Ruslan Grumble - Fotolia
A 34-year-old Cardiff man, described by police as an “internet terrorist”, has been jailed for eight years after developing an encrypted version of a pro-Islamic State blog and publishing training videos on encryption which could be used by terrorists.
Former insurance and IT worker Samata Ullah, who appeared in court wearing a grey sweatshirt, admitted five terrorism offences, including professing to be a member of a proscribed organisation, Islamic State, also known as Isis and Daesh.
At a hearing at the Old Bailey on 2 May, Judge Gerald Gordon said he was satisfied that Ullah, who has been diagnosed with Asperger’s, was dangerous and that he should serve at least five years before being considered for release.
Ullah was arrested in September 2016, in a joint investigation, codenamed Gabbroid, that involved more than 100 officers from the Metropolitan Police and Welsh counter-terrorism units, with support from MI5.
Police seized more than 150 digital devices from Ullah’s bedroom, including phones, USB sticks and computers. These contained over 8TB of data – equivalent to 2.2 million copies of War and Peace.
Commander Dean Haydon, head of the Metropolitan Police’s SO15 counter-terrorism unit, said Ullah had created a website to act as a one-stop source of information for would-be terrorists.
“In my view, he was an internet terrorist. He had set up a self-help library for terrorists around the world, and they were using his library,” said Haydon.
Several people have been arrested in a number of countries following the investigation into Ullah and the website, Haydon disclosed.
“They never actually got to the attack planning stage, but any terrorist attack anywhere in the world would inevitably result in the loss of life,” he said.
Videos teach encryption
Ullah, of 77 Rennie Street in Cardiff’s Riverside area, made videos in his bedroom giving instructions on how to use encryption software to stay anonymous online.
He attempted to disguise his identity by wearing gloves, and used voice distortion to hide his Welsh accent.
Samara Ullah, 34, of Cardiff, created a website to share information with would-be terrorists
The videos, posted on Ullah’s blog, explained how readers of the website could use the Tails operating system to operate anonymously on the internet without leaving data behind on their computers.
The videos also offered instructions on how to send secure emails using PGP and secure instant messages using Pidgin software, and how to use the VeraCrypt encryption program to hide data on a computer hard drive.
Although instructions on encryption software are widely available on the web, prosecutors claimed that in the context of a website devoted to Islamic State, they could only have been intended to help potential terrorists.
“It was actually used by terrorists around the world, we know that, and they actually valued the support and advice he was giving,” said Haydon.
The court heard that Ullah had also researched a technology known as ZeroNet, “with the intention of assisting another or others to commit acts of terrorism”.
He published instructions on his blog explaining how people could use the ZeroNet to create a version of the website that would be virtually impossible for law enforcement to censor or take down.
The service, which was developed in Budapest, Hungary, uses Bitcoin cryptography and open source peer-to-peer technology to create multiple copies of internet files, spread across multiple computers.
The court heard, however, that a forensic analysis of the website, commissioned by Ullah’s defence team, showed that in practice the technology would not have worked.
Ullah pleaded guilty to possessing one USB cufflink loaded with a copy of the Linux operating system, for terrorist purposes. Police claimed it could have been used along with encryption software to hide his identity.
In total, police recoverd 30 pairs of USB cufflinks from Ullah’s bedroom. Police claim that Ullah, who bought the cufflinks from eBay, intended to fill them with Islamic State propaganda, and sell them on to potential terrorists.
Police recovered 30 pairs of USB cufflinks from Samara Ullah’s home, which they claim he intended to fill with Islamic State propaganda and sell on to potential terrorists
Other cufflinks contained information about missile systems and rocket design, including an electronic book, entitled Advances in missile guidance, control and estimation, described as an advanced guide to missile guidance and control.
A second hard-copy book, entitled Guided missiles fundamentals AMF 52-31 – a US Air Force technical training manual – was also seized from his home.
“He was sharing information from those books, that formed part of the technical conversations he was having with various people around the world,” said Haydon.
Arrest follows tip-off from Kenya
The Metropolitan Police traced Ullah after police in Kenya arrested a terrorism suspect, identified in court as Abu Fidaa.
Police were able to establish that Fidaa was in regular contact with Ullah, and that the pair had had discussions about developing specialist skills to help Islamic State in its terror campaign.
Investigators discovered that Ullah had hijacked 30 dormant Twitter accounts in an attempt to hide his identity. He had also set up 50 email addresses and used nine different phone numbers to cover his tracks.
Loner who spent his time on the internet
Ullah was separated from his wife and spent much of his time in his bedroom, using the internet. He is believed to have “self-radicalised” by studying information on Islamic State on the internet.
“He is a lone actor, but he is a lone actor online. He is very much a lone individual, operating from his bedroom,” said Haydon.
Police said Ullah was responsible for creating an Islamic State blog site – known in English as “supporters of the Caliphate” – and populating it with well-indexed information, including links to terrorist propaganda and details about weapons and encryption.
In the videos he posted, ’internet terrorist’ Samara Ullah attempted to disguise his identity by wearing gloves and using voice distortion to hide his Welsh accent
“He had actually catalogued that on his library so anybody could access and find literally anything they wanted in and around that relating to Daesh,” said Haydon. “In my view, he is a dangerous individual.”
Ullah had no formal training in information technology, said Haydon, but was very technically competent.
Terrorist or fantasist?
Ullah’s defence team had presented evidence to the court that Ullah was a fantasist, with a tendency to become obsessive because of his Asperger’s. He lacked real-world friends, spent most of his life online and became obsessed with Islamic State, they said.
But in an oral judgment at the Old Bailey, Judge Gordon said it was difficult to reconcile the idea of a fantasy world with the activities of Isis.
“Although Asperger’s played a role in what he he was doing, he must, as an intelligent man, have appreciated the nature of the organisation he was trying to help,” said the judge. “Either he did genuinely obsess and support it, or he put his need for friendship and cause above his understanding of the organisation.”
Gordon said that, from the evidence presented in court, it seemed Ullah was not “as technically able as he thought or portrayed himself”.
He added: “He was nevertheless doing his very best to join in terrorist activities promoted by that [blog] site, by providing technical assistance to avoid detection.”
Ullah pleaded guilty to five counts of terrorism during a hearing at the Old Bailey on 20 March.
He was sentenced today to concurrent prison sentences of four years for membership of a proscribed organisation, Isis; eight years for terrorist training and preparation for terrorism; six years for possessing a USB cufflink containing the Linux operating system for a purpose connected with the commission, preparation or instigation of terrorism; and six years for possessing a book and a PDF on missile guidance systems for purposes connected with the commission, preparation or instigation of terrorism.
Investigation challenging for police
Haydon revealed that police had found the investigation into Ullah’s activities challenging, as it fell outside the traditional “attack-plan and travel” pattern to terrorist threats.
Detectives faced challenges establishing the significance of evidence gathered from the internet, translating it into material they understood, and matching that to terrorist legislation.
The investigation drew on expertise from the National Digital Exploitation Service (NDES), a unit formed in September 2016 to investigate terrorist activities under part of the Met’s counter-terrorism division, and MI5.
“It was really through a combination of good police work, good intelligence work and good technical expertise that we were able to arrive at the charges for Mr Ullah,” he said.
The Metropolitan Police said most of the material of the blog had been taken down, but police were still working with internet service providers to have other content removed.
“Encryption has its place, quite rightly, in some places on the internet, but frustratingly for law enforcement and the security services, it is where terrorists can operate with impunity,” said Haydon.