Terrorism's Hook Into Your Inbox

Following the Trail

Investigators zeroed in on the three U.K. residents in October 2005, following a tip from Bosnian authorities. Officials there had just arrested Mirsad Bektasevic, a 19-year-old Swedish national of Bosnian origin, and Abdul Cesur, a 21-year-old Danish man of Turkish heritage, as the two were preparing for a bomb attack on European soil. Bektasevic and Cesur were found in possession of nearly 44 pounds of plastic explosives. Also included among their possessions was a video of the two men in ski masks armed with improvised explosive devices.

Such a cache, if armed properly, would have had the potential to inflict massive casualties in a coordinated suicide bombing. In the July 2005 attacks against London's transport system that killed 52 people and injured more than 700, each of the four suicide bombers carried just 10 pounds of explosives concealed in backpacks.

The video seized by Bosnian police was a message from Bektasevic and Cesur meant to be seen after the two had conducted their attack. In it, they said they planned to attack sites in Europe to punish nations that had aided in the invasions of Afghanistan and Iraq. The two were later convicted of plotting to blow up an unidentified European target and sentenced to more than 13 years in prison.

Police were able to draw a connection between the Bosnian duo and the U.K trio because Bektasevic had saved one of the men's phone numbers on his cell phone.

Later that month, British authorities raided Tsouli's basement apartment in West London. Tsouli was reportedly arrested while logged on to the Web site "youbombit.r8.org" using the online identity "IRH007."

It wasn't until weeks after his arrest that U.S. and U.K. police learned that Tsouli was the individual who until then was known to counterterrorism officials only as "Irhabi007." As Irhabi -- literally "terrorist" in Arabic -- Tsouli was thought to have hacked into dozens of Web sites. He then used the sites to host huge computer files, mostly videos of beheadings and suicide bombings filmed in Iraq. Irhabi007 also spent a great deal of time creating and disseminating tutorials on hacking and hiding one's identity online.

Investigators say Tsouli later began using stolen credit card numbers and identities to buy Web hosting services. According to data gathered by U.S. officials, Tsouli and his two associates used at least 72 stolen credit card accounts to register more than 180 Web site domains at 95 different Web hosting companies in the United States and Europe.

Rita Katz, director and co-founder of the SITE Institute, which gathers intelligence on jihadist activity by monitoring dozens of online forums, said the evidence unearthed from items seized from Tsouli's arrest revealed that he had helped to create an online network used by jihadist cells across the globe to exchange information, recruit members and plan attacks.

On Tsouli's laptop, authorities said they found a folder named "Washington" that contained short, video clips of the U.S. Capitol grounds, the World Bank building, a hazardous chemical response vehicle, and fuel tank storage facilities in the Washington metropolitan region. Also on the laptop were instant message chat logs and a PowerPoint presentation detailing how to construct a car bomb.

Five months later, U.S. investigators would arrest two men in the Atlanta area for allegedly working with Tsouli and others to produce the videos discovered on the laptop. In June 2006, Canadian authorities arrested 17 people and charged them with attempting to blow up targets in Canada. Katz, whose institute has worked with investigators in this and other Internet-related terrorism cases, said the two Americans and the members of the Canadian group had all communicated with one another on a jihadist Internet message board.

Masters of Cyber Crime