India's first cyber terrorist to use social media to imagine a bomb plot booked by ATS
‘We r d ameer here of r ownselves’
Anees Ansari allegedly made a ‘thermite bomb’ on Facebook and discussed bombing an American school with his social media friends surfing the Internet during office hours.He is the first Indian to have been described as lone-wolf by Indian security agencies. Anees Ansari made a thermite bomb in Facebook, and discussed bombing an American school with his social media friends, all sitting in his office chair, surfing internet during office hours. The Anti-Terrorism Squad chargsheet filed on January 14 describes his online journey from a college graduate, to an internet surfer, to an IS sympathiser, making him the country’s first cyber terrorist to use social media to imagine a bomb plot, reports Meghna Yelluru and Srinath Rao.
x—-x—–x—–x
Every time they blocked him, he kept popping back – for Anees Ansari couldn’t not stay on Facebook. On each of the ten occasions that Facebook blocked his profile – in or before 2013 – for posting material that infringed upon its policies, Ansari assumed a new identity, but faceless friends managed to find him nonetheless.
Ansari’s return to the popular social networking website in his 11th avatar in October 18, 2014 was only a few days old when a post detailing the manufacture of a thermite bomb and a conversation about blowing up a school led to him being declared India’s first cyber-terrorist.
Accused of wanting to launch an attack on the heavily fortified American school in Bandra-Kurla Complex – which has amongst its students, the wards of prominent Americans living in Mumbai – Ansari’s plans never left the confines of his Facebook chat window.
The 24-year-old Kurla resident blatantly and repeatedly violated strict rules regulating internet access at the Andheri-based firm where he had been employed since 2011, to trawl through Facebook, immersing himself in the violent activities of the extremist group Islamic State in Iraq and Syria.
The 728 pages, technically worded charge-sheet filed by the Maharashtra Anti Terrorist Squad (ATS) on January 16, 2015 comprises majorly of conversations Ansari had with his friends online, as well as a trove of reading material surfed which throw up such popular keywords as Lone Wolf, jihad, mujahideen and Flame Thrower (a weapon that emits a long stream of fire first used in world war I).
x———x———–x
The idea of committing a lone wolf attack was first recorded in the American state of California, where San Diego resident and white supremacist Alexander Curtis against public officials belonging to a racial or ethnic minority in 1997. A press release issued by the Federal Bureau of Investigation (FBI) says that Curtis preached lone wolf attacks to achieve white supremacist goals ‘by any means necessary’. Consequently, in 2004, the United States of America accorded itself sweeping rights to access and intercept communication the world over in the hope of preventing lone wolf attacks by amending its Intelligence Reform and Terrorism Prevention Act. Popularly known as the lone wolf amendment, it permits law enforcement agencies in the USA to – under the Foreign Intelligence Surveillance Act – secretively place under surveillance non-American citizens suspected of engaging in international terrorism and acting on the behest of a foreign power. This was the first time any law ammended its provision to check on designs of a lone wolf, acting outside a direct chain of command.
In India, the Anti-Terrorism Squad’s chargesheet is the first probe document shared with a judicial body within its borders which uses the word ‘lone wolf’ as it describes Ansari’s plan.
x———x———–x
Following Ansari’s arrest, the ATS seized his cell phone and computer at home and three computers he used at his office. All four machines were sent o the Kalina Forensic Sciences Laboratory (FSL) with a specific request to search for ‘User wise presence of Jihadi (provocative material) 1) Literature 2) videos 3) pictures 4) Bayanats (preaching) 5) Banner/posters 6) any other relevant material and more than two dozen keywords. The FSL found that ‘Islamic State’ occurred in 23 places, Flame Thrower in 16 places, Mujahideen in 15 places, Jihad in 13 places, jerjia.mukhayriq (Ansari’s outlook email id) in six places, Lone Wolf and Al-Baghdadi in 4 places each and Usaryrim, Shahada, Tawheed and Martyr in two places each.
The ATS’ case relies largely, on one hand, on the testimony of professional colleagues witness to Ansari reading up Islamic history and conversing incessantly with suspect individuals on Facebook, and on the other hand, friends in a Kurla mosque disgusted and concerned at the glowing terms in which Ansari referred to a terror outfit notorious for its brutal executions of civilians in West Asia.
The agency has brought four charges against Ansari – creating a fake identity on Facebook by misusing computers owned by his employers, conversing with a friend on Facebook – and wanted accused – named Omar Elhajj in social media about supporting ISIS’ terrorist activities, conspiring to attempt a lone wolf attack on the American school and sending offensive messages to his Facebook friends via WhatsApp.
Tracing the chronology of the conspiracy, the ATS is unsure about the date when Ansari created his last fake identity on Facebook, knowing only that it was ‘prior to 18.10.2014.’ Ansari stands charged of using his firm’s computers and internet connections ‘dishonestly and fraudulently’ without seeking the permission of his immediate superiors, punishable under section 43 of the information technology act.
Ansari is next charged under section 66 (A) (a) of the Information Technology Act for conversations on Facebook with Omar Elhajj and other friends between October 13, 2014 and October 18, 2014.
The chargesheet reads, ‘whereby, you were sending offensive messages supporting the terror activities carried out by ISIS,’ using computers and internet connections of his firm.
Ansari’s conversations with Elhajji also form the basis for the ATS’ third charge. But the agency alludes to their conversation on October 13, 2014 and Ansari’s post on Facebook the following day, about building a thermite bomb. Retracing his online steps, the chargesheet reads, ‘In pursuance of the said conspiracy, on 14 October 2014, you procured information of making of Thermite bomb, downloaded the data related to the same and posted it to your other Facebook friends, thereby you have abetted and agreed with your counterparts to commit an illegal Act of attempting LONE WOLF Bomb Attack at American Schools, with malafide intentions to complete your nefarious activities knowing the consequences of the same.’
Ansari is charged under sections 115 and 120 (B) of the Indian Penal Code and 43 and 66 (A) of the IT act.
Finally, Ansari is charged with ‘threatening the unity, integrity, security and sovereignty of the country by exceeding authorized access to your computer devices, hereby committing offences of cyber terrorism (Section 66 F of the IT Act)’ by disseminating first, messages relating to the ISIS’ activities through WhatsApp, and second, the making of a thermite bomb on Facebook.
Backing the “lone wolf bomb attack” charge at American schools the ATS has showed a total of 50 witnesses, 19 of whom are policemen. Panch witnesses apart, the remainder can be divided into two categories – colleagues and superiors from the Andheri firm where Ansari worked and surfed, and Ansari’s peers at Kurla’s Fitwalla Mosque – a medical representative working in a Kurla hospital, a software engineer and a tuition teacher.
In their statements to the ATS, all of Ansari’s friends from the second category of witnesses have referred to him as harbouring sympathy for ISIS.
x———x———–x
Ansari was employed as an associate geographic technician for an American firm that produced maps for online applications, right after his graduation from Mumbai University.
The 24 year old worked at the firm’s office in Andheri East since August 1, 2011, usually between 3 and 11.30 pm. Ever since he was hired in august 2011, Ansari was assigned to the firm’s production department. But while work required him to focus on producing maps of south-east Asian countries, Ansari seemed clearly interested in visiting Europe, as is evident in Ansari’s repeated violations of the firm’s policies regulating internet usage.
Employees found using the internet for anything apart from work required to immediately email a screenshot of the page to their immediate superiors. While a first time offender was verbally censured, repeat offences resulted in a written memo issued by the human resources department.
After two offences in June and July 2014, Ansari was now one offence away from losing his job. But, as Facebook conversations affixed in the ATS’ charge-sheet show, Ansari was openly violating his company’s norms well into October 2014, mere days before his arrest on October 18.
The very instance was documented in February 2014 by a woman colleague who was working with Ansari on a project at that time. The 24-year-old Associate Geographic Technician told the ATS each she would frequently spot Ansari chatting with someone on Facebook during work hours, paying little attention to her project-related queries. “When I tried to speak to him, he would enable the lock screen feature on his desktop. A large black image would then appear on the screen, with the words, ‘There is only one God, Allah.’ On other occasions, the lock screen image would read, ‘Extremist Muslim Graphics Images’,” she said in her witness statement.
She wasn’t the only colleague who found Ansari preoccupied while working on a project.
A 30-year-old Geographic Technician also found that Ansari was unwilling to carry out a conversation while working on a project together. The colleague describes October 16, 2014 when Ansari did not respond to repeated queries about the project, and instead engaged in a Facebook conversation of his own. The colleague was in no doubt of Ansari’s priorities when the latter minimised his work program screen to continue speaking to an unidentified individual on Facebook.
“From that day onwards, I stopped speaking to Ansari, unless there was something to say about the project,” the colleague told ATS.Neither colleague reported Ansari to a senior project leader.
x——x——x——x
Ansari’s isolation from his colleagues was complete when he had a bathroom bust-up with a close friend during the month of Ramzan last year. The 24-year-old Antop Hill resident, studied B.Sc (IT) with Ansari at Bandra’s Rizvi College. After graduating the duo bumped into each other when they were called on the same day for an interview for their future employers. For the next three years, both worked in the production department and became increasingly friendly. Their friendship ended in an abrupt and angry outburst when the colleague did not share Ansari’s sympathy of the Islamic State.
“One day in the month of Ramzan, Ansari sent me images and messages through WhatsApp about the ongoing war between Sunni and Shia Muslims in Syria. I did not like what he had sent and told him so. He then sent me a text on WhatsApp that my head was full of shit,” he told the ATS.
A few minutes later, the colleague chances upon Ansari in the bathroom. “I asked him angrily why he had said that. But he said that I wouldn’t understand and walked out. After that, I blocked Ansari on WhatsApp and never spoke to him again,” his statement reads.
x——x——x——x
Ansari’s complete disregard for the firm’s internet usage rules took him to the brink of earning a pink slip. Twice on June 11 and July 15, 2014, he apologised for his violations and vowed not repeat his behaviour. On each occasion, the promise remained on paper.
On June 11, 2014, Ansari was spotted viewing the Facebook profile of an individual named Abu Baraa. He was by a superior email a screenshot of the page and an apology to his immediate superior. Ansari typed the following email – ‘Hi, sir. I was surfing in working hours. My apologies for the same. Won’t be repeated. Thanks, Anees.’
The superior issued the formal warning to Ansari and forwarded the email to the HR department, which recommended that strict action be taken, following ‘repetitive occurrences observed with Anees’.
On July 9, Ansari’s boss served him a memo, offering him ‘one more last opportunity” to improve his behaviour failing which they would be “forced to take strict disciplinary action” against him.
Prior to be being chastised on June 11, 2014, Ansari had also been given several verbal warning between January and March 2014. The superior also found Ansari guilty of a ‘careless attitude towards work.’
On July 15, Ansari was caught by superior reading two Wikipedia pages – ‘the Islamic history of Spain’ and ‘Musa Bin Nasayr’, a Musa a general who conquered north Africa, present day Spain and France before his death in 716 AD.
x—-x—-x—–x
In October 2014, Ansari operated on Facebook under the pseudonym Usayrim Logan. On Facebook, Logan was born in Baghdad on January 12, 1990 and lived in Mosul Iraq. Logan had friends working at the University of Mosul and worked at an organisation named ‘Dawah – Calling to Allah’, where ten of his friends on Facebook worked.
The very first post from Ansari’s Facebook timeline, which he operates as Usayrim Logan, mentioned by the ATS in the chargesheet has been posted by a friend, Ummu Abdurrahman, wondering why a popular video series has abruptly stopped.
‘What happened to ENTER THE TRUTH…can’t find any video of them on YouTube..’ the post inquired. In response, a certain Zikra Zarook said, ‘Wallah! we missed brother AX via social media after he was arrested by his local authorities. (with a sad face emoticon). and also we have munafiqeens with us whom reported over our brothers and sisters who are in support of Dawlah.’ The Islamic dictionary defines Dawlah as a state or a country.
Of his 284 friends on Facebook, Ansari had chatted only with five people – Elhajj, Mohd Shama, Burhaan Ali Suxufi, Kimberly Daugherty and M EI Wardani. He had also befriended people with names such as, ‘Raise the flag of Tawheed’, ‘Ahmedbinmuhusin isis Mujahidh’, ‘Apologetic Muslim’ and ‘Freekashmir Kashmir’. (The profiles of these individuals no longer show up during a search on Facebook).
The Facebook pages that Ansari ‘liked’ include ‘The ISlamic Caliphate’, ‘The Anti-Media’ and ‘The Deen Show’. The Anti-Media claims to be a page for ‘grassroot revolutionary media’, featuring pictures such as ‘No war with Syria or Iraq’. The Deen show comprises American Muslims who offer to help educate and share the true message of Pure Islam without cultural, traditional or nationalistic prejudices and corruption.
‘Husband and wife in Islam’ and ‘Free the Muslim prisoners in USA’, were pages that Facebook had recommended to him. Ansari had not liked these pages, the ATS found.
x——-x———x
The October 14 thermite bomb post that has led the ATS to brand Ansari as India’s first cyber-terrorist elicited 22 responses. One of these comments was made by a person named Epic Joshua. He said, ‘You cannot punish them with fire… but if there is a extreme necessity to use a fire then you can do so..every rule has a permit to be broken in Jihad.’
Ansari’s rebuttal was furious, referencing Improvised Explosive Devices and sought to draw parallels with the Taliban employing flame throwers against NATO. But the final segment of his reply is as vague as it is foreboding – ‘…beside there are a lot of other uses of flame thrower.’
x——-x———x
Office apart, Ansari’s extremist views had not gone unnoticed in Kurla’s Fitwalla Road neighbourhood. The trustee of Fitwalla Mosque where Ansari offered prayers, had told other youngsters to stay clear of Ansari.
According to the ATS’ charge-sheet, three youngsters of his age, distanced themselves from Ansari after he sent them messages and violent images on WhatsApp.
These include an IT professional, a medical representative and a tuition teacher. All three suspected Ansari to be an ‘IS sympathiser. Only with the last of these three men did Ansari have contact outside the mosque, so much so that they were also friends on Facebook. In June 2014, Ansari, without warning unfriended the 22-year-old tuition teacher and blocked his profile. The hurt teacher met him a few days later in Kurla and asked him why he had done so. Ansari allegedly replied that ‘you have the intellect of a child,’ and went away. The teacher told the ATS that the exchange had baffled him because he had never once chatted with Ansari online.
In July last year, the witness engaged Ansari to teach English grammar to his students, but Ansari took no more than four lectures in three months. Ansari, however, did find the time to send violent imagery from Syria to the witness, who promptly deleted them.
x——-x———x
The incriminating conversation between Ansari and Omar Elhajj (a wanted accused) spans nearly two hours on October 13, 2014. Both men affectionately and intermittently refer to each as ‘Akhi’ or brother in Arabic. Their exchange begins with much cheer with each trading greetings before the tone turns serious. They begin joking about the need to create fresh profiles each time one is blocked. At 8.38 pm on October 13, Elhajj says – ‘I see your previous profile got blocked. I cannot remember the number of times mine too got blocked.’
Ansari replies a minute later. ‘Yeah mine shouldn’t b more than a dozen.. I know ther r many who r on 84 o somthin.. lool.’ The closeness of the pair’s friendship is indicated in only clear instance throughout their exchange, when at at 8.40 pm on the same day, Elhajj says – ‘We have been friends for a while and we always manage to find each other alhamdulillah.’
Over the next five minutes, the pair discusses marriage and among other things, the need for an alternate social network that does away with the prospect of being blocked.
But Ansari prefers martyrdom over marriage and for the first time, raises the prospect of committing a killing. At 8.53 pm he says, ‘I dont want any..all I desire is shahada..d situation here is of killing and get killed.’ elhajj doesn’t know Ansari wants to kill, but says that it is a noble cause.
Over the next 21 minutes, a bit of a cat and mouse game ensues, with Elhajj pressing for details, asking for a hint of ‘what to look for and where, while Ansari attempts to maintain a somewhat conspiratorial silence, letting through bits and bobs of information, only to make the big reveal in the end.
Some 20 minutes into their conversation, at 9.10 pm, Ansari gives away the date of his planned attack – ‘If it is successful inshaAllah…within 2 months or so..the world would witness it… you wouldn’t have to hunt for it’
Had Ansari been successful in penetrating the highly secure educational facility, or even remained a free man on the date of his attack, it would be only a few days removed from the deadly attack on the army public school in Peshawar in which more than 150 students and teachers were killed.
At 9.11 pm, Ansari suddenly checks himself and sounds fearful of having breached operational secrecy – I’v already said much.. wasn’t really supposed to.. it endangers d operation.. hope u understand..’
The unannounced manner with which Facebook may again obliterate their online presence is not lost upon Elhajj, who passes on a hotmail email address, so that the two have a second line of communication open, in the eventuality of bring blocked again.
Their relationship and the circumstance of their friendship is unclear, but Ansari holds some sort of sway over Elhajj, who craves ‘advice’ and ‘hand holding’ to violent designs of his own.
Even before Ansari spells out his plans, Elhajj begs for a ‘slice of action’. But instead of enlisting Elhajj’s help, Ansari takes it as an opportunity to spur him onto committing a lone wolf attack. Elhajj’s pleas – don’t shut me out completely Akhi. I can still assist.’ – fall on deaf ears.
Whether from the paranoia being repeatedly having their profiles blocked by Facebook or only unfulfilled aspiration, neither reveals his true hometown until prodded. Where Ansari has qualms in admitting that he lives in Mumbai, Elhajj is apprehensive of reproach and revulsion and at first says that he lives in Lubnan (Lebanon).
Full of fear, he types at 9.23 pm on October 13 – ‘I am in the evil united snakes of America and as I said not by chance and inshallah we will live under one banner, rayat al-uqab.’ Elhajj also refers to the Usa as Dar Al Harb, Arabic for a place where Islam does not dominate. Security agencies has now retrieved the Internet Protocol addresses through which Omar Elhajj had been operating his Facebook account, along with the date and time.
x——–x———-x——–x
The mere thought of carrying out an act of terrorism on American soil appears to have worked Ansari into a fervour. In his last attempt to get Elhajj to go alone, Ansari grossly overestimates how important such an act could be to ISIS. At 9.50 pm, he tells Elhajj, ‘u have no idea wat impact can it b to d whole planet by a small deed of urs.. a small deed that can help d islamic state far more than any mujahid actually fighting in its front lines.’
At one point, Ansari also invokes the prophet Mohammad to get Elhajj to go down the same path – ‘with us u will be just 1 man in d army..but go back to ur people and try to weaken them from within…and that was d decisive factor in d whole battle…’ he says at 9.27 pm.
Where Elhajj isn’t amongst the easily convinced, Ansari puts forth plan after plan to ‘shake the ground beneath the feet of Obama’ with less than $100. But any serious intention that Elhajj may harbour of committing a terror attack is only a side-track to Ansari’s plans, as his chats keep wavering.
Their exchanges briefly flicker with tension, when Elhajj, who previously likes the plan, suddenly feels Ansari ought not to kill children. Though Elhajj asks Ansari to ‘reconsider and rethink’ and ‘think twice about it’, his attempts at persuasion are too feeble to throw him off-track – (‘please please be careful and why would you target school’ and ‘there are plenty of opportunist and good targets’ and ‘akhi, I must urge you and ask you again to think hard and long about targeting the school please’).
In his final desperate attempt, Elhajj asks Ansari to seek the opinion of his commanding officer. Ansari scoffs at the suggestion of acting under instructions and replies somewhat haughtily. ‘we r d ameer here of r ownselves.. ther aint any jihad organisations here apart from kashmir that is operating openly or even secretly on d field.. none.. not even one..’
For an armchair terrorist, Ansari talks big, almost as if trying to impress Elhajj with his justification for the attack. At 9:45 pm on a chat window he says, ‘u need to hit d enemy where it hurts them d most.. and that is their civilians.. soldiers die anyway.. they signed up for it…’
Minutes into the convesration, Elhajj has another go at dissuading Ansari from bombing the school by taking him to Jordan and Turkey where refugees from war-torn Syria have set up their homes in vacant schools. In spite of this final attempt, Ansari will not budge. His mind is made up, he knows that the American school has ‘VIP students’ from at least ’10 allies of America.’
x——-x———x
Elhajj’s conversation with Ansari ended at 10.21 pm on October 13 with the hope both offering prayers at Al-Aqsa Mosque in Jerusalmem some day. Before logging off, Elhajj writes, ‘please stay in touch and send me an email if you like.’
A day later, Elhajj, who is online, sends Ansari a greeting. But there is no reply. On Friday, October 17, a day before the ATS picked up Ansari, he exchanged greetings with Elhajj at 8.34 pm.
Elhajj’s final question still hangs unanswered in his chat window, but Usaryrim Logan will never reply.
8.45 pm – How are things going in Mumbai?’
Comments