The Invisible War on Terrorism

Battles are fought every day in the war against terrorist groups, but most people aren't aware of them because they happen in cyberspace.A Jihadist Web site exhorts Muslims in Arabic to rise up against the infidels. Another site solicits donations to 'charitable groups' and offers a handy pop-up that will calculate how much contributors should give to meet religious requirements. A third site looks like a CNN imitator, but the stories are written with an anti-U.S. slant.In some cases, unseen messages are hidden inside photos, or in concealed links that can be found only with the right combination of keystrokes.Then there are seemingly innocent Web surfers who skip among sites with facts and figures on the U.S. electrical grid, road maps of towns near nuclear power plants and pictures of major tourist destinations. They could simply be gathering research for term papers or trips, or they could be diligently gleaning raw information to plan a terrorist strike.After all, the 9/11 Commission estimated that 80 percent of the information needed to plan the 2001 attacks on the World Trade Center and the Pentagon was available on the Internet.As part of the battle in cyberspace, two dozen men and women were sitting in a classroom in a nondescript building at the Federal Law Enforcement Training Center near the southern Georgia coast. They took a week's worth of training so they would be prepared to find, hunt down and capture enemies of the United States'and to do everything possible to thwart an attack.The class comprised representatives from the Secret Service, several branches of the military, agencies of the Homeland Security Department, and even civilian agencies such as the Food and Drug Administration and the Energy Department. All of them were experienced federal law enforcement officers. Many have worked extensively with computers'some in forensics units, others in field operations'and each has an appreciation of the magnitude of the task ahead.'I'm here for two reasons,' said one officer who asked that his name and agency not be used. 'I need to know how to do the work. And the other, since my job is supervisory, is that I need to know how to evaluate my people.'For terrorists, the Internet is the perfect vehicle for what the military calls C3I'command, control, communications and intelligence. Stateless themselves, hunted around the globe, these groups find in the Internet both a refuge and a base of operations.'We've almost shoved them to the Internet, in a way,' said Randy Grubb, lead instructor for the Cyber Counterterrorism Investigations Training Program at FLETC. 'We've shut down their training camps, kicked them out of friendly countries.'But terrorist cells'and any wannabes aspiring to inflict mayhem on the United States and its allies'have distinct ad- vantages in making use of the Net.'They have a lot of educated people with engineering degrees,' many of them trained in this country, Grubb said. They operate outside the law; indeed, cybercrimes such as credit card fraud, identity theft and money laundering likely provide much of their funding. The terrorist cell in Madrid that blew up the trains in 2004 sold counterfeit airline tickets to support its operations.'The terrorists don't have the ability to use the global financial network as easily as they used to,' Grubb said. 'The Internet is the alternative.'Then there is the sheer volume of data flowing around the world every day. It is almost impossible to quantify the size of the Internet: The Google search engine claims to index more than three billion pages, but 'less than 15 to 20 percent of the Web is indexed,' said Preston Farley, another senior instructor in the class. 'The remainder is invisible.'And that doesn't include e-mail traffic. In 2000, an e-mail hosting site estimated that 280 billion messages were sent in the U.S. alone.Terrorist cells make extensive use of bulletin boards and Web-based e-mail accounts to relay information, Grubb said. If a terrorist doesn't want to risk exposure in the torrent of messages, he can write a message and save it in draft form, never sending it; his co-conspirators can then visit the same account and read it. There will never be any trace for an investigator to find.There is a difference between cyberplanning via the Internet and cyberterrorism'terrorists' use of the Web actually protects its underlying structure. 'If they're using the Internet like this, why attack it?' Grubb said.Locating telltale signs of terrorist cells on the Internet is not like looking for a needle in a haystack. It's like looking for a single specific stalk of hay located within thousands of haystacks.'What we've done in the last 40 months to step up security is not enough to protect us in the next 40 months,' said Sam Kharoba, president of First Capital Technologies LLC, a Baton Rouge, La., company that develops linguistic software to aid law enforcement.To a large extent, militants don't need to be particularly sophisticated in encryption, he said. There are so few fluent translators of Arabic that terrorists can hide their information in plain sight just by sticking to their own language.American investigators also have an overwhelming tendency to misspell, misunderstand or mistranslate Arabic names.'Arab nations frequently can't help the U.S. because we mangle the names,' Kharoba said. 'How can we hunt terrorists when we don't know their names?' The 19 September 11 hijackers, for instance, had 47 aliases or variations on their names.He walks the class through some exercises intended to calculate the number and strength of prospective terrorists.With approximately 1.5 billion Muslims around the world (only 20 percent of them Arabs), Kharoba throws out an estimate that perhaps 10 percent of the total, or 150 million people, sympathize with Islamist terrorists. Of that group, maybe 1 percent or 2 percent will actually take action. That means there are between 1.5 million and 3 million individuals willing to commit acts of terror.'The money is more important than the numbers of prospective terrorists,' Kharoba said. He estimated the financing that makes these violent attacks possible at somewhere between $14 billion and $28 billion a year, based on the gross domestic product of Muslim countries and the Islamic custom of zakat'tithing 2.5 percent of one's gross income to charity.Kharoba has almost an entire day to instruct the students in some of the intricacies of identifying and tracking Islamist terrorists. It's nowhere near long enough, he knows, but if he can just get them to start paying attention to the differences between cultures, it's a start.The concept of cyberoperational security, or cyber-opsec, is both a thread running through every session and a standalone lecture during the course.Many people don't realize that investigating e-mail and Web sites also leaves identifying traces, unless you take steps to hide your tracks.Consequently, in tracking terrorists, protecting one's identity is paramount, especially for agents with families.'Pedophiles won't hunt you down, but these guys will'there have been documented cases,' Grubb warned the class. 'Every time you sit down, use opsec.'A detective with a large metropolitan police department in the Northeast was a guest lecturer for this segment. On the front lines of terrorist-hunting himself, he laid out the best way to approach the task.'Buy a computer with no ties to you,' the detective said. 'Buy one at a flea market,' then wipe the hard drive completely. Buy a bunch of network interface cards and swap them out, so the machine will look different each time, he suggested, and use a different operating system each time. Never use your home computer for investigative work.Grubb added other suggestions: Go to different places, such as public libraries, to do the work. Use a safe house if you are conducting major operations. And most important, don't become predictable.There is software available that will configure a 'virtual machine' within a computer, the detective said, so that transactions can't be traced back to a real computer. He suggested setting up a virtual machine for every single case. Set up undercover Internet accounts and use anonymizers'free services available on the Internet to further cover one's tracks.There are a wide range of software applications, most of them shareware or freeware, that can be used for 'network penetration,' actually peering into a suspect Web site or the contents of an individual's computer. Other tools can capture every action an agent takes as he probes cyberspace, recording keystrokes or caching Web pages as they are viewed, to allow for more leisurely examination later on. Yet other tools will capture e-mail traffic, even instant messages.'All of these steps to date must be done before going to your first [suspicious] Web site,' Grubb told the class. 'When you're taking a 'snapshot,' be sure to be anonymous, because you're actually finally touching them. ... When all of a sudden every single page is being hit, you're lighting them up like a Christmas tree.'The agents in the class were given disks with many of these tools, and the detective directed them through some exercises so they could begin to get familiar with their use.'This is our arsenal, and if you don't think the bad guys have these, you're dreaming,' he said.At lunch, one agent discussed the usefulness of the information. 'There will be things I'll be putting in place by phone this afternoon, based on this morning and yesterday,' he said. 'For instance, using the anonymizers [to] lengthen the distance between us and the terrorists. You have to do this all day, every day.'The first phase of the class concentrated on planning'getting the right tools, learning to use them, setting up the equipment. The next phase, collecting the information, is a huge challenge. Farley has responsibility for teaching the agents how to go about searching the ocean that is the Internet.'To do an effective Internet search, you need to go about it methodically,' Farley told the class. 'Your results have to be replicable.'One methodology for intelligence-gathering procedures has several steps, he said: plan, collect, process, analyze and start over. These are the same steps that should guide an investigator searching for communications among terrorists.Simply using search engines is a good place to start, he said; investigators should use several, because each one has its own search algorithms and will come up with somewhat different results.In addition to searches, 'I use Google alerts,' Farley said. 'I put in a request for Jihadist Web sites, and information is e-mailed to me daily. It's a good way to build a database of information and let Google do the heavy lifting.'A terrorist group might want to activate a Web site for just 15 minutes, for instance, just long enough to allow the downloading of a video showing a hostage being executed. 'You have to know where they're at' to have a chance to track them, Grubb said.In Internet pornography investigations, Farley suggested, the photos should be evaluated for possible hidden information.'The theory is that terrorists are in bed, pardon the pun, with pornographers,' he said. It's an excellent medium to hide information because the pictures get widely distributed, 'but only a handful of people know there's a message in the file.'Getting the tools and training to conduct covert investigations of potential terrorist activity on the Internet is critical, but agents always have to operate within the law.In every session, the instructor made sure to outline just how far agents can go before they require search warrants.Grubb told students they can scout the configuration of a suspect Web site or check out its registration, because that information is publicly available as a fundamental part of the Internet's architecture. Delving into the contents of a computer hard drive, though, requires a warrant.'There's no problem war-driving, but you can't go through the door,' he said.As Wayne Anderson, acting chief of the division, walked the class through how to track and trace e-mail, he reviewed the different kinds of court orders that will let agents gather evidence.If an agent is going to get a warrant to search the records of an account held by an Internet Service Provider, he reminds them, get a preservation order. It freezes the account, and its traffic, for 90 days.On the final day of the program, Grubb set aside an hour to review specific legal issues.'You're going to have to have a subpoena, you have to have a search warrant,' he warned the class. 'They may give consent, [but] that can always be challenged somewhere down the line. I never have understood the guys who want to push the line on Miranda' warnings.One premise guiding the obtaining of warrants is what Grubb terms the 'independent component doctrine.''Probable cause does not necessarily mean the entire computer system, so each component needs its own justification' for being seized, he says. 'You can take the parts that make the computer work,' such as the keyboard and mouse.Or if a computer was the 'instrument of offense,' used to generate phony credit cards, for instance, all the components of the system can be taken.The laws governing wiretaps and warrants haven't quite caught up with the computer era, he said. If the server for a LAN or WAN is physically located in another state, for instance, a second search warrant should be sought in that jurisdiction.Generally speaking, Grubb ad- vised erring on the side of caution, because agents don't want their hard work tossed out for invalid searches.'The tools online will take you into a gray area,' he said. 'If it asks you for a user name and password and you're trying to get around it, you're crossing the line.'When the class finished on Friday afternoon, students walked up to receive certificates as Grubb called their names. Some were already talking about how, the following Monday morning, they intended to apply what they'd learned to ongoing cases to see what they might have missed.Others talked about their offices sending additional agents to the next class. The federal departments that use FLETC to train law enforcement personnel get an assigned number of slots each time. If any slots are vacant, both federal and state agencies can request that their agents attend.The class costs about $2,000 per student, and each session will accommodate no more than 24 agents. To allow more time with the complex material, Grubb said, starting with the next cycle the course will be extended from five days to eight.This was just the third time FLETC offered the course, and already there's a waiting list.'We're having to turn people away. We'll offer it two more times this fiscal year,' Grubb said. 'Next fiscal year it'll be between eight and 10 times.'