Abstract: Until his death in a U.S. drone strike in August 2015, Junaid Hussain was the Islamic State’s most prolific English-language social media propagandist, working to incite and guide sympathizers in the United Kingdom, United States, and beyond to launch terrorist attacks. Before joining the jihad in Syria, Hussain was part of a hacking collective in the United Kingdom, focusing much of his attention on perceived injustices against Muslims. In many respects, he was well integrated into British society with his family home in a leafy suburb of Birmingham. A spell in prison contributed to his radicalization and his decision to move to Syria, where he married fellow extremist Sally Jones.
Junaid Hussain became the Islamic State’s chief English-language cyber influencer during his short tenure with the group. In addition to directly plotting attacks with recruits, he inspired others, disseminated sensitive information, and captured the attention of the media. He became the face of a new cyber-savvy version of jihadism. His behavior was so threatening to coalition nations that he became the first hacker in history to be killed by a drone strike.
This profile is the culmination of interviews conducted by the author and his research team with Junaid Hussain’s friends, ex-hacking associates, family friends, an ex-prison inmate, his former lawyer, senior U.S. and U.K. security officials, people he spoke to online while he was in Syria, access to transcripts of those private conversations, U.S. and U.K. court documents, and news reports.a
A Politicized Kid from a Leafy Suburb
Junaid Hussain (born circa 1994) was a second-generation British national whose family hailed from the Pakistani side of Kashmir. When he was growing up, his family lived in the Small Heath district of Birmingham, an area heavily populated by South Asians with the second-highest crime rate in Birmingham.1 Before he became radicalized, Hussain’s family moved out of that area and into Kings Heath, an area often touted as a highly desirable place to live in the United Kingdom.2 It was while living in this leafy neighborhood that Hussain’s worldview changed.b
His father was a respectable member of the British Pakistani community. He ran private hire cabs in the Birmingham area when Hussain was growing up. The senior Hussain was considered an “honorable,” “hardworking,” and “well-spoken” man by family friends interviewed by the author.3 Junaid Hussain, in contrast, seemed to be a person of few words.
Junaid Hussain’s friends, including individuals who interacted with him in Syria, paint a picture of a reserved yet passionate young man. According to a family friend who knew Hussain from a young age, “Junaid wasn’t somebody you had a lot of interaction with … he wasn’t that kind of an outgoing person as such, he was of limited words … always seemed withdrawn like, you know, when somebody has a lot on their mind and … they’re really into deep thought … he wasn’t one to hold conversations for long periods of time on any particular topic so it was very sort of piecemeal and short, unless he was talking about technology and then he’d have more of an attention span.”4
This sentiment was echoed by a friend who primarily got to know Hussain in the months before he left for Syria. “When you just tried to have small talk with him, or try to get to know him, he would shut down sort of. But when it came to topics he was passionate about, he really came to life.”5
His personality did not seem to alter much when he went to Syria. Dilly Hussain (no relation to Junaid Hussain) is a U.K.-based journalist and activist, and one of the few people who interviewed Hussain via Skype video when he was in Syria.6 When asked to describe Hussain, he said, “I could describe him in three words: he was polite, he was very smart, and he was passionate … He wasn’t a chatterbox though. When it came to politics, he would be very talkative, very outgoing, very defensive. But areas pertaining to his past … I’d get one-word answers or a handful of words.”7
A Hacker Known as TriCk
Even before he reached his teenage years, he became involved in online hacking. Hussain felt more comfortable interacting with the world from behind a computer screen rather than face to face. According to a friend who knew Hussain from when he was 15 years old to the time he left for Syria, “You couldn’t really see too much of his emotions, unless he was online … He was quiet in real life. He was louder online. I’d say he was more himself online than in real life.” When his hacktivist friends who never met him in real life but chatted with him on a daily or weekly basis were asked to describe his personality, they all described him very differently than those who knew him offline. “One-hundred percent outgoing, extroverted, funny, witty. But most of all, extremely caring and compassionate,” one such hacktivist said.8
Hussain’s foray into the hacking world stemmed from a need for retribution. In February 2012, around two years before he arrived in Syria, Hussain gave a revealing interview to the website Softpedia. He described how at the age of 11 someone hacked into his account for a game he was playing online. “I wanted revenge, so I started Googling around on how to hack.” Hussain was unable to get his revenge, but it did set him down a path of skill-building. “I joined a few online hacking forums, read tutorials, started with basic social engineering and worked my way up … I lurked forums, met people, asked questions, from then I moved onto hacking websites, servers, etc.” 9
As his hacking skills developed, so too did his taste for political activism. “When I was 15, I became political. It started from watching videos of children getting killed in countries like Kashmir & Palestine. I wanted to know why this was happening and who was doing it, there was loads of questions in my head,” Hussain told Softpedia.10 Hussain’s passion for politics would take him out of his house and onto the streets. As early as 2009, he was protesting in the streets for the plight of the Muslim people. “It was mostly against EDL stuff,” said Hussain’s friend, referring the British right-wing group, the English Defense League.11
While Hussain was clearly passionate about the suffering of the Muslim people, he was not particularly passionate about Islam. “I wouldn’t say he was particularly a very religious young man. Nothing ever showed to me that he was, you know, praying five times a day or a devotee as such. He probably went to the mosque a few times on different occasions,” said a family friend who knew him since childhood. “No, just a bitterness towards the suffering in Kashmir, Palestine, Iraq—those sort of places.”12
However, his time alone on his computer would send him down a rabbit hole of conspiracy theories. As he told Softpedia, “I browsed the net, read books, watched documentaries, etc. I was getting more and more into politics, I started researching deeper into stuff like the Free Masons, Illuminati, The Committee of 300, etc. It made me angry, it changed the way I lived my life and the way I saw the world. I then started using hacking as my form of medium by defacing sites to raise awareness of issues around the world and to ‘bully’ corrupt organizations and embarrass them via leaks etc., which is how I got into hacktivism.”13
Hussain was not alone in his ‘hacktivism.’ He got a group of hacktivists together, many who shared similar political leanings though not necessarily the same ethnicity. “I was in a couple of hacking groups & underground forums which were slowly becoming dead and inactive so I created my own site p0ison.org (was 15 at the time), and TeaMp0isoN was formed from there.”14
TeaMp0isoN was a band of eight hacktivists made up of teenagers and young adults mostly from the United Kingdom.15 Hussain’s hacktivist pseudonym was TriCk,16 and the other members went by the pseudonyms of iN^SaNe, MLT, Phantom~, C0RPS3, f0rsaken, aXioM and ap0calypse.17 In the early days of TeaMp0isoN, members collaborated with various other groups such as the ZCompany Hacking Crew. Both groups identified as pro-Palestinian and pro-Kashmiri, and they collaborated on hacks against those they perceived as the enemies of Muslims. For example, in December 2010, posts began to appear on Facebook groups that were deemed Zionist, right-wing, or anti-Islamic, which said “On the evening of the 31st of December 2010 (New Years Eve), TeaM P0isoN and ZCompany Hacking Crew will clean up Facebook.”18 And indeed, on New Year’s Eve, hundreds of Facebook group pages run by organizations like the English Defense League (EDL) went blank. Hussain and members of ZHC took credit for the hack, which was followed shortly thereafter by hacks against Mark Zuckerberg’s19 and then French President Nicolas Sarkozy’s20 Facebook pages. It is unclear if Hussain or TeaMp0isoN was involved in these latter hacks.
Cyber attacking local right-wing groups remained a focus of Hussain’s through the beginning of 2011. In February 2011, EDL’s website was apparently hacked by Junaid Hussain, as evidenced by a message and pictures of Palestinian protestors and Israeli tanks. The message’s headline stated “Hacked By TriCk aka Saywhat? – TeaMp0isoN.” The message stated:
“I am an extremist, I try extremely hard to hack websites to raise awareness of issues, I’m a terrorist, I terrorize websites & servers, But the EDL are extremists too, they try extremely hard to kick Muslims out of the UK, and they are terrorists, they terrorise local Muslim communities & businesses – Myself & the EDL are both extremists & terrorists, but why do they want to kick me out? Because I follow a certain religion? I was born in UK, my skin colour may not be the same as yours but my passport colour is…”21
Hussain then claimed to have personal information of EDL leaders and supporters and threatened to release the information, which he eventually did.22
By mid-2011, Hussain started to up the ante of his hacking exploits. In June of that year, TeaMp0isoN posted former British Prime Minister Tony Blair’s address book online.23 The hack was accomplished by accessing a Blair advisor’s personal email account and then copying the contacts.24
In the months that followed, TeaMp0ison would claim multiple hacks, including on Blackberry for cooperating with authorities during rioting in several cities in England in the summer of 2011;25 defacing Croatia’s NATO website;26 breaching a (potentially outdated) United Nations Development Programme server;27 making questionable claims about hacking U.K. Ministry of Defense email accounts;28 collaborating with ‘Anonymous’ and other groups to leak a database with 26,000 credit card details that they claimed were obtained from a hack of Israeli websites in support of pro-Palestinian and Occupy movements;29 and many other claimed hacks against news agencies and political entities.
One of TeaMp0ison’s most publicized attacks came in April 2012 when they launched a phone-based denial-of-service (DOS) attack against the United Kingdom’s Counter Terrorism Command’s hotline. The attack caused the office’s telephone lines to be bombarded by a robotic voice that repeated “Team Poison.”30 Hussain later revealed that the calls and recording were routed through a compromised server in Malaysia.31 Hussain then himself called the offices the next day to taunt the CTC representatives, introducing himself as TriCk while speaking in an affected American accent before uploading the audio of the conversation to the TeaMp0ison YouTube channel.32 In a more impressive feat of hacking, TeaMp0isoN was able to record and upload33 a call between a CTC representative and another agency where the former tells the latter that their office was barraged with over 700 calls from the hackers. Later court hearings would reveal that it was 111 calls on seven different phone lines over three days.34
Immediately after the attacks, Hussain, under the pseudonym TriCk, released a statement explaining his motivations:
“The reason behind the recent phone denial of service … was because of the recent events where the counter terrorist command and the UK court system has extradited Babar Ahmad, Adel Abdel Bary & a few others to be trialled in the US, and we all know how the US treats innocent Muslims they label as terrorists, e.g. – Aafia Siddiqui … Babar Ahmad is a British Citizen who has been detained in the UK for 7 years without trial he received 149,395+ petitions to be put on trial in the UK and not the US, but they ignored the petition and have extradited him, what’s happened to democracy? Adel Abdel Bary has been in prison for 12 years in the UK, apparently he received a phone call from Osama years ago therefore they imprisoned him claiming they had a tape of the call but there was never a witness to prove it or show the tape, if I (TriCk) was to call George Bush would they lock George Bush up for receiving a phone call from a cyber-terrorist / hacker? … all the allegations against these guys have taken place in the UK, therefore they should be trialled in the UK and not the US. The US is calling it a “global war on terror” which in my opinion is a cover up for “global war on Islam” – the real terrorists are the guys sitting in 10 Downing Street and the Whitehouse.”35
In February 2012, Hussain bragged about his imperviousness to law enforcement, saying “100% certain they have nothing on me … My real identity dosen’t [SIC] exist online – and no I don’t fear getting caught … I don’t fear prison.”36 In another interview published on April 12, 2012, just after the CTC phone hack, he doubled down on those sentiments. “I fear no man or authority,” he stated.37 Within a few hours, authorities arrested him.
Prison and Radicalization
When barrister Ben Cooper first met his client at Westminster Magistrates’ Court in London on April 16, 2012, Hussain’s composure was a far cry from the blustering bravado he projected in his interviews. “He was shocked and frightened by the experience of being brought to court for the first time,” Cooper told the author. “He was very reserved, very meek, very softly spoken, and he came across a very unassuming, even humble young man.” The charges against him related to Tony Blair’s PA email hack and the CTC attack (though hacking of Nicholas Sarkozy’s emails was also brought up by prosecutors38).
Cooper was able to get Hussain bail that day, but given the seriousness of the allegations, the case was sent to Southwark Crown Court. Hussain would spend 104 days on curfew while his prosecution proceeded. Despite his harsh anti-establishment rhetoric, in this period he took advantage of the U.K. education system to complete three A levels and secure admission to London Metropolitan University to study computer forensics.39 His subject choice could have indicated a desire to ‘go clean,’ or, conversely, to get better at covering his trail to ensure his black hat hackingc would not lead to him getting caught again.d
Hussain did not contest the charges against him. He admitted his wrongdoing and pleaded guilty under the Computer Misuse Acte for the email hack and for disrupting the CTC phone lines. Cooper’s arguments for a reduced sentence emphasized 1) the fact that Hussain was admitting and showing remorse for what he had done thus demonstrating his good character;f 2) that a prolonged sentence could jeopardize his placement at university; and 3) that he had a supportive family. His father, in particular, stood by his son. As Cooper put it, “[Hussain] looked scared right from the start, to be honest, and for that reason, his father attended court on every occasion to offer his full support. And so I made clear to the judge that this is a teenager who had strong parental support, a father who is standing by him, a father who is working hard, very responsible, good father, who clearly wasn’t aware of what his son was doing at the time of committing the offense when he [was] only 15.”
Cooper also was aware that an extended prison sentence could have a detrimental impact on Hussain. “I was inviting the court to find alternatives to custody including the prospect of suspending the sentence, really to avoid the scenario of him spending months alongside hardened serious criminals, many of whom may be inside for violent offenses … I was concerned because of his peculiar character. He wasn’t someone who was particularly comfortable in social situations. He was clearly someone spending a lot of time in his room on his computer and not interacting normally with society… that he was someone who was vulnerable to such environments and capable of being exploited.”g
The judge ultimately settled for a lenient sentence. On July 27, 2012, he was given two consecutive sentences of three months for each of the crimes he was charged with, leading to a six-month sentence. However, the judge took into account the 104 days that Hussain spent on curfew, which reduced his sentence by 52 days, making it just over a four-month sentence with the possibility of only serving 50 percent of the sentence in prison and then early home release. “The judge could have given him a much longer sentence, and the authorities would have allowed him to do so,” Cooper says. “[The judge] was understanding of the mitigation and wanting to try to help him by keeping this sentence as short as possible… the judge was hoping that, because of the timing of the sentence, [Hussain] would still have been able to potentially start his university course in the autumn if he was released early.”
Cooper and Hussain last saw each other immediately after the sentencing. “He would be going to Feltham Young Offender’s Institution. And he would have been alongside a whole range of criminals there … he certainly looked scared,” recalls Cooper. “When I heard about what eventually happened with [Husain], I was concerned that the sentence had been counter-productive. I thought that if I had just kept him out of prison maybe things could have been different.” Hussain was eventually given early home release in mid-September 201240 having served only a month and a half in prison.
Prison appears to have been a watershed period for Hussain. Prior to his incarceration, Hussain had labeled himself an “extremist” and a “cyber terrorist” and appeared to see himself as fighting against perceived injustices toward Muslims worldwide, but he had described his political views as closer to anarchism and showed no support for political Islam.
It appears that it was in prison that his political views began to move in an Islamist direction. A prison inmate who was incarcerated with Hussain but did not have much interaction with him told the author’s research team that he witnessed him spending time in prison with a well-known “radical Islamist” group.41 According to Dilly Hussain, who spoke to Hussain twice over Skype and many times over Facebook Messenger while he was in Syria, “I do know that he met individuals in prison. He didn’t say who, but he did say that he did speak to individuals in prison who he said made him enlightened.”
After Hussain was released from prison, his black hat hacking from the United Kingdom seemed to come to a stop. In January 2013 in an interview with Softpedia, he revealed that prison made him see things differently, and so he launched a website called illSecure.com that provided “a legal and safe platform for ‘security experts’ and ‘hackers’ to test and develop their skills in a friendly competitive lawful environment,” Hussain said.42 “There’s currently no organization that helps security experts and hackers to channel their skills down a legal route, so most people go down the illegal route without thinking of the consequences.”43 The website offered 17 challenges that allowed individuals to develop their hacking skills.
His friends revealed that after his release, Hussain spent some of his time doing university coursework and became increasingly involved in posting political commentary on Facebook and attending protests related to issues regarding Muslims. “He was also posting things on Facebook related to Palestine or Kashmir or the EDL,” said one friend who attended protests with Hussain.44 Another exclusively online friend of Hussain said, “He was always online, like 24/7. You could send him a message anytime of the night or day and he would respond.” This same friend also stated that after prison, “he did start looking at Islamic points of view as well. He would talk about what Islam says about certain things like Day of Judgment and in terms of Israel as well. He would send me videos randomly, and I’d watch it and then we’d have a little discussion after it, give our points of view. Then maybe a week later, he’d send me another video. And so it was becoming a religious focus as well.”45
In addition to posting his political thoughts on Facebook, Hussain increased his offline activism. Friends saw him attend more rallies in Birmingham. One EDL rally in Birmingham in July 2013 led to skirmishes when some counter-protestors calling themselves the Muslim Defense League rushed at riot police.46 Hussain was one of the counter-protestors arrested that day for suspicion of violent disorder.47 Another friend told the author48 that Hussain posted a video on Facebook of him running from police. He was released on bail pending further investigation. West Midlands police later decided not to pursue any charges.
His arrest appears to have further hardened Hussain’s views. According to one of Hussain’s friends, after the arrest, Hussain started posting on Facebook “some extreme ideology kind of stuff like ‘if you’re gonna do something, do it properly, or just don’t, blah blah.’ It wasn’t too violent in that sense, but it was kind of worrying.”49
Joining the Jihad in Syria
It was while Hussain was on bail that he left for Syria. It is not exactly clear when he left for Syria, but most sources interviewed by the author said it was sometime in late 2013. “He posted on Facebook when he got to Syria. He said two days after leaving [the United Kingdom] he ended up in Syria … He was saying how he dodged Turkish guards, and they were shooting at him,” according to one online friend.50
The details of Hussain’s crossing into Syria and how he linked up with the Islamic State are unclear. After joining the group, he took up the kunya Abu Hussain al-Britani. Friends of Hussain told the author51 that soon after arriving in Syria, Hussain deleted the Facebook account through which they were communicating with him but then later opened new Facebook and Twitter accounts, where he got in touch with some of them again. Some reported that he tried to convince them to join him in Syria. They also say that he did not initially mention the name of the group that he had joined.
Junaid Hussain’s Twitter profile photo
Around the time that Hussain made his way to Syria in late 2013, so did52 his bride-to-be, Sally Jones, a British woman 25 years his senior who had converted to Islam. Jones and Hussain started a romantic relationship online while they were both living in the United Kingdom. It is not clear if they ever met in person before arriving in Syria.
Jones had had a turbulent life. She was born in Greenwich, southeast London. Her parents divorced, and her father committed suicide when she was 10 years old.53 She dropped out of school at age 16, worked various jobs, and in the 1990s eventually became a singer and guitarist for an all-female punk rock group called Krunch. She had her first son in 1996 (the father of that child died three years later), and her second son from a subsequent relationship, Jojo, was born in 2004.54 She would eventually move to Chatham, Kent, where she lived in council housing with her two sons. Her then neighbors said that she was unemployed and on welfare.55 Jones would be duped into revealing more of her journey via Twitter and Kik messenger to a Sunday Times journalist who posed as a potential recruit, a fictional 17-year old named Aisha.56 The first of two publications following the interview unmasked Sally Jones to the public.57 During those conversations, Jones said that she converted to Islam in May 2013 after starting an online relationship with Hussain.58 When she came to Syria, she brought Jojo with her. She claimed that it was on her very first day in Syria that she married Hussain and Jojo converted to Islam.59
Jones was not the only pre-existing contact Hussain had when he traveled to Syria. He also had contact with Adbel-Majed Abdel Bary, who had previously been a London-based rap artist known as Lyricist Jinn or L Jinny. Bary would later gain notoriety because of his extensive social media use and speculation in the British press that he was possibly a member of the British Islamic State hostage holding unit dubbed The Beatles,60 even though no credible evidence materialized to support that latter claim. A mutual friend of both Hussain and Bary told the author that they had known each other in the United Kingdom through the music scene.61 In fact, the two men appeared in a music video together filmed in the United Kingdom before they left to Syria.62
In February 2014, Bary tweeted the following: “Me & Abu Hussein al britani got kidnapped /tortured by FSA/IF scum they stole our 4 ak’s and a 7mm, my vechile & our phones and cash.”63 It was the first public mention of Hussain’s presence in Syria. It is not clear who traveled to Syria first, but according to their mutual friend, it is plausible that, through online contact, one could have motivated the other to venture there.64
Where exactly this “kidnapping” of Hussain and Bary took place is not clear, but there is a possible clue in a tweet by Sally Jones on August 10, 2014: “Alhamdulillah me and my husband made it to the Islamic State after being stuck in Idlib for 7 mnths & are now living in the khilafah.”65 If accurate, this would place Hussain and Jones somewhere in Syria’s Idlib Province from roughly January to August 2014 before making their way to Raqqa, the Islamic State’s de facto capital at the time.
Islamic State Cybercoach
Around the time they settled in Raqqa, the couple was unmasked. Hussain’s identity was revealed by the British Sunday Times newspaper on June 15, 2014,66 and Jones was unmasked six weeks later on August 31, 2014,67 by the same publication. Their story would turn to tabloid fodder. His hacking past, her rocker past, their age differences and online love connection all added to a gossipy narrative. Hussain and Jones (who went by the kunya Umm Hussain al-Britani and Sakinah Hussain) did not shy away from social media. They tweeted regularly, varying from quoting religious texts, to trolling other Twitter users, to taunting the Islamic State’s enemies, to encouraging more people to migrate to Islamic State territory, to calling for specific acts of domestic terrorism in the United States and United Kingdom.68 Twitter and Facebook shut down their accounts regularly, but they opened new ones immediately and continued their messaging.69
Hussain played the role of an online jihadi propagandist and recruiter. In addition to publicly tweeting, he was also open to having potential recruits contact him via various messaging apps that he listed along with his contact information on his Twitter profile.70 Despite his hacking background, Hussain’s initial operational security was surprisingly poor. Until his death, his Twitter profile listed Kik messenger as a way to contact him. At the time, Kik was commonly used by Islamic State members, but it was rated by the Electronic Foundation Frontier, a non-profit organization that defends digital civil liberties, as one of the least secure messaging platforms.71 Skype was considered equally as insecure,72 and yet he used it to speak with people as well.73 His operational security seemed to improve with time; screenshots that the author reviewed of conversations between him and potential recruits74 did show that by summer 2015, when someone contacted him on Kik, he instructed them to switch to Surespot, an online messaging app that, unlike Kik at the time, offered end-to-end encryption.
Hussain became a founding member of an English-language online recruitment collective within the Islamic State made up of a dozen members who the FBI dubbed “The Legion” and the “Raqqa 12.”75 Other notable members included fellow British nationals Reyaad Khan from Cardiff, Raphael Hostey from Manchester, as well as the Australian Neil Prakash. Together, this band of propagandists reached thousands of English speakers around the world through their public posts and attempts to groom and inspire potential attackers via one-on-one online contact.
Hussain was linked to many attempted terror plots in the United States and the United Kingdom. His popularity in both pro-Islamic State networks and Western media made him a magnet for extremists reaching out to online recruiters like himself. One example was Ohio college student Munir Abdulkader, who reached out to Hussain and fell under his guidance in spring 2015.76 After discouraging Abdulkader from coming to Syria, Hussain instructed him to kidnap a member of the U.S. military and to record his killing. Hussain then switched gears and told him to attack a police station near Cincinnati. After Abdulkader boasted to Hussain about his skills on the shooting range, Hussain responded: “Next time ul be shooting kuffar in their face and stomach.”77 Abdulkader was arrested before he could carry out his shooting spree and sentenced to 20 years in prison.78
In mid-May 2015, Hussain was also in contact with one of a group of three individuals in New England who plotted to kill, after conversations with Hussain, the organizer of a “draw Mohammed contest” in Garland, Texas.79 Their contact with Hussain and purchases related to their intended attack eventually caught the attention of police surveillance, leading one to die after he tried to attack the police with a knife as they approached him in a parking lot, another to plead guilty, and the third to be found guilty at trial.80
In addition to directly plotting attacks, Hussain also corresponded with, encouraged, and facilitated would-be attackers. Twenty-year-old Justin Nojan Sullivan received encouragement and instructions from Hussain to film his planned mass shooting in North Carolina and Virginia.81 Hussain may have been involved from Islamic State territory in another attack in Garland, Texas, where two men opened fire, but were killed by police,82 at the “Draw Prophet Mohamed” contest; Hussain boasted to his Ohio recruit mentioned earlier, Abdulkader, that he helped direct the attack.83 Hussain also reportedly had correspondence with Zahid Hussain who plotted to target a high-speed train line between London and Birmingham with an IED.84 He was in contact with a teenager in Australia who planned to carry out a “Boston bombers”-style attack in Melbourne.85 He also corresponded with and encouraged Junead Khan of Luton to carry out an attack on U.S. soldiers stationed at U.K. bases.86
While Hussain was considered the head of the “Islamic State Hacking Division” (ISHD), it is not clear how much hacking, if any, he personally conducted while in Syria. He did, however, exploit the hacking efforts of others. One example involves Ardit Ferizi, a 20-year-old from Kosovo with a troubled past and mental health issues who was studying cyber security in Malaysia.87 Sometime around June 13, 2015, Ferizi hacked a server that hosted a U.S. retail company’s database of tens of thousands of consumers’ personally identifiable information (PII).88 Searching through PII that included .gov or .mil email addresses, Ferizi culled the list to 1,351 military or government personnel. The culled list was electronically transmitted by Ferizi to Hussain that same day. On August 11, 2015, under the banner of the ISHD, Hussain published the list in a document with a tweet stating “we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!”89 Ferizi was arrested by Malaysian authorities in October 2015 and extradited to the United States the following January, where he was convicted and sentenced to 20 years in prison in September 2016.90
Former senior U.S. and U.K. security officials told the author that it was Hussain’s recruitment efforts, propaganda dissemination, attack plotting and inciting, and sensitive information leaking that made him a high-value target for coalition forces.91 According to media reports, his name appeared as number three on the Pentagon’s target list.92 And on August 24, 2015, he was killed in a U.S. drone strike.93
The exact circumstances of Hussain’s death are uncertain. According to one report, Hussain was using his stepson, Jojo, as a human shield as drones flew overhead in Raqqa. Then late one night, he left an internet café alone and was killed by a U.S. Hellfire missile as he was crossing between two buildings.94 Another version of the story claims that U.S. and U.K. signals intelligence agencies cracked Hussain’s encrypted messages, thus helping to locate him.95 This caused Islamic State fighters to suspect that their trusted messenger app, Surespot, had been compromised, and they started abandoning the app, ripping out GPS transmitters with some avoiding digital communication in general.96 Another version states that he clicked on a compromised hyperlink sent to him by an “undercover agent,”97 and in a slight twist, another version states that the hyperlink was sent by a former hacktivist friend.98 A former hacktivist friend purported to out himself in a series of tweets in which he remorsefully stated that he had “helped [the FBI] MURDER him,”99 though the veracity of this claim cannot be verified.h
Around the same time as Hussain’s death, many other members of the “Legion” were killed.100 After Hussain’s death, Jones continued his habit of tweeting threats and trying to inspire new attacks. Jojo is believed to have appeared in a propaganda film released on August 26, 2016, that showed a child matching his description executing a Kurdish fighter.101 While there was speculation that Jones and Jojo were killed in a U.S. airstrike outside of Raqqa in June 2017,102 their deaths have not been confirmed, and their status is unknown.
A Deadly Legacy
Junaid Hussain’s death marked the first time a hacker was considered enough of a threat to be killed by a drone strike.103 But the value he brought to the Islamic State extended beyond his practical skill sets, his recruitment was a symbolic victory as well. Hussain represented a different profile from the uneducated petty criminals looking for redemption from Europe’s marginalized neighborhoods. He was smart, educated, tech savvy and even, by some measures, socially well integrated. His profile alone could inspire others like him that they too have a place in the Islamic State’s ranks.
“There are people here that secretly admire him,” said a family friend in Birmingham, “he took on Tony Blair, then helped ISIS wage a war against the world and went out in a blaze of glory. Some people believe, ‘hey, more power to him.’”104 Whereas other friends are less impressed by him. “My attitude is, if he really did what they say he did, he deserved to die,” a former hacktivist friend said.105 His friends echoed that sentiment, “we don’t really talk about him anymore,” said one friend.106
The greatest toll his legacy took was likely on his family. “I saw his father at some events after he went to Syria. You could tell he was in pain … they don’t come out much anymore, like [Hussain] brought shame on them,” said a family friend. “Their home was even vandalized.”107 When a member of the author’s research team approached his father for an interview request in July 2016, he politely turned it down, offering only that they were trying to turn the page and not let his son’s legacy define them. CTC
Nafees Hamid is a research fellow at Artis International, an associate fellow at the International Centre for Counter-Terrorism—the Hague, and a Ph.D. candidate in the Security and Crime Science department at the University College London. His research includes ethnographic interviews, survey studies, social network analysis, and psychology and neuroscience experiments with mostly European members of jihadi organizations, their friends and family, supporters of such networks, and the general communities from where they originate. Follow @NafeesHamid
Substantive Notes
[a] The interviews were conducted in the United Kingdom in London, Bedford, and Birmingham, and in the United States in Washington, D.C. and Las Vegas from July 2016 to February 2017. Contact with interviewees was made in some cases via cold calling or emailing and in others cases through snowball sampling whereby one verified individual referred others to the research team. When relationships needed verifying, the author requested supporting documents such as message transcripts, photographs, or verification via third parties. All interviews except two were conducted under the condition of anonymity.
[b] This is according to a family friend who knew Junaid since childhood and a friend who knew him since 2009. Author interview with both men, July 2016.
[c] In the hacking world, black hat hackers are criminals or wrongdoers who carry out unconsented hacks. White hat hackers are those who conduct ethical or consented hacking to improving cybersecurity for people or organizations who hire them. Grey hat hackers are those who engage in both activities. For overview, see Paul Gil “What are ‘black hat’ and ‘white hat’ hackers?” Lifewire, January 22, 2018.
[d] The latter explanation could fit with his implied intentions of joining an organization as a white hatter and then switching to black. “I have personal plans that will lead to a certain organization getting [expletive]-ed, so I’d have to be employed by them first and then [expletive] them up internally, and that’s what I’m aiming to do.” Eduard Kovacs, “Hackers around the world: It’s no TriCk, he’s among the best in the world,” Softpedia News, February 8, 2012.
[e] According to Ben Cooper, this meant he admitted to “effectively infiltrated computers that he wasn’t allowed access to and then altering those computers by obtaining information from them.” Author interview, Ben Cooper, July 2016.
[f] According to Ben Cooper, “he wrote a letter himself to the judge, pleading his case for leniency as did his father and his brother. And so they are all putting across strong accounts of his positive characteristics and, you know, what a good brother he was, what a good son he was.” Author interview, Ben Cooper, July 2016.
[g] Ben Cooper has defended many people from the hacktivist community (Anonymous, LulzSec, etc.) and stated that Hussain’s personality fit the typical profile. “They are often highly vulnerable, troubled individuals who lack social skills, and who very often suffer from autism and often severe autism, Asperger’s syndrome and that reflects the obsessive computing misconduct … [anarchism] often runs with it. Conspiracy theories are common too. And so there is often a form of political protest behind it. And often it’s not a single political line, it can be a form of political expression in a range of different issues.” Author interview, Ben Cooper, July 2016.
[h] The author’s research team interviewed three hacktivists in September 2016 who knew both Hussain and the hacktivist who claimed to help the FBI kill him. They said they believed the claim of the hacktivist who said he worked with the FBI, but they were not able to furnish any evidence to bolster his claim.
Citations
[1] “Small Heath,” UK CrimeStats.
[2] Tom Dyckhoff, “Let’s move to Kings Heath, Birmingham,” Guardian, May 15, 2015.
[3] Author interviews, July 2016.
[4] Author interview, July 2016.
[5] Author interview, February 2017.
[6] See Dilly Hussain, “Exclusive Q & A with Junaid Hussain – British ISIS fighter and hacker,” 5Pillars, September 24, 2014.
[7] Author interview, July 2016.
[8] Author interview, February 2017.
[9] Eduard Kovacs, “Hackers around the world: It’s no TriCk, he’s among the best in the world,” Softpedia News, February 8, 2012.
[10] Ibid.
[11] Author interview, July 2016.
[12] Author interview, July 2016.
[13] Kovacs, “Hackers around the world.”
[14] Ibid.
[15] Author interviews, multiple hacktivist who knew TeaMp0ison members, January-February 2017.
[17] Report on TeaMp0isoN hacking activity February 2012, obtained by author.
[18] Brian Ries, “The mujahideen hackers who clean Facebook,” Daily Beast, January 27, 2011.
[21] See http://zone-h.org/mirror/id/13034590?zh=1
[22] Report on TeaMp0isoN hacking activity September 2011, obtained by author.
[23] Author review of the posting.
[24] Brid-Aine Parnell, “Tony Blair bod’s Gmail hack teen gets 6 months,” Register, July 27, 2012.
[25] “England riots: Hackers hit Blackberry over police help,” BBC, August 10, 2011.
[26] Eduard Kovacs, “Site of NATO Croatia Hacked and Defaced by TeaMp0isoN,” Softpedia News, April 3, 2012.
[27] Eduard Kovacs, “TeaMp0isoN: United Nations Servers Not Outdated,” Softpedia News, December 1, 2011.
[28] Richard Chirgwin, “Foreign government emails HACKED says TeamP0ison,” Register, November 9, 2011.
[29] Eduard Kovacs, “TeaMp0isoN Leaks 26,000 Israeli Credit Cards from One and Citynet,” Softpedia News, February 2, 2012.
[30] Matt Liebowitz, “TeaMp0isoN hacks MI-6 then calls to boast,” NBC News, April 12, 2012.
[31] Eduard Kovacs, “TeaMp0isoN ‘Phone Bombs’ UK Foreign Intelligence Agency MI6,” Softpedia News, April 11, 2012.
[32] “TeaMp0isoN calls Mi6 Anti-Terrorism Command – TeaMp0isoN,” TeaMp0isoN, YouTube, April 10, 2012.
[33] “Mi6: Counter Terrorism Command Phones Hacked – Leaked Call Discussing TeaMp0isoN,” TeaMp0isoN, YouTube, April 12, 2012.
[34] “‘Team Poison’ hacker who posted Tony Blair’s details is jailed,” Telegraph, July 27, 2012.
[35] Kovacs, “TeaMp0isoN ‘Phone Bombs’ UK Foreign Intelligence Agency MI6.”
[36] Kovacs, “Hackers around the world.”
[37] Hannah Furness, “Team Poison: the interview,” Telegraph, April 12, 2012.
[38] Author interview, Ben Cooper, July 2006.
[39] Ibid.
[40] Information provided to author by Ben Cooper.
[41] Author’s research team interview, prison inmate, July 2016.
[42] Eduard Kovacs, “TeaMp0isoN’s TriCk Is Back, Launches Platform to Help Hackers Test Their Skills Legally,” Softpedia News, January 18, 2013.
[43] Ibid.
[44] Author interview, July 2016.
[45] Author interview, February 2017.
[48] Author interview, February 2017.
[49] Author interview, July 2016.
[50] Author interview, February 2017.
[51] Author interviews, July to February 2017.
[54] Ibid.
[55] Gadher, “Sally Jones: ‘My son and I love life with the beheaders.”
[56] “Rocker turned ISIS recruit lures girls, says life is ‘awesome,’” Al Arabiya, December 21, 2014.
[58] Gadher, “Sally Jones: ‘My son and I love life with the beheaders.”
[59] Ibid.
[60] Tom Whitehead and Robert Mendick, “Did Jihadi John slip out of UK with fanatic rapper Abdel-Majed Abdel Bary?” Telegraph, February 27, 2015.
[61] Author interview, July 2016.
[64] Author interview, July 2016.
[66] Dipesh Gadher, “We’ll fly black flag of jihad over London,” Sunday Times, June 15, 2014.
[67] Gadher, “Scatty middle aged rocker mum ‘reborn as jihacker’s wife.’”
[68] Review of database of Hussain and Jones’ Twitter history and social network connections from various accounts from June 2014 until July 2015. Curated and collected by TRAC at trackingterrorism.org
[69] The author followed both of their social media accounts from mid-2014 to mid-2015.
[70] Author review of Junaid Hussain’s and Sally Jones’ Twitter profiles from mid-2014 to mid-2015.
[71] See https://www.eff.org/node/82654
[72] Ibid.
[73] Author interview with two individuals who Skyped with Hussain while he was in Syria, Dilly Hussain and other hacktivist, July 2016.
[74] Given to author via various journalists who had access to this information.
[77] Ibid.
[79] Meleagrou-Hitchens and Hughes.
[83] “U.S. v. Munir Abdulkader, sentencing proceedings,” United States District Court Southern District of Ohio Western Division, November 23, 2016.
[87] “Hacker who gave Isis ‘hitlist’ of US targets jailed for 20 years,” Guardian, September 23, 2016.
[89] Ibid.
[90] “Hacker who aided IS sentenced to 20 years in US prison,” BBC, September 23, 2016.
[91] Author interviews, former senior U.S. and U.K. security officials, December 2016.
[92] Frank Gardner, “UK jihadist Junaid Hussain killed in drone strike, says US,” BBC, August 27, 2015.
[93] Goldman and Schmitt.
[94] Ibid.
[96] Ibid.
[97] Ibid.
[99] See https://archive.is/kANEa#selection-8147.1-8147.121
[100] Goldman and Schmitt.
[103] “Hacker down: ISIS Twitter star,” CNN, March 8, 2017.
[104] Author interview, July 2016.
[105] Author interview, September 2016.
[106] Author interview, September 2016.
[107] Author interview, July 2016.
