The threat of digital tradecraft in terrorism, Pg8

Key Highlights:

• On November 10, a car explosion near Delhi’s Red Fort Metro Station resulted in 15 deaths and over 30 injuries.
• The National Investigation Agency (NIA) is investigating the incident as a terrorist attack, focusing on a module involving three doctors from Al Falah University in Faridabad.
• Suspects allegedly used the encrypted messaging app Threema and "dead-drop emails" to communicate and coordinate, evading surveillance.
• Investigators suspect links to the Jaish-e-Mohammed (JeM), indicating a potentially transnational network.

Detailed Insights:

• The terror module leveraged advanced digital tradecraft, including encrypted platforms and spy-style communication, to plan and coordinate the attack.
• Threema's architecture, featuring end-to-end encryption and no metadata storage, makes it difficult for digital forensics teams to reconstruct communication chains.
• The use of "dead-drop emails," where suspects saved unsent drafts in a shared email account, left almost no digital footprint.
• The suspects conducted multiple reconnaissance missions in Delhi and stockpiled ammonium nitrate, using a familiar vehicle to remain under the radar.
• Traditional surveillance methods like phone tapping and email intercepts are becoming less effective as terror modules adopt privacy-preserving technologies.
• Policy solutions include building dedicated digital forensics teams, regulating self-hosted communication infrastructure, and enhancing legal frameworks to address encrypted communication.
• Community and institutional engagement is crucial to detect radicalization early, especially in professional spaces like universities and among doctors and academics.
• Strengthening international collaboration is necessary to address the transnational nature of the attack, including encrypted apps, private servers, and cross-border funding.

Key Concepts Involved:

• Encrypted Communication: Secure communication methods using encryption to protect the confidentiality of messages.
• Metadata: Data that provides information about other data, but not the content of the data itself.
• VPN: A virtual private network that extends a private network across a public network and enables users to send and receive data as if their devices were directly connected to the private network.