At 3.55 p.m. on October 19, 2005, a squad of anti-terrorist police rang the doorbell of a ground-floor apartment in the Bosnian capitol of Sarajevo. The door was opened by Mirsad Bektasevic, a 19-year old Bosnian native who had spent most of his life in Sweden, and who held a Swedish passport. According to an official English translation of a Bosnian indictment, the police showed Bekasevic a search warrant and their ID cards, but Bektasevic refused to move out of the doorway and allow them in. Then he started trying to push one of the officers back out the door, exclaiming: “Who are you to search my house, you trash.”
Police subdued Bektasevic and barged into the apartment. Inside, they found Bektasevic’s room-mate, a Dane of Turkish extraction named Abdulkadir Cesur, sitting on a sofa with his hand under his coat. Police moved to wrestle the coat off Cesur, at which point they discovered he had in his hand a pistol with a silencer. Cesur’s finger was on the trigger and a bullet was in the chamber. Police knocked the pistol out of Cesur’s hands and wrestled him to the floor. Their search of the apartment proved productive: among items discovered were a home-made “suicide belt,” a quantity of factory-made explosives and a Hi-8 videotape with footage demonstrating how to make a home-made bomb. The tape included this bloodcurdling voiceover: “Here, the brothers are preparing for attacks…These brothers are ready to attack and inshallah, they will attack al-Qufar who our killing our brothers and Muslims in Iraq, Afghanistan…and many other countries. These weapons are going to be used against Europe, against those whose forces are in Iraq and in Afghanistan…” Subsequent analysis by Britain’s Home Office determined that the voice on the tape was “more than rather likely” that of the suspect Mirsad Bektasevic.
Within a day or two of the Bosnia arrests, police in Britain had staged their own, related, series of arrests. Two London men were arrested on terrorism related charges, which included allegations that they were in possession of computer images showing how to make car bombs and "martyrdom operations vests." One suspect, Younis Tsouli, was also charged with possessing computer images of "a number of places" in Washington, D.C. (A third suspect faced terror-funding charges.) Counterterrorism officials in the United States and Britain told NEWSWEEK at the time that the evidence suggested some of those connected with the U.K. suspects may have been targeting the White House and Capitol complex for attacks using homemade bombs. As we reported at the time , the British suspects were believed to have been in e-mail contact, via Hotmail accounts, with a suspected jihadist recruiter who used the Internet nom de guerre Maximus. According to the officials, Maximus was initially based in Sweden and moved to Sarajevo, where investigators believe he helped run a network recruiting European youth to go to Iraq.
Private researchers, as well as counterterrorism officials in both the United States and the United Kingdom, subsequently alleged that the Sarajevo suspect from Sweden, Bektasevic, was the suspected jihadist recruiter who went by the name of Maximus (who Bosnian authorities say, in turn, was in contact with a militant imam in Denmark named Abdul Basit). According to the Bosnian indictment, documentation acquired during the raids in Sarajevo and London also indicated that Maximus and London suspect Tsouli (and one of Tsouli’s co-defendants) were discovered to have been in possession of both Swedish and Bosnian telephone numbers which Maximus had used.
U.S. and U.K. officials now acknowledge that the arrests in London and Sarajevo were part of a wide-ranging terrorism investigation that has spread to North America, including both the United States and Canada. The officials say the terror network exposed by the investigation appears to be an archetypical model of the post 9/11, post Iraq-invasion of what Al Qaeda has morphed into: a widely dispersed movement of radicalized, alienated Muslim militants, most of them youthful, who have essentially become self-recruiting, self-indoctrinating, self-training microcosmic cells of what was once a centrally-directed movement. While there are indications, for example, indicating that Maximus and his co-defendant were involved in recruiting fighters for Iraq, and intended to use their home-made terror gear to mount an attack against a European target linked to the Iraq war, there is no evidence that their recruitment, planning, or indoctrination in any way was directly linked to Al Qaeda or what remains of Osama bin Laden’s central command. There is some evidence, U.S. and U.K. officials indicate, of at least indirect contact between members of the network and Zarqawi’s organization in Iraq, though the precise nature and closeness of these contacts is unclear.
U.S. and European investigators say that the organizational model for the Internet-based Al Qaeda network of Maximus and the London suspects also tracks how two of Europe’s most notorious recent terror attacks--the 2004 Madrid commuter train bombings and last summer’s London tube and bus bombings--were planned. In both of those cases, authorities said, local extremists, perh aps with some tentative, but mysterious contacts to Pakistan or elsewhere in the Islamic world, managed to recruit themselves, brainwash themselves, and arm themselves for a series of deadly bombings.
What’s particularly scary about this model, investigators say, is that it means would-be jihadists can be out there pecking away at their computer keyboards, watching footage from Iraq on TV and their monitors, working themselves into a lather, and downloading instructions on how to make home-made bombs--all without having any contact with other known terrorists or even radical mosques, and all in the privacy of their own homes. It’s an enemy much more difficult to detect, and much more potentially pernicious, than the model established by flamboyant and publicity conscious Al Qaeda leaders like bin Laden and the late Zarqawi.
Another development worrying investigators is the considerable technical expertise, both in computers and weapons, that the new cyberspace jihadis are perfecting. Earlier this year, both official investigators and private anti-terrorism investigators, including researchers for the Anti-Defamation League of B’nai Brith and for the SITE Institute, an East-coast group led by terror investigator Rita Katz, made a further breakthrough: they identified the London suspect Tsouli, the man with the Washington DC pictures on his computer, as a notorious Islamic computer hacker who went by the login “Irhabi007” -- “irhabi” being an Arabic word for “terrorist.” According to a paper produced by SITE , Irhabi 007 had become known as an "infamous hacker whose teaching and contributions to the jihadi Internet community reigned unparalleled." Among the Internet operative's feats, the institute said, were the successful dissemination of "violent material" including weapons manuals, recruitment videos and gruesome beheading videos made by Iraqi insurgents. According to SITE, when Zarqawi's Iraqi group posted its very first Internet communiqué, Irhabi007 was the first to respond online to the message after it was posted. (NEWSWEEK first reported Irhabi007’s story back in March but was asked at the time by U.S. authorities not to mention the login "Irhabi007" due to continuing investigations.)
Last summer, the ADL claimed in a report, Irhabi also began to steal credit card and other identifying information and then used this info to buy space on Web servers. But SITE’s Katz said last week that it was his use of purloined credit-card information that ultimately led the authorities to figure out Irhabi’s real identity. Credit card data recovered from Tsouli's residence provided the key evidence that led investigators to believe that Tsouli was almost certainly the real person behind Irhabi007.
When the information first surfaced that the suspect now believed to be Irhabi had material on his London computer which included pictures of the White House and US Capitol, U.S. officials sharply discounted the possibility of an active threat to either of the Washington landmarks or any other U.S. target. Some evidence began to seep out earlier this year, however, that the threat to North America might have some substance. In March, according to U.S. court documents, U.S. authorities sought and later arrested two young men from the State of Georgia, one of Pakistani extraction and the other from Bangladesh, on terrorism support charges. According to an FBI affidavit, in March 2005, the two men, Syed Ahmed and Ehsanul Sadeeque, traveled to Canada to meet several men who were the target of an ongoing US government investigation.
During a series of interviews with government investigators, the affidavit says, Ahmed acknowledged that while in Canada, he and Sadeeque met with at least three men under investigation by the FBI for international terrorism. In these meetings, the document says, the suspect acknowledged that he, Sadeeque “and the others discussed strategic locations in the United States suitable for a terrorist strike to include oil refineries and military bases. They also plotted how to disable the Global Positioning System in an effort to disrupt military and commercial communications and traffic.” They also discussed going to Pakistan for paramilitary training. Subsequently, according to the SITE Institute’s Katz and a U.S. counter-terrorism official, investigators learned that the video of Washington landmarks found on Irhabi’s computer in London had in fact originally been recorded by Sadeeque on a visit to the U.S. capital. Sadeeque’s family has protested his innocence; Ahmed’s lawyer reportedly has declined to comment.
The extended network took on a truly menacing character 10 days ago with the arrest by Canadian authorities of 17 men, including five juveniles, on terrorism-related charges. Though the published charges were vague, a lawyer for one of the suspects said at a preliminary court hearing near Toronto last week that the prosecutors had provided him with a summary of evidence which alleged that his client, a restaurant worker named Steven Chand, talked about a plot to storm the Canadian Parliament in Ottawa, take politicians hostage, and demand the withdrawal of Canadian troops from Afghanistan and the release of terrorism suspects from Canadian prisons. If the demands were not met, according to the summary, the plotters would then start killing hostages. Chand's lawyer, Gary Batasar, said prosecutors believed his client had a particular interest in beheading Canada’s Prime Minister, Stephen Harper.
Subsequent accounts of what was in the government summary indicated that the talk of beheading may have been bravado . But there were more serious allegations in the document, according to several Canadian media accounts, which were confirmed by U.S. counter-terrorism officials with access to reports on the investigation. First of all, the prosecution document alleged--and public charges partially confirmed --that the suspects were believed to have participated in an alleged terror training camp staged at a remote rural location north of Toronto last December. (The suspects allegedly chose the Christmas season because they believed there was less chance of them being spotted).
After the training camp--and possibly because some of the people who attended it were not happy with the results--the initial group of jihad-minded individuals split in two. One faction, according to news reports and official sources, allegedly plotted multiple truck bomb attacks on targets in the Toronto area, including the local office of Canadian Intelligence and the Toronto Stock Exchange. The other faction allegedly planned to stage a shooting attack either on a Toronto street crowd or on a crowd in a food court in a shopping center. The FBI put out a written statement saying that there was evidence that the U.S. suspects, Ahmed and Sadeeque, during their visit to Canada last year, had been in touch with some of the Toronto suspects.
Canadians will probably never know whether the plot would have really got off the ground. In any case, the drop-out and misfit backgrounds of most of the suspects raised questions as to how effective they would have been as jihadi fighters. But last year’s July 7 London tube and bus bombers were mostly from similar backgrounds, and they got their motivation, training, and possibly even their bomb making instructions either from the internet or from contacts in Pakistan, according to official British accounts. Abu Mussab al-Zarqawi may have been one of the first big-time jihadis to make his reputation over the Internet; now the spores spread through cyber-space are spawning dangerous, yet often undetectable, jihadi cells around the globe.