A London computer expert acquired worldwide notoriety on the internet as an al-Qaeda propagandist called “Irhabi 007”, a court was told yesterday.
Younis Tsouli allegedly used his web identity – which translates from Arabic as “Terrorist 007” – to spread extremist material around the world.
One of the many websites he set up, irhabi.007.ca, received 14,244 hits in August 2005 from users in Saudi Arabia, France, Belgium, Sweden, Israel, Canada, Britain, Mexico and other countries.
Mr Tsouli, 23, also stored media articles about the international hunt for Irhabi007. One article described him as an al-Qaeda “cyber ghost” and another as the “hacker extra-ordinaire” who defied attempts to close down his network of jihadi websites. His use of “007” in his pseudonym earnt him the nickname “Bond” among some of the users of his websites, which were allegedly financed by credit card fraud.
The court was told that he and his codefendants Waseem Mughal, 24, and Tariq al-Daour, 21, had close links to al-Qaeda in Iraq and posted videos of its attacks on coalition forces and the beheading of Western hostages.
The jury at Woolwich Crown Court was told that Mr Tsouli boasted online to associates about being the terrorists’ “favourite files-uploader online” and that “AQ in Iraq” had asked him to organise translation of their electronic magazine.Mark Ellison, for the prosecution, said that in one online exchange with Mr Mughal, Mr Tsouli said that he wanted to join the fighting in Iraq. “It sucks that we are here and not there,” he wrote. “But I suppose someone has to be here.”
But Mr Mughal urged him to continue with his “media work”. He wrote: “A lot of the funding that the brothers are getting is coming because of the videos. Imagine how many have gone after seeing the videos. Imagine how many have become shahid [martyrs].”
On the day before the suicide attacks in London on July 7 2005, Mr Tsouli allegedly wrote: “The only thing that would stop me from joining the brothers is to attack the bastards here in London. The sooner the better.” After the attacks he wrote to an associate: “Brother I am very happy. From the moment the infidels cry, I laugh. Unfortunately most Muslims are not adherent. They don’t understand the attacks must be more profitable in a way that they don’t play into the hands of the infidels.
“The attacks are soft. It is difficult to sell it to the general public. I seriously think there are certain individuals that should be assassinated, striking at precise targets. That’s what I would like to see.”
The three men were arrested in October 2005 as a result of intelligence gathered from the arrest of two terrorist suspects in Bosnia. A video was found showing one of the men in Bosnia, Bektasevic Mirshad, posing with explosives and weapons saying: “We are Muslims. The Lions are coming. We are ready to attack.”
It is alleged that Mr Tsouli and Mr Mughal had the mobile phone number used by Mirshad and had also chatted to him online. Mr Tsouli, a Moroccan living in Shepherd’s Bush, West London, Mr Mughal, from Chatham, Kent, and Mr al-Daour, from Bayswater, West London, deny charges of possessing items and documents of use to terrorists and of inciting terrorism overseas. Mr Tsouli and Mr Mughal also deny a charge of conspiracy to murder linked to the arrests in Bosnia. The trial continues.
By Rita Katz and Michael Kern
Sunday, March 26, 2006; Page B01
For almost two years, intelligence services around the world tried to uncover the identity of an Internet hacker who had become a key conduit for al-Qaeda. The savvy, English-speaking, presumably young webmaster taunted his pursuers, calling himself Irhabi — Terrorist — 007. He hacked into American university computers, propagandized for the Iraq insurgents led by Abu Musab al-Zarqawi and taught other online jihadists how to wield their computers for the cause.
Suddenly last fall, Irhabi 007 disappeared from the message boards. The postings ended after Scotland Yard arrested a 22-year-old West Londoner, Younis Tsouli, suspected of participating in an alleged bomb plot. In November, British authorities brought a range of charges against him related to that plot. Only later, according to our sources familiar with the British probe, was Tsouli’s other suspected identity revealed. British investigators eventually confirmed to us that they believe he is Irhabi 007.
The unwitting end of the hunt comes at a time when al-Qaeda sympathizers like Irhabi 007 are making explosive new use of the Internet. Countless Web sites and password-protected forums — most of which have sprung up in the last several years — now cater to would-be jihadists like Irhabi 007. The terrorists who congregate in those cybercommunities are rapidly becoming skilled in hacking, programming, executing online attacks and mastering digital and media design — and Irhabi was a master of all those arts.
But the manner of his arrest demonstrates how challenging it is to combat such online activities and to prevent others from following Irhabi’s example: After pursuing an investigation into a European terrorism suspect, British investigators raided Tsouli’s house, where they found stolen credit card information, according to an American source familiar with the probe. Looking further, they found that the cards were used to pay American Internet providers on whose servers he had posted jihadi propaganda. Only then did investigators come to believe that they had netted the infamous hacker. And that element of luck is a problem. The Internet has presented investigators with an extraordinary challenge. But our future security is going to depend increasingly on identifying and catching the shadowy figures who exist primarily in the elusive online world.
The short career of Irhabi 007 offers a case study in the evolving nature of the threat that we at the SITE Institute track every day by monitoring and then joining the password-protected forums and communicating with the online jihadi community. Celebrated for his computer expertise, Irhabi 007 had propelled the jihadists into a 21st-century offensive through his ability to covertly and securely disseminate manuals of weaponry, videos of insurgent feats such as beheadings and other inflammatory material. It is by analyzing the trail of information left by such postings that we are able to distinguish the patterns of communication used by individual terrorists.
Irhabi’s success stemmed from a combination of skill and timing. In early 2004, he joined the password-protected message forum known as Muntada al-Ansar al-Islami (Islam Supporters Forum) and, soon after, al-Ekhlas (Sincerity) — two of the password-protected forums with thousands of members that al-Qaeda had been using for military instructions, propaganda and recruitment. (These two forums have since been taken down.) This was around the time that Zarqawi began using the Internet as his primary means of disseminating propaganda for his insurgency in Iraq. Zarqawi needed computer-savvy associates, and Irhabi proved to be a standout among the volunteers, many of whom were based in Europe.
Irhabi’s central role became apparent to outsiders in April of that year, when Zarqawi’s group, later renamed al-Qaeda in Iraq, began releasing its communiqués through its official spokesman, Abu Maysara al-Iraqi, on the Ansar forum. In his first posting, al-Iraqi wrote in Arabic about “the good news” that “a group of proud and brave men” intended to “strike the economic interests of the countries of blasphemy and atheism, that came to raise the banner of the Cross in the country of the Muslims.”
At the time, some doubted that posting’s authenticity, but Irhabi, who was the first to post a response, offered words of support. Before long, al-Iraqi answered in like fashion, establishing their relationship — and Irhabi’s central role.
Over the following year and a half, Irhabi established himself as the top jihadi expert on all things Internet-related. He became a very active member of many jihadi forums in Arabic and English. He worked on both defeating and enhancing online security, linking to multimedia and providing online seminars on the use of the Internet. He seemed to be online night and day, ready to answer questions about how to post a video, for example — and often willing to take over and do the posting himself. Irhabi focused on hacking into Web sites as well as educating Internet surfers in the secrets to anonymous browsing.
In one instance, Irhabi posted a 20-page message titled “Seminar on Hacking Websites,” to the Ekhlas forum. It provided detailed information on the art of hacking, listing dozens of vulnerable Web sites to which one could upload shared media. Irhabi used this strategy himself, uploading data to a Web site run by the state of Arkansas, and then to another run by George Washington University. This stunt led many experts to believe — erroneously — that Irhabi was based in the United States.
Irhabi used countless other Web sites as free hosts for material that the jihadists needed to upload and share. In addition to these sites, Irhabi provided techniques for discovering server vulnerabilities, in the event that his suggested sites became secure. In this way, jihadists could use third-party hosts to disseminate propaganda so that they did not have to risk using their own web space and, more importantly, their own money.
As he provided seemingly limitless space captured from vulnerable servers throughout the Internet, Irhabi was celebrated by his online followers. A mark of that appreciation was the following memorandum of praise offered by a member of Ansar in August 2004:
“To Our Brother Irhabi 007. Our brother Irhabi 007, you have shown very good efforts in serving this message board, as I can see, and in serving jihad for the sake of God. By God, we do not like to hear what hurts you, so we ask God to keep you in his care.
You are one of the top people who care about serving your brothers. May God add all of that on the side of your good work, and may you go careful and successful.
We say carry on with God’s blessing.
Carry on, may God protect you.
Carry on serving jihad and its supporters.
And I ask the mighty, gracious and merciful God to keep for us everyone who wants to support his faith.
Irhabi’s hacking ability was useful not only in the exchange of media, but also in the distribution of large-scale al-Qaeda productions. In one instance, a film produced by Zarqawi’s al-Qaeda, titled “All Is for Allah’s Religion,” was distributed from a page at http://www.alaflam.net/wdkl .
The links, uploaded in June 2005, provided numerous outlets where visitors could find the video. In the event that one of the sites was disabled, many other sources were available as backups. Several were based on domains such as http://www.irhabi007.ca or http://www.irhabi007.tv , indicating a strong involvement by Irhabi himself. The film, a major release by al-Qaeda in Iraq, showed many of the insurgents’ recent exploits compiled with footage of Osama bin Laden, commentary on the Abu Ghraib prison, and political statements about the rule of then-Iraqi Interim Prime Minister Ayad Allawi.
Tsouli has been charged with eight offenses including conspiracy to murder, conspiracy to cause an explosion, conspiracy to cause a public nuisance, conspiracy to obtain money by deception and offences relating to the possession of articles for terrorist purposes and fundraising. So far there are no charges directly related to his alleged activities as Irhabi on the Internet, but given the charges already mounted against him, it will probably be a long time before the 22-year-old is able to go online again.
But Irhabi’s absence from the Internet may not be as noticeable as many hope. Indeed, the hacker had anticipated his own disappearance. In the months beforehand, Irhabi released his will on the Internet. In it, he provided links to help visitors with their own Internet security and hacking skills in the event of his absence — a rubric for jihadists seeking the means to continue to serve their nefarious ends. Irhabi may have been caught, but his online legacy may be the creation of many thousands of 007s.
Rita Katz is the author of “Terrorist Hunter” (HarperCollins) and the director of the SITE Institute, which is dedicated to the “search for international terrorist entities.” Michael Kern is a senior analyst with the institute.