FIRST-LINE PRACTITIONERS

Sentence of the ordinary court of venice n.2346/17 dd. 8-3-2018

2013 - 2018

Italy ,
Syrian Arab Republic

Identification of the Source

Sentence of the Ordinary Court of Venice n.2346/17 dd. 8-3-2018 (not appealed and therefore executive on 1.5.2018)
We meet then XX in Syria in 2018 and interviewed her. The public part of the document is available in
https://www.agenformedia.com/videos/2018/10/forgotten-jihadi-women

Keywords

Hijrah, Jihad, Hacker, Bitlocker, Topsy, Diamond X21, Cyber Calif, ISIS, Muharram

Description

From 9-3-2013 the user Cyber Calif (XX) had 2.084 accesses to her computer. The system had some tools aimed at hiding the IP, however the hard disk was not encrypted but protected by password. For this reason, the investigative LEAs were then able to recover large part of the contents.
From 2014 XX mobile phone IPhone5S contained 200.000 WhatsApp messages, 50.000 Viber messages, and 2.000 Skype conversations. The user name was “rehilygp” with a profile with an AK47, a Qur’an and a radio transmitter.
20-7-2014 until 25-07-2014 WhatsApp contacts with the group Al-Hurr in Syria, probably the Syrian resistance (not Daysh).
16-08-2014 WhatsApp messages with an ISIS recruiter MHMD, asking information on the life in Syria. XX is interested on how to be trained on the use of weapons.
22-08-2014 MHMD authorized XX to enter Syria
23-08-2015 MHMD informed XX that she can enter Syria alone (without a Muharram, meaning a male family member)
16-11-2014 XX reveals to her friend XX that she has enjoyed seeing the decapitation of Kuffar in Syria.
04-02-2015 XX (under the nickname RIM) translates the document ‘Lone Wolfes’ published in www.justpaste.it by ISIS operatives
01-03-2015 XX revealt to her friend her intention to leave for Syria
05-05-2015 XX (under the nickname @IsisTechnical”) publishes online the interrogation of the Jordanian pilot captured by ISIS in Syria and then burned.
25-06-2015 Merieme writes in her Diary: “We are all Osama”, thus referring to the perpetrator of the terror attack in Paris (7-1-2015). Merieme declares her intention to go for the Jihad.
July 2015, XX inform her teacher, Ms. XX, that she is a hacker, under the nickname RIM. She is scared because Anonymus seems to threaten her as a consequence of her online activity (sha translated on line ISIS text from Arabic into French). XX decided to talk to her teacher because she was concerned for her family
10-07-2017 XX buys a flight ticket to Istanbul.
12/13-07-2015 An oath to ISIS appears in her account, using the nickname RIM (user ‘tecnicalisis”
14-7-2015 XX travels to Istanbul and Syria. Her mobile reveals contacts with Turkish and Lebanese numbers of recruiters. Both numbers were associated to the twitter accounts of ISIS recruiters (XX, managing the open source connection ‘for those who wants to join, contact …)
15-7-2015 the ROS of Padua (Carabinieri) starts a formal investigation on XX based on the complaint filed by XX father, following of her disappearance.
A parallel investigation was active in Rome due to the existence of an online documents aimed at tracking Italian militaries, including the head of staff.
17-7-2015 XX contacts her mother in Italy via WhatsApp, ask for forgiveness for what she has done and announces that they will meet again in three Paradise in the future. Contact from Syria with the parents and friends go ahead until 2016, via Skype and WhatsApp. XX wears the Niqab.
13-8-2015 Audio message from Syria to her school friend

Type of Crime

Art. 270 quarter, par. 2
With the exclusion of the cases foreseen in the Art. 270 bis and excluding cases of training, the individual is punished with the imprisonment from 5 to 8 years.
(Beside the article 270 bis, and except for the case of training, the convicted person is punished with the penalty of imprisonment from five to eight years.)
This paragraph was introduced with the Art. 1, comma 1, Decree n. 7/2015 (in force with the L. n.43/2015). The conviction for this crime implies losing the parental responsibility, when a minor is involved.
Comma added to art. 1, comma 1, D.L. 18 February 2015, n. 7, modified into L. 17 April 2015, n. 43.A norm of art. 1, comma 3-bis, D.L. 18 February 2015, n. 7, modified into L. 17 April 2015, n. 43, the conviction for the crime provided for in this article entails the incidental penalty of loss of parental responsibility when a minor is involved.

Type of attack
No attacks are recorded. XX didn’t try to recruit other persons.

Synthetic preliminary metadata analysis
1) The school, through the teacher, advised the LEAs (Carabinieri) based upon the classwork of XX
2) Interferences of Anonymous contributed to the escape of XX to Syria
3) No pre-set organization behind the journey to Syria. All was organized online.

Modus Operandi

Technologies used by the offender: WhatsApp, Skype, Twitter, Facebook, Tools to hide the IP. From 2014 XX’s mobile phone IPhone5S contained 200.000 WhatsApp messages, 50.000 Viber messages, and 2.000 Skype conversations. The user name was “rehilygp” with a profile with an AK47, a Qur’an and a radio transmitter.

Technologies used by the recruiters: WhatsApp, Skype, Twitter, Facebook. Servers are placed between Turkey and Syria. All phones are Syrian, Lebanese and Turkish.
Technologies used for investigation: Forensic software to extract data from mobile phones and computers (Maxtor Diamond X21 for a bit-a-bit extraction); Software Topsy to extract data from Twitter; Software to track and analysis phone calls; Interceptions.

People involved

XX, born in Morocco on XX and living in Arzegrande (Padova, Italy), fugitive.

Criminal History

No past criminal history but signs of instability in the post-adolescence. Until 2014, XX is a young girl apparently well integrated into the Italian society. She comes from a solid family of moderate Muslim background. She frequented the local school, had good results, and solid relations with Italian friends and teachers. Following to the declarations of some testimonials during the investigations, XX had sex with a young boyfriend of Moroccan origin, drank alcohol, and used cocaine. The family and close friend noted that XX started changing her behavior and character from 2014 (this is also the year of the declaration of the Caliphate in Mosul). She became isolated, always connected with mobile phones and internet, with signs of rebellion against the family, refusals to obey, help the mother and brothers; she refuses the family food and didn’t sleep in the night. These are signs of a deep crisis, which however may be common among the young post-adolescents. The judge noted in the sentence: “We have the image of a young girl, suspended in that land which separate the adolescence from the adult age, in a continuous search of her own identity, divided between Western customs and what she believed should be suited to a Muslim….she wanted to purify herself…” (pg. 28)

Influential and/or vulnerable Groups

Influential are the ISIS recruiters, who were in contact with XX since 2014 through the tools WhatsApp and WeChat. They used Syrian telephone under the nicknames MHMND e NEYLA_WW.
Vulnerable is XX who was convinced to leave her house, family and normal life to be dragged into a war, where it was almost impossible for her to escape.