Sentence of corte d’assise of milan, 25 may 2016, n.3/16. not reato 19388/15

• 2015 - 2016
• Italy ,
• Syrian Arab Republic ,
• Tunisia ,
• Turkey

Identification of the Source

Sentence of Corte D’Assise of Milan, 25 May 2016, N.3/16. Not Reato 19388/15

Keywords

#TOR #Dingtone #Freedom #Ba’ya #Islamic_State_in_Rome

links

• -

Description

SCRIPT-Methodology

Most of the following information comes from phone interceptions and forensic extractions of data contained in mobile devices, confiscated to different suspects during the investigations, but also from information stemming from open sources.

7th of April 2015 – the special unit of the Italian Postal Police started the investigation on XX, while monitoring social media, specifically Twitter. They noticed a profile omarmoktar @omarjohn deep506, who was twitting various posts to glorify the Islamic State and was inciting to terrorist actions. Thanks to the profile, the Postal Police could identify the linked IP address.
Even though Twitter blocked and closed the profile, his activities were still running under a new account (@homar_moktar2) and monitored by the Postal Police.

Please note that XX was the leader of native resistance in Cyrenaica, currently Eastern Libya under the Senussids, who fought against the Italian colonization of Libya.

Particularly he posted:
7th of April 2015: a had written note in Arabic as a ba’ya (oath), where he promised loyalty to XX
16th of April 2015: Twitter blocked the profile
16th of April 2015: he opened a new profile called @homar_moktar2, complaining about Twitter blocking his main profile.

He keeps posting: #Islamic_State_in_Rome, with pictures of the IS flag and written “Islamic State Caliphate”. Always on the same date:
“aspettati una sorpresa..siamo dappertutto
Siamo nelle vostre starde Siamo soldati di Allah” (wait for a surprise... we are everywhere. We walk in your streets, we are Allah’s soldiers).

Always on the same day he posted a picture of 5 blue twitter birds wielding machine guns writing the following in Arabic: “oh brothers of the Jihad, support my profile. Support each other to conquer the roman crusaders”.

Further similar posts have been posted on the same day.

17th of April 2015: posted a picture of a machine gun with munitions and hand grenades and upon it was written “Inshall’, we will sit on your throne and we will open Tunisia to Al-Qiruan”
18th of April 2015: different messaging describing the AK-47 gun, as military information
21st of April 2015: posted in Italian “O popolo di Roma, Avete tre soluzioni: 1-accettare l’Islam 2-pagare jezia 3-nostri coltelli (Jihad). A voi la scelta!!! #Islamic_State_in_Rome” (oh people in Rome! You only have three options: 1-accept Islam 2-pay the jezia 3-our knives (Jihad). The choice is yours!!! #Islamic_State_in_Rome)
23rd of April 2015: posted a tweet with a picture of 3 mujahidin with the Egyptian flag and one man wearing a IS black uniform, writing “see you in Syria”
24th of April 2015:
1. one tweet in English “now we act with pictures, soon it will be sharp knives…it is not too far in the future… #Islamic_State_in_Rome”
2. Four tweets in Arabic with pictures of cards written in Italian “we are in your streets”. All the pictures were taken in Milan – Central Station, EXPO, Dom, McDonald’s, close to police vehicles. In Arabic he wrote: “the kuffar (not-believers) promised to stop IS, their Arab allies are happy about it, but that gives us only more strength and devotion, because when the lion will speak, the kuffar will cowering in fear.” And also “allah ahkbar. IS is already in Rome. We are in Italian capital ahahahaha” -attached to a picture of the Colosseum in Rome.

Thanks to the pictures taken on that day, the Postal Police could exactly identify all his movements. Furthermore, thanks to the IP, email address linked to profiles and telephone numbers, they could localize where he lived.

Those pictures had a double goal: (a) intimidation of the other users of the platform – that’s the reason why he writes in English and/or Italian as well; (b) proselytism and instigation.
The pictures in the background highlight some vulnerable spots and they could be a main target for a future terrorist attack

28th of April 2015: police started interceptions with a microphone within his car – in fact, different private users on the same social media (mainly Twitter), could identify from the pictures he took, his vehicle (Ford Focus DS186SJ).
29th of April 2015: the police started the interceptions, using microphone at home, intercepting phone calls, his devices and his online researches.

From April onward: XX’s case had from the beginning a very big media impact , and that’s the reason why he started being more careful on what and whom he was saying.
16th of May 2015: the two suspects talked about a new individual XX. It is important to mention this conversation within our work, because the XX’s case is a very good example vulnerable behavior. XX, an acquaintance, had a deep financial crisis, since he left the accommodation center for asylum seekers after getting a job offer. Unfortunately, he did not get any contract, and got only 75€ a month. Having a wife and children it was impossible for him to survive. XX and XX offered him to travel to Syria, where he and his family would have been rewarded from the Caliphate with money and glory.
20th of May 2015: As first counter-measure he sold his car. But in the month the police force had at his disposal, they could identify XX, born in Gujirat, also living in Manerbio (BS).
31st of June 2015: XX and XX decide to commit a violent act in Italy before leaving for Syria. They start thinking about possible actions: put IS flag on a building; burn LINEA VERDE in Manerbio, which was the agency where XX worked; get a credit from an Italian bank and not extinguish it, in order to damage the Italian economy.

From June onward: After noticing the huge impact his twitters had on media, XX and XX decided to be virtually more careful, so they started to adopt security measures while using their devices (computers, smartphones) in order to navigate anonymously online and without risking getting intercepted by the police controls.

In this sense XX had more expertise and was more careful and aware of counter-techniques for avoiding virtual interceptions. Furthermore, always within the manual on How to survive in the west, there is a whole chapter regarding Internet Privacy.
They started using the browser TOR, which was installed by the suspects. They don’t use the browser Google, Chrome anymore.

1st of June 2015: police started interceptions using a microphone in WAQAS’ car and telematic “active” interceptions on XX’s smartphone.
8th of June 2015: XX proposed instead to kill two Carabinieri or attack the Ghedi, NATO airport in Brescia.

Furthermore, on the same day, XX communicates to XX that he downloaded the manual “How to survive in the west”. Main interests were the chapters on (a) how to make a bomb; and (b) the chapter regarding Internet Privacy.
On the same day, XX went to Brescia to buy two mobile phones to be used ONLY for jihadist researches and contacts. On those phones they have created different fake profiles. Thanks to the fake virtual identities it would have been hard to get back to their real identity.

XX installs on those phones’ different applications, which can be used in Tunisia as well (since XX was planning to travel back home in Tunisia) and he suggested to create a Chinese profile – Li Mei. The accounts were created in other countries.

From that day both XX and XX had a new fake identity online and created different codes to talk to each other and to other affiliates.

Furthermore, on the XX’s tablet, confiscated by Italian authorities, they found out, that he was using different applications, which guarantees the anonymity and avoid tracks of communication.

Among those:
(a) Dingtone, which was first de-activated, de-installed and then re-activated. In this way all the communications got lost
(b) Freedom, for managing VPN. It was impossible to get any information from it.

But beside the virtual world, they were very careful also “offline”. Following the manual, they had to “hide the extremist identity and disguise”.
Already on the 31st of May 2015: they start discussing about got to bars, pretend to drink beers and smoke cigarettes. Start wearing “western clothes”.

10th of June 2015: XX gets in contact through Facebook Messenger with XX, who was at the time in Raqqa (Syria).
12th of June 2015: they start practical planning how to get into Ghedi Airport, in order to open to doors to the Jennah (Paradise). The chances to get in where pretty low, but still possible.
15th of June 2015: XX gets in contact through Facebook Messenger with the user XX (XX), a guy coming from his town in Tunisia (Kairouan). XX is probably already in Syria and XX names him Sheik. He probably plays a significant role within the organization.
19th June 2015: XX starts massively researches online on Ghedi airport. He looks online on how to make a Molotov by hand; how to make bow and harrow by hand; how to make a bomb etc. He was kind of obsessed with the attack at the Ghedi base, that he was not sure any more about leaving the country to IS territories.
21st of June 2015: XX proposes to XX to get “closer” to the Ghedi Airport (Italian military airport). He also expressed lot of times that he thinks to be the chosen one for making this operation. Allah chose him. The NATO base Ghedi is the perfect target to revenge the children killed by western countries in Syria.
24th of June 2015: XX travelled to Tunisia from the port of Genoa. On the same day, XX surf in an e-commerce Chinese website, looking for some key words, such as “swat-vest”, guns, gilets etc.
26th of June 2015: Terrorist attack in Tunisia at the Sousse resort. 39 people died. One of the two terrorists was XX, 23 years old, from Kentaoui, same town as XX. This event had a big psychological impact in the suspect. On that day, XX shared the content of XX (his countryman), where he congratulated for his action. On that day the geo-localization on his phone was exactly at Sousse.
28th of June 2015: XX surfed on the website “L’inviato del Califfato”, from the official website of the Ministry of Interior in Bahrein, in order to recognize a kamikaze. His intent was clearly not to recognize one, but what to do for avoiding being recognized.

While surfing through those websites, he was also looking for new contacts, who could help him out to travel to Syria. One of them was XX. He explained him how to get to Syria without arising suspects. They planned to meet but they were very careful while talking by phone.
They tried to get in contact with another person but using TELEGRAM only.
19th of July 2015: XX went back to Italy and XX waited for him at the Brescia airport.
22nd of July 2015: both XX and XX got under precautionary measures.

At this point it is important to remember some specific characteristics of the new Islamic State:
(A) IS introduced a new form of association, which is called “individual terrorism”.
It is a horizontal structure, different from the typical pyramidal structure (organized crime, Mafia or ‘Ndrangheta in Italy). This new idea was already promoted in 2004 by XX who wrote “Call for Islamic global resistance”, a handbook on do-it-yourself terrorism. He was the first one, who supported the so called “lonely wolf” and small individual terrorist cells, taking distance from the Al-Qaida model. In fact, the IS speakers underlined, that EVERYONE can pursue the goals of the organization INDIVIDUALLY. Very important to say is also that this strategy was extremely facilitated by the massive use of social media, which are nowadays huge recruitment camps, which facilitate the informatics fishing of information and let an individual to go through the pathway of radicalization feeling part of a bigger structure without needing any practical support by the core of the organization.
(B) IS facilitates also the formal access to the organization - meaning it is very easy to be recognized as a member of the association. As written in their manual “how to survive in the west” the affiliates must go to IS territories, but if they are not allowed, they have to pursue the jihad in their territory.

(C) This new horizontal structure is internally very flexible, and it adapts to every new circumstance, letting it be always a “living” organization. Contacts among members of the organization can be physical, telematics, virtual or not-existing.

Type of Crime

Terror-related crime (TN) - Association within the supranational terrorist organization called ‘’Islamic State'', for trying to commit acts of violence with terrorist purposes in Italy and travel to Syria for joining the Islamic State (IS).
Legal Ground:

• Article 270bis of the Criminal Code "Associations for the purposes of terrorism, including international or subversion of the democratic order".
Anyone who promotes, establishes, organizes, directs or finances associations aimed at carrying out acts of violence with the purpose of terrorism or subversion of the democratic order is punished with imprisonment from seven to fifteen years.
Anyone participating in such associations is punished with imprisonment from five to ten years.
For the purposes of the criminal law, terrorism also occurs when acts of violence are directed against a foreign state, an institution or an international body.
The confiscation of the goods that served or was destined to commit the crime and of the things that are the proceed, the product, the profit or that constitute its use is always mandatory towards the convicted person.

• Art. 270quater of the Criminal Code "Enlistment for the purposes of terrorism, including international terrorism".
Anyone, outside of the cases referred to in Article 270bis, enlist one or more persons for the execution of acts of violence or sabotage of essential public services, for the purpose of terrorism, even if directed against a foreign state, an institution or international body, is punished with imprisonment from seven to fifteen years. Out of the cases referred to in art. 270bis, and except in the case of training, the enlisted person is punished with imprisonment from five to eight years

Modus Operandi

The whole operation from both sides (attacks from the convicted and counter-measures from authorities) have been possible thanks to the technological and virtual actions.
In fact, the two convicted operated mainly, if not only, online: posting twitters, contacting other users embracing in the same ideology, surfing through different websites, downloading material, talking virtually to other people. In the “offline” world nothing serious happened and, as also the judge noticed, they were probably completely unable to organize any kind of attack at the Ghedi base, which was a very high target for such unorganized individuals. Anyway, the motivation of the two guys was high and the more the motivation raised, the more they got out-of-control. In this framework the situation could escalate at any time.

Since the whole actions were perpetrated online, they also took preventive measures for being not recognized:
- Using the browser TOR, or Onion ? it permits users to cover their identity and position
- Using encrypted chats as Telegram or Whatsapp
- Using specific devices for researches and contacts
- Using Dingtone
- Using Freedom

On the other hand, the Postal Police worked as well only online, using forensic methods and telematics interception for countering attacks and for stopping the two suspects.
In this sense it’s remarkable to notice the problem of public-private cooperation: in fact, the software, which the police used for interception was provided by a private Italian company “Hacking Team” (this case will be analyzed below). Exactly on that period (05.07.2015) there was a huge hacking attack, which blocked the whole telematics interception system.

People involved

XX, born in Kairouan (Tunisia) on the XX, convicted in Nuoro (Sardinia) – High Security Prison - for 6 years, living in Manerbio (Italy);

XX, born in Gujrat (Pakistan) on the XX, convicted in Nuoro (Sardinia) – High Security Prison - for 6 years, living in Manerbio (Italy).

Criminal History

No past criminal history is documented.

Influential and/or vulnerable Groups

In this case we have both figures: (a) is XX, the guy who got convinced by XX and XX to leave Italy in search for better life. (b) XX and XX, highly ideologically motivated young guys, who actively recruited and motivated themselves in order to accomplish terrorist attacks in Italy and who wanted to actively fight to the right of the Islamic State.