Wanted: Living terror legend

"I know this bomb from somewhere," mumbled the intelligence expert studying recent photos from a Damascus blast. After racking his brain and going through some files trying to remember where he had seen a combination of explosives rigged to gas tanks, it finally hit him – it was the trademark of Saif al-Din ("Sword of the Faith") – one of the world's most notorious and wanted terrorists to date.

In September of 2006, an al-Qaeda affiliated terror group attempted to carry out an attack on the US Embassy in Damascus. The footage taken of the intended scene included photos of the mass explosive device, which was placed in the most structurally-vulnerable point of the building; waiting to bring it down on its inhabitants. The footage left no room for error – the device was one of the explosives developed for al-Qaeda by Saif al-Din. It was the vigilance of the Syrian and American security guards that prevented a catastrophe, saving dozens of lives, if not more.

Saif al-Din has been the focus of a worldwide manhunt for the past two years, with dismal results. The international intelligence community doesn't even know what he looks like and all they have to go on is a picture of his hands. In a world that allows one to run his whole life through an online browser, essentially never leaving the house, one cannot be too surprised that the man responsible for the deaths of hundreds of American soldiers stationed in Iraq and Afghanistan is little more than a virtual character in cyberspace.

The mystery surrounding Saif al-Din has turned him into a living legend among legions of Jihad fans. The man, on his part, has made no mistakes so far; leaving no trace which may lead to an unexpected visit by a hitman: There is no known address, no known associates or affiliations, not so much a blurry image of his face. All the international intelligence community has to go on is the image of his hands, which appear in an instructional video – "bomb-making 101" – designed to teach eager terrorist-wannabes how to make explosive devices that can cause maximum casualties.

Cut from the same cloth? Al-Qaeda's Osama Bin Laden (Photo: AP) 

Humble beginnings

Saif al-Din got off to a humble start when it comes to performing international acts of terror. Some five years ago, a Jihad activist logged on to a Hamas forum and introduced a series of lessons on bomb-making. "These instructions are meant for (Islamic) Jihad warriors. They must be applied on the heretics and Jews. I am here to praise Allah's commands and will not he held responsible if this is used against any other Muslim," he wrote.

The seemingly ephemeral post was to become one of Jihad's most ambitious and dangers online adventures, granting the man behind the avatar unprecedented fame and recognition.

The man's chosen cyber alter ego, "Saif al-Din", carries a deep religious significance in Islam. Considered one of the religion's ancient mythological characters, Saif al-Din was a 16-year old boy when he converted to Islam against his family's wishes. He soon became famous for his pious lifestyle and strong Muslim beliefs, and according to tradition was given the name Saif al-Din by the Prophet Muhammad himself. Saif al-Din was killed is one of Islam's early jihads, at the age of 23. The Prophet himself is believed to have buried his follower. Saif al-Din then became one of Islam's most highly regarded figures, hailed as the most shining example of a muslin believer. 

The virtual entity dubbed Saif al-Din first appeared in cyberspace in 2003, in a Hamas forum considered a relatively minor one, since it was dedicated to local conflicts. He began his Internet venture independently, believed to be motivated by his religious devotion alone. His early posts are indicative of both research and operational methods unsupported – financially or otherwise – by any external group. According to the posts, he would buy books and read various documents with the intent of distributing his newfound knowledge in favor of his "Mujahedin brethren," i.e. – Jihad warriors and extreme Islamists worldwide. 

Although believed not to reside in the Palestinian Authority, Saif al-Din focuses many of his posts on the Palestinian problem, often saying he hopes Palestinians will use the knowledge he provides to "build a device which would facilitate the liberation of Palestine from the Israeli occupation."

Terrorism 101

The highly sophisticated level of Saif al-Din's posts soon made him an authority figure among the forum's participants. His random posts were soon complied into the first addition of his official writings – "Saif al-Din's illustrated encyclopedia of explosives" – gaining him worldwide fame, and notoriety, in similar forums. It wasn’t long before the global Jihad took notice.

Saif al-Din's first few official publications under the Jihad's banner were signed "your brother Saif al-Din, transcendent paradise brigades." Others were singed "the world Islamic front for Jihad against Jews and crusaders." The latter, formed in 1998, is believed to be the name given to the group under which Osama Bin Laden's al-Qaeda and the Egyptian Islamic Jihad movement joined forces.

The affiliation between Saif al-Din and al-Qaeda has become obvious over the past few years, when his posts began sporting photos of Osama Bin Laden and other prominent al-Qaeda and Jihad figures; and their publications began crediting him; but they share the fear of being tracked down, and rarely post personal messages in public forums.

The most recent message detected was posted when one of al-Qaeda's senior technical experts, dubbed the "Hawk," was killed in Iraq: "The Hawk flies no more," wrote one of the forum's participants. "Can someone please get in touch with Saif al-Din and tell him his dear fried and colleague has died a martyr's death?"

The people frequenting the forum are well aware of each other's respective "expertise," and have been discussing the creation of a virtual training camp for guerilla warfare, so that "warriors" intending to leave for Iraq could receive weapons and explosives training. Saif al-Din was to run the show.

Responsible for killing hundreds of people (Illustration: Reuters)

The operative's guide to terrorism galaxy

Gadi Aviran, founder and chief intelligence officer at Terrogence – a company which specializes in intelligence gathering for the international intelligence community – believes Saif al-Din really does know what he is talking about.

"Saif al-Din demonstrates high levels of proficiency, probably based on vast experience in manufacturing improvised explosives, manufacturing advanced explosives and coming up with various scenarios for incorporating them in acts of terror," he says. "Most notable is his ability to relay complicated matters in layman's terms, so terrorists who aren't as proficient as he is would be able to apply them.

"Saif al-Din has been instrumental in the creation of a database considered a reliable source of information by Jihad operatives when planning attacks. This information is made available through the forums, and if they find it lacking, they post a question and await the professional answer that soon follows."

Right off the bat, Saif al-Din made it clear that he is here to kill as many "heretics" as he can; and that unlike other Jihad followers, he has no intention of engaging in complex debates on various religious decrees and what is and isn't the right thing to do.

"My dear brothers," he writes in chapter five of the illustrated encyclopedia of explosives, "I have no official training in this science so your theoretical questions in chemistry are of little interest to me, at least at this time. I have studied from what I have seen and done and from those I trust...I am just a man seeking knowledge, one who wants to pass on the knowledge he already has to this handful of good men here online, without misleading them or giving them any information that may cause them harm."

No one knows exactly where Saif al-Din received his basic training in guerilla warfare. According to one conjecture, he is a former Hamas man who was deported to Lebanon in 1992, only to be trained by Hizbullah, Iran's Revolutionary Guards, and Iranian intelligence specialists. Another "graduate" of the same class in the infamous "engineer" – Yahya Ayyash – who later became instrumental in devising Hamas' deadly terror attacks on Israel between 1995 and 1996.

Saif al-Din's knowledge has become increasingly extensive over the years, with much of his deadly expertise obtained – according to his own statements – through experiments and overt sources. His uncanny ability to research information and turn abstract theories into operational facts have allowed him to write the three dissertations he is most famous for: "Saif al-Din's illustrated encyclopedia of explosives" – which spans five volumes; "Answers to the Mujahedin's questions," and the four-part  "Intellectual and personal advancement of the Mujahedin."

Saif al-Din's publications span thousands of pages that provide step-by-step illustrated instruction on how to carry out an attack on civilian targets. Ranging from complex technical assignments such as how to get hold of ammonium nitrate (a key component in the manufacturing of explosives) and assembling your very own car bomb, to purely operational tasks, the likes of gathering intelligence and concealing one's identity and plans to avoid detection – all written in language even the most dunce of Jihadists could understand.

Practice makes perfect

Unlike his fellow cyberspace Jihadists, Saif al-Din is a man of action. He does not waste time on ornate greetings or elaborate prologs – he gets right down to business, offering his readers a short introduction before going ahead with the demonstrations.  

"Today we will learn about the practical uses of chemicals… such as their temperature and combustibility and the best ways of mixing them together," he begins his lesson. Once the basics are out of the way, he goes on to the logistics: "In order to effectively destroy a building you must first know how it is constructed – bricks, steel etc, - because every building has different (shock) tolerance…"

Saif al-Din is also a known patron of several chemistry websites, aimed at the genre's enthusiasts, who usually engage in innocent discussions about various compounds and the composition and use of various chemicals, oblivious to the fact that one of them is using the information they so generously share to make explosives.

Known only by his hands (Illustration: Liquid Library)

A modest man, yet acutely aware of the importance of intellectual property, Saif al-Din has only one request of his pupils: "Dear brothers, I hope that in every website or forum you feature this information on, you will remember to credit Saif al-Din's encyclopedia.

Origins of Evil

A large part of the information used by Saif al-Din comes from online research, but this is not your run of the mill Google search: The FBI investigators who probed the Oklahoma City bombing of April 19, 1995 – which left 168 people dead – and Timothy McVeigh's involvement in it, may be surprised to know of the extensive use al-Din makes of classified material they entered into evidence during McVeigh's trial.

Saif al-Din has been able to get his hands on the sketches illustrating the best possible positioning of the explosives in the truck used in the bombing, so that the detonation would create an accurate, massive blast; and is using them as instructional blueprints in his teachings, without so much as a feeble attempt to conceal their origin. They even sport the "confidential" watermark embedded on FBI documents.

A source familiar with the investigation of Saif al-Din believes the manner in which the documents are presented is aimed to achieve three goals: The first – to distribute information about a lethal terror attack; the second – to increase Jihadists' motivation, since the attack struck at the heart of Jihad's archenemy – the US; and third – to ridicule the security measures taken by US Intelligence, which he has been so effortlessly able to breach.

Saif al-Din uses the Oklahoma City bombing in order to teach his followers about the kind of truck they should use in a similar attack, the amounts of explosives required to take out a building of the size, and the magnitude of the shockwave that follows such an explosion. "The numbers marking the quantities (of explosives) are only estimates," he cautions; "if a Jihad warrior can get his hands on more explosives, there is nothing wrong in using bigger quantities to ensure the destruction of heretics everywhere."

Classified material from the interrogation of al-Qaeda's Dhiren Barot, who was arrested on suspicion of planning terror attacks in the US and the UK, has also found its way to his tutorials. Barot, who was fortunately arrested before any of the attacks he planned were carried out, had several atrocities in the works, ranging from booby-trapped limousines to radioactive charges, set to explode near Wall Street. Security footage of Barot casing various locations to plant his bombs are now available online as part of Saif al-Din's teachings.

Blueprints to mayhem

Shai Arbel of Terrogence has devoted the better part of the past three years to following Saif al-Din's online activity. "He's very savvy and he knows how to exploit the Internet for his needs," he says. "Some of the material he uses is based on Western sources – commercial publications, footage from past experiments and videos from P2P file sharing sites… his biggest contribution is his ability to get hold of rough material, translate it, process it and post it online in a way that allows Jihadists with no special training to make use of it."

An example of just how applicable Saif al-Din's teachings are was evident in the failed attempt to attack the US embassy in Damascus. During the attack, four Jihadists attempted to force their way into the building by opening fire at security guards and hurling grenades at the entrance. The attack was contained because the car bomb parked near the embassy failed to go off, allowing the security guards to return fire, kill three of their assailants and wound the fourth.

"The car bomb contained several gas-based explosive devices, rigged with pipe bombs. The structure of the devices was highly unusual and their design was similar to one shown in material we know Saif al-Din had relayed to his followers," added Aviran. Since 2006, several explosive devices found in scenes of foiled terror attacka in the UK and Scotland have been traced back to the same method of rigging gas tanks to explosives in a very specific manner.

Series of operational errors? Scene of 2004 Madrid bombing (Photo: Reuters)

Saif al-Din's contribution goes beyond the logistics of planning a terror attack. As time passed, he began to devote much of his time to analyzing past terror attacks. Among his subject matters, for example, was the 2004 Madrid bombing: Saif a-Din explores all aspects of the bombing in his posts, from the location through to the weapons of choice, while detailing everything he believe was done wrong.

"When you read this analysis, don’t think for one minute that we (Jihad) doubt this blessed attack's legitimacy, or the blessed death of our enemies. This is still one of the most successful operations since the attacks on New York and Washington… nevertheless, one of the critical errors mentioned here, which took place in the planning stages, led to the martyr's death of many of the cell's members and prompted the Spanish security forces to boast about their so-called 'capabilities' in apprehending the Jihad cell. We must review the reasons that led to this result, while keeping in mind that it was Allah's wish."

Among the errors counted in the analysis, al-Din went on to note the terrorists' involvement with local Spanish criminal elements, which led to the cell's exposur, the misuse of a cellular phone as the device's trigger, leaving fingerprints on various components, and so on.

International manhunt

It is exactly these kinds of posts, says Aviran, that have made Saif al-Din the foremost source of online information for Jihad warriors when it comes to weapons manufacturing. "They know they can ask him just about anything and that he will find a way to give then an answer."

This answer, posted on one of Jihad's secret online forums, was brought to the attention of MI5, which immediately alerted the Scotland Yard. London Police was immediately put on its highest state of alert, flooding the city with mass forces in order to gather intelligence, but to no avail.

The conclusion eventually reached was that the post was a stunt – an attempt by Saif al-Din to check how closely his posts were monitored, as well as an attempt to see what steps would be taken to protect London from any such threat.

Ghosts of cyberspace

Saif al-Din is extremely careful about concealing and protecting his identity, avoiding any personal questions and saying he does so for his own personal safety. It is believed he logs on to the various forums using several aliases and is known for refusing to send any kind of private message, for fear it may be intercepted. The only thing consistent about his posts is his signature phrase – "don’t forget to pray for us."  

As Saif al-Din became a celebrity of sorts, and with the ever-increasing fear of exposure, he began keeping his personal appearances in various forums to a minimum. Since 2005, he has only made rare appearances online, posting the following message: "For many important reasons I cannot log on to more than one forum a day, or stay online for too long. This is why I entrust you, my brothers, with the mission (of distributing the teachings) should this forum fail to ensure it… you will have my gratitude, appreciation and thanks and may Allah's blessing be upon you."

Instead of making personal appearances, Saif al-Din has began using mediators, who post his teachings and relay any questions his followers may have. The identity of these mediators remains unknown, and it is likely that some of them are aliases used by al-Din himself.

No one knows exactly where Saif al-Din is operating from. Analysis of several of the images he posted and several slips of the tongue have led the international community to think he resides somewhere in Europe.

"Saif al-Din is your classic arch-villain of the Internet era, concludes Adi Angel of Terrogence. "He has worldwide influence and he operates from an undisclosed location and under and alias. His posts are relevant to all (terror) operatives regardless of their affiliation or geographic location, and he himself is an independent contactor, obligated to no organizational hierarchy whose tracking may lead to him being captured.

"Despite the extensive use he makes of the Internet he has left little to no clues as to who he is or where he operates from. He's in the wind." 

• Stay focused