And now, USA Today Presents a Word from Horseman #2

R. A. Hettinga rah at shipwright.com
Mon Jun 28 08:47:19 PDT 2004


<http://www.usatoday.com/tech/news/2004-06-27-terrorweb-usat_x.htm>

USA Today




Internet's many layers give terrorists room to post, then hide


Terrorists are increasingly using the Internet to spread shocking images
and state their demands. In the past month, video and photos of the
beheadings of American Paul Johnson Jr. and South Korean Kim Sun Il were
posted on Web sites sympathetic to Islamic terrorists. Last week, a Saudi
Web site posted a statement from alleged terrorist leader Abu Musab
al-Zarqawi claiming responsibility for attacks across Iraq.

Weimann says the Web offers terrorists "anonymity, easy access ... and the
ability to disappear."
By Stephen J. Boitano, AP

The sites are often shut down by the governments of the countries in which
they're based, but new ones quickly appear. USA TODAY's Mark Memmott talked
with an expert on terrorists' use of the Internet, Gabriel Weimann, a
senior fellow at the federally funded U.S. Institute of Peace. Their
conversation has been edited for length and clarity.

Q: Can't terrorists be caught by tracing who posts their messages?

A: You can track it. ... The question is, how deep can you go and how far
can you go? Let me explain the layers. ... The first layer will be to look
at the Web site and see the address. With the address, you can track the
server (host computer) that is used - you can see where the Web site is
based. That can be done in seconds. It's not a problem. ... That is being
done by security agencies and counterterrorism forces all over the world.

 Q: What's the next layer?

A: To know where the message or the video or the announcement or the
picture or whatever was sent from. ... If I try to post something on a Web
site, I'm using a server, too. There are two servers connected: the server
that I'm using and the server that posts it on your Web site.

 Q: Sounds simple to trace.

A: But there are many options. You can access different servers from
different domains, which are public. It can be a university library. You go
to a public library or a university library or an Internet cafe.

Q: So, physically, there's little evidence to find if investigators get to
that library or cafe?

A: Now we're getting to the third level: the user. Let's say that I find
the server that you used. I still didn't get to the individual user. I can
say, 'This was sent from a computer in Jakarta' ... or from wherever. It
was in a library or a computer network. ... But the user may disappear
seconds after posting the message. Usually they do. So the deeper you go,
the harder it is to find the user. This is one of the most important
advantages of the Internet for terrorists. Anonymity, easy access, free
access and the ability to disappear.

Q: And if the person who sat at the computer and sent the video out is ever
found, who is he likely to be?

A: The guy who's posting the messages for the terrorists, or doing the
downloading, is like the smallest of actors in the theater. You won't find
the scriptwriters.

I'm sure modern terrorists are quite aware of the possibility to track them
down. So the chains (in their organizations) will be very long, and
probably nobody knows who's the third link from him.

 Q: How do you, and investigators, monitor terrorists' use of the Web?

A: It takes time. ... Al-Qaeda right now is moving among 50 different Web
addresses. ... You have to follow the psychology of terrorists, the
publicity-seeking mind of terrorists. They want you to find (information
they put on the Web). They want people who are supporters or potential
supporters, and journalists, to find them. To do so they have to publicize
the new (Web addresses). They will go into Internet chat rooms and notify
people.

Q: So you monitor the chat rooms, watching for messages?

A: We call it lurking. You sit quietly in a chat room. You do nothing. Just
join it and sit quietly in the dark. This is what I do and what my research
assistants are doing. You find very important information.

 (Relevant chat rooms can be found, for example, by performing a Google
"groups" search using key words such as al-Qaeda or jihad.)

Q: What are the messages like?

A: Someone might ask, "Where can I find video of a Chechen slitting the
throat of a Russian?" A few lines later, someone will answer, "Go to this
Web site, and you'll see it."

Q: People are looking for such things, then?

A: Yes, and now we're coming to the speed at which things move. Once
(terrorists' messages or video) appears somewhere, especially after an
execution or dramatic event, within seconds it will be diffused and posted
on other Web sites. You can find it within seconds all over the Internet.
Even the beheading of Mr. Johnson. It was posted first on an Arab (Web)
forum in England. But within seconds, it was also posted on American
servers and American Web sites and then worldwide.


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'





More information about the cypherpunks-legacy mailing list