Replies

http://www.lauramansfield.com/j/007.asp

March 1, 2006: Me and Terrorist 007:

Tracking a terrorist through cyberspace

By Laura Mansfield

It’s been two years since I first locked horns with a cyber jihadi by the name of Terrorist 007.

I was working as the assistant director for the Northeast Intelligence Network (NEIN) and a writer for World Net Daily when I ran into Terrorist 007, or Irhabi 007, on the old Ansar forum, an Arabic language message board frequently used by Al Qaeda sympathizers. (I've since left NEIN and am now on my own at LauraMansfield.com.)

Irhabi 007 was bragging about his hacking abilities, in an attempt to weasel his way into the “in crowd” of vetted jihadis. Over the next few months, I watched as Terrorist 007 began to establish himself as an expert, and gain the respect of the fellow jihadis.

My friend Jill St. Claire and I began building a dossier on 007, just as we were doing on Abu Banan, the apparent director of Global Islamic Media.

One thing that stood out about Terrorist 007 initially was that he posted primarily in English. He was apparently learning Arabic, because over the next two years, he began to shift to posting more and more in Arabic.

As time went on, 007 became more and more brazen. He began to post links to cracked commercial software programs, as well as to various jihadi audio and video propaganda files. He gradually began to expand into posting detailed instructional material on making suicide bomb vests, improvised explosive devices, and other terrorist tools.

007 was always one of the first to post links to Voice of Jihad (Sawt al Jihad) and Al Battar, publications created by Al Qaeda of the Arabian Peninsula (Saudi Arabia) and distributed by Global Islamic Media.

Over the months, it appeared that 007 was making inroads into an “inner circle” of internet jihadis, including Abu Banan.

007’s identity was elusive. At times he claimed to be in the United States; other times he claimed to be in the UK. His tendency to use British spellings of words led credence to theories that he was in the UK.

As time went on, Terrorist 007 continued to amass a huge collection of Al Qaeda propaganda films, and as one website after another was pulled down by authorities, he began to appropriate server space belonging to unsuspecting companies and institutions who left open doors on their webservers by enabling anonymous FTP uploads. One of the first to be appropriated by 007 was a server at George Washington University in Washington DC.

When Nick Berg was beheaded in Iraq in April 2004, Irhabi 007 had one of the most extensive collections of links to videos of the beheading.

The bandwidth storm that followed the release of the beheading video combined with the public outcry over the brutality of the murder brought down the Ansar website as well as several other jihadi forums; others went to a password protected mode to limit access.

By the time American hostage Paul Johnson was kidnapped and beheaded in Saudi Arabia in June, 007 was an integral part of the network responsible for distributing the video films, “borrowing” server space from an unsuspecting California company, slipping in through the anonymous FTP security hole.

It was only a few weeks later that I discovered Terrorist 007 “borrowing” web space from the State of Arkansas. I made the discovery during my weekly terrorist update on Ernie Brown’s syndicated radio show America at Night while checking jihadi sites for last minute updates.

When I noticed that 007 was posting jihadi material on the servers of the Arkansas Department of Transportation, I immediately notified the authorities through the chain of command at the Northeast Intelligence Network

But since that rarely brought any results, I also went directly to the media, tipping off a friend at CNN about my find.

The initial press release from NEIN has been removed from their servers, but can be accessed through their Google cache here

A more extensive set of links that NEIN published is located here

Among them were files highly sought after by jihadis, including the al-Qaida films "Badr al Riyadh," "American Hell in Iraq," "Russian Hell," "Martyrs of the Confrontation" and "Wills of Martyrs." Other files posted included the beheading video of Nick Berg, as well as audio and video clips of various al-Qaida leaders, including Osama Bin Laden, Ayman al-Zawahiri and Abu Musa'ab al-Zarqawi.

The files were located at ftp://www.ahtd.state.ar.us/ incoming/GIS/007 and at ftp://www.ahtd.state.ar.us/ incoming/GIS/ALQA3EDAH

Within hours, the FBI had confiscated the server. The ensuing publicity brought me to the attention of Terrorist 007. He began posting to me in English on the jihadi forums, and at one point he even told his cyber friends that he planned to find me and marry me.

In late summer of 2004, 007 informed his buddies on the boards that he was going to be going on a trip to the Bahamas, and advised them not to worry about his absence from the boards. In a couple of weeks, true to his word, Terrorist 007 was back on the boards.

He began expanding his horizons, putting up numerous websites containing extensive libraries of both propaganda videos and audios, and of instructional materials teaching terrorism techniques, how to make more and more destructive killing devices, and basic hacking techniques as well. For many months, Terrorist 007 was a source of “WAREZ”, pirated commercial software. At one point, the ever helpful 007 posted ripped copies of Arabic language translation software to help those who needed assistance in translation!

By spring of 2005, 007 was feeling the bandwidth pinch again, and began stealing credit card numbers to use in purchasing domain names and web hosting for his websites. His favorite technique seemed to be keystroke loggers. On many occasions, my virus protection intercepted attempts by 007 to download a keystroke logger to my company as I monitored his websites.

In May and June 2005, 007 had posted maps of the London transit system, as well as photographs of various tube terminals in London on his websites. It is unknown at this time if there was any connection between these posts and the London bombings in July 2005.

Then, last fall, shortly after Joel Hinnrichs committed suicide with an explosives vest at Oklahoma University, Terrorist 007 abruptly disappeared. Some analysts even speculated that Hinnrichs was 007, although that seemed unlikely. It seemed more likely that 007 had disappeared from view, and was actually using a cyber alias. This theory gained credibility after law enforcement discovered that Hinnrichs had downloaded the instructions for creating his explosives from one of 007’s websites.

His absence was noted on the jihadi boards; many of his fellow jihadis speculated that he had gone to Iraq to participate in the jihad there.

What we know now is that Terrorist 007 was arrested in October 2005 near London. His real name is Younis Tsouli. His arrest came as part of a series of arrests that began with a raid in Bosnia. Tsouli had apparently been in email contact with the men arrested in that terror raid, and in late October, British police arrested Tsouli and two other men under the Terrorism Act.

Tsouli was charged with ten charges “including conspiracy to murder, conspiracy to cause an explosion, conspiracy to obtain money by deception, fundraising and possession of articles for terrorist purposes.” Police allege that Tsouli and his coherts intended to detonate a huge car bomb in central London.

A senior Scotland Yard source said: "We are convinced that if we had not acted swiftly a massive bomb, designed to kill and maim hundreds of innocent people, would have been set off in London, probably before the end of the year and possibly during the Christmas rush."

According to the Sunday Mirror, the Tsouli is accused of the following:
# Possession of a video showing how to make a car bomb.
# Possession a video showing a number of places in Washington DC and including a CRBN (chemical, radiological, biological and nuclear) vehicle.
# Conspiracy to murder.
# Conspiracy to cause an explosion.
# Conspiracy to cause a public nuisance, conspiracy to obtain money by deception and other offences under the Terrorism Act.

As law enforcement began to examine Tsouli’s computer, they found pictures of several locations in Washington D.C., according to Scotland Yard, as well as computerized slides demonstrating how to make a car bomb and a DVD explaining how to create a suicide bomber belt.

From other information on the computer, police realized that they had managed to finally apprehend the elusive Terrorist 007.

The role that Irhabi 007 played in the growth of the global jihad should not be underestimated. He was very active in recruiting new members to the jihad, and provided valuable expertise to the group. His tutorials on how jihadis can conceal themselves through the use of anonymous proxy servers have no doubt helped many terrorists elude detection over the last several years.

The instructional material he provided has almost certainly resulted in the deaths of innocents.

Terrorist 007 is now in custody. But dozens of his followers remain, and several have already begun to carry on where he left off.