IS supporter Samata Ullah branded a “new and dangerous breed of terrorist"

Samata Ullah, a 34-year-old man from Cardiff who posted encryption training videos on a radical Islamic blog, is a dangerous “cyber terrorist”, a court heard on 28 April 2017

A former insurance worker who contributed encryption training videos to a pro-Islamic State website, was branded as a “new and dangerous breed of terrorist” at a hearing in the Old Bailey court.

Samata Ullah, a 34-year-old man from Cardiff, is awaiting sentencing after pleading guilty to five terrorist offences, including terrorist training and preparation of terrorism acts.

Brian Altman QC, for the prosecution, told the court that Ullah was a dangerous “cyber terrorist” who used his technology skills to further the cause of Isis, also known as Islamic State.

Ullah, who was unemployed and lived alone in his mother’s house in Cardiff, spent his time in his bedroom browsing the web and became obsessed with the Islamic State. He has been diagnosed with Aspergers.

Files and videos found on computers and USB cufflinks at Ullah’s home provided evidence that he was not just a supporter but a member of Isis, said Altman.

From December 2015, Ullah filmed two training videos in his bedroom, explaining how to use encryption and secruity software, including PGP, Pidgin, Tails and VeraCrypt. He distorted his voice, wore gloves and ensured his face did not appear in the videos to avoid identification.

The videos were posted on Dailymotion, the French equivalent of YouTube, and on an Islamic State propaganda blog known as “Ansar al Khilafah”, which purported to offer “everything about the Islamic State: news updates, all media releases, and articles about Khilafa (Califate)”.

Ullah also researched a technology known as ZeroNet, which he attempted to use to create a distributed version of Ansar al Khilafah, which would be difficult to censor or to take down by the authorities.

He has pleaded guilty to possessing a book on guided missiles which he had bought on eBay in March 2014, and a PDF of another book on advanced missile guidance, published by CRC Press.

Kenyan connections

The Metropolitan Police and Welsh Counter Terrorism began an investigation into Ullah after Kenyan Police arrested an Islamic activist known as Abu Fidaa in April 2016.

The FBI were able to recover files from Fidaa's mobile phone and computer, which allowed investigators to trace Fidaa’s contacts, including Ullah.

It emerged that Fidaa had initially contacted Ullah by sending him a direct message on Twitter, and later introduced him to the Ansar al Khilafah blog site, the court heard. They communicated in chat groups on the secure messaging app, Telegram.

Messages recovered from computer equipment and phones show that Abu Fidaa had encouraged Ullah to make the encryption videos and to share copies of his books on missile technology.

“As for guided missile fundamentals, please scan it and upload it to I am going to pass it to the bros ... Also send the e-book,” Fidaa wrote.

Altman said Ullah had “made it clear to Abu Fidaa that it was his intention to pass on whatever knowledge and advice he had and distribute that to the Califate”.

In one message, Ullah suggested that the Islamic State should send teenagers to university in Turkey to learn subjects that would be useful to the group.

“Chemistry graduates know how to mix the right ingredients for explosives, while chemical engineers know how to put together equipment to make these explosives on an industrial scale.”

‘Nothing new’ in training videos

Expert analysis presented to the court showed that there was nothing novel or unique about the information in Ullah’s encryption videos, said Ben Emmerson QC, acting for Ullah.

Duncan Campbell, a forensic expert, identified 30 other videos on Dailymotion that offered nearly identical training. They were viewed more than 750,000 times in six years.

“The real-world impact of what he had done was a drop in the ocean,” Emmerson told the court.

Ullah’s attempts to create a permanent and irremovable version of the Ansar al Khilafa using ZeroNet were a failure, he added.

Forensic evidence showed that the ZeroNet version of the site could not contain all of the information on the original blog because it was too small.

“The version that Ullah created was non-viable, incomplete and could not be updated in the future to make it viable,” said Emmerson.

People had left messages complaining about the ZeroNet version of the site, and the police also experienced difficulties with it.

Islamic material recovered

Investigators recovered vast quantities of radical Islamic literature from electronic devices seized from Ullah’s home.

This include copies of the Dabiq propaganda magazine, documents from the “Islamic State Central Office”, and a style guide for producing English language literature on the Islamic State.

One PDF was entitled Beyond Antrax: The Weaponization of Infectious Diseases. Others, such as Secrets of a Super Hacker, gave instructions on how to hack into computer systems and how to hide secret messages in audio and picture files.

A forensic report concluded that there is no evidence that Ullah uploaded any files to the Ansar al Khilafah blog site, apart from the two encryption training videos. Some 121 files found on Ullah’s computer had been automatically downloaded from the web site, the court heard.

Ullah lived an online fantasy life

Ben Emmerson QC, representing Ullah, told the court that Ullah was living out a fantasy life online, along with others who describe themselves as “fanboys” of Isis.

“He was part of a diaspora of pro-Isis supporters who live out their fantasies online,” he told the court. “He created an avatar, a false online persona of himself.”

Ullah was at least one step – probably two steps – removed from anyone involved in the Islamic State, he told the court.

“There is nothing in the evidence that could raise the possibility that the battle hardened commanders of Isis in Syria had shown or would have shown any interest in this man bragging in his bedroom in Cardiff,” he said.

He said the books on guided missiles found in Ullah’s possession were publicly available. One of them was more than 40 years old and unlikely to be of any value. Another contained complex algorithms that Ullah, and those he discussed it with, did not understand.

Groomed by Kenyan radical

In mitigation, Emmerson told the court that Fidaa had groomed Ullah and encouraged Ullah to share his expertise with IS supporters.

Ullah regarded Fidaa as his only friend, even though the two had not met. “I tried to keep him online with me because I did not want to lose a friend,” Ullah  had confided.

Ullah’s obsessive behaviour was fundamentally the result of his Aspergers, said Emmerson, which “left him vulnerable to exploitation and fantasy behaviour online”.

Ullah has been in and out of jobs since he left school. He became interested in politics on the internet after being given a computer in 2000. He took part in online debates about Middle East policy and studied online security.

He began working in the pensions department of Legal and General in 2016. He was quiet and did not perform well, and did not socialise with the other trainees. A month later, he resigned.

Ullah was arrested in Paget Street, Cardiff, on 22 September 2016, for breaches under the Terrorism Act 2000, following an investigation by the FBI and UK Counter Terrorism police.

Since his arrest, Ullah has shown remorse and wants nothing more to do with Isis or Jihadi thinking, according to a report by Simon Baron Cohen, an expert on Aspergers. According to the police, Ullah was shocked when he realised what he had done.

Read more on Hackers and cybercrime prevention