Intelligence War Breaks out on the Jihadi Forums
By Stephen Ulph
A battle royal appears to have erupted on the jihadi forums related to the arrests of 40 mujahideen in Saudi Arabia, and the suspicions of the role played by the al-Hesbah forum in the arrests. On March 7, Terrorism Focus highlighted how there were murmurings of Saudi penetration of the famous al-Hesbah website in view of the swift arrest of the attackers of the Abqaiq (Buqayq) oil facility in February. The jihadi site al-Hesbah has hitherto been considered by the mujahideen to be the premier source from which many jihadi forums subsequently distribute materials. The Abqaiq arrests, however, followed by the more recent arrest of 40 mujahideen, have increased suspicions that the site is heavily penetrated by Saudi security, or that indeed it operates on its behalf (Terrorism Focus, April 4).
In mid-March, a further impetus to suspect al-Hesbah was voiced by members of the Tajdeed jihadi forum (http://www.tajdeed.org.uk), who blamed the site for the arrest of the infamous cyber-mujahid Irhabi007, also known as Younis Tsouli, by British intelligence last October. Irhabi007 had been hunted for two years as an al-Qaeda webmaster and the suspected source of many of the al-Qaeda declarations posted on the net. With his close links to al-Qaeda, his arrest is considered an important event in the struggle against jihadi sites. Members also wondered aloud how the report by the Society for Internet Research (SOFIR), analyzing the readership of the al-Hesbah site, could have been compiled without inside collaboration. Some of these suspicions focused around the fact that al-Hesbah's administrators requested that applicants for registration provide their country of origin, and rejected the applicants' use of proxies to disguise their personal details; these requests are unusual for a jihadi forum. There were also concerns that there was an unusual concentration of a single nationality—Jordanians—on the administration staff and that this surely opened up the possibility of security penetration.
The pace of events then accelerated on news that two of these, the "poet" of al-Qaeda Muhammad al-Zuhayri and Muhammad Tamallat, had been exposed as agents and hastily expelled from al-Hesbah. Almost immediately, a notice appeared on the al-Hesbah site stating that the forum was suspended. This was explained, on March 26, by an anonymous posting on Muntada al-Jihad (http://shahid.cjb.net): "The real reason was that members had discovered that it was penetrated by intelligence. As soon as postings arrived on this, the administrators closed the forum. It is clear that Muhammad al-Zuhayri, otherwise known as al-Mu'tazz bi-Tawheedih, leads a cell spying on readers and members of the forum, financed by Jordan and Saudi Arabia." The posting went on to say that three other forums, al-Buraq, al-Mohajeroon and al-Firdaws, were also under suspicion of being under the control of government intelligence agencies.
Four days later, mujahideen readers of the forums were shaken by a report by the pan-Arab al-Quds al-Arabi that notable Saudi dissident Sheikhs Saad al-Fagih and Abu Majid had added their weight to the belief of the site's penetration, and that this was indeed one of the reasons for the early capture of the militants involved in the Abqaiq attack. Al-Fagih also claimed that there were several jihadi forums penetrated by intelligence services and that via this method the Saudis had come to know that jihadi cells were planning to target members of the ruling family (al-Quds al-Arabi, March 30). The director of the Tajdeed forum, Saudi dissident Dr. Muhammad al-Mas'ari, also indicated that forum penetration was the primary reason for the arrests of the attackers of the Abqaiq facilities, pointing to the mere six hours separating their posted claim to the attack and their subsequent arrest (Terrorism Focus, April 4).
On March 31, one of the suspect sites, al-Mohajeroon, countered with a posting supporting the positive role played by al-Hesbah, arguing "the decision to close it was only due to the arrests which had befallen its team, which for security reasons this statement will not go into…We appeal to members to defend the honor of their brothers, and to continue on the path of jihad" (http://www.mohajroon.com). Expressions of confusion and distress permeated the forums. How was it, therefore, that al-Hesbah was also posting bona fide declarations from jihadi groups? The analysis was fine-tuned: most of these concerned countries other than Saudi Arabia. "The al-Hesbah site," argued one member on March 30 on Tajdeed, "never promoted the jihad in the Arabian peninsula, and the publications they did post—on the [December 2004] attack of the Sariya al-Falluja on the U.S. Consulate—were naught but a deception to spy out the mujahideen and their helpers in the country" (http://www.tajdeed.org.uk).
"This is the greatest turmoil that has overcome the jihadi forums and the deepest penetration yet [by counter-intelligence]!" lamented one member on the Tajdeed forum. Others commented ruefully that the al-Hesbah site need not be singled out, "since all of the jihadi forums—even Tajdeed itself—have had their databases copied by U.S. intelligence and anti-Islamic forces." Even so, as one participant pointed out on April 3, the al-Hesbah debacle is unprecedented. Until now, espionage has been conducted via anti-jihadist websites. "That espionage should be conducted via websites actually calling for jihad and publishing their news…this has never happened before."
As significant figures such as Irhabi007 and the Abqaiq attackers continue to fall to counter-intelligence strikes, confidence in the internet forum as a means for mujahideen to circumvent state control of media and communications will be severely shaken. The administrators of the jihadi forums, for all the copious information they provide on proxies and identity concealment, may find this confidence difficult to restore.
A battle royal appears to have erupted on the jihadi forums related to the arrests of 40 mujahideen in Saudi Arabia, and the suspicions of the role played by the al-Hesbah forum in the arrests. On March 7, Terrorism Focus highlighted how there were murmurings of Saudi penetration of the famous al-Hesbah website in view of the swift arrest of the attackers of the Abqaiq (Buqayq) oil facility in February. The jihadi site al-Hesbah has hitherto been considered by the mujahideen to be the premier source from which many jihadi forums subsequently distribute materials. The Abqaiq arrests, however, followed by the more recent arrest of 40 mujahideen, have increased suspicions that the site is heavily penetrated by Saudi security, or that indeed it operates on its behalf (Terrorism Focus, April 4).
In mid-March, a further impetus to suspect al-Hesbah was voiced by members of the Tajdeed jihadi forum (http://www.tajdeed.org.uk), who blamed the site for the arrest of the infamous cyber-mujahid Irhabi007, also known as Younis Tsouli, by British intelligence last October. Irhabi007 had been hunted for two years as an al-Qaeda webmaster and the suspected source of many of the al-Qaeda declarations posted on the net. With his close links to al-Qaeda, his arrest is considered an important event in the struggle against jihadi sites. Members also wondered aloud how the report by the Society for Internet Research (SOFIR), analyzing the readership of the al-Hesbah site, could have been compiled without inside collaboration. Some of these suspicions focused around the fact that al-Hesbah's administrators requested that applicants for registration provide their country of origin, and rejected the applicants' use of proxies to disguise their personal details; these requests are unusual for a jihadi forum. There were also concerns that there was an unusual concentration of a single nationality—Jordanians—on the administration staff and that this surely opened up the possibility of security penetration.
The pace of events then accelerated on news that two of these, the "poet" of al-Qaeda Muhammad al-Zuhayri and Muhammad Tamallat, had been exposed as agents and hastily expelled from al-Hesbah. Almost immediately, a notice appeared on the al-Hesbah site stating that the forum was suspended. This was explained, on March 26, by an anonymous posting on Muntada al-Jihad (http://shahid.cjb.net): "The real reason was that members had discovered that it was penetrated by intelligence. As soon as postings arrived on this, the administrators closed the forum. It is clear that Muhammad al-Zuhayri, otherwise known as al-Mu'tazz bi-Tawheedih, leads a cell spying on readers and members of the forum, financed by Jordan and Saudi Arabia." The posting went on to say that three other forums, al-Buraq, al-Mohajeroon and al-Firdaws, were also under suspicion of being under the control of government intelligence agencies.
Four days later, mujahideen readers of the forums were shaken by a report by the pan-Arab al-Quds al-Arabi that notable Saudi dissident Sheikhs Saad al-Fagih and Abu Majid had added their weight to the belief of the site's penetration, and that this was indeed one of the reasons for the early capture of the militants involved in the Abqaiq attack. Al-Fagih also claimed that there were several jihadi forums penetrated by intelligence services and that via this method the Saudis had come to know that jihadi cells were planning to target members of the ruling family (al-Quds al-Arabi, March 30). The director of the Tajdeed forum, Saudi dissident Dr. Muhammad al-Mas'ari, also indicated that forum penetration was the primary reason for the arrests of the attackers of the Abqaiq facilities, pointing to the mere six hours separating their posted claim to the attack and their subsequent arrest (Terrorism Focus, April 4).
On March 31, one of the suspect sites, al-Mohajeroon, countered with a posting supporting the positive role played by al-Hesbah, arguing "the decision to close it was only due to the arrests which had befallen its team, which for security reasons this statement will not go into…We appeal to members to defend the honor of their brothers, and to continue on the path of jihad" (http://www.mohajroon.com). Expressions of confusion and distress permeated the forums. How was it, therefore, that al-Hesbah was also posting bona fide declarations from jihadi groups? The analysis was fine-tuned: most of these concerned countries other than Saudi Arabia. "The al-Hesbah site," argued one member on March 30 on Tajdeed, "never promoted the jihad in the Arabian peninsula, and the publications they did post—on the [December 2004] attack of the Sariya al-Falluja on the U.S. Consulate—were naught but a deception to spy out the mujahideen and their helpers in the country" (http://www.tajdeed.org.uk).
"This is the greatest turmoil that has overcome the jihadi forums and the deepest penetration yet [by counter-intelligence]!" lamented one member on the Tajdeed forum. Others commented ruefully that the al-Hesbah site need not be singled out, "since all of the jihadi forums—even Tajdeed itself—have had their databases copied by U.S. intelligence and anti-Islamic forces." Even so, as one participant pointed out on April 3, the al-Hesbah debacle is unprecedented. Until now, espionage has been conducted via anti-jihadist websites. "That espionage should be conducted via websites actually calling for jihad and publishing their news…this has never happened before."
As significant figures such as Irhabi007 and the Abqaiq attackers continue to fall to counter-intelligence strikes, confidence in the internet forum as a means for mujahideen to circumvent state control of media and communications will be severely shaken. The administrators of the jihadi forums, for all the copious information they provide on proxies and identity concealment, may find this confidence difficult to restore.
posted by Marko at 4/12/2006 09:53:00 AM
<< Home