<http://www.usatoday.com/tech/news/2004-06-27-terrorweb-usat_x.htm> USA Today Internet's many layers give terrorists room to post, then hide Terrorists are increasingly using the Internet to spread shocking images and state their demands. In the past month, video and photos of the beheadings of American Paul Johnson Jr. and South Korean Kim Sun Il were posted on Web sites sympathetic to Islamic terrorists. Last week, a Saudi Web site posted a statement from alleged terrorist leader Abu Musab al-Zarqawi claiming responsibility for attacks across Iraq. Weimann says the Web offers terrorists "anonymity, easy access ... and the ability to disappear." By Stephen J. Boitano, AP The sites are often shut down by the governments of the countries in which they're based, but new ones quickly appear. USA TODAY's Mark Memmott talked with an expert on terrorists' use of the Internet, Gabriel Weimann, a senior fellow at the federally funded U.S. Institute of Peace. Their conversation has been edited for length and clarity. Q: Can't terrorists be caught by tracing who posts their messages? A: You can track it. ... The question is, how deep can you go and how far can you go? Let me explain the layers. ... The first layer will be to look at the Web site and see the address. With the address, you can track the server (host computer) that is used - you can see where the Web site is based. That can be done in seconds. It's not a problem. ... That is being done by security agencies and counterterrorism forces all over the world. Q: What's the next layer? A: To know where the message or the video or the announcement or the picture or whatever was sent from. ... If I try to post something on a Web site, I'm using a server, too. There are two servers connected: the server that I'm using and the server that posts it on your Web site. Q: Sounds simple to trace. A: But there are many options. You can access different servers from different domains, which are public. It can be a university library. You go to a public library or a university library or an Internet cafe. Q: So, physically, there's little evidence to find if investigators get to that library or cafe? A: Now we're getting to the third level: the user. Let's say that I find the server that you used. I still didn't get to the individual user. I can say, 'This was sent from a computer in Jakarta' ... or from wherever. It was in a library or a computer network. ... But the user may disappear seconds after posting the message. Usually they do. So the deeper you go, the harder it is to find the user. This is one of the most important advantages of the Internet for terrorists. Anonymity, easy access, free access and the ability to disappear. Q: And if the person who sat at the computer and sent the video out is ever found, who is he likely to be? A: The guy who's posting the messages for the terrorists, or doing the downloading, is like the smallest of actors in the theater. You won't find the scriptwriters. I'm sure modern terrorists are quite aware of the possibility to track them down. So the chains (in their organizations) will be very long, and probably nobody knows who's the third link from him. Q: How do you, and investigators, monitor terrorists' use of the Web? A: It takes time. ... Al-Qaeda right now is moving among 50 different Web addresses. ... You have to follow the psychology of terrorists, the publicity-seeking mind of terrorists. They want you to find (information they put on the Web). They want people who are supporters or potential supporters, and journalists, to find them. To do so they have to publicize the new (Web addresses). They will go into Internet chat rooms and notify people. Q: So you monitor the chat rooms, watching for messages? A: We call it lurking. You sit quietly in a chat room. You do nothing. Just join it and sit quietly in the dark. This is what I do and what my research assistants are doing. You find very important information. (Relevant chat rooms can be found, for example, by performing a Google "groups" search using key words such as al-Qaeda or jihad.) Q: What are the messages like? A: Someone might ask, "Where can I find video of a Chechen slitting the throat of a Russian?" A few lines later, someone will answer, "Go to this Web site, and you'll see it." Q: People are looking for such things, then? A: Yes, and now we're coming to the speed at which things move. Once (terrorists' messages or video) appears somewhere, especially after an execution or dramatic event, within seconds it will be diffused and posted on other Web sites. You can find it within seconds all over the Internet. Even the beheading of Mr. Johnson. It was posted first on an Arab (Web) forum in England. But within seconds, it was also posted on American servers and American Web sites and then worldwide. -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'