30 CTC SENTINEL A P R I L 2 01 8

The British Hacker Who Became the Islamic

State's Chief Terror Cybercoach: A Profile of
Junaid Hussain
By Nafees Hamid

A Politicized Kid from a Leafy Suburb

Until his death in a U.S. drone strike in August 2015, Junaid Junaid Hussain (born circa 1994) was a second-generation British
Hussain was the Islamic State’s most prolific English- national whose family hailed from the Pakistani side of Kashmir.
language social media propagandist, working to incite and When he was growing up, his family lived in the Small Heath dis-
guide sympathizers in the United Kingdom, United States, trict of Birmingham, an area heavily populated by South Asians
and beyond to launch terrorist attacks. Before joining the with the second-highest crime rate in Birmingham.1 Before he be-
came radicalized, Hussain’s family moved out of that area and into
jihad in Syria, Hussain was part of a hacking collective in
Kings Heath, an area often touted as a highly desirable place to live
the United Kingdom, focusing much of his attention on
in the United Kingdom.2 It was while living in this leafy neighbor-
perceived injustices against Muslims. In many respects, hood that Hussain’s worldview changed.b
he was well integrated into British society with his family His father was a respectable member of the British Pakistani
home in a leafy suburb of Birmingham. A spell in prison community. He ran private hire cabs in the Birmingham area when
contributed to his radicalization and his decision to move Hussain was growing up. The senior Hussain was considered an
to Syria, where he married fellow extremist Sally Jones. “honorable,” “hardworking,” and “well-spoken” man by family

J
friends interviewed by the author.3 Junaid Hussain, in contrast,
unaid Hussain became the Islamic State’s chief English-lan- seemed to be a person of few words.
guage cyber influencer during his short tenure with the Junaid Hussain’s friends, including individuals who interacted
group. In addition to directly plotting attacks with recruits, with him in Syria, paint a picture of a reserved yet passionate young
he inspired others, disseminated sensitive information, and man. According to a family friend who knew Hussain from a young
captured the attention of the media. He became the face of age, “Hussain wasn’t somebody you had a lot of interaction with …
a new cyber-savvy version of jihadism. His behavior was so threat- he wasn’t that kind of an outgoing person as such, he was of limited
ening to coalition nations that he became the first hacker in history words … always seemed withdrawn like, you know, when somebody
to be killed by a drone strike. has a lot on their mind and … they’re really into deep thought … he
This profile is the culmination of interviews conducted by wasn’t one to hold conversations for long periods of time on any
the author and his research team with Junaid Hussain’s friends, particular topic so it was very sort of piecemeal and short, unless
ex-hacking associates, family friends, an ex-prison inmate, his for- he was talking about technology and then he’d have more of an
mer lawyer, senior U.S. and U.K. security officials, people he spoke attention span.”4
to online while he was in Syria, access to transcripts of those private This sentiment was echoed by a friend who primarily got to
conversations, U.S. and U.K. court documents, and news reports.a know Hussain in the months before he left for Syria. “When you
just tried to have small talk with him, or try to get to know him, he
would shut down sort of. But when it came to topics he was pas-
a The interviews were conducted in the United Kingdom in London, Bedford,
sionate about, he really came to life.”5
and Birmingham, and in the United States in Washington, D.C. and Las His personality did not seem to alter much when he went to
Vegas from July 2016 to February 2017. Contact with interviewees was Syria. Dilly Hussain (no relation to Junaid Hussain) is a U.K.-based
made in some cases via cold calling or emailing and in others cases journalist and activist, and one of the few people who interviewed
through snowball sampling whereby one verified individual referred
others to the research team. When relationships needed verifying, the
Hussain via Skype video when he was in Syria.6 When asked to de-
author requested supporting documents such as message transcripts, scribe Hussain, he said, “I could describe him in three words: he
photographs, or verification via third parties. All interviews except two were was polite, he was very smart, and he was passionate … He wasn’t
conducted under the condition of anonymity. a chatterbox though. When it came to politics, he would be very
talkative, very outgoing, very defensive. But areas pertaining to his
past … I’d get one-word answers or a handful of words.”7
Nafees Hamid is a research fellow at Artis International, an
associate fellow at the International Centre for Counter-Terror- A Hacker Known as TriCk
ism—the Hague, and a Ph.D. candidate in the Security and Crime Even before he reached his teenage years, he became involved in
Science department at the University College London. His research online hacking. Hussain felt more comfortable interacting with the
includes ethnographic interviews, survey studies, social network
analysis, and psychology and neuroscience experiments with
mostly European members of jihadi organizations, their friends b This is according to a family friend who knew Junaid since childhood and
and family, supporters of such networks, and the general commu- a friend who knew him since 2009. Author interview with both men, July
nities from where they originate. Follow @NafeesHamid 2016.
 A P R I L 2 01 8 CTC SENTINEL 31

world from behind a computer screen rather than face to face. Ac- the pseudonyms of iN^SaNe, MLT, Phantom~, C0RPS3, f0rsaken,
cording to a friend who knew Hussain from when he was 15 years aXioM and ap0calypse.17 In the early days of TeaMp0isoN, mem-
old to the time he left for Syria, “You couldn’t really see too much of bers collaborated with various other groups such as the ZCompa-
his emotions, unless he was online … He was quiet in real life. He ny Hacking Crew. Both groups identified as pro-Palestinian and
was louder online. I’d say he was more himself online than in real pro-Kashmiri, and they collaborated on hacks against those they
life.” When his hacktivist friends who never met him in real life but perceived as the enemies of Muslims. For example, in December
chatted with him on a daily or weekly basis were asked to describe 2010, posts began to appear on Facebook groups that were deemed
his personality, they all described him very differently than those Zionist, right-wing, or anti-Islamic, which said “On the evening of
who knew him offline. “One-hundred percent outgoing, extrovert- the 31st of December 2010 (New Years Eve), TeaM P0isoN and
ed, funny, witty. But most of all, extremely caring and compassion- ZCompany Hacking Crew will clean up Facebook.”18 And indeed, on
ate,” one such hacktivist said.8 New Year’s Eve, hundreds of Facebook group pages run by organiza-
Hussain’s foray into the hacking world stemmed from a need for tions like the English Defense League (EDL) went blank. Hussain
retribution. In February 2012, around two years before he arrived in and members of ZHC took credit for the hack, which was followed
Syria, Hussain gave a revealing interview to the website Softpedia. shortly thereafter by hacks against Mark Zuckerberg’s19 and then
He described how at the age of 11 someone hacked into his account French President Nicolas Sarkozy’s20 Facebook pages. It is unclear
for a game he was playing online. “I wanted revenge, so I started if Hussain or TeaMp0isoN was involved in these latter hacks.
Googling around on how to hack.” Hussain was unable to get his Cyber attacking local right-wing groups remained a focus of
revenge, but it did set him down a path of skill-building. “I joined a Hussain’s through the beginning of 2011. In February 2011, EDL’s
few online hacking forums, read tutorials, started with basic social website was apparently hacked by Junaid Hussain, as evidenced by
engineering and worked my way up ... I lurked forums, met people, a message and pictures of Palestinian protestors and Israeli tanks.
asked questions, from then I moved onto hacking websites, servers, The message’s headline stated “Hacked By TriCk aka Saywhat? -
etc.” 9 TeaMp0isoN.” The message stated:
As his hacking skills developed, so too did his taste for political
activism. “When I was 15, I became political. It started from watch- “I am an extremist, I try extremely hard to hack websites to
ing videos of children getting killed in countries like Kashmir & raise awareness of issues, I’m a terrorist, I terrorize websites
Palestine. I wanted to know why this was happening and who was & servers, But the EDL are extremists too, they try extremely
doing it, there was loads of questions in my head,” Hussain told hard to kick Muslims out of the UK, and they are terrorists,
Softpedia.10 Hussain’s passion for politics would take him out of they terrorise local Muslim communities & businesses - My-
his house and onto the streets. As early as 2009, he was protesting self & the EDL are both extremists & terrorists, but why do
in the streets for the plight of the Muslim people. “It was mostly they want to kick me out? Because I follow a certain religion? I
against EDL stuff,” said Hussain’s friend, referring the British right- was born in UK, my skin colour may not be the same as yours
wing group, the English Defense League.11 but my passport colour is…”21
While Hussain was clearly passionate about the suffering of the
Muslim people, he was not particularly passionate about Islam. Hussain then claimed to have personal information of EDL leaders
“I wouldn’t say he was particularly a very religious young man. and supporters and threatened to release the information, which
Nothing ever showed to me that he was, you know, praying five he eventually did.22
times a day or a devotee as such. He probably went to the mosque By mid-2011, Hussain started to up the ante of his hacking ex-
a few times on different occasions,” said a family friend who knew ploits. In June of that year, TeaMp0isoN posted former British
him since childhood. “No, just a bitterness towards the suffering in Prime Minister Tony Blair’s address book online.23 The hack was
Kashmir, Palestine, Iraq—those sort of places.”12 accomplished by accessing a Blair advisor’s personal email account
However, his time alone on his computer would send him down and then copying the contacts.24
a rabbit hole of conspiracy theories. As he told Softpedia, “I browsed In the months that followed, TeaMp0ison would claim multiple
the net, read books, watched documentaries, etc. I was getting more hacks, including on Blackberry for cooperating with authorities
and more into politics, I started researching deeper into stuff like during rioting in several cities in England in the summer of 2011;25
the Free Masons, Illuminati, The Committee of 300, etc. It made defacing Croatia’s NATO website;26 breaching a (potentially out-
me angry, it changed the way I lived my life and the way I saw the dated) United Nations Development Programme server;27 making
world. I then started using hacking as my form of medium by defac- questionable claims about hacking U.K. Ministry of Defense email
ing sites to raise awareness of issues around the world and to ‘bully’ accounts;28 collaborating with ‘Anonymous’ and other groups to
corrupt organizations and embarrass them via leaks etc., which is leak a database with 26,000 credit card details that they claimed
how I got into hacktivism.”13 were obtained from a hack of Israeli websites in support of pro-Pal-
Hussain was not alone in his ‘hacktivism.’ He got a group of estinian and Occupy movements;29 and many other claimed hacks
hacktivists together, many who shared similar political leanings against news agencies and political entities.
though not necessarily the same ethnicity. “I was in a couple of One of TeaMp0ison’s most publicized attacks came in April 2012
hacking groups & underground forums which were slowly becom- when they launched a phone-based denial-of-service (DOS) attack
ing dead and inactive so I created my own site p0ison.org (was 15 at against the United Kingdom’s Counter Terrorism Command’s ho-
the time), and TeaMp0isoN was formed from there.”14 tline. The attack caused the office’s telephone lines to be bombarded
TeaMp0isoN was a band of eight hacktivists made up of teenag- by a robotic voice that repeated “Team Poison.”30 Hussain later re-
ers and young adults mostly from the United Kingdom.15 Hussain’s vealed that the calls and recording were routed through a compro-
hacktivist pseudonym was TriCk,16 and the other members went by mised server in Malaysia.31 Hussain then himself called the offices
32 CTC SENTINEL A P R I L 2 01 8 HAMID

the next day to taunt the CTC representatives, introducing himself University to study computer forensics.39 His subject choice could
as TriCk while speaking in an affected American accent before up- have indicated a desire to ‘go clean,’ or, conversely, to get better at
loading the audio of the conversation to the TeaMp0ison YouTube covering his trail to ensure his black hatc hacking would not lead to
channel.32 In a more impressive feat of hacking, TeaMp0isoN was him getting caught again.d
able to record and upload33 a call between a CTC representative and Hussain did not contest the charges against him. He admitted
another agency where the former tells the latter that their office was his wrongdoing and pleaded guilty under the Computer Misuse Acte
barraged with over 700 calls from the hackers. Later court hearings for the email hack and for disrupting the CTC phone lines. Cooper’s
would reveal that it was 111 calls on seven different phone lines over arguments for a reduced sentence emphasized 1) the fact that Hus-
three days.34 sain was admitting and showing remorse for what he had done thus
Immediately after the attacks, Hussain, under the pseudonym demonstrating his good character;f 2) that a prolonged sentence
TriCk, released a statement explaining his motivations: could jeopardize his placement at university; and 3) that he had
a supportive family. His father, in particular, stood by his son. As
“The reason behind the recent phone denial of service ... was Cooper put it, “[Hussain] looked scared right from the start, to be
because of the recent events where the counter terrorist com- honest, and for that reason, his father attended court on every occa-
mand and the UK court system has extradited Babar Ahmad, sion to offer his full support. And so I made clear to the judge that
Adel Abdel Bary & a few others to be trialled in the US, and this is a teenager who had strong parental support, a father who is
we all know how the US treats innocent Muslims they label standing by him, a father who is working hard, very responsible,
as terrorists, e.g. - Aafia Siddiqui ... Babar Ahmad is a British good father, who clearly wasn’t aware of what his son was doing at
Citizen who has been detained in the UK for 7 years without the time of committing the offense when he [was] only 15.”
trial he received 149,395+ petitions to be put on trial in the Cooper also was aware that an extended prison sentence could
UK and not the US, but they ignored the petition and have have a detrimental impact on Hussain. “I was inviting the court to
extradited him, what’s happened to democracy? Adel Abdel find alternatives to custody including the prospect of suspending
Bary has been in prison for 12 years in the UK, apparently the sentence, really to avoid the scenario of him spending months
he received a phone call from Osama years ago therefore they alongside hardened serious criminals, many of whom may be inside
imprisoned him claiming they had a tape of the call but there for violent offenses … I was concerned because of his peculiar char-
was never a witness to prove it or show the tape, if I (TriCk) acter. He wasn’t someone who was particularly comfortable in so-
was to call George Bush would they lock George Bush up for cial situations. He was clearly someone spending a lot of time in his
receiving a phone call from a cyber-terrorist / hacker? ... all room on his computer and not interacting normally with society…
the allegations against these guys have taken place in the UK, that he was someone who was vulnerable to such environments and
therefore they should be trialled in the UK and not the US. The capable of being exploited.”g
US is calling it a “global war on terror” which in my opinion
is a cover up for “global war on Islam” – the real terrorists are
the guys sitting in 10 Downing Street and the Whitehouse.”35
c In the hacking world, black hat hackers are criminals or wrongdoers who
carry out unconsented hacks. White hat hackers are those who conduct
In February 2012, Hussain bragged about his imperviousness ethical or consented hacking to improving cybersecurity for people or
to law enforcement, saying “100% certain they have nothing on me organizations who hire them. Grey hat hackers are those who engage in
… My real identity dosen’t [SIC] exist online – and no I don’t fear both activities. For overview, see Paul Gil “What are ‘black hat’ and ‘white
hat’ hackers?” Lifewire, January 22, 2018.
getting caught … I don’t fear prison.”36 In another interview pub-
d The latter explanation could fit with his implied intentions of joining an
lished on April 12, 2012, just after the CTC phone hack, he doubled
organization as a white hatter and then switching to black. “I have personal
down on those sentiments. “I fear no man or authority,” he stated.37 plans that will lead to a certain organization getting [expletive]-ed, so I’d
Within a few hours, authorities arrested him. have to be employed by them first and then [expletive] them up internally,
and that’s what I’m aiming to do.” Eduard Kovacs, “Hackers around the
world: It’s no TriCk, he’s among the best in the world,” Softpedia News,
Prison and Radicalization
February 8, 2012.
When barrister Ben Cooper first met his client at Westminster
e According to Ben Cooper, this meant he admitted to “effectively infiltrated
Magistrates’ Court in London on April 16, 2012, Hussain’s compo-
computers that he wasn’t allowed access to and then altering those
sure was a far cry from the blustering bravado he projected in his computers by obtaining information from them.” Author interview, Ben
interviews. “He was shocked and frightened by the experience of Cooper, July 2016.
being brought to court for the first time,” Cooper told the author. f According to Ben Cooper, “he wrote a letter himself to the judge, pleading
“He was very reserved, very meek, very softly spoken, and he came his case for leniency as did his father and his brother. And so they are
across a very unassuming, even humble young man.” The charges all putting across strong accounts of his positive characteristics and,
you know, what a good brother he was, what a good son he was.” Author
against him related to Tony Blair’s PA email hack and the CTC at-
interview, Ben Cooper, July 2016.
tack (though hacking of Nicholas Sarkozy’s emails was also brought
g Ben Cooper has defended many people from the hacktivist community
up by prosecutors38). (Anonymous, LulzSec, etc.) and stated that Hussain’s personality fit the
Cooper was able to get Hussain bail that day, but given the seri- typical profile. “They are often highly vulnerable, troubled individuals who
ousness of the allegations, the case was sent to Southwark Crown lack social skills, and who very often suffer from autism and often severe
Court. Hussain would spend 104 days on curfew while his prose- autism, Asperger’s syndrome and that reflects the obsessive computing
misconduct … [anarchism] often runs with it. Conspiracy theories are
cution proceeded. Despite his harsh anti-establishment rhetoric, in common too. And so there is often a form of political protest behind it. And
this period he took advantage of the U.K. education system to com- often it’s not a single political line, it can be a form of political expression in
plete three A levels and secure admission to London Metropolitan a range of different issues.” Author interview, Ben Cooper, July 2016.
 A P R I L 2 01 8 CTC SENTINEL 33

The judge ultimately settled for a lenient sentence. On July 27,

2012, he was given two consecutive sentences of three months for
each of the crimes he was charged with, leading to a six-month
sentence. However, the judge took into account the 104 days that
Hussain spent on curfew, which reduced his sentence by 52 days,
making it just over a four-month sentence with the possibility of
only serving 50 percent of the sentence in prison and then early
home release. “The judge could have given him a much longer sen-
tence, and the authorities would have allowed him to do so,” Cooper
says. “[The judge] was understanding of the mitigation and want-
ing to try to help him by keeping this sentence as short as possible…
the judge was hoping that, because of the timing of the sentence,
[Hussain] would still have been able to potentially start his univer-
sity course in the autumn if he was released early.”
Cooper and Hussain last saw each other immediately after the
sentencing. “He would be going to Feltham Young Offender’s Insti- Junaid Hussain’s Twitter profile photo
tution. And he would have been alongside a whole range of crim-
inals there … he certainly looked scared,” recalls Cooper. “When I 24/7. You could send him a message anytime of the night or day and
heard about what eventually happened with [Husain], I was con- he would respond.” This same friend also stated that after prison,
cerned that the sentence had been counter-productive. I thought “he did start looking at Islamic points of view as well. He would talk
that if I had just kept him out of prison maybe things could have about what Islam says about certain things like Day of Judgment
been different.” Hussain was eventually given early home release and in terms of Israel as well. He would send me videos randomly,
in mid-September 201640 having served only a month and a half and I’d watch it and then we’d have a little discussion after it, give
in prison. our points of view. Then maybe a week later, he’d send me another
Prison appears to have been a watershed period for Hussain. video. And so it was becoming a religious focus as well.”45
Prior to his incarceration, Hussain had labeled himself an “extrem- In addition to posting his political thoughts on Facebook, Hus-
ist” and a “cyber terrorist” and appeared to see himself as fighting sain increased his offline activism. Friends saw him attend more
against perceived injustices toward Muslims worldwide, but he had rallies in Birmingham. One EDL rally in Birmingham in July 2013
described his political views as closer to anarchism and showed no led to skirmishes when some counter-protestors calling themselves
support for political Islam. the Muslim Defense League rushed at riot police.46 Hussain was one
It appears that it was in prison that his political views began to of the counter-protestors arrested that day for suspicion of violent
move in an Islamist direction. A prison inmate who was incarcer- disorder.47 Another friend told the author48 that Hussain posted a
ated with Hussain but did not have much interaction with him told video on Facebook of him running from police. He was released
the author’s research team that he witnessed him spending time in on bail pending further investigation. West Midlands police later
prison with a well-known “radical Islamist” group.41 According to decided not to pursue any charges.
Dilly Hussain, who spoke to Hussain twice over Skype and many His arrest appears to have further hardened Hussain’s views. Ac-
times over Facebook Messenger while he was in Syria, “I do know cording to one of Hussain’s friends, after the arrest, Hussain started
that he met individuals in prison. He didn’t say who, but he did say posting on Facebook “some extreme ideology kind of stuff like ‘if
that he did speak to individuals in prison who he said made him you’re gonna do something, do it properly, or just don’t, blah blah.’
enlightened.” It wasn’t too violent in that sense, but it was kind of worrying.”49
After Hussain was released from prison, his black hat hacking
from the United Kingdom seemed to come to a stop. In January Joining the Jihad in Syria
2013 in an interview with Softpedia, he revealed that prison made It was while Hussain was on bail that he left for Syria. It is not
him see things differently, and so he launched a website called exactly clear when he left for Syria, but most sources interviewed
illSecure.com that provided “a legal and safe platform for ‘security by the author said it was sometime in late 2013. “He posted on
experts’ and ‘hackers’ to test and develop their skills in a friendly Facebook when he got to Syria. He said two days after leaving [the
competitive lawful environment,” Hussain said.42 “There’s currently United Kingdom] he ended up in Syria … He was saying how he
no organization that helps security experts and hackers to channel dodged Turkish guards, and they were shooting at him,” according
their skills down a legal route, so most people go down the illegal to one online friend.50
route without thinking of the consequences.”43 The website offered The details of Hussain’s crossing into Syria and how he linked up
17 challenges that allowed individuals to develop their hacking with the Islamic State are unclear. After joining the group, he took
skills. up the kunya Abu Hussain al-Britani. Friends of Hussain told the
His friends revealed that after his release, Hussain spent some of author51 that soon after arriving in Syria, Hussain deleted the Face-
his time doing university coursework and became increasingly in- book account through which they were communicating with him
volved in posting political commentary on Facebook and attending but then later opened new Facebook and Twitter accounts, where he
protests related to issues regarding Muslims. “He was also posting got in touch with some of them again. Some reported that he tried
things on Facebook related to Palestine or Kashmir or the EDL,” to convince them to join him in Syria. They also say that he did not
said one friend who attended protests with Hussain.44 Another ex- initially mention the name of the group that he had joined.
clusively online friend of Hussain said, “He was always online, like Around the time that Hussain made his way to Syria in late 2013,
34 CTC SENTINEL A P R I L 2 01 8 HAMID

so did52 his bride-to-be, Sally Jones, a British woman 25 years his rative. Hussain and Jones (who went by the kunya Umm Hussain
senior who had converted to Islam. Jones and Hussain started a ro- al-Britani and Sakinah Hussain) did not shy away from social me-
mantic relationship online while they were both living in the United dia. They tweeted regularly, varying from quoting religious texts, to
Kingdom. It is not clear if they ever met in person before arriving trolling other Twitter users, to taunting the Islamic State’s enemies,
in Syria. to encouraging more people to migrate to Islamic State territory, to
Jones had had a turbulent life. She was born in Greenwich, calling for specific acts of domestic terrorism in the United States
southeast London. Her parents divorced, and her father commit- and United Kingdom.68 Twitter and Facebook shut down their ac-
ted suicide when she was 10 years old.53 She dropped out of school counts regularly, but they opened new ones immediately and con-
at age 16, worked various jobs, and in the 1990s eventually became tinued their messaging.69
a singer and guitarist for an all-female punk rock group called Hussain played the role of an online jihadi propagandist and re-
Krunch. She had her first son in 1996 (the father of that child died cruiter. In addition to publicly tweeting, he was also open to having
three years later), and her second son from a subsequent relation- potential recruits contact him via various messaging apps that he
ship, Jojo, was born in 2004.54 She would eventually move to Cha- listed along with his contact information on his Twitter profile.70
tham, Kent, where she lived in council housing with her two sons. Despite his hacking background, Hussain’s initial operational se-
Her then neighbors said that she was unemployed and on welfare.55 curity was surprisingly poor. Until his death, his Twitter profile
Jones would be duped into revealing more of her journey via Twitter listed Kik messenger as a way to contact him. At the time, Kik was
and Kik messenger to a Sunday Times journalist who posed as a po- commonly used by Islamic State members, but it was rated by the
tential recruit, a fictional 17-year old named Aisha.56 The first of two Electronic Foundation Frontier, a non-profit organization that de-
publications following the interview unmasked Sally Jones to the fends digital civil liberties, as one of the least secure messaging plat-
public.57 During those conversations, Jones said that she convert- forms.71 Skype was considered equally as insecure,72 and yet he used
ed to Islam in May 2013 after starting an online relationship with it to speak with people as well.73 His operational security seemed
Hussain.58 When she came to Syria, she brought Jojo with her. She to improve with time; screenshots that the author reviewed of con-
claimed that it was on her very first day in Syria that she married versations between him and potential recruits74 did show that by
Hussain and Jojo converted to Islam.59 summer 2015, when someone contacted him on Kik, he instructed
Jones was not the only pre-existing contact Hussain had when them to switch to Surespot, an online messaging app that, unlike
he traveled to Syria. He also had contact with Adbel-Majed Abdel Kik at the time, offered end-to-end encryption.
Bary, who had previously been a London-based rap artist known as Hussain became a founding member of an English-language
Lyricist Jinn or L Jinny. Bary would later gain notoriety because of online recruitment collective within the Islamic State made up of a
his extensive social media use and speculation in the British press dozen members who the FBI dubbed “The Legion” and the “Raqqa
that he was possibly a member of the British Islamic State hostage 12.”75 Other notable members included fellow British nationals
holding unit dubbed The Beatles,60 even though no credible evi- Reyaad Khan from Cardiff, Raphael Hostey from Manchester, as
dence materialized to support that latter claim. A mutual friend of well as the Australian Neil Prakash. Together, this band of propa-
both Hussain and Bary told the author that they had known each gandists reached thousands of English speakers around the world
other in the United Kingdom through the music scene.61 In fact, the through their public posts and attempts to groom and inspire po-
two men appeared in a music video together filmed in the United tential attackers via one-on-one online contact.
Kingdom before they left to Syria.62 Hussain was linked to many attempted terror plots in the United
In February 2014, Bary tweeted the following: “Me & Abu Hus- States and the United Kingdom. His popularity in both pro-Islam-
sein al britani got kidnapped /tortured by FSA/IF scum they stole ic State networks and Western media made him a magnet for ex-
our 4 ak’s and a 7mm, my vechile & our phones and cash.”63 It was tremists reaching out to online recruiters like himself. One example
the first public mention of Hussain’s presence in Syria. It is not clear was Ohio college student Munir Abdulkader, who reached out to
who traveled to Syria first, but according to their mutual friend, it Hussain and fell under his guidance in spring 2015.76 After discour-
is plausible that, through online contact, one could have motivated aging Abdulkader from coming to Syria, Hussain instructed him
the other to venture there.64 to kidnap a member of the U.S. military and to record his killing.
Where exactly this “kidnapping” of Hussain and Bary took place Hussain then switched gears and told him to attack a police station
is not clear, but there is a possible clue in a tweet by Sally Jones on near Cincinnati. After Abdulkader boasted to Hussain about his
August 10, 2014: “Alhamdulillah me and my husband made it to skills on the shooting range, Hussain responded: “Next time ul be
the Islamic State after being stuck in Idlib for 7 mnths & are now shooting kuffar in their face and stomach.”77 Abdulkader was ar-
living in the khilafah.”65 If accurate, this would place Hussain and rested before he could carry out his shooting spree and sentenced
Jones somewhere in Syria’s Idlib Province from roughly January to to 20 years in prison.78
August 2014 before making their way to Raqqa, the Islamic State’s In mid-May 2015, Hussain was also in contact with one of a
de facto capital at the time. group of three individuals in New England who plotted to kill, af-
ter conversations with Hussain, the organizer of a “draw Moham-
Islamic State Cybercoach med contest” in Garland, Texas.79 Their contact with Hussain and
Around the time they settled in Raqqa, the couple was unmasked. purchases related to their intended attack eventually caught the
Hussain’s identity was revealed by the British Sunday Times news- attention of police surveillance, leading one to die after he tried to
paper on June 15, 2014,66 and Jones was unmasked six weeks later attack the police with a knife as they approached him in a parking
on August 31, 2014,67 by the same publication. Their story would lot, another to plead guilty, and the third to be found guilty at trial.80
turn to tabloid fodder. His hacking past, her rocker past, their age In addition to directly plotting attacks, Hussain also corre-
differences and online love connection all added to a gossipy nar- sponded with, encouraged, and facilitated would-be attackers.
 A P R I L 2 01 8 CTC SENTINEL 35

Twenty-year-old Justin Nojan Sullivan received encouragement doning the app, ripping out GPS transmitters, with some avoiding
and instructions from Hussain to film his planned mass shooting digital communication in general.96 Another version states that he
in North Carolina and Virginia.81 Hussain may have been involved clicked on a compromised hyperlink sent to him by an “undercover
from Islamic State territory in another attack in Garland, Texas, agent,”97 and in a slight twist, another version states that the hyper-
where two men opened fire, but were killed by police,82 at the “Draw link was sent by a former hacktivist friend.98 A former hacktivist
Prophet Mohamed” contest; Hussain boasted to his Ohio recruit friend purported to out himself in a series of tweets in which he re-
mentioned earlier, Abdulkader, that he helped direct the attack.83 morsefully stated that he had “helped [the FBI] MURDER him,”99
Hussain also reportedly had correspondence with Zahid Hussain though the veracity of this claim cannot be verified.h
who plotted to target a high-speed train line between London and Around the same time as Hussain’s death, many other members
Birmingham with an IED.84 He was in contact with a teenager in of the “Legion” were killed.100 After Hussain’s death, Jones contin-
Australia who planned to carry out a “Boston bombers”-style attack ued his habit of tweeting threats and trying to inspire new attacks.
in Melbourne.85 He also corresponded with and encouraged Junead Jojo is believed to have appeared in a propaganda film released on
Khan of Luton to carry out an attack on U.S. soldiers stationed at August 26, 2016, that showed a child matching his description ex-
U.K. bases.86 ecuting a Kurdish fighter.101 While there was speculation that Jones
While Hussain was considered the head of the “Islamic State and Jojo were killed in a U.S. airstrike outside of Raqqa in June
Hacking Division” (ISHD), it is not clear how much hacking, if any, 2017,102 their deaths have not been confirmed, and their status is
he personally conducted while in Syria. He did, however, exploit unknown.
the hacking efforts of others. One example involves Ardit Ferizi, a
20-year-old from Kosovo with a troubled past and mental health A Deadly Legacy
issues who was studying cyber security in Malaysia.87 Sometime Junaid Hussain’s death marked the first time a hacker was consid-
around June 13, 2015, Ferizi hacked a server that hosted a U.S. ered enough of a threat to be killed by a drone strike.103 But the value
retail company’s database of tens of thousands of consumers’ per- he brought to the Islamic State extended beyond his practical skill
sonally identifiable information (PII).88 Searching through PII that sets; his recruitment was a symbolic victory for the Islamic State as
included .gov or .mil email addresses, Ferizi culled the list to 1,351 well. Hussain represented a different profile from the uneducated
military or government personnel. The culled list was electronically petty criminals looking for redemption from Europe’s marginal-
transmitted by Ferizi to Hussain that same day. On August 11, 2015, ized neighborhoods. He was smart, educated, tech savvy and even,
under the banner of the ISHD, Hussain published the list in a docu- by some measures, socially well integrated. His profile alone could
ment with a tweet stating “we are in your emails and computer sys- inspire others like him that they too have a place in the Islamic
tems, watching and recording your every move, we have your names State’s ranks.
and addresses, we are in your emails and social media accounts, we “There are people here that secretly admire him,” said a family
are extracting confidential data and passing on your personal infor- friend in Birmingham, “he took on Tony Blair, then helped ISIS
mation to the soldiers of the khilafah, who soon with the permission wage a war against the world and went out in a blaze of glory. Some
of Allah will strike at your necks in your own lands!”89 Ferizi was people believe, ‘hey, more power to him.’”104 Whereas other friends
arrested by Malaysian authorities in October 2015 and extradited are less impressed by him. “My attitude is, if he really did what they
to the United States the following January, where he was convicted say he did, he deserved to die,” a former hacktivist friend said.105
and sentenced to 20 years in prison in September 2016.90 His friends echoed that sentiment, “we don’t really talk about him
Former senior U.S. and U.K. security officials told the author anymore,” said one friend.106
that it was Hussain’s recruitment efforts, propaganda dissemina- The greatest toll his legacy took was likely on his family. “I saw
tion, attack plotting and inciting, and sensitive information leaking his father at some events after he went to Syria. You could tell he
that made him a high-value target for coalition forces.91 According was in pain … they don’t come out much anymore, like [Hussain]
to media reports, his name appeared as number three on the Pen- brought shame on them,” said a family friend. “Their home was
tagon’s target list.92 And on August 24, 2015, he was killed in a U.S. even vandalized.”107 When a member of the author’s research team
drone strike.93 approached his father for an interview request in July 2016, he po-
The exact circumstances of Hussain’s death are uncertain. Ac- litely turned it down, offering only that they were trying to turn the
cording to one report, Hussain was using his stepson, Jojo, as a hu- page and not let his son’s legacy define them. CTC
man shield as drones flew overhead in Raqqa. Then late one night,
he left an internet café alone and was killed by a U.S. Hellfire missile
as he was crossing between two buildings.94 Another version of the
story claims that U.S. and U.K. signals intelligence agencies cracked h The author’s research team interviewed three hacktivists in September
Hussain’s encrypted messages, thus helping to locate him.95 This 2016 who knew both Hussain and the hacktivist who claimed to help the
FBI kill him. They said they believed the claim of the hacktivist who said
caused Islamic State fighters to suspect that their trusted messen- he worked with the FBI, but they were not able to furnish any evidence to
ger app, Surespot, had been compromised, and they started aban- bolster his claim.
36 CTC SENTINEL A P R I L 2 01 8 HAMID

Citations

1 “Small Heath,” UK CrimeStats. EDL rally in Birmingham,” Birmingham Mail, July 20, 2013.
2 Tom Dyckhoff, “Let’s move to Kings Heath, Birmingham,” Guardian, May 47 Steve Swann and Secunder Kermani, “Pair under police investigation skip
15, 2015. bail ‘to fight in Syria,’” BBC, June 18, 2014.
3 Author interviews, July 2016. 48 Author interview, February 2017.
4 Author interview, July 2016. 49 Author interview, July 2016.
5 Author interview, February 2017. 50 Author interview, February 2017.
6 See Dilly Hussain, “Exclusive Q & A with Junaid Hussain – British ISIS 51 Author interviews, July to February 2017.
fighter and hacker,” 5Pillars, September 24, 2014. 52 Dipesh Gadher, “Sally Jones: ‘My son and I love life with the beheaders,’”
7 Author interview, July 2016. Sunday Times, September 7, 2014.
8 Author interview, February 2017. 53 Harry Cockburn, “Sally Jones: Who was the ‘White Widow’? What we
9 Eduard Kovacs, “Hackers around the world: It’s no TriCk, he’s among the know about the Isis member reportedly killed in a US drone strike,”
best in the world,” Softpedia News, February 8, 2012. Independent, October 12, 2017.
10 Ibid. 54 Ibid.
11 Author interview, July 2016. 55 Gadher, “Sally Jones: ‘My son and I love life with the beheaders.”
12 Author interview, July 2016. 56 “Rocker turned ISIS recruit lures girls, says life is ‘awesome,’” Al Arabiya,
13 Kovacs, “Hackers around the world.” December 21, 2014.
14 Ibid. 57 Dipesh Gadher, “Scatty middle aged rocker mum ‘reborn as jihacker’s
15 Author interviews, multiple hacktivist who knew TeaMp0ison members, wife,’” Sunday Times, August 31, 2014.
January-February 2017. 58 Gadher, “Sally Jones: ‘My son and I love life with the beheaders.”
16 Lorraine Murphy, “The curious case of the jihadist who started out as a 59 Ibid.
hacktivist,” Vanity Fair, December 15, 2015. 60 Tom Whitehead and Robert Mendick, “Did Jihadi John slip out of UK with
17 Report on TeaMp0isoN hacking activity February 2012, obtained by fanatic rapper Abdel-Majed Abdel Bary?” Telegraph, February 27, 2015.
author, 61 Author interview, July 2016.
18 Brian Ries, “The mujahideen hackers who clean Facebook,” Daily Beast, 62 Josh Layton, “Watch: Birmingham ISIS terrorist Junaid Hussain appears
January 27, 2011. in RAP video,” Birmingham Mail, April 7, 2017.
19 Charles Arthur, “The wrong kind of sharing: Mark Zuckerberg Facebook 63 “’Hip hop jihadist’ who left £1m London home to fight in Syria complains
page hacked,” Guardian, January 26, 2011. on Twitter of being kidnapped, tortured and robbed by fellow Islamists,”
20 Melissa Bell, “Sarkozy’s Facebook page hacked: Intruder wrote that Daily Mail, March 9, 2014.
French president would resign in 2012,” Washington Post, January 24, 64 Author interview, July 2016.
2011. 65 “’British rocker mom joins ISIS, vows to ‘behead Christians with blunt
21 See http://zone-h.org/mirror/id/13034590?zh=1 knife,’” RT, September 1, 2014.
22 Report on TeaMp0isoN hacking activity September 2011, obtained by 66 Dipesh Gadher, “We’ll fly black flag of jihad over London,” Sunday Times,
author, June 15, 2014.
23 Author review of the posting. 67 Gadher, “Scatty middle aged rocker mum ‘reborn as jihacker’s wife.’”
24 Brid-Aine Parnell, “Tony Blair bod’s Gmail hack teen gets 6 68 Review of database of Hussain and Jones’ Twitter history and social
months,” Register, July 27, 2012. network connections from various accounts from June 2014 until July
25 “England riots: Hackers hit Blackberry over police help,” BBC, August 10, 2015. Curated and collected by TRAC at trackingterrorism.org
2011. 69 The author followed both of their social media accounts from mid-2014 to
26 Eduard Kovacs, “Site of NATO Croatia Hacked and Defaced by mid-2015.
TeaMp0isoN,” Softpedia News, April 3, 2012. 70 Author review of Junaid Hussain’s and Sally Jones’ Twitter profiles from
27 Eduard Kovacs, “TeaMp0isoN: United Nations Servers Not Outdated,” mid-2014 to mid-2015.
Softpedia News, December 1, 2011. 71 See https://www.eff.org/node/82654
28 Richard Chirgwin, “Foreign government emails HACKED says 72 Ibid.
TeamP0ison,” Register, November 9, 2011. 73 Author interview with two individuals who Skyped with Hussain while he
29 Eduard Kovacs, “TeaMp0isoN Leaks 26,000 Israeli Credit Cards from One was in Syria, Dilly Hussain and other hacktivist, July 2016.
and Citynet,” Softpedia News, February 2, 2012. 74 Given to author via various journalists who had access to this information.
30 Matt Liebowitz, “TeaMp0isoN hacks MI-6 then calls to boast,” NBC News, 75 Del Quentin Wilber, “Here’s how the FBI tracked down a tech-savvy
April 12, 2012. terrorist recruiter for the Islamic State,” Los Angeles Times, April 3, 2017.
31 Eduard Kovacs, “TeaMp0isoN ‘Phone Bombs’ UK Foreign Intelligence 76 Alexander Meleagrou-Hitchens and Seamus Hughes, “The Threat to
Agency MI6,” Softpedia News, April 11, 2012. the United States from the Islamic State’s Virtual Entrepreneurs,” CTC
32 “TeaMp0isoN calls Mi6 Anti-Terrorism Command - TeaMp0isoN,” Sentinel 10:3 (2017).
TeaMp0isoN, YouTube, April 10, 2012. 77 Ibid.
33 “Mi6: Counter Terrorism Command Phones Hacked - Leaked Call 78 Adam Goldman and Eric Schmitt, “One by One, ISIS Social Media Experts
Discussing TeaMp0isoN,” TeaMp0isoN, YouTube, April 12, 2012. Are Killed as Result of F.B.I. Program,” New York Times, November 24,
34 “‘Team Poison’ hacker who posted Tony Blair’s details is jailed,” Telegraph, 2016.
July 27, 2012. 79 Meleagrou-Hitchens and Hughes.
35 Kovacs, “TeaMp0isoN ‘Phone Bombs’ UK Foreign Intelligence Agency 80 “Massachusetts Man Convicted of Supporting ISIS and Conspiring to
MI6.” Murder U.S. Citizens,” U.S. Department of Justice, Office of Public Affairs,
36 Kovacs, “Hackers around the world.” October 18, 2017.
37 Hannah Furness, “’Team Poison: the interview,” Telegraph, April 12, 2012. 81 “North Carolina Man Pleads Guilty to Attempting to Commit An Act of
38 Author interview, Ben Cooper, July 2006. Terrorism Transcending National Boundaries,” U.S. Department of Justice,
39 Ibid. Office of Public Affairs, November 29, 2016.
40 Information provided to author by Ben Cooper. 82 Catherine Shoichet and Michael Pearson, “Garland, Texas, shooting
41 Author’s research team interview, prison inmate, July 2016. suspect linked himself to ISIS tweets,” CNN, May 4, 2015.
42 Eduard Kovacs, “TeaMp0isoN’s TriCk Is Back, Launches Platform to Help 83 “U.S. v. Munir Abdulkader, sentencing proceedings,” United States District
Hackers Test Their Skills Legally,” Softpedia News, January 18, 2013. Court Southern District of Ohio Western Division, November 23, 2016.
43 Ibid. 84 Tony Larner, “Junaid Hussain: How Birmingham ISIS terrorist was linked
44 Author interview, July 2016. to thirty plots across world,” Birmingham Mail, December 10, 2017.
45 Author interview, February 2017. 85 Gloria Kalache, “Melbourne teen partially made explosive device similar
46 Amardeep Bassey, “Anti-fascists frustrated as police prevent access to to Boston bombings in terror plot, court told,” ABC News, September 5,
 A P R I L 2 01 8 CTC SENTINEL 37

2016. 96 Ibid.
86 Lizzie Dearden and Serina Sandhu, “Junead Khan: Luton delivery driver 97 Ibid.
found guilty of preparing for Isis terror attack on American forces in UK,” 98 Fruzsina Eördögh and Lorenzo Franceschi Bicchierai, “Hacker Outs
Independent, April 1, 2016. Himself as FBI ‘Snitch’ and Claims He Helped Track Down ISIS,” Vice
87 “Hacker who gave Isis ‘hitlist’ of US targets jailed for 20 years,” Guardian, Motherboard, November 23, 2015.
September 23, 2016. 99 See https://archive.is/kANEa#selection-8147.1-8147.121
88 “ISIL-Linked Kosovo Hacker Sentenced to 20 Years in Prison,” U.S. 100 Goldman and Schmitt.
Department of Justice, Office of Public Affairs, September 23, 2016. 101 Darren Boyle “Could this be the ISIS blue-eyed child killer? Boy in horrific
89 Ibid. video is same age as son of jihadi bride Sally Jones who took him to Syria
90 “Hacker who aided IS sentenced to 20 years in US prison,” BBC, aged 10 and set up home with extremist called ‘al-Britani,’” Daily Mail,
September 23, 2016. August 27, 2016.
91 Author interviews, former senior U.S. and U.K. security officials, 102 Ewen MacAskill “British Isis member Sally Jones ‘killed in airstrike with
December 2016. 12-year-old son,’” Guardian, October 12, 2017.
92 Frank Gardner, “UK jihadist Junaid Hussain killed in drone strike, says US,” 103 “Hacker down: ISIS Twitter star,” CNN, March 8, 2017.
August 27, 2015. 104 Author interview, July 2016.
93 Goldman and Schmitt. 105 Author interview, September 2016.
94 Ibid. 106 Author interview, September 2016.
95 John Simpson and Duncan Gardham, “Spies hacked ISIS phones to track 107 Author interview, July 2016.
British jihadists,” Times, September 16, 2015.