its existence and shuts it down, only to see it pop up again with a slightly different name. U.S. officials say Banan has ties to al-Qaeda and previously used the site to signal attacks. According to Astley, Banan is in Canada. Astley has tracked down the current incarnation of the site and traced the author's Internet origin -- called a router hub -- to a Toronto suburb. He says he's forwarded all the information to the RCMP, but rarely hears back. (An RCMP spokesman says that while the agency encourages the public to report possible threats, any leads provided -- and details of subsequent investigations -- are confidential.)

Not all freelance terrorist hunters are content with passing tips to the authorities -- some take a more direct approach. Internet Haganah, a group named after the clandestine military wing of the Jewish leadership during British rule in Palestine, for example, investigates sites related to Islamic extremism and, depending on what it finds, either monitors or "engages" them by asking the Web-hosting company to shut them down. "The point," says Aaron Weisburd, the group's American leader, "is to let terrorists know there are consequences to waging jihad." For his efforts, he's received copious amounts of hate mail, was the subject of a fatwa by a Muslim cleric, and has had to fight off countless attempts to overload and crash his site. More ominously, in June he received a handwritten letter addressed to "the Jewish asshole Aaron Weisburd," giving him a week to shut down his site or he'd be beheaded.

Some anti-jihad activists go so far as to set up phony terrorism websites, cataloguing who visits them before turning the information over to the authorities. Others embed homemade Trojan horse programs into bomb-making documents and other digital files; when someone downloads and opens such a file, the embedded program sends information about the user's email and surfing habits back to the program's creator. But this sort of "hacktivism" is frowned upon by most anti-terrorism activists because it can morph into vigilante acts. "I'm not sure I like the idea of individuals fighting this by themselves," says Weimann. "Once they move to hacking, I would argue it's counterproductive."

Occasionally, tactics get downright bizarre. The Northeast Intelligence Network, an anti-terrorism publication, posts beheading videos on its site, arguing the public needs to see the pictures to understand the enemy's nature. "Our objective is to show what these men really are," says NEIN director Douglas Hagmann. "They're not militants, freedom fighters or activists. They're savages."

For all the dedication and even risk-taking, does all this amateur activity make a difference? Intelligence agencies, after all, have entire departments dedicated to monitoring online traffic. For some Web detectives, the chase seems as much a hobby as a public service, with groups competing to be the first to translate a new posting and put it on their sites. Most troll the same sources, and hardly any know Arabic. "There are numerous well-meaning civilian groups," says FBI's Jensen. "Sometimes they provide helpful information that initiates investigations, but mostly they provide information on sites with which we are already familiar."

Astley admits that he sometimes wonders if he's wasting his time. He gets no money for his labours, and he hasn't worked as a programmer in six months. His wife isn't crazy about the 16 hours a day he spends on the computer. And often the leads he follows turn into dead ends. "I spent three days on this one site with jihad marching songs," he says with a chuckle. "I finally realized they were cellphone ring tones." Still, Astley finds consolation and encouragement in his few successes, and has no intention of stopping. "I just keep telling myself there would be people dead except for what we've done."

http://www.macleans.ca/topstories/world/article.jsp?content=20041115_92448_92448