Russia and the far-right have aligned internationally, working in a complex network to undermine democracy and the stability of western powers. Working together they deploy state of the art techniques to hack data, emotionally control electorates, and spread disinformation.
Over a period of years, they have gained control of geopolitics and the financial markets through a labyrinth of connections and companies.
Understanding this raises more questions than it answers, especially when the changing face of terrorism is considered.
The greatest unanswered question is: has this global operation played an active role in terror attacks aimed at the democracies they are targeting?
There is no firm answer, but the flags are up.
In 2000, almost all terror attacks across the world involved the use of bombs. Non-complex, explosive devices.
Between 2006 and 2013 the number of terrorist attacks across Europe dropped significantly, including in the highest volume category – separatist violence.
“When you start to probe these new attacks, set in the context of the development of a global operation with an extensive disinformation network – which has claimed to be ISIS in cyber-attacks – the change takes a different hue.”
“Lahouaiej-Bouhlel regularly sent small sums of money to his family in Tunisia, but only days before the attack persuaded friends to smuggle bundles of cash worth 100,000 euros to his relatives.”
“While Moroccan intelligence warned Germany about an attack planned by Amri, and they did monitor him in Berlin, he showed no signs of planning a terrorist event according to official reports submitted to the German Interior Minister.”
“Among all of the suspects, from France, to Germany, to Sweden, the common points are easy to identify: criminal offending histories, limited or no links to terrorism – even under surveillance – and mental health issues. In two cases there are links to suspicious finances and two direct links to Chechnya.”
I have purposefully avoided all reference to ISIS and ISIL to distil the facts as they are.
With almost all suspects killed before questioning, and almost every single connected person arrested released without charge, the evidential links are almost entirely reliant on internet searches.
In respect of online radicalisation, some claims of responsibility and activity reported to have been the work of ISIS have been traced back to Kremlin linked hacking group APT28.
In April 2015, France’s TV5Monde network was knocked off air for around 18 hours in the aftermath of a hack attack which also led to the hijack of the agency’s website and Facebook page.
The attackers, who identified as the “CyberCaliphate”, also leaked documents they claimed were ID cards of French soldiers involved in anti-ISIS operations. Initially the hack was attributed to sophisticated hackers ideologically aligned to ISIS.
French investigators later announced the attack was carried out by Russia-based hackers. Sources close to the investigation and TV5 Monde’s president told France 24 “the finger of blame” pointed at Russia, confirming a report by L’Express.
This conclusion is supported by findings from security vendors FireEye and Trend Micro.
Computer malware and scripts featured in the attack were typed on a Cyrillic keyboard and were compiled during office hours in Moscow and St. Petersburg. The threats against the families of French soldiers serving overseas and other jihadist propaganda also contained numerous grammatical mistakes.
The group, reports say, also “targeted the computer systems of Nato members, Russian dissidents and Ukrainian activists.”
FireEye’s security experts said the “website which published leaked information was hosted on the same IP block as other APT28 infrastructure, and used the same name server and registrar that FireEye has seen APT28 use in the past.”
“We suspect that this activity aligns with Russia’s institutionalized systematic “trolling” – devoting substantive resources to full-time staff who plant comments and content online that is often disruptive, and always favourable to President Putin.”
President of FireEye, Richard Turner, said “what we already suspect is that the group is sponsored by the Kremlin. We now also believe that ISIS was a decoy and APT28 was actually responsible for the attack on TV5Monde. Russia has long history of using information operations to sow disinformation and discord, and to confuse the situation in a way that could benefit them.”
“The ISIS cyber caliphate could be a distraction tactic. This could be a touch run to see if they could pull off a coordinated attack on a media outlet that resulted in stopping broadcast and news dissemination. We have been watching APT28’s infrastructure very closely and have seen them target other journalists around the same time as the TV5Monde attack,” he added.
If state-sponsored actors can hack under this guise for this purpose, it’s a credible threat that they may be hosting radicalisation operations too.
On the 22nd of March 2017, a terrorist attack took place in Westminster.
The attacker, 52-year-old Briton Khalid Masood, drove a car into pedestrians on the pavement along the south side of Westminster Bridge and Bridge Street, injuring more than 50 people, killing several.
After the car crashed into the perimeter fence of Parliament grounds, Masood abandoned it and ran into New Palace Yard where he fatally stabbed an unarmed police officer. He was then shot by an armed police officer and died at the scene.
Though the attack was instantly attributed to Islamic terrorism by right-wing figures and media outlets across the world, Police have found no link with any terrorist organisation.
Born Adrian Russell Elms, the attacker later changed his name to Adrian Russell Ajao then to Khalid Masood after he converted to Islam. Police said he also used several other aliases, including Khalid Choudry. His background matches the French and German suspects and his profile is otherwise atypical – most jihadi terrorists are under 30, while he was 52.
When he was 16, he dropped out of school and by 18 he was described as a heavy cocaine user. In 2000, he was sentenced to two years in prison for grievous bodily harm after a knife attack in a public house in Northiam in Sussex. In 2003, he was sentenced to a further six months in prison for possession of an offensive weapon following another knife attack in Eastbourne in Sussex. As well as these two prison terms, Masood had convictions for public order offences going back to 1983.
Analysts monitoring Islamic State activity online said claims of responsibility appeared to be an effort to mask losses in Iraq and Syria, adding that “the lack of biographical information on the attacker and lack of specifics about the attack suggested it was not directly involved.”
Neil Basu, Deputy Assistant Commissioner of the Metropolitan Police and Senior National Coordinator for UK Counter-Terrorism Policing, announced that investigators believed Masood acted alone, adding: “there is a possibility we will never understand why he did this.”
Westminster fits the exception pattern of the other events.
“Analysts monitoring Islamic State activity online said claims of responsibility appeared to be an effort to mask losses in Iraq and Syria, adding that “the lack of biographical information on the attacker and lack of specifics about the attack suggested it was not directly involved.”
These attacks have helped drive the disinformation narrative, feeding right-wing politicians and false reports such as those which led me to Sweden in the first place -the very same investigation which exposed the previously missing links in the chain which definitively connects Russia and the far-right.
The change in the pattern of the terror incidents and the surrounding information suggest something very drastic has changed. Not just in the method, but in the suspects too. Petty criminals, drug users, often with mental health issues and who can’t be directly linked to terrorism.
False flags have been broadly admitted in the past – actions used to justify another end – and large payments of cash, such as those made in Nice, are not associated with the acts of radicals.
And, more to the point, Daesh has been losing financial ground for years. By February 2017, Alessandro Pansa, Director General of the Department of Information Security for the Italian Council of Ministers, said: “ISIS has significantly retreated. Its sources of revenue, primarily smuggling oil products and antiquities, are at the edge of drying out.”
Russia, at the heart of everything else we are witnessing, is no stranger to deploying black operations tactics.
In September 1999, Russia saw ‘the apartment bombings’ which killed 293 people and injured more than 1,000. Together with the Dagestan War, the bombings led the country into the Second Chechen War.
Explosions happened at Buynaksk on the 4th of September, Moscow on the 9th and 13th, and Volgodonsk on the 16th. An explosive device similar to those used in these bombings was found and defused in an apartment block in the Russian city of Ryazan a week later.
On the day after the last bomb was found, Vladimir Putin ordered the air bombing of Grozny, which marked the beginning of the Second Chechen War.
According to the Moscow City Court, the bombings were acts of terrorism organised and financed by the leaders of armed group the Caucasus Islamic Institute yet, thirty-six hours after this announcement, three FSB agents were arrested by the local police for planting the Ryazan explosives.
The incident was declared to have been a “training exercise” and the agents were released on Moscow’s orders.
Yury Felshtinsky, Alexander Litvinenko, Boris Berezovsky, David Satter, Boris Kagarlitsky, Vladimir Pribylovsky, and the secessionist Chechen authorities claim the the 1999 bombings were a false flag attack coordinated by the FSB in order to win public support for a new full-scale war in Chechnya – which boosted the popularity of former FSB director Putin.
The pro-war Unity Party succeeded in the subsequent elections to the State Duma and helped Putin attain the presidency within a few months.
The MP Yuri Shchekochikhin filed two motions for a parliamentary investigation of the events, which were rejected and a public commission to investigate the bombings was rendered ineffective by the government’s refusal to respond to its inquiries.
Two key members of the Kovalev Commission, Sergei Yushenkov and Yuri Shchekochikhin, have since died in apparent assassinations and Litvinenko’s death is probably the most famous execution of a spy in history – he was poisoned with radioactive material in London, and the public inquiry concluded the FSB killed him, and probably on the direct orders of Putin himself.
Could it be possible that the changed face of terror in Europe is the darker side of the global destabalisation operation? What if ISIS, as it’s currently understood, is only as real as the Cyber Caliphate?
While there is no decisive or definitive evidence available, we are left facing a very credible “what if?”