India: Arrests, Revelations and Implications

India: Arrests, Revelations and Implications
August 20, 2008


Graphic for Terrorism Intelligence Report

By Fred Burton and Scott Stewart

On Aug. 17, an Indian court in Ahmedabad, Gujarat, remanded nine suspects to police custody for 14 days. The nine were accused by the police criminal branch in Ahmedabad of involvement in a string of 17 explosions that rocked Ahmedabad on July 26, leaving more than 50 people dead. Among those arrested was Mufti Abu Bashir, who Indian authorities claim masterminded the attacks and who reportedly admitted his involvement during interrogation.

On Aug. 19, police in Rajasthan announced that they have detained 13 people in connection with the May 13 attacks in which seven improvised explosive devices (IEDs) were used to strike soft targets in Jaipur that killed 68.

Both the Ahmedabad and Jaipur attacks, as well as attacks involving eight IEDs that occurred July 25 in Bangalore, have been claimed by an organization calling itself the Indian Mujahideen. In a series of e-mails sent to the Indian press, the organization stated that the operations were intended to demolish the faith of the “infidels in India.” They also claimed that the attacks were in retaliation for the 2002 communal riots in Gujarat in which more than 1,000 (mostly Muslim) people were killed. The e-mail claiming responsibility for the Ahmedabad attacks was sent to news outlets just minutes prior to the attacks — underscoring the claim’s veracity.

Indian authorities believe that the Indian Mujahideen is really a pseudonym used by the banned Students Islamic Movement of India (SIMI), although some reports suggest that it is in fact a militant faction that broke away from the more moderate wing of the SIMI organization. Other sources have suggested that the Indian Mujahideen is actually a cooperative effort between Kashmiri militant groups, SIMI and Lashkar-e-Taiba (LeT) or Harkat-ul Jihad al-Islami (HUJI).

Any of these three explanations could be the truth. Kashmiri groups have traditionally used a number of names in an attempt to sow confusion — confusion further aided by the fact that the Kashmiri militants tend to be a fractious bunch. Furthermore, in general, people arrested by the police for violent undertakings who are part of a particular organization will commonly deny membership in an effort to protect their fellow members from government action. This murky milieu makes it very difficult to sort out the true identity of the group calling itself the Indian Mujahideen.

What we do know, however, is that some people who were at some point affiliated with SIMI do appear to be connected with these attacks and that the attacks were claimed by the Indian Mujahideen. We also know that some SIMI members have been closely linked to other Kashmiri militant groups such as LeT and HUJI.

Indian authorities have made a number of arrests of high-ranking SIMI members over the past several months that appear to be connected to the Indian Mujahideen and this string of related bombing attacks. Information provided by these men during interrogations suggests that there are a number of operational cells scattered throughout the country including trained bombmakers.

The recent arrests in Ahmedabad and Jaipur are a step in the right direction, but the Indian authorities have a long way to go before they will be able to defang the indigenous threat posed by the SIMI/Indian Mujahideen.
Operational Similarities

In addition to the claims of responsibility, there are a number of operational similarities that tie the Jaipur, Ahmedabad and Bangalore incidents together. These attacks also share a number of characteristics with a failed July 29 attempt to attack the city of Surat, Gujarat, with more than 20 IEDs.

First, the attacks all involved a number of small devices that were concealed in small boxes or bags and directed against soft targets such as crowded markets and bazaars — busy locations with lots of people and lots of places to stash the devices. The devices were all hidden and left in place to detonate by timer and not by command. Furthermore, the devices all contained shrapnel such as nuts, bolt and ball bearings. This is a clear indication that although they were small, they were intended to kill and not merely attract attention. Some of the devices were hidden in containers and attached to auto rickshaws or bicycles that were left in public places; others were placed inside automobiles that had been stolen and then parked on the street. The attacks also involved improvised explosive mixtures or commercial explosives rather than the military-grade RDX usually associated with past Kashmiri militant attacks in India.

However, in spite of the similarities, there were some differences in the construction of the unexploded devices recovered in Ahmedabad and Surat, indicating that there may have been a different bombmaker involved in those two cases. For example, a few of the devices recovered in Surat had small gas canisters affixed to them, an element not seen in the other attacks. Additionally, the timers employed in the Surat devices were reportedly stand-alone integrated circuit timers, whereas the Ahmedabad devices used simple mechanical timers. Judging from the total failure of the Surat devices, either the timers had a critical flaw or the bombmaker responsible for them made a critical error while assembling the devices. Normally, a bombmaker will test his components prior to assembly — so either a test of the timers was not conducted, or the problem lay in the assembly of the devices’ components and not the timers themselves.

Some have suggested that the Surat devices were dummies intentionally constructed not to explode, but we do not buy that theory. If a group really wanted to achieve that result, it could have done so with one or two hoax devices. The group would not have taken the effort and risk of constructing and planting more than 20 devices. Adding shrapnel to such hoax devices or attempts to enhance their effectiveness by adding fuel canisters also would not have been necessary. From the number and design of the Surat devices, it is clear their designers clearly wanted them to function and ultimately cause casualties.

This modus operandi of using multiple, small devices hidden in bags or boxes, placed in congested areas and activated by timers has also been seen in several other attacks in India in the recent past, such as the May 2007 and November 2007 attacks in the Uttar Pradesh cities of Gorakhpur, Varanasi, Faizabad and Lucknow, and an August 2007 attack in Hyderabad, Andhra Pradesh.

This operational profile is very different from the attacks we are seeing in Pakistan or Afghanistan, where militants tend to use much larger devices activated by suicide operatives. It is, however, similar to tactics we have seen previously employed in Bangladesh, where one militant attack in August 2005 involved more than 400 small IEDs. This similarity may not be mere coincidence. As security along the Indian-Pakistani border has tightened in recent years, militants have increased their use of the porous border with Bangladesh to move in and out of India.
Interrogations Shedding Light on SIMI

In November 2007, Indian police caught a break when they arrested a man named Riazuddin Nasir, alias Mohammed Ghouse, in India’s southern Karnataka state. Nasir was initially collared for vehicle theft, but authorities later learned that he was stealing vehicles for use in terrorist attacks. According to Nasir’s interrogation, he was a SIMI activist who helped recruit and train activists at a remote camp in Hubballi, Karnakata. Nasir further relayed that 40 militants had gathered for training there and that at least 15 of them were trained to construct IEDs. After training ended, the militants were sent out to different parts of the country to conduct operations. Based on Nasir’s information, Indian Intelligence Bureau officials increased their focus on SIMI. As a result, their efforts enabled Indian officials to track down some, but not all, of the men who were allegedly trained militants.

One of the alleged militants swept up by the authorities in March 2008 was Safdar Nagori, the general secretary of SIMI, who Nasir identified as participating in the training. Nagori led police to a second training camp in Choral, Madhya Pradesh, where they uncovered a cache of explosives. According to Nagori’s interrogations, the camp in Choral was used to train classes of 20 militants at a time and had graduated five such classes in 2006 and 2007.

The Aug. 17 arrest of Mufti Abu Bashir was a further blow to the organization. Bashir was a madrassa teacher in Hyderabad who claims to have been recruited into SIMI by Nagori. Bashir has admitted to masterminding the Ahmedabad attacks and, during interrogation, reportedly told Indian authorities that he assumed a leadership role in the organization following the arrest of Nagori.
Another IT connection

Indian authorities say that their interrogations of Bashir revealed the identity of the man who sent the e-mail from the Indian Mujahideen to the Indian press just prior to the Ahmedabad attack. They claim that Taufique Bilal, also known as Abdul Subhan Qureshi, a Mumbai-based militant, was tasked by Bashir with sending the message. The authorities say they now believe that Bilal hacked into the wireless Internet connection of an American living in Mumbai to send the message.

Bilal apparently came to the attention of the authorities after the July 11, 2006, Mumbai train bombings, but, at the time, they reportedly did not have enough evidence to charge him. That has since changed, and police in Gujarat have obtained a warrant for his arrest in connection with the Ahmedabad attack. Indian police also claim that, In addition to sending the e-mail claiming responsibility for the attack, Bilal obtained the explosives and timers used in the incident and that he met on several occasions with Bashir to plan it.

The American whose system was hacked by Bilal is an employee of the Navi Mumbai-based IT firm Campbell White. He does not appear to have been involved in the case and has since left the country, although controversy did arise over his leaving because he has not yet been officially cleared by Indian authorities.

Bilal was also connected to the IT industry, and apparently earned a degree in electronic engineering. Bilal reportedly worked in the IT hubs of Bangalore and Hyderabad before moving to Mumbai. He appears to have worked for the IT firm Wipro from 1996 to 1998. The Times of India is reporting that Bilal may have worked for as many as three IT companies.

Using an American expatriate’s computer to send the note was not only a handy way to disguise the identity of the author, and a display of operational flair, but it also underscores an awareness on the militants’ behalf of the importance of the IT sector to the Indian economy and the significant role that international companies play. It is clearly a shot across the bow.
Other Implications

The operational similarities in the attacks we have seen in 2007 and 2008, and the involvement of SIMI members such as Bashir, make it highly likely that these attacks were conducted by the network that was trained at the camps identified by Nasir and Nagori. While the Indian authorities have arrested many of these people, there are still others, perhaps hundreds of them, still on the loose. The arrests of senior SIMI officials do not appear to have affected the network’s operational ability; in fact, the tempo of militant activity seems to have increased following the arrests of Nasir, Nagori and others late 2007 and early 2008.

The SIMI/Indian Mujahideen militants may be encouraged and inspired by al Qaeda (as materials recovered from their training facilities have shown), but they appear to be a uniquely Indian phenomenon. So far, their operations appear to have been planned and conducted by Indian citizens who were trained and directed by other Indian citizens using materials procured inside their own country. According to the interrogations of captured leaders, the group has been able to recruit and train hundreds of militants inside India.

It will be very hard for the Indian government to pin these connected attacks on the Pakistani Directorate of Inter-Services Intelligence (ISI) and its extensive network inside India. While all leads in Indian counterterrorism investigations normally point to Islamabad, that does not seem to be the case this time. In fact, even if the ISI were to somehow drop its support for Kashmiri militants — something we do not see happening — this particular organization would not seem to be affected. This group’s operations have been small scale and relatively inexpensive to conduct. Such attacks are sustainable and do not require extensive outside funding. If the ISI is backing this group, it has done a very thorough job of hiding its hand.

Indeed, the Indian press recently reported that, according to the interrogations of Nagori, SIMI was experimenting with peroxide-based improvised explosives at its training camps inside India. The group was apparently concerned that the Indian government would clamp down on its ability to obtain commercial explosives and ammonium nitrate fertilizer. This is a clear indication that the militants are not anticipating future shipments of high-explosives from a sponsor such as the Pakistani ISI. Peroxide-based explosives are notoriously fickle, unstable and downright dangerous. Palestinian bombmakers gave peroxide-based explosives such as triacetone triperoxide (TATP) the nickname “mother of Satan” for good reason. Militants would certainly not bother with such unreliable and dangerous improvised mixtures if they had any hope of receiving military-grade explosives from a state sponsor.

Some Indian media outlets have claimed that the presence of electronic components from Southeast Asia in the timers used in the Surat devices indicates that there is a connection to Jemaah Islamiyah (JI), the Indonesian-based al Qaeda franchise. However, electronic components such as integrated circuits manufactured in Southeast Asia can be found in nearly every part of the world, including India. It is, therefore, very tenuous to try to draw a link to JI based on that fact. Plans for integrated circuit timers are widely available in jihadist literature and are not difficult to assemble — though, as previously noted, the timers fabricated for the attacks in Surat appear to have somehow been botched.

The strategic objective of these attacks has been twofold. The first objective was to incite communal riots between Hindus and Muslims and to inflame political tensions between Islamabad and New Delhi. Meeting this objective would allow these groups to highlight any grievances Indian Muslims have with the Indian government and expand their support base within the country by radicalizing Muslims — and Muslim youth specifically. The second objective was to damage the Indian economy. Bangalore, Ahmedabad and Surat are important commercial centers, and Jaipur is a popular tourist city.

To date, these attacks have not been successful in achieving these objectives, though the ease with which the network was able to recruit and train young militants may be a sign that the militants are making progress in their efforts to radicalize Muslim youth. However, with elections coming up and Hindu nationalist political parties stepping up their activity, the network has a prime window of opportunity in which to incite communal violence. Recently, protests by members of Hindu national party Shiv Sena in Gujarat and Maharashtra have included marches through Muslim neighborhoods, with protestors demanding that all madrassas be closed — partly in response to the recent attacks.

While there have been a number of significant arrests, it will be difficult for the Indian government to stamp out this domestic, self-replicating network. As an indigenous organization, however, the operational abilities of the network will be limited. Without outside assistance it will likely continue to conduct simple attacks against soft targets. This militant network has not yet begun to conduct large al Qaeda-type attacks or to use suicide operatives, but this could change should the network fall further under the sway of the international al Qaeda movement.

Tell Stratfor What You Think

This report may be forwarded or republished on your website with attribution to www.stratfor.com