360DigitalInfluence

By Ellen Knickmeyer
Washington Post Foreign Service
Saturday, October 18, 2008; A01

DUBAI, United Arab Emirates, Oct. 17 — Four of the five main online forums that al-Qaeda’s media wing uses to distribute statements by Osama bin Laden and other extremists have been disabled since mid-September, monitors of the Web sites say.

The disappearance of the forums on Sept. 10 — and al-Qaeda’s apparent inability to restore them or create alternate online venues, as it has before — has curbed the organization’s dissemination of the words and images of its fugitive leaders. On Sept. 29, a statement by the al-Fajr Media Center, a distribution network created by supporters of al-Qaeda and other Sunni extremist groups, said the forums had disappeared “for technical reasons,” and it urged followers not to trust look-alike sites.

For al-Qaeda, “these sites are the equivalent of pentagon.mil, whitehouse.gov, att.com,” said Evan F. Kohlmann, an expert on online al-Qaeda operations who has advised the FBI and others. With just one authorized al-Qaeda site still in business, “this has left al-Qaeda’s propaganda strategy hanging by a very narrow thread.”

At the same time, in an apparently unrelated flare-up of online sectarian hostility, Shiite and Sunni hackers have targeted Web sites associated with the other sect, including that of a Saudi-owned television network and of Iraq’s most revered Shiite cleric.

On several occasions over the past three years, unknown hackers have shut down al-Qaeda-affiliated Web sites after they announced the imminent release of a new video message from Osama bin Laden or another extremist leader. It is often impossible to pinpoint the source of such online attacks, though some experts say the culprits could be independent activists.

A U.S. intelligence official, asked about the online attacks, declined to say whether U.S. spy agencies engage in them. American and British security forces each have joint commands overseeing online operations against extremists.

“There had been this aura of invincibility” about al-Qaeda’s media operations, said Gregory D. Johnsen, a U.S.-based expert on violent Sunni groups in Yemen. “Now this has really been taken away from them.”

In early September, the al-Fajr forums were drumming up anticipation of al-Qaeda’s annual video marking the Sept. 11, 2001, attacks. “Await Sept. 11!” one message declared.

Instead, on Sept. 10, the forums vanished.

Rapid changes in domain-registration information and in servers suggested that the sites’ webmasters were working intently to bring the forums back up, according to a statement from the SITE Intelligence Group, a leading private monitor of Web sites of extremist groups.

After about 24 hours, one forum, al-Hesbah, reappeared, according to Kohlmann, a senior investigator with the NEFA Foundation in Charleston, S.C.

Al-Qaeda’s Sept. 11 video eventually appeared on al-Hesbah, which means “one who holds others accountable,” on Sept. 19. By then, the shine had been taken off the anniversary for al-Qaeda supporters.

“Oh, my God, save my brothers on the jihadi forums,” one user posted on al-Hesbah, according to Kohlmann.

“My dear brothers . . . increase your supplications for Allah to guide the bullet and to restore al-Ekhlaas successfully so that the message is spread,” another user wrote, according to SITE, referring to the most prominent of the downed forums.

Johnsen said that on extremist “forums that are still up, you have people who are quite paranoid and quite confused” about what’s going on. He said it is “certainly normal for jihadi chat rooms and forums . . . to have some kind of disruption. It was very clear this is something entirely different.”

Al-Qaeda has continued posting videos and statements on al-Hesbah. But Kohlmann said comparatively few followers have passwords to that site.

Al-Qaeda webmasters may be too concerned about letting in infiltrators to issue more passwords for al-Hesbah or to move to an alternate forum with new passwords, Kohlmann said.

“It’s the first time it’s happened now in three years for al-Qaeda to have only one forum left carrying al-Qaeda’s propaganda stream,” Kohlmann said. The al-Fajr center was created in late 2005.

Al-Qaeda has had to rely on the sites of others to help distribute its videos, costing the organization some control of its message and shrinking its audience, monitors said.

The sabotage of sites operated by extremist groups makes it more difficult for those groups to inspire attacks and recruit attackers, said Erich Marquardt, editor in chief of the Sentinel, a monthly online publication by the Combating Terrorism Center at the U.S. Military Academy at West Point.

However, “the downside of knocking jihadist Web sites offline is that you lose the ability to monitor jihadist activities,” eliminating opportunities for Western monitors to search for ideological weaknesses or clues to future operations, Marquardt said. “When these Web sites are taken offline, it closes an important window.”

Separately, Sunni and Shiite Internet partisans are waging a tit-for-tat hacking war. For now, Sunni extremist sites are taking the brunt.

In September, hackers targeted what Iranian news media estimated to be 300 Shiite sites, many of them operated by Shiite religious leaders in Iran. Targets included the official site of Grand Ayatollah Ali Sistani, the leading Shiite cleric in Iraq. For several days, visitors to that site were connected instead to a YouTube video featuring American talk-show host Bill Maher mocking what he said were the cleric’s edicts, or fatwas, on sexual matters. Aides to Sistani later denied that he had issued such edicts.

A group called Ghoroub XP, based in the United Arab Emirates, asserted responsibility. Its claim has not been publicly confirmed by any authorities.

Alleged Shiite hackers responded in force. By Oct. 1, hundreds of sites run by Sunnis, including those of religious figures, had vanished. In their place appeared a site featuring an Iranian flag superimposed over the intense gaze of a smiling woman.

There also was a message, citing a Koranic verse: “And one who attacketh you, attack him in like manner as he attacked you.”

The site of the Saudi-owned network al-Arabiya was among those attacked, forcing the news organization to move its site briefly to another domain. Al-Arabiya managers issued statements saying their coverage was balanced and neutral.

One Iranian, who answered questions submitted in writing and was identified as a hacker by sources familiar with the online religious world in Tehran, asserted responsibility for disrupting one Sunni site and said Sunni extremists online provoked the attack.

“The war is only between Shiite groups in Iran and Wahhabis,” said the writer, who declined to be further identified. Wahhabis are followers of a stringent Saudi-born branch of Sunni Islam.

“The way of hacking is that they attack and we respond,” he wrote. “The future will reveal our next step.”

Correspondent Thomas Erdbrink in Tehran and staff writer Joby Warrick and staff researcher Julie Tate in Washington contributed to this report.