Terrorist e-mail dodge revealed

The New York Times MADRID, Spain — One of the leading figures indicted in the March 11, 2004, train bombings in Madrid used a simple trick that allowed him to communicate with his confederates on ordinary e-mail accounts but still avoid government detection, according to the judge investigating the case.

Instead of sending the messages, the man, Hassan el Haski, saved them as drafts on accounts he shared with other militants, said papers issued by the judge, Juan del Olmo. They all knew the password, so they could access the accounts to read his unsent notes and post replies the same way, the judge said. This way, the notes left less of a digital trail that the government could track.

Intelligence officials have said in the past that some terrorist groups were using the method, which investigators call a "virtual dead drop." But few concrete examples had come to light until now, and its possible use in such a major attack, along with the wide circle of contacts that Haski maintained, officials say, raises the possibility that it is much more widespread among terrorists than previously thought.

Few details of this use of e-mail accounts were given in a lengthy indictment that was released to news organizations this month naming 29 suspects, most of them North African, in connection with the Madrid attack. But because of testimony from one of the suspects, the government now contends that such shared accounts were apparently used by the conspirators as early as late 2003.

"This is probably a common method of communication among jihadists in Europe," said Javier Jordan, the director of the Center for Security Studies and Analysis at the University of Granada.

"Haski is a person who traveled a lot and had lots of contacts," Jordan said. "If he used this method, a logical interpretation is that many others did, too."

The indictment includes testimony from a man named Attila Turk, a native of Turkey who was arrested on terrorism charges in France in 2004. Turk was trying to flee Europe after the Madrid bombings, fearing arrest. He asked Haski for help, he testified.

"Hassan had given me an address on the Internet the day that I left," the indictment quotes Turk as testifying. "I was to check the Internet address in question every day and to go to the draft menu to check for messages."

"The only way to get in touch with him was through the e-mail address Babana12002 with password Wahd11," Turk said. "Hassan told me that the address worked in Yahoo or in Hotmail."

Spanish investigators contend that by saving the messages as drafts, the men did not leave the digital traces that are normally created when e-mail messages are sent, and can often be traced by law-enforcement agencies.

Jordan said he was skeptical that the authorities were as unable as they claimed to track unsent messages. "There is still communication between the computer and the server," he said. "I wouldn't be surprised if the intelligence services have a way of monitoring that."

Haski, 42, a Moroccan who has lived in Belgium, is portrayed in the indictment as one of the three main conspirators who helped bombers carry out the Madrid attacks, which killed 191 people. He was arrested in the Canary Islands nine months after the bombings, and his trial is to begin next spring.

Before his arrest, Spanish investigators said, Haski was a top leader of a terrorist network described as having broad contacts in Europe and Morocco and many ties to the Madrid suspects. The network, the Moroccan Islamic Combatant Group, is described in the indictment as the "supreme point of reference for the Salafist Jihadist Movement in our country." That refers to the followers of an extremist interpretation of Islam.

The indictment also says the group has sent "a large part of its militants to join the ranks of the insurgency in Iraq" and "constitutes the principal concern regarding the end of the conflict and the return of the volunteers to Europe and Morocco."