ISIS via WhatsApp: 2018Blow Yourself Up, O Lion’
by Sebastian Rotella ProPublica, July 11, 2016, 8 a.m.
After assembling suicide bomb vests for the attacks that slaughtered 130 people in Paris last November, Najim Laachroui went underground in his native Brussels.
The 24-year-old explosives expert wasn’t just hiding from the biggest manhunt in Europe’s recent history. He was plotting. In a dingy apartment converted into a bomb factory, Laachroui exchanged a series of messages in French with Abu Ahmed, a shadowy commander in the Islamic State based in Syria.
If law enforcement agencies had intercepted the communications, they would have been immediately alarmed. Laachroui asked militants in Syria to test chemical mixtures so he could assemble powerful bombs. He discussed his hopes to strike France again and disrupt a soccer championship there. He reported that he and half a dozen other fugitives from the Paris attacks had split up among three safe houses, according to Belgian and French counterterror officials.
Although U.S and European spy agencies were scouring the internet for any trace of Laachroui, they failed to intercept those exchanges. The reason, U.S. and European counterterror officials say: during Laachroui’s four months on the run, he and Abu Ahmed communicated through Telegram, an encrypted messaging application, and other widely available tools for secure communications.
On March 15, Belgian police raided a safe house and killed another leader of the terrorist cell in a gunfight. A worried Laachroui sent a message to Abu Ahmed reporting that the raid had cost the plotters the stash of ammunition for their AK201347 rifles, according to Belgian and French counterterror officials.
“The original plan at the airport was for them to do an attack more like Paris: shoot a lot of people first, and then set off the bombs,” a Belgian counterterror official explained in an interview in April. “But they didn’t have ammo because it was left behind in the safe house. Laachroui says: 2018We don’t have chargers for our guns. What do we do?’ They were told to go ahead and attack just with bombs’.”
On March 22, they did just that. Laachroui and two other suicide bombers killed 32 people at the airport and at a subway station in Brussels. Afterward, investigators found a laptop computer that helped them reconstruct Laachroui’s encrypted audio and text exchanges with his commander in Syria, according to European counterterror officials.
The communications were described by European and U.S. counterterror officials to ProPublica, which is preparing a documentary about terrorism in Europe in collaboration with the PBS program Frontline. ProPublica interviewed counterterror officials in Europe and the United States, some on condition of anonymity, and reviewed intercepted conversations documented in European court cases.
Taken together, the voices of the Islamic State offer insights into the day-to-day workings of an organization that has carried out lethal attacks in Baghdad, Bangladesh, and Turkey in the past two weeks.
The culture of ISIS mixes the centralized control that characterized al-Qaida with a more freewheeling approach that gives its operatives considerable latitude. The group’s use of digital propaganda to inspire “self-radicalizing” terrorists has drawn attention with attacks on U.S. soil in San Bernardino and Orlando. But the communications collected in Europe show the group provides direct long-distance instructions to operatives it dispatches from its base in Syria, and they rely heavily on that guidance.
The European communications also clearly establish the importance of encryption to ISIS operations.
“We are dealing with a challenge right now: New technologies that enable encryption and allow them to be fairly confident that they are communicating in a way that can’t be detected,” a senior U.S. intelligence official said. “They know how to communicate securely. Often we are inhibited: We know the fact of the communications taking place without knowing the content.”
In April, Italian police overheard a senior figure in Syria urging a Moroccan suspect living near Milan to carry out an attack in Italy, according to a transcript. Although the voice message had been sent through an encrypted channel, the Moroccan played it back in his car, where a hidden microphone recorded it.
In the message, the unidentified “sheik” declared: “Detonate your belt in the crowds declaring Allah Akbar! Strike! (Explode!) Like a volcano, shake the infidels, confront the throng of the enemy, roaring like lightning, declare Allah Akbar and blow yourself up, O lion!”
The suspects exchanged recorded messages over WhatsApp, an encrypted telephone application that is widely used in Europe, the Arab world and Latin America. FBI Director James Comey and other counterterror officials have publicly expressed concern about extremists in the United States using such techniques to elude monitoring.
“We’ll be monitoring a couple of guys in an internet chatroom,” a former FBI counterterror official said in an interview. “Then you’ll see one of them says: 2018OK, reach out to me on WhatsApp.’ At that point, we can’t do anything.”
Executives at WhatsApp and Telegram defend encryption as a vital shield to privacy. Reached for comment last week, a spokesperson at WhatsApp said the company complies with U.S. laws requiring cooperation with law enforcement agencies. The spokesperson cited a statement by executives in April when WhatsApp implemented “end-to-end” encryption that will conceal the content of users’ communications even from the company itself.
“Encryption is one of the most important tools governments, companies, and individuals have to promote safety and security in the new digital age,” said Jan Koum, the company’s founder, in a blog post in April. “While we recognize the important work of law enforcement in keeping people safe, efforts to weaken encryption risk exposing people’s information to abuse from cybercriminals, hackers, and rogue states.”
(Facebook, which owns WhatsApp, announced Friday that it would add end-to-end encryption for some photo and text messages on its Messenger application.)
Telegram did not respond to a request for comment for this article last week. But company executives have publicly addressed concerns about encryption by saying that technology comes with an inevitable dark side. The company says it has shut down more than 660 public channels on its application that were being used by the Islamic State.
Intelligence officials say the Islamic State’s failure to launch Paris-style attacks in the United States reflects differences in both geography and demography. American Muslims are less radicalized and less numerous than those in Europe, and U.S. border security makes it harder for would-be terrorists to enter the country, according to Western counterterror officials.
In Europe, the Islamic State has found support in large and restive Muslim communities, especially among criminals who radicalize more rapidly today than previous generations of hoodlums-turned-jihadis. Investigators say intensified Western military pressure in Iraq and Syria has prompted the group to order European recruits to strike immediately rather than make the pilgrimage to the caliphate.
“In the context of the current strategy of the Islamic State, it’s clear that their focus is causing casualties here,” said Claudio Galzerano, commander of a counterterrorism unit of the Italian police.
The ISIS strategy toward the West has evolved since the Islamic State conquered a swath of territory in Syria and Iraq and declared the caliphate two years ago, causing thousands of militants to flock to Syria.
Previous generations of aspiring jihadis passed through a series of filters as they journeyed to al-Qaida training camps in South Asia, often with a first stop at radical mosques in London. This selective, secretive approach allowed