‘You are next’: online posts show Islamic State interest in attacks on US ahead of election

By Guardian-Ben Makuch - Sun 20 Oct 2024 12.00 BST

Internet chatter and Oklahoma arrest of alleged would-be IS attacker indicate terror group’s planning attacks on US ahead of election

After the FBI arrested an Afghan man in Oklahoma planning an election day shooting on behalf of the Islamic State, the terrorist organization re-entered what has become one of the most chaotic news cycles leading up to a November vote.

Nasir Ahmad Tawhedi, 27, of Oklahoma City admitted to investigators he and a co-conspirator expected to die as IS martyrs as they opened fire on crowds on election day, according to charging documents.

Warnings about IS-sponsored or -inspired attacks in the west have intensified in recent weeks.

In a statement on the Tawhedi case, the US attorney general, Merrick Garland, remarked there was a continuing need to “combat the ongoing threat that [IS] and its supporters pose to America’s national security”. Ken McCallum, the head of MI5, the UK’s domestic intelligence service, described how his agency had “one hell of a job” managing the threat of the resurgent terrorist organization.

Despite the talk from top officials, public perception still remains that IS was defeated or has somehow disappeared.

But, experts say, before and after that incident, internal IS talk was anything but quiet: on chat boards and encrypted apps, both supporters and operatives alike have increasingly been discussing attacks on the west and the US homeland.

The online conversations are being led by IS-Khorasan (IS-K), the branch based in Afghanistan that was behind the Moscow attack that killed 145 people in March. Khorasan is a reference to an ancient region that includes parts of what is modern-day Iran, Afghanistan and other bordering countries.

IS-K has quickly become the most active international force of the terror group, having already carried out the deadly plot in Russia and another in Iran months before it. Days after Tawhedi’s arrest, US officials later confirmed it was an IS-K operative allegedly directing the plot.

In a propaganda poster it released in September, IS-K put American targets on notice as top of its hitlist.

“[IS-K] has recently reiterated its intent to target the US with a poster depicting one of its militants holding a grenade in front of the US Capitol building captioned ‘you are next,’” said Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, a watchdog organization working with government agencies around the world.

The Guardian obtained the same poster, which was released online through a known IS-K platform.

“This is additionally concerning given the branch’s mass casualty attacks on Russia and Iran, leaving the United States as the remaining adversary on this shortlist for a successful external operation,” said Webber.

Webber said the arrest of Tawhedi gave a glimpse into the “uptick” in attempted stateside plots emanating from IS. For example, earlier this week a Maryland man was charged for supporting IS with the criminal complaint describing his attempt at buying a Kalashnikov assault rifle.

Webber continued: “This follows a Tajik [IS suspect] arrested in Costa Rica; a central Asian network rolled up in New York City, Los Angeles and Philadelphia; as well as a Canada-based Pakistani national who was allegedly plotting an attack against a New York Jewish center.”

While IS-K has seized on the tumult in Afghanistan since the Taliban took over in the summer of 2021 and established a base of operations in that country, its broader movement has also been heavily recruiting since the 7 October attacks and the Israeli military operations that followed.

It’s part of an IS-K recruitment plan targeting young men in the west who can’t travel overseas easily. A relative of Tawhedi, who was an Afghan national who came to the US after the fall of Kabul, was charged in France for a similar plot.

In one spring issue of Voice of Khurasan, its English-language propaganda magazine, IS-K encourages “contacting the organization directly” through encrypted communications and being covertly recruited from western locales.

Riccardo Valle, the director of research at the Islamabad-based publication the Khorasan Diary, closely follows the movements of IS on everything from Facebook and Instagram to Telegram and the lesser-known encrypted chat app Rocket.Chat.

“Discussions online are very diverse,” he said. “However, there has been an increase in talks about either carrying out attacks or making hijra [migration] to tamkeen – lands where IS is present in force and controls.”

For years, a long-observed debate within IS channels is whether or not it’s more effective for followers to carry out attacks at home or travel to active war zones where IS operates and join in its ranks there.

On a Rocket.Chat forum, the choice communications platform among IS supporters and operatives, Valle said one user posted about lamenting Tawhedi’s arrest.

“I feel like if we had contact with these brothers before they bought the guns from the informants things would’ve turned differently,” they said, while another wrote: “I live in the west and we can do more damage here.”

In other chat dumps that Valle had access to and shared with the Guardian, users talked about “kitchen made bombs, commercial drones” and other potential simplistic tools for carrying out terrorism.

Another Rocket.Chat user, Valle showed the Guardian, directed an account to target Jewish people in an unnamed western country with knives.

“Now take a kitchen knife and drive it into the throat of a young Jew around your age when nobody is paying attention and then escape,” wrote the user.

Webber noted that a part of the problem in raising awareness surrounding the seriousness of the moment is the “common misconception that [IS] was defeated”.

But, he added, branches still remain in “Syria, Afghanistan, Pakistan, Somalia and elsewhere”.

US officials say documents appear to be legitimate and House speaker says ‘leak is very concerning’

By Guardian - Richard Luscombe - Sun 20 Oct 2024 15.26 BST

The US government is investigating an unauthorized release of classified documents that assess Israel’s plans to attack Iran.

The US House speaker, Mike Johnson, confirmed the investigation in remarks to CNN’s State of the Union program on Sunday, saying “the leak is very concerning”.

“There’s some serious allegations being made there,” the Republican from Louisiana said. “The investigation’s underway, and I’ll get a briefing on that in a couple of hours.”

Three US officials had earlier told the Associated Press about the investigation into the leak. A fourth US official said the documents in question appear to be legitimate.

The documents are attributed to the US Geospatial Intelligence Agency and National Security Agency, and they note that Israel was still moving military assets in place to conduct a military strike in response to Iran’s blistering ballistic missile attack on 1 October. They were sharable within the “Five Eyes”, which are the US, Great Britain, Canada, New Zealand and Australia.

The documents, which are marked top secret, were posted to the Telegram messaging app and first reported by CNN and Axios. The officials spoke on the condition of anonymity because they were not authorized to discuss the matter publicly.

The investigation is also examining how the documents were obtained – including whether it was an intentional leak by a member of the US intelligence community or obtained by another method, like a hack – and whether any other intelligence information was compromised, one of the officials said. As part of that investigation, officials are working to determine who had access to the documents before they were posted, the official said.

The US has urged Israel to take advantage of its elimination of Hamas leader Yahya Sinwar and press for a cease-fire in Gaza, and has likewise urgently cautioned Israel not to further expand military operations in the north in Lebanon and risk a wider regional war. However, Israel’s leadership has repeatedly stressed it will not let Iran’s missile attack go unanswered.

In a statement, the Pentagon said it was aware of the reports of the documents but did not have further comment.

Johnson on Sunday said he spoke with Israeli prime minister Benjamin Netanyahu – referring to him as “my friend” – and explained how he had made it a point “to encourage him”. He also said there would be “a classified level briefing, and then others, but we’re following it closely”.

The Israeli military did not immediately respond to a request for comment over the leak of the two documents.

The documents first appeared online Friday via a channel on Telegram, claiming they had been leaked by someone in the US intelligence community, then later the US Defense Department. The information appeared entirely gathered through the use of satellite image analysis.

One of the two documents resembled the style of other material from the US National Geospatial Intelligence Agency leaked by Jack Teixeira, an air national guardsman who pleaded guilty in March to leaking highly classified military documents about Russia’s war on Ukraine and other national security secrets.

The Telegram channel involved in the leak identifies itself as being based in Tehran, Iran’s capital. It previously published memes featuring Iran’s Supreme Leader Ayatollah Ali Khamenei and material in support of Tehran’s self-described “Axis of Resistance,” which includes Middle East militant groups armed by the Islamic Republic.

• The Associated Press contributed reporting