A snapshot of the intelligence cyber-war

As the Internet begins to take center stage as the new focus of the battleground of terrorism, the position of the jihadi forums has been the subject of speculation. Some analysts have pointed to the wave of Internet site closures following the July 7 attacks on London as evidence of British intelligence getting to grips with a source of radicalization, akin to the role played by outspoken Islamist preachers in the United Kingdom.

An interesting illustration of the intelligence cyber-war comes from communications concerning the al-Qal’a jihadi site [www.qal3ati.net], associated with the Saudi Islamist dissident, Saad al-Faqih. Al-Qal’a achieved notoriety of sorts when it was the first forum to carry a posting by the “Secret Organization Group, Organization of al-Qaeda in Europe” claiming responsibility for the July 7 bombings. A few hours later, after it had been closed down, the administrators posted an explanatory notice that read: “It appears that, after the London bombings, the situation has changed. We no longer feel that the site is safe, particularly when things concern Western governments.”

The notice then goes on to state that after the Secret Organization Group claim was aired by the media “we received a letter from the company saying we had broken the agreement with them, and that we had to depart as soon as possible.” A subsequent note mysteriously appeared to cancel this, explaining that the temporary loss of the site was due to a “technical fault”. While seeking to reassure its participants that “Western security services … are not concerned with peoples’ criticisms of this or that government, but are interested in knowing the source of the [London bombing] posting,” the administrators indicated that the postings database and private members’ registrations had meanwhile been copied and transferred to a new server [www.qal3ati.net].

Its tale does not end there. On August 3 the Tajdeed jihadi forum (which also suffered a temporary suspension) posted “A Warning to all Members of the al-Qal’a forum.” It noted that while the al-Qal’a forum is still closed, “fake messages are being sent to your addresses purporting to be from the al-Qal’a forum” and which “invite you to enter [one of the] al-Qal’a site addresses, but the site which you enter is not Qal’a, but a spy site. This pinpoints where you are communicating from and your country (and God knows what else) and, after it has obtained what it needs from you, informs you that your account has been closed. Messages have been sent to all the addresses where the brothers were registered on the al-Qal’a, since the database was copied by Scotland Yard … Beware, brothers, of opening up on the links [being] sent!” [www.tajdeed.org.uk].

Internet forums have been an invaluable source for intelligence services hoping to gain insight on latest opinions and ideological discussions, determining trends and possible warning signs of impending activity. However, the cyber-war is a constantly changing environment as the forum administrators increase the mobility and sophistication of their sites, introducing password protection systems to protect identities and remain anonymous. Public exposure, of the type that al-Qal’a suffered, is very damaging to a forum’s prospects, since the increased readership traffic sooner or later ends with complaints dispatched to the site hosting company, which fears the negative publicity. However, the on-again, off-again al-Qal’a experience may reflect the value such a resource, alive rather than dead, retains for intelligence services.