Computer Crime Research Center

How al Qaeda put Internet to use
From Britain, Webmaster kept ‘the brothers’ abreast on terror
By Andrew Higgins

In February 2000, an Egyptian merchant here in Guangzhou, the commercial hub of southern China, asked a local Internet firm for help in setting up a Web site. After lengthy haggling over the fee, he paid $362 to register a domain name and rent space on a server.

CHEN RONGBIN, a technician at Guangzhou Tianhe Siwei Information Co., and an aide went to the Egyptian’s apartment. They couldn’t fathom what the client, Sami Ali, was up to. His software and keyboard were all in Arabic. “It just looked like earthworms to us,” Mr. Chen says.

All he could make out was the site’s address: “maalemaljihad.com.” Mr. Chen had no idea that meant “Milestones of Holy War.” Nor that China, one of the world’s most heavily policed societies, had just become a launchpad for the dot-com dreams — and disappointments — of Osama bin Laden’s terror network.

In the months that followed, Arab militants in Afghanistan, a radical cleric living on welfare in London, a textile worker in Karachi, Pakistan, and others pitched in, laboring to marry modern technology with the theology of a seventh-century prophet. Their home page, featuring two swords merging to form a winged missile, welcomed visitors to the “special Web site” of Egyptian Islamic Jihad, a violent group at the core of al Qaeda. A few clicks led to a 45-page justification of “martyrdom operations,” jihad jargon for kamikaze terrorism. It explained that killing “infidels” inevitably caused innocent casualties because “it is impossible to kill them separately.”

Since the Sept. 11 attacks, radical Islam’s use of technology has stirred both scrutiny and fear. The White House has warned that video footage of Mr. bin Laden could hold encrypted messages. The Federal Bureau of Investigation has called for vigilance against hacking into the computers that control vital services. Some experts have wondered if terrorism might even lurk in pornographic Web sites, with instructions embedded in X-rated photos.

The Milestones of Holy War site signals much more modest cyber-skills. Al Qaeda operatives struggled with some of the same tech headaches as ordinary people: servers that crashed, outdated software and files that wouldn’t open. Their Web venture followed a classic dot-com trajectory. It began with excitement, faced a cash crunch, had trouble with accountants and ultimately fizzled.

But the project also illuminates the elusive contours of al Qaeda’s strengths: far-flung outposts of support, a talent for camouflage and a knack for staying in touch using tools both sophisticated and simple. Though driven from Afghanistan, al Qaeda still has many hiding places, many channels of communication and — boasts Mr. bin Laden’s senior lieutenant, Egyptian Islamic Jihad chief Ayman al-Zawahri — many means of attack.

Al Qaeda chiefs communicate mainly by courier, say U.S. officials. But their underlings make wide use of computers: sending e-mail, joining chat rooms and surfing the Web to scout out targets and keep up with events. Since late last year, U.S. intelligence agencies have gathered about eight terabytes of data on captured computers, a volume that, if printed out, would make a pile of paper over a mile high. The rise and eventual demise of maalemaljihad.com — pieced together from interviews, registration documents and messages stored on an al Qaeda computer The Wall Street Journal obtained in Kabul — provides an inside glimpse of this scattered, sometimes fumbling, but highly versatile fraternity.

Using Microsoft Front Page and other software, militants in Afghanistan devised graphics and assembled content, packaging hundreds of text, audio and video files for display on the Web. Because of primitive conditions there, they handed some technical tasks to confederates in China and later Pakistan. To upload content, they turned to an ally in Britain, using messengers to deliver compact discs to a shabby rented home in west London.

TRACKING JIHAD
The Central Intelligence Agency and other security services have tracked Egyptian Islamic Jihad closely for nearly a decade, monitoring Dr. Zawahri’s activities alongside Mr. bin Laden in Sudan, Yemen and Afghanistan. Egyptian Jihad’s Web site, however, began far from any well-known bastion of Islamic militancy, and beyond the reach of the CIA. Mr. Ali, the Egyptian trader who registered the site in China, lived in Jingui Garden, an upscale complex on Liberation North Road, a few miles from Guangzhou’s international airport and a short boat ride from Hong Kong.

A tall, heavyset man with thin, straight hair that dangles over his eyes, Mr. Ali, who also uses the name Mohammed Ali, arrived in China in 1997. To Chinese who met him, he was just another foreign businessman scrambling to cash in on China’s vibrant economy. He was a Muslim but didn’t seem particularly observant. He paid his rent on time, stayed out of trouble and socialized mainly with fellow Arabs.

Contacted by the Journal in August, Mr. Ali denied any knowledge of Egyptian Islamic Jihad or its Web site. But the site’s registration records — it is registered in Beijing — name him as the registrant and give the fifth-floor apartment where he lived at the time as a contact address for maalemaljihad.com.

Chinese police say they began monitoring Mr. Ali’s movements and phone calls after Jingui property managers told them of inquiries by the Journal. Three days after a reporter’s visit, Mr. Ali canceled his two mobile phones and disappeared. Police say he moved in with an Arab friend in Guangzhou but won’t discuss his current whereabouts.

There’s no evidence Mr. Ali was directly involved in terrorism. His role in the Web venture, however, suggests a hitherto-unknown jihad support network in southern China and shows how legitimate business can serve as a cover, even unwittingly, for al Qaeda activities.

Before he moved, Mr. Ali told the Journal that he ran his own machinery trading company called ZMZM General Trading. Officials at China’s Industrial and Commercial Bureau say they have no record of a company under this name.

A housing rental agreement signed by Mr. Ali in 2000 names a different Guangzhou concern, Almehdhar Trading Co., as his place of work. Mr. Chen, the technician who helped set up maalemaljihad.com, says Almehdhar arranged his first meeting with Mr. Ali, and they met several times at its office. Almehdhar trades garments out of a cramped room in a downtown Guangzhou building. The firm’s owner, a Yemeni named Abubakr Almehdhar, left China late last year, staff members say. Another Yemeni, Ayman Alwan, runs the office. He says Mr. Ali sometimes visited but wasn’t an employee. Mr. Alwan says he knows nothing of the Web site.

In the spring of 2000, after negotiating a price with Mr. Ali, Mr. Chen’s tiny Guangzhou firm contacted a big Beijing Internet company, Sinonets Information Technology Co., to arrange server space. Sinonets provided Mr. Ali with a facility that let him set up password-controlled mailboxes inside the Web site. “None of us even knew what ‘jihad’ meant,” says George Chen, Sinonet’s U.S.-educated president. “We never had any reason to be suspicious.”

Nor, say Chinese officials, did China’s vast security apparatus. Shortly after the Sept. 11 attacks, Guangzhou police made a sweep through Jingui Garden, checking the documents of foreign residents. Mr. Ali’s were in order. China, though efficient at crushing Muslim separatists in its northwestern Xinjiang region as well as other dissents, has prickly relations with foreign intelligence services. In contrast to some Asian nations, China has uncovered no suspected al Qaeda activists, despite evidence militants have slipped in and out of China for years.

In the mid-1990s, a senior Egyptian Jihad operative made several trips to southern China posing as a businessman, according to documents seized by Russian police who arrested Dr. Zawahri and two confederates in late 1996 as they tried to enter Chechnya. Russian investigators found details of an account at the Guangzhou headquarters of the Bank of China. Still active, it belongs to an Arab friend of Mr. Ali.

Four months after its Chinese genesis, Egyptian Jihad’s Web site put down roots in more-traditional Islamist terrain. In July 2000, maalemaljihad1.com, a sister site, was registered in the Pakistan port city of Karachi, a hotbed of Islamic militancy.

Egyptian Jihad, a group that announced a united front with Mr. bin Laden against America in 1998 and whose operatives figured prominently in the upper echelons of al Qaeda’s operational command, often faced technical troubles. It may have used two Web sites as a precaution, says Yasser al-Sirri, a London Islamist who recently revived his own site, after being cleared of helping arrange the murder of the anti-Taliban Afghan warlord Ahmed Shah Massoud days before Sept. 11.

Registration records show maalemaljihad1.com was set up in July 2000 by a Karachi Web-design company called Advanced Learning Institute & Development Center. Its manager, Muhammed Ali Aliwan, says he registered the site on behalf of Ahmed Bakht, who worked in a local textile factory.

Reached by phone in Karachi, Mr. Bakht initially denied any knowledge of the jihad Web site. But later he said he had helped set it up on behalf of someone else, whom he wouldn’t name. Soon after the call from a reporter, Mr. Bakht, too, vanished. His relatives say he left on a trip.

With technical foundations laid, militants in Afghanistan set about providing content for the Milestones of Holy War sites. The hard drive of the computer found in Kabul last winter contained the building blocks: statements by Mr. bin Laden and Dr. Zawahri, religious tracts, a photo album of “martyrs” and back issues of al-Mujahidoon, an often-vituperative Islamist newsletter.

NEWS DIGESTS
The Kabul computer also contained news digests, including video recordings of bulletins from al Jazeera and other TV stations — with the faces of unveiled female news readers blacked out. U.S. officials say Mr. bin Laden shut down his satellite phone following news-media reports that the CIA was listening to his calls to his mother.

While fiercely hostile to any religious or social norms tinged by modernity, Islamists “have no problems with technology,” says Omar Bakri, a radical cleric from Syria who lives in Britain. “Other people use the Web for stupid reasons, to waste time. We use it for serious things.” (U.S. officials say Islamists weren’t always so earnest: Many computers the CIA recovered from suspected al Qaeda operatives in Afghanistan and elsewhere contained pornographic material.)

In the fall of 2000, someone using the computer the Journal obtained in Kabul drafted an e-mail to Abu Qatada, a Palestinian preacher who had lived in Britain since 1993. It said a computer disk would be sent to him and asked him to upload its contents onto maalemaljihad.com.

The unsigned message gave punctilious instructions. It notified Abu Qatada of a password and told him to create an internal mailbox under the name Aljihad. “It is extremely important to establish this mailbox,” said the message. Abu Qatada — also known as Omar Mohamed Othman — was also asked to “please write to the brothers” via Hotmail.

Abu Qatada took pride in his computer skills, fellow Islamists say. Besides helping out with maalemaljihad.com, he ran his own Web site and frequently joined chat-room debates. He would spend hours each day tapping at his computer in the front room of his rented house on a quiet street in Acton, west London. Neighbors say he kept the curtains closed and rarely spoke to them but often received bearded visitors.

In an interview late last year, Abu Qatada denied any terrorist links, describing himself as an honest preacher with “a big mouth and a big belly.” But messages on the Kabul computer to and from Abu Qatada indicate extensive contacts with operatives in Afghanistan. European investigators say Abu Qatada acted as both a spiritual guide and a liaison officer, passing messages between scattered al Qaeda cells.

Last December, shortly before Britain adopted a new antiterrorist law, Abu Qatada vanished from his Acton home, stiffing his landlord and owing $700 on his cellphone service. He would turn up in London again later.

A few weeks after the drafting of the first e-mail message to Abu Qatada in late 2000, a militant in Kabul code-named Fat’hi wrote a follow-up note to be delivered to the cleric by courier. “The bearer of this message is a brother we trust,” said Fat’hi, an alias used by Tariq Anwar al-Sayyid Ahmad, a veteran associate of Dr. Zawahri, the Egyptian Jihad leader and Mr. bin Laden’s righthand man. “He will be the link between us and you. He has the CD we promised to send you containing our products. Please add some of the products to our site.” Most important, he said, was transferring audio and video files to the site.

What these files contained wasn’t specified. The Kabul computer held sermons and recruitment videos, including footage of militants taking potshots at a lifesize image of Bill Clinton. Clips from Walt Disney cartoons and wildlife films were spliced with hard-core jihad films, a technique apparently used to help conceal the content of al Qaeda videos and make it easier for traveling operatives to carry copies through customs.

Appended to Fat’hi’s note was a shopping list for tools needed in Web-site construction, such as Ulead Cool 3D, for animation and three-dimensional effects, and WebPainter, for animation and graphics. “Please make sure you buy the latest,” wrote Fat’hi, adding that the courier must return with them quickly to Kabul.

Relations were sometimes testy. “The Web site is OK until now, thank God, but it would have been better if you had done what I asked,” said a message bearing the name of Abu Qatada in London, who complained of trouble uploading “the doctor’s words,” an apparent reference to statements by Dr. Zawahri.

Much of the software on the Kabul computer was pirated. This included a program that muttered Bism Allah (“in the name of God”) each time the machine was booted up. Al Qaeda apparently ignored a request from the program’s designers in Pittsburgh for a $24.95 registration fee. The program had been unregistered for 81 days when Kabul fell last Nov. 13.

Also tight-fisted was Mr. Ali, the Egyptian who registered maalemaljihad.com in China. In February 2001, the Internet company hired the prior year informed Mr. Ali that his contract for server space would expire unless he paid an additional fee. Mr. Ali, says his Chinese translator, declined to pay.

His reluctance to cough up was motivated in part by dissatisfaction with the Chinese site’s erratic operation, e-mail traffic stored on the Kabul computer indicates. “I want you to try to enter and use the site. If you are able to do so I will call the company and pay the renewal fees,” says an unsigned message from the same Hotmail account Abu Qatada had been told to use to contact the “brothers.” A few weeks later, Mr. Ali decided to renew the account after all, paying an additional $120 to Chen Rongbin, the technician who visited his apartment earlier. Mr. Chen sent it to Sinonets in Beijing.

But now the bookkeepers messed up. Sinonets says the accounting department mislaid Mr. Ali’s money. The renewal order was never processed. Maalemaljihad.com crashed.

The site’s Pakistan-registered twin staggered on for several months but then crashed in the summer of 2001 after Mr. Bakht failed to pay renewal charges. Islamists still had many communications outlets sympathetic to Mr. bin Laden and Dr. Zawahri, but not the “special Web site” supervised from al Qaeda headquarters in Afghanistan.

Fat’hi, the Egyptian Islamic Jihad veteran who helped organize the Web sites’ content, died in a U.S. bombing raid in Afghanistan. Those who set up the Web sites vanished, but one figure stayed in touch. At a London gathering of Islamic radicals in July, the organizer read a statement of support he said he’d received via the Web from an absent champion of global jihad: Abu Qatada.

Late last month, British police raiding a south London public housing block seized the Palestinian cleric. He has not been charged but is being held as a terror suspect under a new British law introduced after the Sept. 11 attacks that permits the detention without trial of foreigners deemed a danger to national security.

Held in a high-security jail, he has not responded publicly to his arrest. But Islamist supporters denounced his detention, mostly via statements on the Internet such as “May Allah secure his rapid release.”

Source: www.msnbc.com

Home | What's New | Articles | Links
Library | Staff | Contact Us

Copyright © Computer Crime Research Center 2001, 2002 All Rights Reserved.
Contact the CCRC Office at 380-612-735-907