#Snowman Series 7 –The Changing Face Of Terror
Russia and the far-right have aligned internationally, working in a complex network to undermine democracy and the stability of western powers. Working together they deploy state of the art techniques to hack data, emotionally control electorates, and spread disinformation.
Over a period of years, they have gained control of geopolitics and the financial markets through a labyrinth of connections and companies.
Understanding this raises more questions than it answers, especially when the changing face of terrorism is considered.
The greatest unanswered question is: has this global operation played an active role in terror attacks aimed at the democracies they are targeting?
There is no firm answer, but the flags are up.
“The greatest unanswered question is: has this global operation played an active role in terror attacks aimed at the democracies they are targeting?”
In 2000, almost all terror attacks across the world involved the use of bombs. Non-complex, explosive devices.
Between 2006 and 2013 the number of terrorist attacks across Europe dropped significantly, including in the highest volume category – separatist violence.
During this time the number of arrests increased, as countries introduced updated surveillance and counter-terrorism strategies. The largest increase in arrests related to religious terrorism offences.
While there is an argument that efforts of the authorities and the airline industry restrictions on liquids have had an impact, the fact remains that bomb making materials are still broadly available across Europe. As this investigation found in Sweden, ex-military explosive stock is readily available and in active use, and the Brussels bombing underlines the point.
2015, however, saw a significant shift in the style of attack – the method turning to the use of vehicles to mow down pedestrians.
When you start to probe these new attacks, set in the context of the development of a global operation with an extensive disinformation network - which has claimed to be ISIS in cyber-attacks – the change takes a different hue.
This can also be held up for scrutiny against the quick responses of Alt-Right media sites (and even Donald Trump) who have presumptively claimed incidents as being ‘Terrorism’ often within minutes of the attacks taking place, and use the events to drive their own viral messages through their complex channels.
These narratives have been exploited to the advantage of the far-right political parties, often during campaigns, and those parties are clearly linked to Russian destabilisation operations.
“When you start to probe these new attacks, set in the context of the development of a global operation with an extensive disinformation network - which has claimed to be ISIS in cyber-attacks – the change takes a different hue.”
The lesser known of the vehicle attacks took place in Nantes on the on the 22nd of December 2014, and in Dijon the day before.
Sébastien Sarron ran over ten pedestrians at the Christmas market of the French city of Nantes in a van, then attempted suicide with a bladed weapon. Ten people, including the suspect, suffered non-fatal injuries and one person died. French Interior Minister Bernard Cazeneuve is on record as saying the attacker was "unbalanced."
While there were some reports at first Sarron had shouted “Allahu Akbar”, police stated a notebook in his van contained "incoherent suicidal phrases" and set out fears of “being murdered by the secret services.”
Sarron was an alcoholic French farmer, drunk at the time of the attack, and killed himself in his cell in April 2016.
The incident was immediately preceded on the 21st of December 2014 in Dijon, when a was arrested after a vehicle-ramming attack in which he drove into pedestrians in five areas of the city in the space of half an hour. Two people were seriously injured.
The forty-year-old man was known to the police for minor of offences committed over the course of twenty years, and had repeatedly been treated for “serious and long-established psychiatric issues”. The local prosecutor said the incident was not linked to terrorism.
The New York Times reported speaking to the city prosecutor, who said the driver became “'very agitated' at home after watching a television program about the plight of children in Chechnya.”
The next attack took place on Bastille Day, the 14th of July 2016, in Nice.
French investigators identified the perpetrator – who was killed during the incident - as Mohamed Lahouaiej-Bouhlel, a 31-year-old man of Tunisian nationality.
He was born in Tunisia but held a French residency permit and lived in Nice where he married a French-Tunisian cousin with whom he had three children. His parents still live in Tunisia and state they rarely heard from him since the move to France in 2005.
Lahouaiej-Bouhlel’s father has stated that the attacker underwent psychiatric treatment before he moved to France and, according to his wife's lawyer, he was repeatedly reported for domestic violence. He was known to French police for five criminal offences including threatening behaviour, violence, and petty theft.
François Molins, the prosecutor leading the inquiry into the possible involvement of organised Islamist terrorism, has made clear there was no link to Islam except in a very short period before the attack and referred to the attacker as "a young man completely uninvolved in religious issues and not a practising Muslim, who ate pork, drank alcohol, took drugs and had an unbridled sex life."
Lahouaiej-Bouhlel regularly sent small sums of money to his family in Tunisia, but only days before the attack persuaded friends to smuggle bundles of cash worth 100,000 euros to his relatives.
In the immediate aftermath of the attack social media was virally attacked with false claims of hostage situations, a double attack showing images of the Eiffel Tower exploding, claims of a further attack in Cannes, and images of unrelated persons being named as victims and suspects.
Marine Le Pen, currently in the last round of the French elections, condemned immigration and government policy in response to the attacks.
“Lahouaiej-Bouhlel regularly sent small sums of money to his family in Tunisia, but only days before the attack persuaded friends to smuggle bundles of cash worth 100,000 euros to his relatives.”
On the 19th of December 2016, another truck was deliberately driven into the Christmas market at Breitscheidplatz in Berlin, leaving 12 people dead and 56 others injured. The truck's original driver, Łukasz Urban, who was found shot dead in the passenger seat.
The suspect, Anis Amri - a failed asylum seeker from Tunisia - was killed in a shootout with police near Milan four days later.
Amri fled from Tunisia to escape imprisonment for stealing a truck and arrived for the first time in Europe in 2011 on a refugee raft at the island of Lampedusa.
According to reports he lied about his age, pretending to be a minor, and was sent to the temporary migrants reception center on the island where, according to Italian security officials, he "took part in a particularly violent riot, when the center was set on fire and several people were injured." He was subsequently imprisoned for four years for this and robbery. Amri was released in 2015 and it is believed he went to Germany at this point.
In Tunisia, Amri was sentenced in absentia to five years in prison, "reportedly for aggravated theft with violence” and had been arrested several times for possession and use of drugs. According to his family, he drank alcohol, took drugs and was initially not religious.
His autopsy found that he frequently consumed drugs.
In Germany he was involved in a bar brawl, drug dealing, and a knife attack over drugs in July 2016. He disappeared after police tried to question him.
While Moroccan intelligence warned Germany about an attack planned by Amri, and they did monitor him in Berlin, he showed no signs of planning a terrorist event according to official reports submitted to the German Interior Minister.
National and international right-wing politicians and commentators blamed the attack partly on German Chancellor Angela Merkel and her policy of accepting an unlimited number of asylum seekers and migrants. The groups also condemned the lack of border checks under the EU Schengen system for allowing the perpetrator to travel freely through several countries after the attack.
“While Moroccan intelligence warned Germany about an attack planned by Amri, and they did monitor him in Berlin, he showed no signs of planning a terrorist event according to official reports submitted to the German Interior Minister.”
Only days before I travelled to Sweden to investigate crime and immigration, on the 7th of April 2017, a hijacked truck was deliberately driven into crowds along Drottninggatan (Queen Street) in Stockholm.
The suspect, Rakhmat Akilov, a 39-year-old rejected asylum seeker from Uzbekistan, was apprehended the same day and admitted carrying out the attack at a pre-trial hearing on the 11th of April.
Säpo (the Swedish intelligence service) have stated they received some information on the suspect, but were unable to confirm it when they followed up on it. They reportedly deemed him a "marginal figure" on the fringes of extremist groups.
Akilov arrived in Sweden on the 10th of October 2014 and claimed asylum, saying he needed refuge from "the Uzbek security services which he claims tortured him and accused him of terrorism and treason". Uzbekistan remains closely tied to Russia.
Sweden's Migration Board ruled against Akilov and he was ordered to leave the country within four weeks. He failed to do so voluntarily and did not appear at the Swedish Migration Agency when called, so the case was referred to the police but he went on the run.
Akilov was registered at the same address as another person with links to financial crime where a number of people were convicted of false accounting and severe tax crimes. He was also linked to Chechnya and a facebook group which aimed to expose the "terrorism of the imperialistic financial capitals."
The Swedish far-right was accused of trying to profit from the attack, producing fake news and circulating fake quotations online. This included tweets and social media posts from officials of the Sweden Democrats.
Among all of the suspects, from France, to Germany, to Sweden, the common points are easy to identify: criminal offending histories, limited or no links to terrorism – even under surveillance – and mental health issues. In two cases there are links to suspicious finances and two direct links to Chechnya.
“Among all of the suspects, from France, to Germany, to Sweden, the common points are easy to identify: criminal offending histories, limited or no links to terrorism – even under surveillance – and mental health issues. In two cases there are links to suspicious finances and two direct links to Chechnya.”
I have purposefully avoided all reference to ISIS and ISIL to distil the facts as they are.
With almost all suspects killed before questioning, and almost every single connected person arrested released without charge, the evidential links are almost entirely reliant on internet searches.
In respect of online radicalisation, some claims of responsibility and activity reported to have been the work of ISIS have been traced back to Kremlin linked hacking group APT28.
In April 2015, France's TV5Monde network was knocked off air for around 18 hours in the aftermath of a hack attack which also led to the hijack of the agency’s website and Facebook page.
The attackers, who identified as the "CyberCaliphate", also leaked documents they claimed were ID cards of French soldiers involved in anti-ISIS operations. Initially the hack was attributed to sophisticated hackers ideologically aligned to ISIS.
French investigators later announced the attack was carried out by Russia-based hackers. Sources close to the investigation and TV5 Monde’s president told France 24 “the finger of blame” pointed at Russia, confirming a report by L’Express.
This conclusion is supported by findings from security vendors FireEye and Trend Micro.
Computer malware and scripts featured in the attack were typed on a Cyrillic keyboard and were compiled during office hours in Moscow and St. Petersburg. The threats against the families of French soldiers serving overseas and other jihadist propaganda also contained numerous grammatical mistakes.
The group, reports say, also “targeted the computer systems of Nato members, Russian dissidents and Ukrainian activists.”
FireEye’s security experts said the “website which published leaked information was hosted on the same IP block as other APT28 infrastructure, and used the same name server and registrar that FireEye has seen APT28 use in the past.”
"We suspect that this activity aligns with Russia’s institutionalized systematic “trolling” – devoting substantive resources to full-time staff who plant comments and content online that is often disruptive, and always favourable to President Putin.”
President of FireEye, Richard Turner, said "what we already suspect is that the group is sponsored by the Kremlin. We now also believe that ISIS was a decoy and APT28 was actually responsible for the attack on TV5Monde. Russia has long history of using information operations to sow disinformation and discord, and to confuse the situation in a way that could benefit them."
"The ISIS cyber caliphate could be a distraction tactic. This could be a touch run to see if they could pull off a coordinated attack on a media outlet that resulted in stopping broadcast and news dissemination. We have been watching APT28’s infrastructure very closely and have seen them target other journalists around the same time as the TV5Monde attack," he added.
If state-sponsored actors can hack under this guise for this purpose, it’s a credible threat that they may be hosting radicalisation operations too.
“Computer malware and scripts featured in the attack were typed on a Cyrillic keyboard and were compiled during office hours in Moscow and St. Petersburg.”
On the 22nd of March 2017, a terrorist attack took place in Westminster.
The attacker, 52-year-old Briton Khalid Masood, drove a car into pedestrians on the pavement along the south side of Westminster Bridge and Bridge Street, injuring more than 50 people, killing several.
After the car crashed into the perimeter fence of Parliament grounds, Masood abandoned it and ran into New Palace Yard where he fatally stabbed an unarmed police officer. He was then shot by an armed police officer and died at the scene.
Though the attack was instantly attributed to Islamic terrorism by right-wing figures and media outlets across the world, Police have found no link with any terrorist organisation.
Born Adrian Russell Elms, the attacker later changed his name to Adrian Russell Ajao then to Khalid Masood after he converted to Islam. Police said he also used several other aliases, including Khalid Choudry. His background matches the French and German suspects and his profile is otherwise atypical - most jihadi terrorists are under 30, while he was 52.
When he was 16, he dropped out of school and by 18 he was described as a heavy cocaine user. In 2000, he was sentenced to two years in prison for grievous bodily harm after a knife attack in a public house in Northiam in Sussex. In 2003, he was sentenced to a further six months in prison for possession of an offensive weapon following another knife attack in Eastbourne in Sussex. As well as these two prison terms, Masood had convictions for public order offences going back to 1983.
Analysts monitoring Islamic State activity online said claims of responsibility appeared to be an effort to mask losses in Iraq and Syria, adding that “the lack of biographical information on the attacker and lack of specifics about the attack suggested it was not directly involved.”
Neil Basu, Deputy Assistant Commissioner of the Metropolitan Police and Senior National Coordinator for UK Counter-Terrorism Policing, announced that investigators believed Masood acted alone, adding: "there is a possibility we will never understand why he did this.”
Westminster fits the exception pattern of the other events.
“Analysts monitoring Islamic State activity online said claims of responsibility appeared to be an effort to mask losses in Iraq and Syria, adding that “the lack of biographical information on the attacker and lack of specifics about the attack suggested it was not directly involved.”
These attacks have helped drive the disinformation narrative, feeding right-wing politicians and false reports such as those which led me to Sweden in the first place -the very same investigation which exposed the previously missing links in the chain which definitively connects Russia and the far-right.
The change in the pattern of the terror incidents and the surrounding information suggest something very drastic has changed. Not just in the method, but in the suspects too. Petty criminals, drug users, often with mental health issues and who can’t be directly linked to terrorism.
False flags have been broadly admitted in the past – actions used to justify another end – and large payments of cash, such as those made in Nice, are not associated with the acts of radicals.
And, more to the point, Daesh has been losing financial ground for years. By February 2017, Alessandro Pansa, Director General of the Department of Information Security for the Italian Council of Ministers, said: “ISIS has significantly retreated. Its sources of revenue, primarily smuggling oil products and antiquities, are at the edge of drying out.”
Russia, at the heart of everything else we are witnessing, is no stranger to deploying black operations tactics.
In September 1999, Russia saw ‘the apartment bombings’ which killed 293 people and injured more than 1,000. Together with the Dagestan War, the bombings led the country into the Second Chechen War.
Explosions happened at Buynaksk on the 4th of September, Moscow on the 9th and 13th, and Volgodonsk on the 16th. An explosive device similar to those used in these bombings was found and defused in an apartment block in the Russian city of Ryazan a week later.
On the day after the last bomb was found, Vladimir Putin ordered the air bombing of Grozny, which marked the beginning of the Second Chechen War.
According to the Moscow City Court, the bombings were acts of terrorism organised and financed by the leaders of armed group the Caucasus Islamic Institute yet, thirty-six hours after this announcement, three FSB agents were arrested by the local police for planting the Ryazan explosives.
The incident was declared to have been a “training exercise” and the agents were released on Moscow's orders.
Yury Felshtinsky, Alexander Litvinenko, Boris Berezovsky, David Satter, Boris Kagarlitsky, Vladimir Pribylovsky, and the secessionist Chechen authorities claim the the 1999 bombings were a false flag attack coordinated by the FSB in order to win public support for a new full-scale war in Chechnya – which boosted the popularity of former FSB director Putin.
The pro-war Unity Party succeeded in the subsequent elections to the State Duma and helped Putin attain the presidency within a few months.
The MP Yuri Shchekochikhin filed two motions for a parliamentary investigation of the events, which were rejected and a public commission to investigate the bombings was rendered ineffective by the government's refusal to respond to its inquiries.
Two key members of the Kovalev Commission, Sergei Yushenkov and Yuri Shchekochikhin, have since died in apparent assassinations and Litvinenko’s death is probably the most famous execution of a spy in history – he was poisoned with radioactive material in London, and the public inquiry concluded the FSB killed him, and probably on the direct orders of Putin himself.
Could it be possible that the changed face of terror in Europe is the darker side of the global destabalisation operation? What if ISIS, as it’s currently understood, is only as real as the Cyber Caliphate?
While there is no decisive or definitive evidence available, we are left facing a very credible “what if?”