Al-Qaeda Chatter on UseNet?

Free Republic Exclusive ^ | Nov. 21, 2002 | Johnathan Galt

[JohnathanRGalt]

There exists a series of 'nonsense' postings in Usenet. (Please no jokes about Usenet already being full of nonsense). Obviously computer generated.  These often have Arabic names interspersed in the content.

One speculation is they might just be 'merry pranksters' posting vast amounts of nonsense to confuse Usenet readers.

Another speculation is this might be the 'increased al-Qaeda chatter' we hear about when the Home Land Security changes the color to a redder hue. Note the increase just after Dec. 22 (the date that the Shoe Bomber was captured trying to blow up Miami to Paris, flight AA 63). We need to do a lot more research on this.

Operation Overloard ( www.leesaunders.com/html/Overlord.htm ) -- was the code name for the invasion of mainland Europe. On June the 6th 1944, D-Day, the Allies mounted the biggest naval invasion force ever seen in the history of war, with over 6,000 vessels. The successful invasion of Northern France allowed the Allies to create the long awaited second front in Europe.

The track starts with radio messages in French which were broadcasted from London. These coded messages passed on important information to the French Resistance, who were working in occupied France. Such a message would have alerted the French Resistance of the impending invasion, allowing the Resistance to create confusion and disruption within German-held France.

[Woman/Femme]:
Qu'est-ce que c'est? (What is it?)

[Radio]:
Les sanglots longs des violons de l'automne. Je repete: Les sanglots longs des violons de l'automne...
(Long sobs of autumn violins. I repeat: Long sobs of autumn violins)

[Man/Homme]:
Et cette fois vous allez combattre sur la terre de France.
Dans nos campagnes. Dans nos villages. Sous les yeux des notres.
(And this time you will fight on land of France. In our country. In our villages. Before our eyes.)

[Radio]:
Ici radio Londres. Voici notre huitieme bulletin d'information. Mais voici, tout d'abord, quelques messages personnels. Demain, la melasse deviendra du cognac. Demain, la melasse deviendra du cognac. Jean a de longues moustaches. Je repete...
(This is radio London. This is our eighth information bulletin. But first, a few private messages. Tomorrow, treacle will turn to brandy. Tomorrow, treacle will turn to brandy. John has a long moustache. I repeat...)

[Woman/Femme]:
Vite, il faut se depecher! (Lets go! We have to hurry up!)

[Radio] :
Jean a de longues moustaches. (John has a long moustache.)

---

I did some searches of Google (Usenet) groups, for example "Moustapha Rais", or "Saad Rais":  Rais is an Indonesian name. Moustapha Lebanese or Turkish. Saad is Saudi. I doubt that many male Indonesians emigrated to Saudi Arabia and had a bunch of kids.  Therefore Rais and Moustapha don't often appear together in the same name. I put in their names and then scanned the postings for nonsense text. Names of posters are often forged anyway.

Sometimes appearing in popular but unmoderated groups such as  rec.collecting.sport.hockey or soc.men always only one thread.  Mostly ignored by other people in the group -- once and a while someone complains.  

http://groups.google.com/groups?selm=%25Dea9.662%24Za.34883734%40newssvr16.news.prodigy.com

Certainly postings of garbage are 'off-topic'.

For the most part, messages are usually being sent to groups that no one reads -- or would ever complain about:

news.admin.net-abuse.email -- A high volume group that is used to used to make a record of SPAM reports, no one reads it unless they are commenting on a previous spam report.
 
alt.test or gnu.gnusenet.test -- high volume group for test postings, no one reads them.

Click 'View Original Format' on the right side of these posting.  I looked first for the 'NNTP-Posting-Host',  First put IP address in http://www.checkdomain.com/ this is usually good for American (ARIN) or Asian IPs. If the IP is 'RIPE', then check European addresses with:  http://www.ripe.net/perl/whois

If that wasn't available I report the  'X-Trace' (need some help on deciphering this).

Some posters used an anonymous services such as Cotse.net to post their nonsense text. Obviously, someone thinks it is important to keep their location secret while they post nonsense text to the internet. A court order would be required to get the actual posters IP address.

---

Re: they frantically excuse to Mohammed when the kind ...
... Where will you live the worthwhile handsome bandages before Al does? cheers, Yosri
Moustapha Rais -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.0.5 Myw ...
news.admin.net-abuse.email - Dec. 23, 2001 by Yosri Moustapha Rais - View Thread (1 article)
NNTP-Posting-Host: 192.117.153.9  -- Computerland, Israel/Palestine

who lifts happily, when Chester explains the dirty pumpkin ...
... it. What will we seek after Moustapha behaves the strange structure's candle ... kicks
mercilessly. Ismat attacks, then Yosri partly orders a lean sauce ...
news.admin.net-abuse.email - Dec. 22, 2001 by Saad Rais - View Thread (1 article)
NNTP-Posting-Host: 213.56.128.14  -- France Telecom, France

Re: these days Estefana will play the pumpkin, and if ...
... ball. cheers, Hakeem Ghassan Rais -----BEGIN PGP SIGNATURE ... Both learning now, Yosri
and Frederick expected the ... so quietly, whenever Moustapha judges the inner ...
news.admin.net-abuse.email - Dec. 23, 2001 by Hakeem Ghassan Rais - View Thread (1 article) 
NNTP-Posting-Host: 192.117.153.9  -- Computerland, Israel/Palestine

Re: she wants to kick urban buckets behind Edwin's cafe
... admiringly join Patrice too. What did Yosri mould against all the cans? We ... t proud.
Both burning now, Susan and Moustapha lifted the strong markets in ...
news.admin.net-abuse.email - Dec. 22, 2001 by Feyd Rais - View Thread (1 article)
NNTP-Posting-Host: 213.56.128.14  -- France Telecom, France

Re: they are covering below the sunshine now, won't promise ...
... it'll actually clean the sauce. Moustapha! You'll laugh spoons. Nowadays, I ... attempt
them, then we stupidly excuse Yosri and Oliver's ugly cloud. Are you ...
news.admin.net-abuse.email - Dec. 24, 2001 by Aslan Rais - View Thread (1 article)
X-Trace: 335181803332803de216e058c7070e0983c6723642c7e10b013235183c27be6d

george moves, then Moustapha angrily converses a dull pin ...
... tyrants furiously talk as the filthy porters join. She can behave neatly, unless
Moustapha fears counters on Ayaz's twig. Will you expect on the sign, if Will ...
news.admin.net-abuse.email - Dec. 24, 2001 by jeff@news.clara.net - View Thread (1 article)
X-Trace: 30ae3e2c3390803866803880023222e871153070c3118004c47721303c27bf18

try shouting the canyon's difficult enigma and Moustapha will ...
... throughout light sauces? Try not to dream a sauce! Who will we climb after Moustapha
cares the old shore's dose? Alfred fears the frame behind hers and freely ...
news.admin.net-abuse.email - Mar. 5, 2002 by Bert - View Thread (1 article)
X-Trace: DXC=33INC98fLL52A>:_e3Gd79X`1N4>^k1L3iF6BbIV4YY2LnHEXCOOR@?IeF]QLCH9C;6d`EYgl61h26[ahYg_<kV?

monolith's kind ball and Moustapha will irrigate you! Tell ...
... raindrops. Sometimes, I'll kill the pitcher. Better monolith's kind ball and Moustapha
will irrigate you! Tell Atiqullah it's change, care, and smell. Others ...
soc.men - Oct. 27, 2002 by Axolotl2 - View Thread (1 article)
Anon proxy from Cotse: http://www.cotse.net/abusepolicies.html

Re: moustapha talks, then Sharon lazily answers a shallow ...
... were hating over the hollow monument. Until Ahmed climbs the goldsmiths partially,
Moustapha won't move any younger mirrors. Almost no thin games improve Neal ...
rec.games.netrek - Jul. 24, 2002 by Lydia - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

for Moustapha the ache's light, towards me it's young, ...
... kicks the humble potter in back of the morning? Until Aslan fears the games freely,
Moustapha won't love any lean stars. It can lift the active spoon and pull ...
comp.lang.limbo - Jul. 24, 2002 by opufne@OBASQAW.NE.US - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

Re: until Moustapha attacks the forks undoubtably, Rose won' ...
... are all sour and dull. We burn them, then we fully seek Yosri and Moustapha's stale
unit. She wants to pour sticky jackets among Imran's sign. Otherwise the ...
rec.collecting.sport.hockey - Jul. 24, 2002 by Wally - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

Re: otherwise the book in Moustapha's coconut might arrive ...
i am a demon from She can smell once, grasp believably,
then laugh alongside the poultice ...
alt.test - Nov. 2, 2002 by Tariq_Marwan_al-Jabbar@bocvu.org.my - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

will you nibble outside the morning, if Moustapha lovingly ...
i am a demon from Almost no closed thin oranges will
believably promise the jugs. She ...
alt.test - Nov. 2, 2002 by Ziad_al_Makhoul@leqman.org.pe - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

i was opening grocers to pretty Moustapha, who's scolding ...
i am a demon He might weekly promise for glad smart
shores. They partly grasp light ...
alt.test - Nov. 2, 2002 by demonspawn@aol.com - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

(... many more examples are available, more research needed ...)

[Mitchell]

I think this is a HipCrime Usenet attack. Although annoying and disruptive, HipCrime wouldn't seem to be Islamic terrorism. A Google search for "hipcrime" will provide some information on the history of this problem.

[b4its2late]

Interesting.

[TLBSHOW]

He is right. I should of linked it different as it is a very graphic picture of which I wanted to make the point we are up against a very graphic group.

Most photos like that are normally listed as such here at Freerepublic.

Bombs Add to Israeli Fury After Baby's Killing * Be Warned Very Graphic Photo *

http://www.freerepublic.com/forum/a3ac28683787f.htm

even then they can be too much! Thanks for the reminder freepers!

[TLBSHOW]

Thanks Cindy!

[proxy_user]

I agree it is HipCrime. If Islamic terrorists wanted to communicate through Usenet, they would simply used Mixmaster and a mail2news gateway like everybody else in alt.anonymous.messages.

[Cindy]

Mr. Galt,

I don't know a darn thing about Usenet or the postings, but I did notice that the last usenet posts you noted are in Virginia and posted in November, 2002.

stepping back in time...HUMAN EVENTS ONLINE: "SUBURBAN WASHINGTON'S TERROR TRAIL" by Tiimothy P. Carney and Terrence P. Jeffrey (November 5, 2001)
http://www.humaneventsonline.com/articles/11-05-01/cover.html

[JohnathanRGalt]

I always dismissed it as the work of some kook named Thomas Boschloo who lives in the Netherlands and apparently has some kind of grudge against the group. But now I see the words 'Moustapha' and 'Boschloo' often appear together in these posts.

Note that these 491 posts appear mostly in the, alt.privacy.anon-server newsgroup. Each message is '-- PGP SIGNED --' so the recipient can uniquely identify the sender -- rather than malicious spamming in a futile attempt to bring down UseNet --  it looks like some form of anonymous communication.

[Mixer]

Thanks for the ping. I think that Usenet is a high traffic place for terrorist chatter because it is so hard to regulate. There are so many groups and so many ways to spread the word withouit anyone catching on. Thnaks for looking into this and it might be a good idea for everyone to ping into this thread anything else that they see on Usenet that may contain cryptic code that the feds might be interested in seeing.

Johnathan.....great job as always.

[BiffSchneider]

We already had this thread several months back. Perhaps a FAQ? ;)

[Mixer]

Farmers=?; store=?; monolith=?; butchers=?; spoon=?; upper house=?; enigmas=?; tailor=?; dusts=?; onions=?; shopkeepers=? There has to be a decoder for all this uninteligible crap.

Yeah, I'll bet the koran would provide some answers.

[Mitchell]

I knew I'd seen a thread like this somewhere. I didn't remember if there was one on FR or not. I think kuro5hin had a similar thread too.

[proxy_user]

C'mon, alt.privacy.anon-server is an obvious place to attack. The guy probably has a beef with Froggie or something.

[DoctorMichael]

I have a bluebird in my pencilbox.

Repeat: I have a bluebird in my pencilbox.

[JohnathanRGalt]

I think this is a HipCrime Usenet attack....

Ok, here's a few links on HipCrime

Hipcrime was incarcertaed on August 23, 1998, and remained in the Dungeon until the Escape of November 1999. He was recaptured on June 8 2002, and will likely remain in the Dungeon indefinitely.

NOTE: "Hipcrime" himself is not responsible for the supersedes. He merely wrote the software that others are abusing for this purpose. The problem acquired the name "Hipcrime" because that is the tool that the vandals are using. In fact, more than one vandal could be involved.

The most recent tactic that HipCrime (see 3.1.4) has adopted in his/their campaign against news.admin.net-abuse.email is to post in other newsgroups articles which are either derogatory to America or pretending to be encoded messages for terrorists. The follow-ups for these articles are set to news.admin.net-abuse.email, with the intention that when the denizens of these newsgroups reply in understandable indignation, their replies all go into news.admin.net-abuse.email and drown out other conversations.

[JohnathanRGalt]

Relax. Those are Hipcrime or Hipclone attacks....

Here's a great thread: The time has come to hunt down HipCrime

[dsc]

These messages may very well be hipcrime attacks, but just as a general aside, terrorists might very well use the time-honored method of sending a pre-arranged phrase in the clear.

"When you hear me say, 'Lavender rhinos swan about the oven,' that means 'Execute plan A.'

[philetus]

I agree. Show all the pics.

Too many people haven't seen them.

[winner3000]

It's interesting that the terrorists targeted a nurse who was helping Palestinians from a refugee camp in Lebanon. Just another indication that they don't want to help the Palestinians and instead want to keep them in miserable conditions, so that they could be used against Israel.

[Cindy]

re post #47<

LINKS OF INTEREST:

MSNBC.com: "DEFENDERS: ADMITTED TERRORIST WALKS FREE" (ARTICLE NOTE: The suspect is identified as Fawzi Mustapha Assi.) (ARTICLE SNIPPET: ""This offense is neither a crime of violence nor does it involve a narcotic drug. It is an offense that involves allegations of support for an international terrorist organization. However, the items that were alleged in the offense do not involve weapons or indications of a crime of violence." said the judge. Assi was released on $100,000 bond and his father put up his Dearborn home as collateral, vouching that his son would appear back in court. But Assi never returned to the courthouse, his father lost his home and federal agents lost a man with suspected ties to terror, Local 4 reported.") (111102)

stepping back in time...BXA.doc.gov - BUREAU OF INDUSTRY AND SECURITY: "THERMAL IMAGING CAMERA INTERCEPTED ON ITS WAY TO HIZBALLAH (FAWZI MUSTAPHU ASSI)"

GOOGLE Search Term: "FAWZI MUSTAPHA ASSI"

[TxBec]

tailor = fashion designer?