Islamic State Via WhatsApp: ‘Blow Yourself Up, O Lion’

abulhussain (CC BY 2.0)

After assembling suicide bomb vests for the attacks that slaughtered 130 people in Paris last November, Najim Laachroui went underground in his native Brussels.

The 24-year-old explosives expert wasn’t just hiding from the biggest manhunt in Europe’s recent history. He was plotting. In a dingy apartment converted into a bomb factory, Laachroui exchanged a series of messages in French with Abu Ahmed, a shadowy commander in the Islamic State based in Syria.

If law enforcement agencies had intercepted the communications, they would have been immediately alarmed. Laachroui asked militants in Syria to test chemical mixtures so he could assemble powerful bombs. He discussed his hopes to strike France again and disrupt a soccer championship there. He reported that he and half a dozen other fugitives from the Paris attacks had split up among three safe houses, according to Belgian and French counterterror officials.

Although U.S and European spy agencies were scouring the internet for any trace of Laachroui, they failed to intercept those exchanges. The reason, U.S. and European counterterror officials say: during Laachroui’s four months on the run, he and Abu Ahmed communicated through Telegram, an encrypted messaging application, and other widely available tools for secure communications.

On March 15, Belgian police raided a safe house and killed another leader of the terrorist cell in a gunfight. A worried Laachroui sent a message to Abu Ahmed reporting that the raid had cost the plotters the stash of ammunition for their AK–47 rifles, according to Belgian and French counterterror officials.

“The original plan at the airport was for them to do an attack more like Paris: shoot a lot of people first, and then set off the bombs,” a Belgian counterterror official explained in an interview in April. “But they didn’t have ammo because it was left behind in the safe house. Laachroui says: ‘We don’t have chargers for our guns. What do we do?’ They were told to go ahead and attack just with bombs’.”

On March 22, they did just that. Laachroui and two other suicide bombers killed 32 people at the airport and at a subway station in Brussels. Afterward, investigators found a laptop computer that helped them reconstruct Laachroui’s encrypted audio and text exchanges with his commander in Syria, according to European counterterror officials.

The communications were described by European and U.S. counterterror officials to ProPublica, which is preparing a documentary about terrorism in Europe in collaboration with the PBS program Frontline. ProPublica interviewed counterterror officials in Europe and the United States, some on condition of anonymity, and reviewed intercepted conversations documented in European court cases.

Taken together, the voices of the Islamic State offer insights into the day-to-day workings of an organization that has carried out lethal attacks in Baghdad, Bangladesh, and Turkey in the past two weeks.

The culture of ISIS mixes the centralized control that characterized al-Qaida with a more freewheeling approach that gives its operatives considerable latitude. The group’s use of digital propaganda to inspire “self-radicalizing” terrorists has drawn attention with attacks on U.S. soil in San Bernardino and Orlando. But the communications collected in Europe show the group provides direct long-distance instructions to operatives it dispatches from its base in Syria, and they rely heavily on that guidance.

The European communications also clearly establish the importance of encryption to ISIS operations.

“We are dealing with a challenge right now: New technologies that enable encryption and allow them to be fairly confident that they are communicating in a way that can’t be detected,” a senior U.S. intelligence official said. “They know how to communicate securely. Often we are inhibited: We know the fact of the communications taking place without knowing the content.”

In April, Italian police overheard a senior figure in Syria urging a Moroccan suspect living near Milan to carry out an attack in Italy, according to a transcript. Although the voice message had been sent through an encrypted channel, the Moroccan played it back in his car, where a hidden microphone recorded it.

In the message, the unidentified “sheik” declared: “Detonate your belt in the crowds declaring Allah Akbar! Strike! (Explode!) Like a volcano, shake the infidels, confront the throng of the enemy, roaring like lightning, declare Allah Akbar and blow yourself up, O lion!”

The suspects exchanged recorded messages over WhatsApp, an encrypted telephone application that is widely used in Europe, the Arab world and Latin America. FBI Director James Comey and other counterterror officials have publicly expressed concern about extremists in the United States using such techniques to elude monitoring.

“We’ll be monitoring a couple of guys in an internet chatroom,” a former FBI counterterror official said in an interview. “Then you’ll see one of them says: ‘OK, reach out to me on WhatsApp.’ At that point, we can’t do anything.”

Executives at WhatsApp and Telegram defend encryption as a vital shield to privacy. Reached for comment last week, a spokesperson at WhatsApp said the company complies with U.S. laws requiring cooperation with law enforcement agencies. The spokesperson cited a statement by executives in April when WhatsApp implemented “end-to-end” encryption that will conceal the content of users’ communications even from the company itself.

“Encryption is one of the most important tools governments, companies, and individuals have to promote safety and security in the new digital age,” said Jan Koum, the company’s founder, in a blog post in April. “While we recognize the important work of law enforcement in keeping people safe, efforts to weaken encryption risk exposing people’s information to abuse from cybercriminals, hackers, and rogue states.”

(Facebook, which owns WhatsApp, announced Friday that it would add end-to-end encryption for some photo and text messages on its Messenger application.)

Telegram did not respond to a request for comment for this article last week. But company executives have publicly addressed concerns about encryption by saying that technology comes with an inevitable dark side. The company says it has shut down more than 660 public channels on its application that were being used by the Islamic State.

Intelligence officials say the Islamic State’s failure to launch Paris-style attacks in the United States reflects differences in both geography and demography. American Muslims are less radicalized and less numerous than those in Europe, and U.S. border security makes it harder for would-be terrorists to enter the country, according to Western counterterror officials.

In Europe, the Islamic State has found support in large and restive Muslim communities, especially among criminals who radicalize more rapidly today than previous generations of hoodlums-turned-jihadis. Investigators say intensified Western military pressure in Iraq and Syria has prompted the group to order European recruits to strike immediately rather than make the pilgrimage to the caliphate.

“In the context of the current strategy of the Islamic State, it’s clear that their focus is causing casualties here,” said Claudio Galzerano, commander of a counterterrorism unit of the Italian police.

The ISIS strategy toward the West has evolved since the Islamic State conquered a swath of territory in Syria and Iraq and declared the caliphate two years ago, causing thousands of militants to flock to Syria.

Previous generations of aspiring jihadis passed through a series of filters as they journeyed to al-Qaida training camps in South Asia, often with a first stop at radical mosques in London. This selective, secretive approach allowed al-Qaida to vet prospective holy warriors and detect attempts at infiltration by intelligence services.

In contrast, the flow to Syria has been larger, faster and less security-conscious. Taking advantage of Europe’s proximity and ease of travel, fighters who rushed to Syria posted photos of themselves online brandishing guns. Their ranks included criminals and thrill-seekers with little religious knowledge, according to Marc Trevidic, a veteran French counterterror judge.

The Islamic State “has accepted for strategic reasons, because it wanted to impose itself on other groups in the region, the recruitment of anyone,” Trevidic said. “Methods will be created afterwards to check that … they are not spies, etcetera, but initially there are no filters.”

An Italian investigation begun in 2014 documented that hectic period. Tracking jihadis from Italy, police intercepted the cell phones of senior figures in Turkey and Syria, according to a 44-page report by a Milan investigative magistrate dated June 12, 2015. A Turkish phone was used primarily by Ahmed Abu al Harith, “a significant member of the terrorist organization with the role … of coordinating volunteers arriving in Turkey and headed to join the Islamic State,” the report says.

Monitored in late 2014 and early 2015, Ahmed Abu al Harith and fellow coordinators spoke multiple languages with callers from 22 countries including Afghanistan, Saudi Arabia, Georgia, San Marino and Sweden.

They explained “concrete rules for joining the Islamic State already described on the internet in a manual titled ‘Hijrah [Pilgrimage] to the Islamic State — what to bring, whom to contact, where to go’,” according to the Italian report.

The coordinators didn’t use encryption or coded language. But they banned recruits from traveling with “latest-generation mobile devices” in order to “avoid being located” by spy agencies. The Islamic State wanted recruits to leave behind smartphones, tablets and other devices with existing trails of activity that make them easier to trace, and use new, disposable cell phones instead, the report says.

Some recruits were less than sophisticated about the directives.

On Jan. 4, 2015, an exasperated coordinator repeatedly explained to a befuddled caller with a Lebanese accent that he could only bring a basic cell phone to Syria, according to a transcript.

“The important thing is that when you arrive in Turkey you have a small cell phone to contact me,” the coordinator said. “Don’t bring smart phones or tablets. OK, brother?”

For the fourth time, the recruit asked: “So we can’t have cell phones?”