1. Exquisite Tweets from @rcallimachi

    PreoccupationsCollected by Preoccupations

    1. Hello world, today I bring you a piece I've been working on for months about how ISIS "remote-controls" attacks: nytimes.com/2017/02/04/wor…

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    2. Plots in America, Europe, Asia have been described as work of Lone Wolves. Got my hands on intel docs showing they're not so lonely

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    3. A growing share of both successful & foiled plots were carried out by attackers being remotely coached by ISIS cyberplanners in Syria

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    4. What do I mean by a coached? In the most basic case, the ISIS handler acted as a confidante, egging the attacker towards violence.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    5. In the most involved, ISIS arranged for every aspect of the logistics to carry out murder, down to the bullets used to kill victims

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    6. Last summer in India, ISIS identified a group of men willing to carry out a suicide operation. But it's not easy to buy guns there.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    7. So what did ISIS do? A cyberplanner believed to be in Syria sent the cell the GPS coordinates of a location located 100s of miles away.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    8. The men made their way to the location & were guided to a tree. Swinging from its branches was a bag containing pistols/bullets:

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    9. Pls read excerpts from the interrogation of 1 of the suspects to see how he was being guided w/in ft of the tree by some1sitting in Syria

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    10. Credit where credit is due: This transcript was 1st obtained by the talented @SreenivasanJain whose story was the inspiration for my own

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    12. I traveled to Hyderabad in Oct with @suhasiniraj, my 1st trip back to India in a decade. There we headed to the Old City to Aman Nagar B

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    13. @suhasiniraj stood outside the window of the home of chief suspect Ibrahim Yazdani & convinced his bereft family to let us in.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    14. Like all families who are blindsided by love, the Yazdanis insisted their brother had been set up and the evidence planted.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    15. But the breadcrumbs he left behind leave little doubt he was being guided by IS. He began chatting via Telegram with Abu Issa al-Amriki

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    16. As it happens in 2015, when Yazdani begins talking to Amriki via Telegram, I too was following Amriki in his channel, @honeyntea

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    17. So I was able to confirm some of the details in the transcript, including that Amriki's Twitter profile guided "brothers" to HoneyNTea

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    18. The chats indicated that Amriki passed off Yazdani to a Hindi-speaking recruiter, who instructed the cell to send a pledge of allegiance

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    19. The pledge had to be written in Arabic so they sought out an Arabic speaker who wrote it out. They signed it with their noms de guerres

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    20. Yazdani was told to folo a head-spinning security protocol using various encryption tools before uploading it to gulf-up.com

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    21. Gulf-up allows users to save a file & produces a URL which can be shared with a 3rd party. This is where my colleague @runasand comes in

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    22. @runasand figured out that each URL ends in a #. For ex, a pic of clouds on my desktop that I just uploaded is: gulf-up.com/do.php?img=258…

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    23. So the most recent URL ends in 258612. What Runa did is subtract 1 #, to see pic uploaded just before. So 258611, then 258610 etc

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    25. Indian investigators were not aware the pledge was still on Gulf-up at time @runasand found it. It's since been included in indictment:

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    26. In addition to the pistols left in tree, the handler in Syria also arranged drops in a canal, under an overpass & next to railroad track

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    27. It's similar to the Sid Ahmed Ghlam case in France where he was planning to open fire on a church. Guns left in backseat of stolen car

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    28. Here's the chat recovered in 2015 on Ghlam's laptop. Handler in Syria gives detailed, blow-by-blow instructions on where to find the car

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    29. This blows my mind: Handler in Syria tells Ghlam to find the Renault in a lot near a sandwich shop. Specifies keys are on front tire

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    30. The Sid Ahmed Ghlam case was the 1st time I heard French officials refer to a plot which had been "telecommander" (remote-controlled).

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    31. Since then, similar chats have been found in numerous other cases. See @thomasjoscelyn on Germany attacks: longwarjournal.org/archives/2016/…

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    33. Let me close with the takeaway in light of current events: These attacks are being carried out by people *already* in Europe, N America

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    34. The bulk of these attackers attempted to travel to Syria, but never got there. They did not travel here. They were *already* here.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    35. Majority of attackers were from the country where attack was being planned. Hence visa ban would *not* have stopped these.

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    36. My final shout-out is for the indomitable @SeamusHughes, the walking encyclopedia of factoids on ISIS recruits in America

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi

    37. A useful @SeamusHughes factoid 2ponder next time we hear of dire threat of refugees: Of the 114 ISIS arrests in US, majority=US citizens

    Reply Retweet Like

    rcallimachi

    Rukmini Callimachi