Terrorist Financing on the Internet

june 2009 . Vol 2 . Issue 6

Terrorist Financing on the entity called “Azzam Publications” and whose leaders were impressed by his a number of associated websites that computer knowledge and ambition. Internet were primarily focused on supporting He quickly developed close ties to the the Taliban in Afghanistan and the organization.6 AQI began feeding videos By Michael Jacobson mujahidin in Chechnya. On these sites, directly to Tsouli for him to post.7 At Babar solicited funds, attempted to the outset, Tsouli uploaded these videos since the september 11 attacks on the recruit fighters, and even provided to free webhosting services, and at this United States, al-Qaìda has come detailed instructions on how individuals point he had few expenses and little need under growing international pressure. could move both themselves and money for funds. These free sites, however, In response, the terrorist organization to conflict zones.2 The website was had limited bandwidth and soon came has increasingly relied on the internet explicit in its purpose.3 to slow Tsouli down as he ramped up to spread its message and gain support his activities. Tsouli then turned to throughout the world. While its use To persuade individuals to donate, Babar sites with better technical capabilities, of the internet for propaganda and used a familiar argument: supporting but that forced him to raise money.8 recruiting purposes has received wide jihad in some fashion was an obligation publicity, al-Qaìda has also utilized the incumbent upon every Muslim. Babar Not surprisingly, given his expertise, internet for a variety of other purposes, noted that even if one could not fight Tsouli turned to the internet to raise including terrorist financing. Al- in the jihad, they nonetheless had a the funds to pay for these sites. Tsouli Qaìda is far from alone among terrorist religious obligation to contribute funds. and his partner, Tariq al-Daour, organizations in exploiting the internet He argued that the began acquiring stolen credit card for financing. A wide range of other numbers on the web, purchasing them terrorist groups—including Hamas, first and most important thing through various online forums, such Lashkar-i-Tayyiba and Hizb Allah— that Muslims can do in the West as Cardplanet.9 By the time Tsouli and have also used the internet to raise and is to donate money and to raise his partner were arrested, al-Daour had transfer needed funds to support their it amongst their families, friends accumulated 37,000 stolen credit card activities. and others…for someone who is numbers on his computer, which they not able to fight at this moment had used to make more than $3.5 million The internet offers broad reach, timely in time due to a valid excuse they in charges.10 Tsouli laundered money efficiency, as well as a certain degree of can start by the collection and through a number of online gambling anonymity and security for both donors donation of funds.4 sites, such as absolutepoker.com and and recipients. Although governments paradisepoker.com, using the stolen throughout the world now recognize that Babar’s case is just one example of early credit card information. They conducted the internet is an increasingly valuable terrorist use of the internet for financing hundreds of transactions at 43 different tool for terrorist organizations, the purposes. websites in total. Any winnings were response has been inconsistent. For the cashed in and transferred electronically United States and its allies to effectively Financing Earned through Online Criminal to bank accounts specifically established counter this dangerous trend, they will Activity for this purpose. In this way, the money have to prioritize their efforts in this One of the primary ways that terrorist would now appear legitimately won, area in the years to come. This article groups use the internet to raise funds is and thus successfully laundered.11 In provides an example of early terrorist through criminal activity. Younis Tsouli, total, Tsouli used 72 of these credit use of the internet, explains how and a young British man better known by cards to register 180 websites, hosted why terrorists launder and raise funds his internet code-name “Irhabi 007,”5 by 95 different companies.12 through websites, and examines the may today be the best known virtual challenges of countering this problem terrorist. Tsouli began his “career” 6 Gordon Corera, “The World’s Most Wanted Cyber- effectively. by posting videos depicting terrorist Jihadist,” BBC News, January 16, 2008. activity on various websites. He came to 7 Ibid. Early Terrorist Financing on the Internet the attention of al-Qaìda in Iraq (AQI), 8 “Cyber Operative Charged in Real World Terror Plot,” While terrorists’ use of the internet for Anti-Defamation League, March 1, 2006. finance-related activities dramatically Ahmad,” September 2004 and indictment of Ahmad in 9 “U.S. Secret Service’s Operation Firewall Nets 28 Ar- increased after 9/11, it began well before. U.S.A. v. Babar Ahmad, District Court of Connecticut, rests,” U.S. Secret Service, press release, October 28, The most prominent example was Babar 2004. 2004. These forums obtained the credit cards through Ahmad, a young British citizen from 2 “Affadavit in Support of Request for Extradition of various online scams and e-mail viruses. See Brian South London who put his computer Babar Ahmad.” Krebs, “Terrorism’s Hook into Your Inbox,” Washington expertise to use early on in support of 3 On a question and answer page, Babar wrote that “Az- Post, July 5, 2007. the jihadist cause until his arrest in zam Publications has been set up to propagate the call for 10 For example, one New Jersey woman described how 2004.1 Beginning in 1997, Babar ran an jihad among the Muslims who are sitting down, ignorant she received an e-mail asking her to verify eBay account of this vital duty…Thus the purpose of Azzam Publica- information, which she completed, including sensitive fi- 1 Babar was arrested in 2004 by the United Kingdom on tions is to ‘incite the believers’ and secondly to raise some nancial information. Al-Daour ended up with her credit the basis of an extradition request by the United States. money for the brothers.” card information. For more, see Krebs. Babar’s appeals of the extradition request are still cur- 4 “Affadavit in Support of Request for Extradition of 11 Krebs. rently pending. For more, see U.S.A. v. Babar Ahmad, Babar Ahmad.” 12 Written statement from Andy Cochran at “Do the “Affadavit in Support of Request for Extradition of Babar 5 “Irhabi 007” means “Terrorist 007.” Payment Card Industry Data Standards Reduce Cyber- june 2009 . Vol 2 . Issue 6

Charities (GRF), an organization designated in of the internet to raise and transfer Charities and non-governmental 2002 by the U.S. Treasury Department funds is also part of a broader global organizations (NGO) remain a major for its ties to al-Qaìda and the Taliban.15 shift toward the use of technology in problem in the terrorist financing arena, On its website, the GRF said that the international commerce. There have and their activities on the internet are charity was “organized exclusively been dramatic shifts in how funds can no exception to this troublesome trend. for charitable, religious, education be transferred from one destination According to the Paris-based Financial and scientific purposes including to to another, with new technological Action Task Force, “the misuse of non- establish, promote, and carry out relief developments. Transferring funds profit organizations for the financing of and charitable activities, projects, electronically—using the internet to terrorism is coming to be recognized as a organizations, institutions and funds.” initiate transactions—has become crucial weak point in the global struggle GRF’s mission statement focused on increasingly common through services to stop such funding at its source.”13 its work in emergency relief, medical such as PayPal. Transactions can also Charities are especially susceptible to aid, advancement of education and be conducted through cell phones abuse by terrorists and their supporters development of social welfare, noting in what are now better known as for whom charitable or humanitarian that it will “act with goodwill towards “M-payments.” In countries where organizations are particularly all people.” GRF accepted donations the formal financial sector is less attractive front organizations. Some through its website, with donors able to than robust—such as in many African charities are founded with the express pay through credit and debit cards, and countries—using the internet or cell purpose of financing terror, while wire transfers, among other means.16 phones to facilitate transfers is a far others are existing entities that are In reality, the charity was set up and more attractive and readily available infiltrated by terrorist operatives and run for years by Rabih Haddad, who option. Online gambling sites and supporters and co-opted from within. was allegedly a previous member of other similar entities have also made it It is a significant challenge for law Maktab al-Khidmat (Services Bureau), the easier to launder money on the internet enforcement, intelligence officials, “precursor organization to al Qaeda.”17 than it was in the past—a practice that and charity headquarters personnel to terrorist groups have taken advantage effectively monitor funds distributed Another al-Qaìda-linked NGO, the al- of in recent years. While this type of in conflict zones, which can be easily Haramain Islamic Foundation, a Saudi- activity could potentially expose them diverted away from the intended cause. based NGO that was designated by the to detection, terrorists attempt to mask Another challenge for governments that U.S. Treasury Department in November their identities on the internet when makes charities an attractive vehicle 2008 for its ties to al-Qaìda, also had a using these sites. Another factor that is for terrorist groups is that banned or website that encouraged donations.18 likely fueling the increase in terrorists’ exposed charities tied to terrorism criminal activity on the internet is that can shut down one day, and reopen Why the Internet? key terrorist leaders and operatives the next under a new name—a tactic Terrorists’ increasing use of the internet have specifically encouraged their often used successfully by terrorist for financing purposes is being driven followers to pursue this path. organizations.14 by a number of different underlying factors. The use of the internet has Anonymity Charities and NGOs that are tied to expanded exponentially and globally Perhaps the most obvious reason why terrorist organizations are often open during the past decade, and terrorists’ terrorist groups, cells and operatives about their fundraising activities since and other illicit actors’ use has risen have increasingly turned to the internet it is all ostensibly for humanitarian alongside this growth.19 Terrorists’ use is for the security it offers. As the United purposes. Therefore, many of the States and the international community terrorist-linked charities have had 15 “Treasury Department Statement Regarding the Des- crack down on al-Qaìda and affiliated websites openly advertising their ignation of the Global Relief Foundation,” U.S. Treasury terrorist organizations, terrorists have activities and soliciting funds. This Department, press release, October 18, 2002. tried to find new ways to avoid detection. includes the Global Relief Foundation 16 “Jihad Online: Islamic Terrorists and the Internet,” The Tsouli case again provides a good Anti-Defamation League, 2002. example of the ways in which terrorists crime?” Subcommittee on Emerging Threats, Cyberse- 17 The GRF also received funding from individuals are able to exploit security gaps and curity, and Science and Technology Hearing, March 31, linked to al-Qaìda, and GRF officials had “extensive opportunities for anonymity. Even 2009. Tsouli also used these credit cards to purchase contacts” with Wadih el-Hage, a close associate of Usama while he was engaging in extensive equipment for the mujahidin. The equipment was sent bin Ladin, who was convicted by a U.S. jury for his role criminal activity on the internet, Tsouli to locations or premises that he and his associate would in the 1998 U.S. Embassy bombings. See U.S. Treasury was able to cover his tracks, paying for rent on a short-term basis. Department, press release, October 18, 2002. transactions with stolen credit cards 13 “Terrorist Financing,” Financial Action Task Force, 18 “Treasury Designates Al Haramain Islamic Founda- and identification information, and 20 February 29, 2008. tion,” U.S. Treasury Department, press release, June 19, never using his real identity. Tsouli 14 The Treasury Department, for example, noted that the 2008. A number of al-Haramain’s branches had been Bosnian branch of the al-Haramain Foundation “recon- blacklisted by the United States and by Saudi Arabia internet crime in 2008 at approximately $264 million. stituted” itself after its designation by the U.S. govern- years earlier. See U.S. Treasury Department, press re- “Internet Crime,” Federal Bureau of Investigation, press ment in 2002, reopening under the name “Vazir.” More lease, June 2, 2004. release, March 30, 2009. recently, Treasury added new aliases for al-Rashid Trust 19 Terrorists are also far from alone in using the internet 20 Written statement from Andy Cochran at “Do the and al-Akhtar Trust International, years after their des- for illicit purposes. In fact, crime on the internet has been Payment Card Industry Data Standards Reduce Cyber- ignations by the U.S. and UN. growing rapidly, with the FBI estimating losses from crime?” Subcommittee on Emerging Threats, Cyberse- june 2009 . Vol 2 . Issue 6 also used a variety of techniques to companies. For example, a site tied to “brilliant” encryption it was possible hide his computer’s Internet Protocol the Taliban was hosted by a company to “send a verse from the Koran, an (IP) address, including anonymizing in Texas, on which the terrorist group appeal for charity and even a call for software and proxy servers.21 bragged about attacks in Afghanistan jihad and know it will not be seen by on U.S. forces. Perhaps even more anyone hostile to our faith, like the In fact, at one point, authorities disturbingly, in the 2008 attack in Americans.”29 suspected that Tsouli was in the United Mumbai, which the Pakistani-based States because he hacked into and group Lashkar-i-Tayyiba is suspected The Way Forward uploaded data to an Arkansas State of perpetrating, the cell members Terrorists will continue to exploit website and a George Washington communicated through internet the internet for all aspects of their University site.22 Illustrating how telephone calls, which were routed operations, including raising and seriously Tsouli generally took security through a Texas server.26 moving funds. This trend is only likely matters, he had never even met Tariq to increase as the scope and scale of the al-Daour, his co-conspirator in the Increased Caution for Electronic Payments internet expands, and with other related effort.23 Interestingly, in the end Tsouli Nevertheless, while terrorist groups technological developments. There is was not apprehended through cyber- have increasingly turned to the internet widespread agreement at this point investigation, but through traditional to spread their extremist message, they among governments that the internet detective work.24 are at the same time growing more weary creates serious counterterrorism about the risks of electronic payments vulnerabilities and that action is needed Babar was also careful in his tradecraft, specifically, as governments have to counter this growing threat. There is using aliases and post office boxes to begun to crack down on the practice. A far less agreement, however, on what conceal the fact that he was the one participant in an early 2009 discussion steps need to be taken. The United States operating these extremist websites, and on al-Fallujah, a well-known extremist has taken aggressive actions unilaterally often paying the fees through cash and forum, cautioned others about how to in this area, specifically designed to money orders. Babar used encryption for pay for online services. Governments, address the use of the internet for his e-mail communications as well as to this extremist warned, are carefully terrorist financing purposes. This has protect data stored in his computer.25 tracking and monitoring electronic included a number of prosecutions of payment services, and through this suspected terrorists for their internet- In fact, terrorists appear so confident have been able to identify jihadists and related activity. The United States about the security that the internet eventually unravel entire networks.27 has also used its law enforcement provides that some terrorist websites The extremist noted that even “if your tools more broadly, targeting money are actually hosted by companies in use of the electronic payments has not remitters without adequate anti-money the United States. The U.S. sites are brought you woes, then that does not laundering/counterterrorist financing appealing, experts say, because of the mean it is safe.” He recommended that internal compliance systems. The high quality and low costs. There are when using the internet for payment United States has even pursued money numerous examples of websites linked that the brothers use “circumvented remitters based outside of the country to terrorist groups being hosted by U.S. ways and methods” to make it more that were marketing online to U.S. difficult to trace.28 citizens, charging them with failing to curity, and Science and Technology Hearing, March 31, register in the United States as required 30 2009. Hamas has also instructed potential by law. It has complemented this 21 Nadya Labi, “Jihad 2.0,” Atlantic Monthly, July/August donors on what steps to take to avoid with a softer approach, reaching out to 2006. Tsouli apparently learned this early in his internet apprehension by security forces. For individual web service providers who career. When he first began visiting a particular jihadist example, on its Qassam Brigades are hosting troublesome sites, asking site, one of the members of the forum warned Tsouli not website, Hamas told donors to use the providers to voluntarily shut them to access the site from his own IP address, a lesson Tsouli “fake” names when sending e-mails down. appears to have heeded. about contributions. Hamas also 22 Rita Katz and Michael Kern, “Terrorist 007, Ex- reassured donors that they will use Not all countries have been as posed,” Washington Post, March 26, 2006. “secure handling” for the donations to aggressive as the United States on 23 Tsouli, however, was extremely careless on several the fighters. Hizb Allah, likewise, has this front. First, many countries lack occasions, failing to anonymize his transactions, which bragged about its sophistication using the technical capabilities necessary to 31 led one private cyber-investigator to conclude that Tsouli the internet, particularly in utilizing investigate online terrorist activity. was located in Ealing, England, a short distance from his encryption to protect communications Second, there is still a debate about how actual home. For more, see Corera and Labi. from detection. Hizb Allah spokesman 24 In October 2005, Bosnian police arrested two men Ahmed Jabril said that with this 29 “Jihad Online: Islamic Terrorists and the Internet.” whom they suspected were involved in a terrorist attack. 30 See, for example, the U.S. Justice Department pros- During the search of their phone and e-mail records, they 26 Joby Warrick and Candace Rondeauz, “Extremist ecutions of MENAEXCHANGE.com, a money remitter uncovered Tsouli and his colleagues. See “Cyber Opera- Web Sites are Using US Hosts,” Washington Post, April that transferred funds between the United States, the tive Charged in Real World Terror Plot.” 9, 2009. Middle East and North Africa. 25 U.S.A. v. Babar Ahmad, “Affadavit in Support of Re- 27 “Jihadi Discussion Forum Posting on Safely Financ- 31 Raphael Perl, “Terrorist Use of the Internet: Threat, quest for Extradition of Babar Ahmad,” September 2004 ing Jihad-Related Websites,” translated by the NEFA Issues, and Options for International Cooperation,” Or- and indictment of Ahmad in U.S.A. v. Babar Ahmad, Dis- Foundation, April 7, 2009. ganization for Security and Cooperation in Europe, April trict Court of Connecticut, 2004. 28 Ibid. 7-10, 2008. june 2009 . Vol 2 . Issue 6 far governments should go in cracking cooperation on this issue, there are limits down on internet-related activities. to what is likely to be accomplished. Some governments are concerned that taking these steps will abridge the Michael Jacobson is a senior fellow in The right to free speech. There is also an Washington Institute’s Stein Program active debate about what works best on Counterterrorism and Intelligence. from a counterterrorism perspective— Previously he served as senior adviser particularly whether it is more valuable in the Office of Terrorism and Financial to monitor terrorists’ activities on the Intelligence and as counsel on the 9/11 internet for intelligence purposes, or Commission. He is the author, with Matthew to shut their websites down. Third, the Levitt, of the 2008 Institute Publication, laws in this area have not kept up with “The Money Trail: Finding, Following and the technological changes, and there Freezing Terrorist Financing.” is not agreement about what changes should be made to move forward. At present, there is no consistency at the national level in what laws are on the books.32 For example, in Italy cyber cafés are required to ask for identification; Rome is alone in the European Union in imposing this regulation. In India, some states mandate this, but others do not.33 The United States has also interpreted its responsibilities and laws more expansively than many other countries, targeting entities outside its borders for prosecution; others are hesitant to give their law enforcement agencies this broad reach. Finally, while some countries favor the establishment of an international legal instrument that would govern this area, not all governments regard this as a necessary or helpful step forward.34

There are limits, however, to what the United States or any one country can accomplish on its own in this area. The internet crosses all geographic boundaries, and if the United States cracks down on what is taking place within its borders, terrorists can easily relocate to other jurisdictions that are less vigilant about monitoring and countering this type of illicit activity. Only when there is more of a collective and coherent global response will a dent be made in terrorists’ ability to use the internet so easily to further their nefarious goals. The U.S. actions are a step in the right direction, but without broader international focus and

32 Ibid. 33 “Indian States Make Cyber-Users Sign In,” Associated Press, January 10, 2006. 34 For example, at an April 2009 conference in Spain organized by the Council of Europe and the Organization of American States that the author attended, the Russian Federation was pressing for an international treaty to govern this area, but the United States and others pushed back against the Russian proposals.