Al-Qaida's online forums go dark for extended period

WASHINGTON — Al-Qaida's main Web forums have been offline for the past 11 days in what experts say is the longest sustained outages of the sites since they began operating eight years ago.

No one has publicly claimed responsibility for disabling the sites, but the breadth and the duration of the outages have prompted some experts to conclude the forums have been taken down in a cyberattack — launched perhaps by a government, government-backed organization or hacking group.

The first website, Shumukh al-Islam, a primary source for al-Qaida videos and messages, went down on March 22, and since then four others have gone dark. The administrator of a second-tier al-Qaida site recently posted a message on an online forum saying that “the media arena is witnessing a vicious attack by the cross and its helpers on the jihadi media castles.”

Officials in the United States and elsewhere have long been concerned by sites associated with al-Qaida. Those sites have been used to call for violence against Western targets and to try to recruit Islamic extremists to carry out attacks.

There remains uncertainty over whether the recent outages were caused by a cyberattack at all, and some skeptics note that some prominent al-Qaida forums remain online. U.S. government agencies, including U.S. Cyber Command, had no role in the outages, according to officials who would speak about the issue only on condition of anonymity.

Still, Will McCants, a former State Department counterterrorism official who is now a senior fellow at the Homeland Security Policy Institute at George Washington University, said given the number of sites down and the duration of the outages, “it sure looks like a takedown.”

If it were a technical problem being addressed by site administrators, “usually they will get on another site and say we've got administrative problems,” McCants said.

The last lengthy blackout of al-Qaida Web forums took place in the summer of 2010, when British intelligence officials disrupted the launch of an online magazine produced by the network's affiliate in Yemen.

In that case, the most prominent al-Qaida site at the time, al Fallujah Web forum, was dark for at least seven days, said Evan Kohlmann, senior partner at Flashpoint Global Partners, which tracks the sites, which are mostly in Arabic language. The magazine appeared on the restored forum about two weeks later. Although he generally sees the disruption of al-Qaida websites as a fruitless game of whack-a-mole, Kohlmann said the most recent outages have clearly begun to affect jihadi communications.

“At least temporarily, the social networking among jihadists has been disrupted,” he said. “The remaining forums are really struggling to attract the participation of users.”

For years, U.S. intelligence officials have relied on al-Qaida forums to gather insights into conversations among extremists. Some officials have argued against attempts to shut down the forums, saying they provide valuable intelligence.

At the same time, any cyberattack, even one that shut down an online forum only briefly, could temporarily stifle extremist activity, or perhaps just sow confusion and distrust among users.

Said one U.S. official: “It's a good thing whenever a terrorist website goes offline.”

Regardless of the cause of the latest outages, if they persist, the larger consequences could be far-reaching, said A. Aaron Weisburd, a senior fellow at the Homeland Security Policy Institute who runs Internet Haganah, a site that tracks jihadi forums.

The loss of primary forums such as Shumukh and al-Fida' would deprive al-Qaida of control over its message, he said. “It leaves the rank-and-file to guess which messages and which messengers are genuine al-Qaida, and provides undercover operators with new opportunities to disrupt the movement,” he said.

Comments on the handful of Arabic-language forums that remain online reflect the frustration and defiance among users.

“Life without Shumukh and Fida' is unbearable ... they are the Titanic supporting the foundation for the triumphant sects fighting in Iraq, Yemen, Somalia,” a user identifying himself as Fata Musslim Ghayoor said on the Ansar al-Mujahideen Arabic Forum on Thursday, according to a Flashpoint translation.

“The forums will return,” commented a user identified as “Azam” on a different site. “We are in a media battle with the enemies of Allah. ... Even if Shumukh is gone, a thousand other Shumukhs will be born.”

Philip Mudd, a former longtime CIA and FBI counterterrorism expert, said he understands the intelligence value the sites have. But as the al-Qaida movement loses ground, he said, “maybe the more important issue is how do we now get more aggressive in shutting down any effort they have to spread the message?”

In the past, U.S. officials have also relied on diplomatic channels to dismantle extremist sites that are seen as posing a threat to American personnel or interests, according to former U.S. officials familiar with the episodes.

The approach has worked in more than a dozen cases, and in each instance was backed by at least the implicit threat of a cyberattack by the U.S. military if the website's host country failed to act, the officials said. The countries that cooperated were in Europe, the Persian Gulf and the Pacific, they said.

“We've never had a country refuse us,” said the former vice chairman of the Joint Chiefs of Staff, James Cartwright, speaking at U.S. China Commission hearing at George Mason University last week. “But if they did, then you can invoke the right of self-defense.”

Cartwright said that in some cases the foreign government would be given a 48-hour window to investigate, what he termed “fair notice,” before the U.S. military did so on its own.

The approach makes sense, current and former officials say. Although the U.S. government has the ability to disrupt the sites on its own, “you're not going to go do something unilaterally if you can do it cooperatively,” said a former administration official who requested anonymity to discuss sensitive internal deliberations.

The al-Qaida sites that have recently gone offline were hosted on servers in various countries, including Malaysia, Panama and the Gaza Strip, Kohlmann said. It is rare these days to see them hosted on servers in the United States or Canada, he said.

Some of the forum followers have suggested new outlets.

Said one commenter, Al-Muktafi bel-Lah, last week: “I suggest to the brothers having a page for the jihadi forums on Facebook and twitter.”