The Global Intelligence Files,
files released so far...
2537
The Global Intelligence Files

### Index pages

List of Releases

### by Date of Document

unspecified
2001
2004
2005
2006
2007
2008
2009
2010
2011

### by Date of Release

2001-03-13
2010-03-10
2011-03-05
2011-03-15
2012-01-29
2012-02-27
2012-02-28
2012-02-29
2012-03-01
2012-03-02
2012-03-03
2012-03-04
2012-03-05
2012-03-06
2012-03-07
2012-03-08
2012-03-09
2012-03-10
2012-03-11
2012-03-12
2012-03-13
2012-03-14
2012-03-15
2012-03-16
2012-03-17
2012-03-19
2012-03-20
2012-03-23
2012-03-25
2012-03-26
2012-03-27
2012-04-01
2012-04-02
2012-04-24
2012-04-26
2012-04-30
2012-05-10
2012-06-18
2012-06-20
2012-07-01
2012-07-24
2012-07-28
2012-07-29
2012-07-30
2012-07-31
2012-08-01
2012-08-02
2012-08-05
2012-08-06
2012-08-07
2012-08-08
2012-08-09
2012-08-10
2012-08-11
2012-08-12
2012-08-13
2012-08-14
2012-08-15
2012-08-16
2012-08-17
2012-08-18
2012-08-19
2012-08-20
2012-08-21
2012-08-22
2012-08-23
2012-08-24
2012-08-25
2012-08-26
2012-08-27
2012-08-29
2012-08-30
2012-08-31
2012-09-01
2012-09-02
2012-09-03
2012-09-04
2012-09-05

### Our Partners

ABC Color - Paraguay
Al Akhbar - Lebanon
Al Masry Al Youm - Egypt
Asia Sentinel - Hong Kong
Bivol - Bulgaria
Carta Capital - Brazil
CIPER - Chile
Dawn Media - Pakistan
L'Espresso - Italy
La Repubblica - Italy
La Jornada - Mexico
La Nacion - Costa Rica
Malaysia Today - Malaysia
McClatchy - United States
Nawaat - Tunisia
NDR/ARD - Germany
Owni - France
Pagina 12 - Argentina
Philip Dorling - Fairfax media contributor - Australia
Plaza Publica - Guatemala
Publica - Brazil
Publico.es - Spain
Rolling Stone - United States
Russian Reporter - Russia
Ta Nea - Greece
Taraf - Turkey
The Hindu - India
The Yes Men - Bhopal Activists
Sunday Star-Times - New Zealand

### Community resources

Supporters Support Wikileaks Follow us on Twitter Twitter this Follow us on Facebook

courage is contagious

# The Global Intelligence Files

On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.

## Terrorism Weekly : India: Arrests, Revelations and Implications

Released on 2012-08-25 09:00 GMT

Email-ID | 347739
Date | 2008-08-20 23:20:49
From | noreply@stratfor.com
To | allstratfor@stratfor.com

Strategic Forecasting logo
India: Arrests, Revelations and Implications
August 20, 2008
Graphic for Terrorism Intelligence Report
By Fred Burton and Scott Stewart
On Aug. 17, an Indian court in Ahmedabad, Gujarat, remanded nine
suspects to police custody for 14 days. The nine were accused by the
police criminal branch in Ahmedabad of involvement in a string of 17
explosions that rocked Ahmedabad on July 26, leaving more than 50 people
dead. Among those arrested was Mufti Abu Bashir, who Indian authorities
claim masterminded the attacks and who reportedly admitted his
involvement during interrogation.
On Aug. 19, police in Rajasthan announced that they have detained 13
people in connection with the May 13 attacks in which seven improvised
explosive devices (IEDs) were used to strike soft targets in Jaipur that
killed 68.
Both the Ahmedabad and Jaipur attacks, as well as attacks involving
eight IEDs that occurred July 25 in Bangalore, have been claimed by an
organization calling itself the Indian Mujahideen. In a series of
e-mails sent to the Indian press, the organization stated that the
operations were intended to demolish the faith of the "infidels in
India." They also claimed that the attacks were in retaliation for the
2002 communal riots in Gujarat in which more than 1,000 (mostly Muslim)
people were killed. The e-mail claiming responsibility for the Ahmedabad
attacks was sent to news outlets just minutes prior to the attacks -
underscoring the claim's veracity.
Indian authorities believe that the Indian Mujahideen is really a
pseudonym used by the banned Students Islamic Movement of India (SIMI),
although some reports suggest that it is in fact a militant faction that
broke away from the more moderate wing of the SIMI organization. Other
sources have suggested that the Indian Mujahideen is actually a
cooperative effort between Kashmiri militant groups, SIMI and
Lashkar-e-Taiba (LeT) or Harkat-ul Jihad al-Islami (HUJI).
Any of these three explanations could be the truth. Kashmiri groups have
traditionally used a number of names in an attempt to sow confusion -
confusion further aided by the fact that the Kashmiri militants tend to
be a fractious bunch. Furthermore, in general, people arrested by the
police for violent undertakings who are part of a particular
organization will commonly deny membership in an effort to protect their
fellow members from government action. This murky milieu makes it very
difficult to sort out the true identity of the group calling itself the
Indian Mujahideen.
What we do know, however, is that some people who were at some point
affiliated with SIMI do appear to be connected with these attacks and
that the attacks were claimed by the Indian Mujahideen. We also know
that some SIMI members have been closely linked to other Kashmiri
militant groups such as LeT and HUJI.
Indian authorities have made a number of arrests of high-ranking SIMI
members over the past several months that appear to be connected to the
Indian Mujahideen and this string of related bombing attacks.
Information provided by these men during interrogations suggests that
there are a number of operational cells scattered throughout the country
including trained bombmakers.
The recent arrests in Ahmedabad and Jaipur are a step in the right
direction, but the Indian authorities have a long way to go before they
will be able to defang the indigenous threat posed by the SIMI/Indian
Mujahideen.
Operational Similarities
In addition to the claims of responsibility, there are a number of
operational similarities that tie the Jaipur, Ahmedabad and Bangalore
incidents together. These attacks also share a number of characteristics
with a failed July 29 attempt to attack the city of Surat, Gujarat, with
more than 20 IEDs.
First, the attacks all involved a number of small devices that were
concealed in small boxes or bags and directed against soft targets such
as crowded markets and bazaars - busy locations with lots of people and
lots of places to stash the devices. The devices were all hidden and
left in place to detonate by timer and not by command. Furthermore, the
devices all contained shrapnel such as nuts, bolt and ball bearings.
This is a clear indication that although they were small, they were
intended to kill and not merely attract attention. Some of the devices
were hidden in containers and attached to auto rickshaws or bicycles
that were left in public places; others were placed inside automobiles
that had been stolen and then parked on the street. The attacks also
involved improvised explosive mixtures or commercial explosives rather
than the military-grade RDX usually associated with past Kashmiri
militant attacks in India.
However, in spite of the similarities, there were some differences in
the construction of the unexploded devices recovered in Ahmedabad and
Surat, indicating that there may have been a different bombmaker
involved in those two cases. For example, a few of the devices recovered
in Surat had small gas canisters affixed to them, an element not seen in
the other attacks. Additionally, the timers employed in the Surat
devices were reportedly stand-alone integrated circuit timers, whereas
the Ahmedabad devices used simple mechanical timers. Judging from the
total failure of the Surat devices, either the timers had a critical
flaw or the bombmaker responsible for them made a critical error while
assembling the devices. Normally, a bombmaker will test his components
prior to assembly - so either a test of the timers was not conducted, or
the problem lay in the assembly of the devices' components and not the
timers themselves.
Some have suggested that the Surat devices were dummies intentionally
constructed not to explode, but we do not buy that theory. If a group
really wanted to achieve that result, it could have done so with one or
two hoax devices. The group would not have taken the effort and risk of
constructing and planting more than 20 devices. Adding shrapnel to such
hoax devices or attempts to enhance their effectiveness by adding fuel
canisters also would not have been necessary. From the number and design
of the Surat devices, it is clear their designers clearly wanted them to
function and ultimately cause casualties.
This modus operandi of using multiple, small devices hidden in bags or
boxes, placed in congested areas and activated by timers has also been
seen in several other attacks in India in the recent past, such as the
May 2007 and November 2007 attacks in the Uttar Pradesh cities of
Gorakhpur, Varanasi, Faizabad and Lucknow, and an August 2007 attack in
Hyderabad, Andhra Pradesh.
This operational profile is very different from the attacks we are
seeing in Pakistan or Afghanistan, where militants tend to use much
larger devices activated by suicide operatives. It is, however, similar
to tactics we have seen previously employed in Bangladesh, where one
militant attack in August 2005 involved more than 400 small IEDs. This
similarity may not be mere coincidence. As security along the
Indian-Pakistani border has tightened in recent years, militants have
increased their use of the porous border with Bangladesh to move in and
out of India.
Interrogations Shedding Light on SIMI
In November 2007, Indian police caught a break when they arrested a man
named Riazuddin Nasir, alias Mohammed Ghouse, in India's southern
Karnataka state. Nasir was initially collared for vehicle theft, but
authorities later learned that he was stealing vehicles for use in
terrorist attacks. According to Nasir's interrogation, he was a SIMI
activist who helped recruit and train activists at a remote camp in
Hubballi, Karnakata. Nasir further relayed that 40 militants had
gathered for training there and that at least 15 of them were trained to
construct IEDs. After training ended, the militants were sent out to
different parts of the country to conduct operations. Based on Nasir's
information, Indian Intelligence Bureau officials increased their focus
on SIMI. As a result, their efforts enabled Indian officials to track
down some, but not all, of the men who were allegedly trained militants.
One of the alleged militants swept up by the authorities in March 2008
was Safdar Nagori, the general secretary of SIMI, who Nasir identified
as participating in the training. Nagori led police to a second training
camp in Choral, Madhya Pradesh, where they uncovered a cache of
explosives. According to Nagori's interrogations, the camp in Choral was
used to train classes of 20 militants at a time and had graduated five
such classes in 2006 and 2007.
The Aug. 17 arrest of Mufti Abu Bashir was a further blow to the
organization. Bashir was a madrassa teacher in Hyderabad who claims to
have been recruited into SIMI by Nagori. Bashir has admitted to
masterminding the Ahmedabad attacks and, during interrogation,
reportedly told Indian authorities that he assumed a leadership role in
the organization following the arrest of Nagori.
Another IT connection
Indian authorities say that their interrogations of Bashir revealed the
identity of the man who sent the e-mail from the Indian Mujahideen to
the Indian press just prior to the Ahmedabad attack. They claim that
Taufique Bilal, also known as Abdul Subhan Qureshi, a Mumbai-based
militant, was tasked by Bashir with sending the message. The authorities
say they now believe that Bilal hacked into the wireless Internet
connection of an American living in Mumbai to send the message.
Bilal apparently came to the attention of the authorities after the July
11, 2006, Mumbai train bombings, but, at the time, they reportedly did
not have enough evidence to charge him. That has since changed, and
police in Gujarat have obtained a warrant for his arrest in connection
with the Ahmedabad attack. Indian police also claim that, In addition to
sending the e-mail claiming responsibility for the attack, Bilal
obtained the explosives and timers used in the incident and that he met
on several occasions with Bashir to plan it.
The American whose system was hacked by Bilal is an employee of the Navi
Mumbai-based IT firm Campbell White. He does not appear to have been
involved in the case and has since left the country, although
controversy did arise over his leaving because he has not yet been
officially cleared by Indian authorities.
Bilal was also connected to the IT industry, and apparently earned a
degree in electronic engineering. Bilal reportedly worked in the IT hubs
of Bangalore and Hyderabad before moving to Mumbai. He appears to have
worked for the IT firm Wipro from 1996 to 1998. The Times of India is
reporting that Bilal may have worked for as many as three IT companies.
Using an American expatriate's computer to send the note was not only a
handy way to disguise the identity of the author, and a display of
operational flair, but it also underscores an awareness on the
militants' behalf of the importance of the IT sector to the Indian
economy and the significant role that international companies play. It
is clearly a shot across the bow.
Other Implications
The operational similarities in the attacks we have seen in 2007 and
2008, and the involvement of SIMI members such as Bashir, make it highly
likely that these attacks were conducted by the network that was trained
at the camps identified by Nasir and Nagori. While the Indian
authorities have arrested many of these people, there are still others,
perhaps hundreds of them, still on the loose. The arrests of senior SIMI
officials do not appear to have affected the network's operational
ability; in fact, the tempo of militant activity seems to have increased
following the arrests of Nasir, Nagori and others late 2007 and early
2008.
The SIMI/Indian Mujahideen militants may be encouraged and inspired by
al Qaeda (as materials recovered from their training facilities have
shown), but they appear to be a uniquely Indian phenomenon. So far,
their operations appear to have been planned and conducted by Indian
citizens who were trained and directed by other Indian citizens using
materials procured inside their own country. According to the
interrogations of captured leaders, the group has been able to recruit
and train hundreds of militants inside India.
It will be very hard for the Indian government to pin these connected
attacks on the Pakistani Directorate of Inter-Services Intelligence
(ISI) and its extensive network inside India. While all leads in Indian
counterterrorism investigations normally point to Islamabad, that does
not seem to be the case this time. In fact, even if the ISI were to
somehow drop its support for Kashmiri militants - something we do not
see happening - this particular organization would not seem to be
affected. This group's operations have been small scale and relatively
inexpensive to conduct. Such attacks are sustainable and do not require
extensive outside funding. If the ISI is backing this group, it has done
a very thorough job of hiding its hand.
Indeed, the Indian press recently reported that, according to the
interrogations of Nagori, SIMI was experimenting with peroxide-based
improvised explosives at its training camps inside India. The group was
apparently concerned that the Indian government would clamp down on its
ability to obtain commercial explosives and ammonium nitrate fertilizer.
This is a clear indication that the militants are not anticipating
future shipments of high-explosives from a sponsor such as the Pakistani
ISI. Peroxide-based explosives are notoriously fickle, unstable and
downright dangerous. Palestinian bombmakers gave peroxide-based
explosives such as triacetone triperoxide (TATP) the nickname "mother of
Satan" for good reason. Militants would certainly not bother with such
unreliable and dangerous improvised mixtures if they had any hope of
receiving military-grade explosives from a state sponsor.
Some Indian media outlets have claimed that the presence of electronic
components from Southeast Asia in the timers used in the Surat devices
indicates that there is a connection to Jemaah Islamiyah (JI), the
Indonesian-based al Qaeda franchise. However, electronic components such
as integrated circuits manufactured in Southeast Asia can be found in
nearly every part of the world, including India. It is, therefore, very
tenuous to try to draw a link to JI based on that fact. Plans for
integrated circuit timers are widely available in jihadist literature
and are not difficult to assemble - though, as previously noted, the
timers fabricated for the attacks in Surat appear to have somehow been
botched.
The strategic objective of these attacks has been twofold. The first
objective was to incite communal riots between Hindus and Muslims and to
inflame political tensions between Islamabad and New Delhi. Meeting this
objective would allow these groups to highlight any grievances Indian
Muslims have with the Indian government and expand their support base
within the country by radicalizing Muslims - and Muslim youth
specifically. The second objective was to damage the Indian economy.
Bangalore, Ahmedabad and Surat are important commercial centers, and
Jaipur is a popular tourist city.
To date, these attacks have not been successful in achieving these
objectives, though the ease with which the network was able to recruit
and train young militants may be a sign that the militants are making
progress in their efforts to radicalize Muslim youth. However, with
elections coming up and Hindu nationalist political parties stepping up
their activity, the network has a prime window of opportunity in which
to incite communal violence. Recently, protests by members of Hindu
national party Shiv Sena in Gujarat and Maharashtra have included
marches through Muslim neighborhoods, with protestors demanding that all
madrassas be closed - partly in response to the recent attacks.
While there have been a number of significant arrests, it will be
difficult for the Indian government to stamp out this domestic,
self-replicating network. As an indigenous organization, however, the
operational abilities of the network will be limited. Without outside
assistance it will likely continue to conduct simple attacks against
soft targets. This militant network has not yet begun to conduct large
al Qaeda-type attacks or to use suicide operatives, but this could
change should the network fall further under the sway of the
international al Qaeda movement.
Tell Stratfor What You Think
This report may be forwarded or republished on your website with
attribution to www.stratfor.com
Terms of Use | Privacy Policy | Contact Us
(c) Copyright 2008 Strategic Forecasting Inc. All rights reserved.