Not ‘Lone Wolves’ After All

For 17 months, terrorist operatives guided the recruit, a young engineer named Mohammed Ibrahim Yazdani, through every step of what they planned to be the Islamic State’s first strike on Indian soil.

They vetted each new member of the cell as Mr. Yazdani recruited helpers. They taught him how to pledge allegiance to the terrorist group and securely send the statement.

And from Syria, investigators believe, the group’s virtual plotters organized for the delivery of weapons as well as the precursor chemicals used to make explosives, directing the Indian men to hidden pickup spots.

Until just moments before the arrest of the Indian cell, here last June, the Islamic State’s cyberplanners kept in near-constant touch with the men, according to the interrogation records of three of the eight suspects obtained by The New York Times.

As officials around the world have faced a confusing barrage of attacks dedicated to the Islamic State, cases like Mr. Yazdani’s offer troubling examples of what counterterrorism experts are calling enabled or remote-controlled attacks: violence conceived and guided by operatives in areas controlled by the Islamic State whose only connection to the would-be attacker is the internet.

In the most basic enabled attacks, Islamic State handlers acted as confidants and coaches, coaxing recruits to embrace violence. In the Hyderabad plot, among the most involved found so far, the terrorist group reached deep into a country with strict gun laws to arrange for pistols and ammunition to be left in a bag swinging from the branches of a tree.

For the most part, the operatives who are conceiving and guiding such attacks are doing so from behind a wall of anonymity. When the Hyderabad plotters were arrested last summer, they could not so much as confirm the nationalities of their interlocutors in the Islamic State, let alone describe what they looked like. Because the recruits are instructed to use encrypted messaging applications, the guiding role played by the terrorist group often remains obscured.

As a result, remotely guided plots in Europe, Asia and the United States in recent years, including the attack on a community center in Garland, Tex., were initially labeled the work of “lone wolves,” with no operational ties to the Islamic State, and only later was direct communication with the group discovered.

While the trail of many of these plots led back to planners living in Syria, the very nature of the group’s method of remote plotting means there is little dependence on its maintaining a safe haven there or in Iraq. And visa restrictions and airport security mean little to attackers who strike where they live and no longer have to travel abroad for training.

Close examination of both successful and unsuccessful plots carried out in the Islamic State’s name over the past three years indicates that such enabled attacks are making up a growing share of the operations of the group, which is also known as ISIS, ISIL or Daesh.

“They are virtual coaches who are providing guidance and encouragement throughout the process — from radicalization to recruitment into a specific plot,” said Nathaniel Barr, a terrorism analyst at Valens Global, who along with Daveed Gartenstein-Ross of the Foundation for Defense of Democracies in Washington wrote one of the first articles discussing the virtual plotters.

“If you look at the communications between the attackers and the virtual plotters, you will see that there is a direct line of communication to the point where they are egging them on minutes, even seconds, before the individual carries out an attack.”

Detailing this kind of plot direction has become a critical focus of counterterrorism officials in the United States and Europe, as they try to track terror planners who pose a lasting threat and to unravel the criminal networks that the group uses as middlemen to facilitate attacks.

Mr. Yazdani’s case presents one of the most detailed accounts to date of how the Islamic State is exporting terrorism virtually. This style of attack has allowed the terrorist group’s reach to stretch into countries as disparate as France and Malaysia, Germany and Indonesia, Bangladesh and Australia. And plots have been discovered in multiple locations in the United States, including in Columbus, Ohio, the suburbs of Washington and upstate New York.

“I fear this is the future of ISIS,” said Bridget Moreng, an analyst whose research on the virtual plotters was recently published in Foreign Affairs.

A Diverse Portfolio

Until roughly a year ago, Islamic State recruiters aggressively pushed the message that going to Syria was a spiritual obligation. They described the physical journey as a “hijrah,” the Arabic word used to refer to the Prophet Muhammad’s journey to escape persecution in Mecca, imbuing the act with religious meaning.

The recruiters hid within an ocean of 2.3 billion live social media accounts, flooding the internet with romanticized videos of life inside the caliphate, as well as brutal execution videos, using them as clickbait to lure potential recruits.

One of the Islamic State’s most influential recruiters and virtual plotters was known by the nom de guerre Abu Issa al-Amriki, and his Twitter profile instructed newcomers to contact him via the encrypted messaging app Telegram. Among those who sought him out, asking for instructions on how to reach Syria, was Mr. Yazdani, who had convinced himself that it was his religious duty to move his family to the caliphate.

By 2015, Amriki was one of close to a dozen cyberplanners based in Syria or Iraq who were already actively recruiting volunteers abroad, according to a tally based on investigation records from North America, Europe and Asia.

Initially, they made little effort to hide, posting grandiose threats against the West on public social media feeds. They were sometimes discounted as mere cheerleaders for the terrorist group.

But by the late spring of 2015, they were considered enough of a threat that both American and British intelligence began tracking their movements, methodically targeting them with airstrikes and killing several since then.

Among them was Amriki himself, who was killed along with his wife on April 22, 2016, when a bomb flattened their apartment in Al Bab, Syria. The Pentagon press secretary, Peter Cook, identified him as a Sudanese citizen also known as Abu Sa’ad al-Sudani, and described him as one of the Islamic State’s “external attack planners” who “actively sought to harm Western interests.”

The Department of Defense’s account showed, moreover, that the handler had been involved in far more than just the Hyderabad case, planning attacks on three continents.

At the same time that he was recruiting Mr. Yazdani, Amriki was grooming attackers in Canada and Britain, as well as at least three other young men in suburbs across America, according to court records. They included a former member of the Army National Guard living in Virginia; a warehouse worker from Columbus; and Emanuel L. Lutchman, a 25-year-old in Rochester.

Looking for ways to get to Syria, Mr. Lutchman reached out to Amriki on Dec. 25, 2015, asking what it was like to live inside territory controlled by the group. “Dream come true,” Amriki responded, before telling the young man that the Syrian border had been closed, according to the criminal complaint.

Instead, the handler suggested that Mr. Lutchman carry out an attack right at home on New Year’s Eve — less than a week after their first exchange. Plan an “operation” and kill “1000000s of kuffar,” Amriki instructed him, using a derogatory Arabic word meaning infidel. Over the course of several chats via the Telegram service, they planned how Mr. Lutchman would attack a bar serving craft beer to celebrate the holiday, prosecutors say.

The two men discussed recruiting three other “brothers” to take part. They stayed in contact as Mr. Lutchman went to Walmart, where he spent $40 on two ski masks, two knives, a machete, zip-ties, duct tape and latex gloves. He planned to abduct one of the bar’s customers and videotape himself killing the victim, prosecutors say.

And they exchanged a flurry of messages, as the 25-year-old began to voice doubts and the handler assumed the role of therapist, patiently listening and reassuring him.

Mr. Lutchman was arrested at his home the day before his planned attack on Merchants Grill in Rochester, outed by the accomplice he had recruited, who turned out to be an F.B.I. informant.

At the time of his arrest, Mr. Lutchman had been communicating with the handler for a total of five days. It appears he never heard his handler’s voice, or saw so much as a photograph of him, according to the court filings.

By late 2015, travel to Syria had become treacherous. Intelligence services on both sides of the Atlantic were getting better at identifying aspiring jihadists, arresting dozens as they prepared to board flights for Istanbul in hopes of crossing into Syria. At first, Islamic State operatives instructed recruits to throw off law enforcement by taking more indirect routes. They also began urging followers to head to other Islamic State colonies, including in Libya.

That was what law enforcement officials said a young man from Columbus, Aaron T. Daniels, was trying to do in November, when he was arrested while trying to board a United Airlines flight to Houston, from where he would travel to Port of Spain, Trinidad and Tobago, before continuing toward Libya.

No longer describing the journey to Syria as a spiritual necessity, the Islamic State announced last year that those who could not reach the caliphate should attack at home.

“If the tyrants have closed in your faces the door of hijrah, then open in their face the door of jihad,” the group’s spokesman, Abu Muhammad al-Adnani, said in a message released in May.

Local Assets

At the time Amriki was killed last April, he had been exchanging messages with Mr. Yazdani in India for more than a year, patiently offering encouragement as his recruit tried and failed to get a visa first to Greece, and then to Turkey in an effort to reach Syria.

One of eight children, Mr. Yazdani, who is now 30, grew up in a cramped apartment in the slum of Aman Nagar B, in a narrow alley that smells of sewage in Hyderabad’s Old City. He beat the odds, earning an engineering degree and landing a job as a quality inspector in Saudi Arabia for nearly four years, before returning to India.

While abroad, he began watching the Islamic State’s online propaganda, and soon he became consumed by a desire to leave it all for the caliphate.

“Since then, I was inclined to join Islamic State and work for the cause of religion,” Mr. Yazdani told investigators from India’s National Investigation Agency, according to his interrogation record, which was obtained by The Times and was first reported by NDTV, a New Delhi-based television company.

He logged into Twitter and searched the hashtags #ISIS and #Khilafa, the terrorist group’s preferred spelling of caliphate. In a few keystrokes, he made contact with Amriki.

“I created a Telegram ID,” Mr. Yazdani told investigators, “and sought his guidance to reach Syria.”

After months of frustrating and failed attempts to help Mr. Yazdani get a visa, Amriki’s directions changed course: “He asked me to work for I.S. by staying in India itself.”

It was a period in which the Islamic State was refining the way it exports terror, increasingly relying on cyberplanners with local knowledge. Just before his death, Amriki handed off Mr. Yazdani to a different handler, known only by his Telegram screen name, “WindsofVictory.” His identity has not yet been confirmed by Indian officials, though they believe he is Indian because he spoke fluent Hindi.

The new handler guided the eight-member cell as it took shape, exchanging messages with Mr. Yazdani as the engineer recruited his family members and friends. They named themselves “Jund-ul-Khilafa-Fi-Bilad-Hind,” the Army of the Caliphate in India, according to the interrogation records, which misspelled part of the Arabic name.

At the end of May, Mr. Yazdani received a message telling him to go to the Nanded Airport, about 200 miles away. He and an accomplice, Habeeb Mohammed, 31, drove all night. After they reached the airport the next morning, the handler told them to head to the Railway Division Office. Near that office, he said, they would see a plastic bag hanging from a tree, according to the transcripts of the men’s interrogations.

“It was informed by the handler that opposite to DRM office, there are two trees and on one of the trees there would be a white color polythene sheet (used for wrapping fragile articles),” Mr. Mohammed told investigators. “We spotted the place, and I, first on the pretext of urinating, went to check for the consignment.”

When they opened the bag, they found two pistols and 20 bullets, according to their account to law enforcement. It was one of at least four drops that the handler set up for them.

Because the pistols were rusted, they say the handler instructed them to travel to the railway station in the city of Ajmer, about 600 miles to the north. This time they were told to bring 65,000 rupees — around $1,000 — and leave it near the railway track sealed in a plastic bag, which would be picked up and used as payment for weapons.

Because the communication always had to go through the handler, the members of the Hyderabad cell never directly interacted with the arms seller. When they were arrested, they could not provide any clues as to who had left the contraband, Indian investigators said.

The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Mr. Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork.

As soon as Mr. Yazdani indicated he was willing to undertake an attack, the handler instructed him to download ChatSecure, a messaging app to be used when they spoke by phone. When he used his laptop, he was told to contact the handler via Pidgin, another encrypted tool. He was told to create an account with Tutanota, a secure email service. And the handler taught Mr. Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive.

Once that system was in place, the handler told Mr. Yazdani to prepare a handwritten oath of allegiance, known as a “bayah,” to the Islamic State’s leader.

Members of the cell signed it using their noms de guerre, and Mr. Yazdani was told to scan it to his laptop, using Tails to obscure the operation. Next, he was told to upload it to www.gulf-up.com, which allows users to upload files and produces a URL that can be shared with a third party. The link to the URL was to be sent via the secure email.

By methodically working through URLs archived on the website, The Times was able to find the image of the one-page handwritten document containing the Indian men’s pledge of allegiance to the Islamic State. The file was uploaded around the time that Mr. Yazdani told investigators he had done so, and the document matched his description of the wording he had disclosed to the authorities. Until they were alerted to its existence, Indian investigators were not aware that the document was still archived on the website, they said.

The men’s families have denied that they played any role in a terrorist plot, and accuse the authorities of planting evidence against them.

One Indian investigator, speaking on the condition of anonymity because he was not authorized to brief reporters, said officials were able to crack the full extent of the case only because Mr. Yazdani and his accomplices confessed during interrogation, divulging the passwords to their accounts after their arrests last summer.

Global Reach

Though the Hyderabad case is among the most detailed in showing how Syria-based handlers directly facilitated terrorist attacks abroad, it is neither the first, nor the only one. Investigation documents from Europe show that a growing share of attacks bear signs of contact with the Islamic State’s stronghold, even though the attacker was initially described as acting alone.

The first time that officials in Europe described an attack as having been “télécommandé,” or remote-controlled, was in the spring of 2015 after a young information technology student named Sid Ahmed Ghlam tried to open fire on a church in the Paris suburb of Villejuif. Instead, he shot himself in the leg.

When the police searched his car, they found his Lenovo laptop containing a series of messages showing how he, too, had been guided by a pair of handlers who provided both the weapons and the getaway car, according to hundreds of pages of police and intelligence records obtained by The Times.

“OK, brother, now pay attention,” one of the messages begins, instructing the then-23-year-old to head to the suburb of Aulnay-sous-Bois, where he would find the automatic weapons in a bag left in a locked car parked near a sandwich shop. “Search among the cars that are parked there near the big road and look for a Renault Mégane,” the message said. “Look at the front right tire — you’ll find the keys placed on top.”

The handler then instructed him to store the weapons in another car in a parking garage 10 miles away, a precaution in case his apartment was searched.

Later, French investigators said they had found that Mr. Ghlam’s handlers were French citizens who had traveled to Syria to join the Islamic State. They, in turn, tapped their criminal network back in France to arrange the logistics of Mr. Ghlam’s plot.

Seamus Hughes, the deputy director of the Program on Extremism at George Washington University, said the handlers were essentially “quarterbacking” the attack: “They’re from there, so they can essentially tell someone, ‘O.K., go 10 yards and go this way.”

Wiretaps, interrogation records and transcripts of chats recovered on suspects’ phones and laptops show that this level of guidance has occurred all over the world.

In Germany, a man who set off a bomb outside a concert and a teenager who assaulted train passengers with an ax were both chatting with handlers until minutes before their attacks. The teenager’s handler urged him to use a car instead of an ax — “The damage would be much greater,” the handler advised — but the young man said he did not have a driving permit. “I want to enter paradise tonight,” he said, according to a transcript obtained by a German newspaper.

In northern France, a pair of attackers who had been guided by an Islamic State cybercoach slit the throat of an 85-year-old priest. The pair had not known each other, and according to the investigative file, the handler introduced them, organizing for them to meet days before the attack. Intelligence records obtained by The Times reveal that the same handler in Syria also guided a group of young women who tried to blow up a car in front of the Cathedral of Notre-Dame in Paris.

And investigations into attacks in Malaysia, Indonesia and Bangladesh reveal that the recruits were directly communicating with Islamic State handlers who molded the plots as they took shape and helped arrange logistics, in some cases wiring money.

In several, a pattern has emerged: The attacker initially tries to reach Syria, but is either blocked by the authorities in the home country or else turned back from the border. Under the instructions of a handler in Syria or Iraq, the person then begins planning an attack at home.

Law enforcement officials describe that sequence of events in one of the most recent foiled attacks in France, where a group of people are accused of plotting to hit the popular Christmas market in the city of Strasbourg, having been given the GPS coordinates of a location to pick up weapons. At least one of the five men arrested so far had been turned back from Turkey, French prosecutors said.

Weak Links

While a reliance on local amateurs has allowed the Islamic State to announce that it can stage terrorism around the world, it has also led to many failed attacks.

Instead of opening fire on a church, Mr. Ghlam shot himself in the leg. Instead of laying waste to a music festival this past summer, the Islamic State recruit in Germany detonated his bomb prematurely, killing only himself.

The same thing happened the day before the end of Ramadan on July 2 inside a police compound in Indonesia, where another remotely guided attacker hit the switch on his crudely assembled suicide vest.

“He didn’t even knock over the flowerpot on the ledge next to where he blew himself up,” said Sidney Jones, director of the Institute for Policy Analysis of Conflict.

Indonesian officials say that the suicide bomber had been incited to attack by Bahrun Naim, a 33-year-old Indonesian man who is now one of the Islamic State’s most prolific cyberplanners, operating from the group’s capital in Raqqa, Syria.

Initially, Mr. Naim wired money to families in Indonesia to pay for travel to Syria, officials said. Later, the bank transfers he sent were to be used to buy the chemicals needed to build explosives, according to the interrogation records of his recruits.

In just over a year, the young men with whom he was in touch attempted at least six attacks, targeting a police post, a Buddhist temple and a church, as well as foreigners visiting the country. In November, a college dropout who the police said had at least been initially in contact with Mr. Naim was arrested as he prepared to attack the embassy of Myanmar. In his home, the police recovered a quantity of explosives that could have resulte in a blast twice as powerful as the 2002 Bali bombing, which killed 202 people, the police spokesman told local news media.

Yet nearly all of the plots attributed to Mr. Naim have failed. And it was human error that finally led to the arrest of Amriki’s followers in Hyderabad.

The plot began to unravel in June after the men were instructed to collect a 10-kilogram bag of ammonium nitrate left beside a canal next to mile marker No. 9 on the Vijayawada Highway.

They returned to Mr. Mohammed’s home to begin preparing a bomb, but could not figure out how to replicate the steps in the instructional YouTube video sent to them by the handler. “We could not succeed in making powder, as it became jellylike paste,” Mr. Yazdani lamented, according to the transcript of his interrogation.

They tried using a tea strainer. They tried heating it longer. They began talking on their cellphones about their efforts to “cook the rice.”

By then, the police were wiretapping their calls and suspected that all the food talk was a crude attempt at misdirection. Early on June 29, the police banged on the door of Mr. Mohammed’s home.

In his bedroom, they found the half-cooked explosive in his refrigerator.