How a selfie cracked Da’ish in K-P

Vanity and a window in the background led investigators to major op

PESHAWAR: It’s Saturday night, the 24th of June, and in the Peshawar suburb of Dalazak Road, 28 intelligence and police officials have surrounded Arsalan Flour Mills. The compound – just 20 minutes from the heart of the city – is newly-built, but oddly abandoned.

The thick air was unmoving, as if stalled by the summer heat, which was making the men sweat in their civvies. All they could hear was the faraway murmur of recitations that fill the nights of Ramazan from distant mosques.

When they looked up across the 16-foot walls, they noted with satisfaction the near-full moon appear in some of the flour mill's nine-pane blocks of windows. Some of them took cover under the awning that protruded over the mill's gate, their minds focused on getting the man they had been chasing down for over eight years.



The order was given for an armoured personnel carrier to ram the gate. The first strike didn’t take it down. The second did, but by this time, the men inside had started firing at the security officials. Undeterred, the plainclothes teams slipped in, and in those moments they heard what many had been expecting, an explosion on the first floor.

Police personnel cordon off the area the following morning. PHOTO: FILE

“Bomb!” a senior police official alerted the squad, but only to indicate that it was a scare tactic.

A grenade thrown from the first floor exploded and injured three policemen and two soldiers who had just breached the building.

A distress call was made. Military and police personnel, including the station house officers of three nearby police stations, the Anti-Terrorism Squad, and the Quick Response Force, took positions around the mill. The exchange of fire continued till dawn. Then it suddenly stopped – but something was off. Nobody thought the men inside had fled.



 

Then there was the sound of movement on the first floor. Someone was taking the flight of stairs to the ground. Two men headed to the bushes near the gate. "Naraa-e-Takbeer!" one of them cried before opening fire.

“Take cover!” shouted an officer.

Amid the commotion, the two men in the bushes did not realise that two policemen were coming up behind them. As the first pair opened fire, so did the latter. They were shot and killed in less than two minutes.

When the first man was identified, senior officers on scene could barely contain themselves.

It was Muhammad Arif, the head of the Islamic State (IS) in Khyber-Pakhtunkhwa. Arif had several aliases, the most recent being Khalil. At 34, the Peshawar native had already been on Law enforcement’s radar for years before he even joined IS.

He was originally identified as a Tehreek-e-Taliban member when in 2014 he went to Afghanistan and joined the Tariq Geedar Group (TGG). He was wanted in multiple attacks and law enforcement had been trying to pick him up for a while. But after moving across the border, he went off the radar. When he eventually resurfaced, it was as an IS member.

CNIC and explosives were recovered in the search operation. PHOTO: EXPRESS

The other man was Umer Afghani, who managed finances for the group. Little is known about him other than his Afghan origins.

Seized from the flour mill was a stash of destructive materials including 130 electronic detonators and 150 non-electronic ones, bolts of camouflage cloth, four televisions, a typewriter, IED components, sub-machine guns, and a list of ‘deserving families’ they had to give money to on Eid.



With their deaths, the intelligence and police had succeeded in annihilating what was known as IS in K-P—at least for the time being.

What follows is a one-year investigation by The Express Tribune into IS's presence in Peshawar, of which this case and the operation at Dalazak road is just a highlight. Hours of background interviews with senior police and counter-terrorism and intelligence officials shed light on the phenomenon. And the most extraordinary part of the story is IS's communication methods and how law-enforcement intercepted them to track one head of the hydra.

Clueless

The picture was not, however, this clear up until a year ago. It was only when IS's news agency Amaq claimed its first attack in the region that law enforcement was certain that their worst fears were coming true. In the last week of November 2016, five policemen in a city patrol vehicle were shot at from all four sides and an ASI was killed. A damaged rickshaw whose driver was shot in the back provided some leads that the attackers were using this inconspicuous form of transport.

A series of attacks followed, all claimed via Amaq. As forensics of the 9mm and 30-bore pistols seized at the flour mill would later confirm, IS was behind at least six targeted killings of clerics from a religious-political party, military personnel, scholars and other people in 2016 and 2017. IS had cast the net wide; it was almost nondiscriminatory in its choice of victims.



One of the IS target killers nabbed in Peshawar was 23-year-old Muhammad Farid from Qazi Kalay. He confessed to interrogators that he had killed 32 people, providing chilling accounts. He had murdered 15 policemen, but particularly gruesome was the way in which he claimed to have killed five sex workers.

Farid was identified as a TTP affiliate in 2009 and had received training in Afghanistan a year before that. He is an Afghan citizen, senior police officials told The Express Tribune, adding that he was part of a larger network of men who were involved in target killing, extortion, and robberies. He spoke of receiving large sums of money from Afghanistan through the informal hundi transfer system.

Then Farid joined IS. He posed as a rickshaw driver – even picking up passengers – while he surveyed areas where attacks were being planned. He was later tasked with killing policemen as they became "soft targets" when unarmed or off-duty. His revelations stunned investigators as they brought to light how IS was recruiting people like him as foot soldiers. "The breeding grounds are elsewhere. They are only looking to recruit for now," said an official.

Amid the details of the trail of death that followed him, a breakthrough came for investigators.



Farid’s phone revealed IS’s preferred method of communication. “Almost all communication was through the Telegram app,” said a CTD official. “The aliases they used were common names which they changed often. They were mostly communicating with their group in Afghanistan.”

Encrypted chat

Telegram, a Russian chat app, has approximately 100 million users and has been giving law enforcement headaches the world over as it has end-to-end encryption, is difficult to crack, and has messages that self-destruct.

Furthermore, Telegram has group chat options where IS members were sharing potential target information. “We found a list of 12 people who the group [in the flour mill] had identified when it was busted,” said an intelligence official who asked to remain unnamed as he is not authorised to speak to the media. “Most of these targets were randomly chosen from Facebook and Twitter on sectarian grounds.”

Data for three months from the cell phones found in the flour mill operation showed that the men had made no calls but their combined internet usage exceeded 18 gigabytes, confirming to investigators the way IS was communicating.



The men were trained to use the app in Afghanistan. Once they learnt that it was being tracked, they tried to shift to another encrypted app called Signal. "They were more advanced than some countries in their communications," remarked one official.

IS has been highly effective in its use of social media and the internet in general, but it is also proficient in using old-school methods such as throwing pamphlets at the scene of an attack. IS graffiti was reported in parts of Peshawar a long time back, but the police initially publicly dismissed it as pranks to avoid creating panic.

It was an IS attack on June 15 on a police van in Chamkani in which three policemen were killed, that brought investigators closer to the flour mill. A constable managed to kill one of the attackers. He was identified as Mustafa, an IED-making expert and one of the most feared members of IS.

Vanity kills

In his cell phone, investigators found a selfie. And while his face did not say much, it was the nine-pane window in the background that they picked up on. It took them ten days to find it in Peshawar.



When IS started emerging in the Middle East, law enforcement and security agencies in Pakistan worried about it reaching their turf. Military operations had effectively wiped out the leadership of local terrorist organisations but IS's global approach meant that it could fill that void for the orphaned militants spoiling for a fight. IS's deadly charm was that it held territory the size of a country. "Their aim is to create anarchy because that is where they breed," said another official.



"Although IS did not practically exist anywhere [in Pakistan]," an intelligence official said, "elements that could have been part of it were already here in a scattered form. Somebody just needed to put the blocks together."

Now investigators believe that IS has poured in resources from across the border. Officials in the know suggest, however, that many of the attack attempts made by members of the group functioning across the border have not been successful.

Farid had a long list of confessions, which included planting a bomb outside the Peshawar home of a polio vaccinator and demanding Rs1.5 million in extortion from him. He killed a polio worker immunising children in Shabqadar and Charsadda. The trail of violence went all the way to Waziristan, where tribal elders were targeted.

He also told investigators that he butchered five sex workers with a sword after luring them in with a Rs3,000 payment for services. Three were killed in one incident, and two in another. The sex workers were mostly picked up from the walled city. Their body parts were dumped into a river.

Transnational problem

"They grow an inch every few weeks," said a senior police official. "And we crop them down." There is no illusion, however, that much of what is happening or will pan out in Pakistan, will depend on how matters shape up in the Middle East and Afghanistan. "Security and peace are never isolated phenomena. In one way or another, whatever happens globally will affect us locally."