,
37 tweets,
11 min read
Read on Twitter
1. Hello world, today I bring you a piece I've been working on for months about how ISIS "remote-controls" attacks: nytimes.com/2017/02/04/wor…
2. Plots in America, Europe, Asia have been described as work of Lone Wolves. Got my hands on intel docs showing they're not so lonely
3. A growing share of both successful & foiled plots were carried out by attackers being remotely coached by ISIS cyberplanners in Syria
4. What do I mean by a coached? In the most basic case, the ISIS handler acted as a confidante, egging the attacker towards violence.
5. In the most involved, ISIS arranged for every aspect of the logistics to carry out murder, down to the bullets used to kill victims
6. Last summer in India, ISIS identified a group of men willing to carry out a suicide operation. But it's not easy to buy guns there.
7. So what did ISIS do? A cyberplanner believed to be in Syria sent the cell the GPS coordinates of a location located 100s of miles away.
8. The men made their way to the location & were guided to a tree. Swinging from its branches was a bag containing pistols/bullets: 
9. Pls read excerpts from the interrogation of 1 of the suspects to see how he was being guided w/in ft of the tree by some1sitting in Syria
10. Credit where credit is due: This transcript was 1st obtained by the talented @SreenivasanJain whose story was the inspiration for my own
11. His story is here: ndtv.com/india-news/how… & I was set on this course by @DaveedGR, @thomasjoscelyn @nbarr5 @BridgetMoreng & @JcBrisard
12. I traveled to Hyderabad in Oct with @suhasiniraj, my 1st trip back to India in a decade. There we headed to the Old City to Aman Nagar B
13. @suhasiniraj stood outside the window of the home of chief suspect Ibrahim Yazdani & convinced his bereft family to let us in. 
14. Like all families who are blindsided by love, the Yazdanis insisted their brother had been set up and the evidence planted.
15. But the breadcrumbs he left behind leave little doubt he was being guided by IS. He began chatting via Telegram with Abu Issa al-Amriki
16. As it happens in 2015, when Yazdani begins talking to Amriki via Telegram, I too was following Amriki in his channel, @HoneyNTea
17. So I was able to confirm some of the details in the transcript, including that Amriki's Twitter profile guided "brothers" to HoneyNTea
18. The chats indicated that Amriki passed off Yazdani to a Hindi-speaking recruiter, who instructed the cell to send a pledge of allegiance
19. The pledge had to be written in Arabic so they sought out an Arabic speaker who wrote it out. They signed it with their noms de guerres
20. Yazdani was told to folo a head-spinning security protocol using various encryption tools before uploading it to gulf-up.com
21. Gulf-up allows users to save a file & produces a URL which can be shared with a 3rd party. This is where my colleague @runasand comes in 
22. @runasand figured out that each URL ends in a #. For ex, a pic of clouds on my desktop that I just uploaded is: gulf-up.com/do.php?img=258… 
23. So the most recent URL ends in 258612. What Runa did is subtract 1 #, to see pic uploaded just before. So 258611, then 258610 etc
24. She worked her way back to the period of time when Yazdani told investigators he had uploaded the pledge. And boom, @runasand found it: 
25. Indian investigators were not aware the pledge was still on Gulf-up at time @runasand found it. It's since been included in indictment: 
26. In addition to the pistols left in tree, the handler in Syria also arranged drops in a canal, under an overpass & next to railroad track
27. It's similar to the Sid Ahmed Ghlam case in France where he was planning to open fire on a church. Guns left in backseat of stolen car
28. Here's the chat recovered in 2015 on Ghlam's laptop. Handler in Syria gives detailed, blow-by-blow instructions on where to find the car 
29. This blows my mind: Handler in Syria tells Ghlam to find the Renault in a lot near a sandwich shop. Specifies keys are on front tire 
30. The Sid Ahmed Ghlam case was the 1st time I heard French officials refer to a plot which had been "telecommander" (remote-controlled).
31. Since then, similar chats have been found in numerous other cases. See @thomasjoscelyn on Germany attacks: longwarjournal.org/archives/2016/…
32. See @BridgetMoreng on French plots last summer: foreignaffairs.com/articles/2016-… and @DaveedGR @Nbarr5 on others in Asia: warontherocks.com/2016/07/bloody…
33. Let me close with the takeaway in light of current events: These attacks are being carried out by people *already* in Europe, N America
34. The bulk of these attackers attempted to travel to Syria, but never got there. They did not travel here. They were *already* here.
35. Majority of attackers were from the country where attack was being planned. Hence visa ban would *not* have stopped these.
36. My final shout-out is for the indomitable @SeamusHughes, the walking encyclopedia of factoids on ISIS recruits in America
37. A useful @SeamusHughes factoid 2ponder next time we hear of dire threat of refugees: Of the 114 ISIS arrests in US, majority=US citizens
