Reply All - #62 Decoders

Episode Date: April 21, 2016

Reporter Rukmini Callimachi is always looking for new ways to eavesdrop on ISIS operatives online. Recently, she got a new look into how ISIS members might be using the internet to coordinate their attacks. Plus, a new Yes, Yes, No.  Learn more about your ad choices. Visit podcastchoices.com/adchoices

From Gimlet, this is Reply All. I'm PJ Vote. Okay, so I guess the first thing is just can you guys say your names and your titles? So we have them. Rukmini Kalimaki, and I'm a reporter at the New York Times covering terrorism. Runa Sandvik, I am the director of information security for the newsroom at the New York Times. Wait, what does that mean? That anything security, encryption related for the people in the newsroom sort of falls under me. So last week, I headed up to the New York Times to talk with Rickmini and Runa.

You might remember Rukmini. We actually talked to her back in episode 33 about how ISIS uses the Internet. And Rikmini's reporting is so good because she's like, she does a lot of reporting on ISIS using the Internet. She's kind of like a narc at a high school, like a cop who's like hanging out with the high school kids trying to fit in, but with ISIS on the Internet. And since we talked last summer, a lot has happened. and Rikmini has learned way more about how ISIS talks on the internet in its most private, confidential conversations. So, of course, I was dying to talk to her. But before we could even get into that, Rikmini was just excited to show me this new encrypted chat program she has on her phone.

ISIS people use it to have conversations, and Rukmini has been listening in on those conversations because that's what she does. What's interesting is you'll see them posting. Let me see if I can pull up some of them. You have it on your phone? Yeah, it's on my phone. and let's see if I can find some of them. They'll post things. They'll say, okay, please ask your friends to join the Kalafah News channel.

And then at the bottom here, I'll say, this should not reach Twitter nor Facebook. Wow. They use emojis. Like a lot of them. Yes, yes, they do. And it just looks like a chat, like it looks like Facebook Messenger. Exactly, exactly. Okay, so in our pocket, Rikmini just carries around that little window into how ISIS people are chatting with each other.

And it's helpful enough, but ISIS knows that they're journalists in these chat rooms, so they're always a little bit cagey. The reason that I was there was to talk to her about this other window that she'd found. And it had the potential to be way bigger, because it seemed to show where ISIS members planned their actual terror attacks. So this story starts right after the ISIS attacks on Paris last November. 130 people were murdered. The attacks were all over the news.

Most famously, there were images from the Bata Klan, a rock venue in Paris that was one of the targets. Normally, after an attack like this, investigators work backwards. They look at the terrorist phones and computers, and they draw the web of contacts that made the attack, the planners, the financiers, so they can try to stop the next one. But this time, there was nothing.

After the Paris attacks, authorities found absolutely no electronic communications. They found no emails, no Facebook chats, no nothing, you know, nothing that showed. an electronic trace. Now, Runa and others argue that perhaps, perhaps this means that they never actually sent any messages, right? That they were so disciplined, that they managed to carry out the operation by only speaking to each other in person or using burner phones, you see,

without ever having communicated in some other way. I happen to think that's not true for the following reason. One, in the Bata Klan, several witnesses saw one of the suicide bombers who had a bomb strapped onto him and was walking around with a detonator in his hand, they saw him flip open a laptop and do something with it. And they saw, they saw them asking about the internet. Why is the internet not working? Rukmini thought that maybe this was a clue that they'd been talking, using computers, just not on any of the channels that anybody outside of ISIS was used to trying to eavesdrop on. And there were more hints in this direction. Reportedly,

some of the witnesses saw a bunch of weird code on the screen of one of the terrorist computers, which led some people to theorize that maybe the terrorist was actually using true crypt, which is this open source program. Nobody actually knows who made it. But it's considered by security experts to be a very good encryption tool. So that's one data point. The other data point is after Brussels in a trash can outside of the apartment that they had rented. They found a laptop of one of the airport bombers. And that laptop with the information on it, including a will, et cetera, you know, has helped investigators. So it seems that they were doing something, you know, that involved the internet. I don't know, I don't know what, but it stands to reason that,

in my opinion, that they were using this for later attacks. So does ISIS have a way of talking online that none of us have figured out how to listen in on. Brugmini felt pretty sure that they did. And then, very, very recently, she got a hold of this document. It's an interrogation record from a man named Redahame. Radahame was a French citizen who had joined ISIS. He'd been arrested three months before the attack on the Bada clan. And he was very unusual for two reasons.

First of all, he was an IT guy, like a tech support guy. And second of all, unlike every other ISIS operative that French intelligence officials have been able to capture, he was very willing to talk. Rada told French investigators that he had actually just recently returned to Paris after training with ISIS. He had been sent a couple of months before the Paris attacks, and under interrogation, he acknowledged that he had been sent by that same person with the objective of hitting a rock concert hall, which is, what does that make you think of, you know, the Bata clan? But he didn't go through with it. So here is Rada's version of what happened. He had a good job, and then he lost it. He was angry, and so he flew to Syria to fight Bashar al-Assad.

But instead, he ended up working with ISIS on a plan to attack France. So Rada was trained by this ISIS head honcho, who was codenamed Dad. And the training was not what I would have expected. It was extremely focused on just using computers. He was there for roughly a week, so a very short amount of time, and part of his training was learning how to use weapons. And the other part of his training took place inside of a cyber cafe in Raka where they handed him a USB stick containing TrueCrypt. He was supposed to use this whenever he was writing a message to the group. He was supposed to encrypt it and put it inside an encrypted folder.

And then he was supposed to upload it to a Turkish website from where his ISIS handler was going to download it. The website was called dossier.co. It was like a Turkish version of Dropbox. According to the training, if Radha wanted to send a message to his handler, rather than sending an email, which some government could spy on, he was supposed to upload an encrypted file

to this Turkish dropbox. Then his handler would just have the same login as him, and he could log onto that drop box and download the file. So nothing actually passed between them. But when he gets to France, Rada gets busted, and he tells the police everything. And so Rikmini says that the guy who Rada was told to call dad, he was actually also the planner for the big Paris attacks, which makes Rikmini think that it's likely that those attackers were using that same encryption, that they were using TrueCrypt. Rikmini cares about this because she wants to understand terrorists.

That is her job. But for the rest of us, it is also so interesting and so relevant because for months we've been having this big national. debate about encryption versus terrorism. Most people will remember this, but a while ago, two people who were inspired by ISIS murdered a bunch of civilians in San Bernardino. Both of the shooters died, and one of them left behind a locked iPhone that the FBI wanted to open. So the FBI tried to force Apple to unlock it for them, and Apple said they couldn't do it. They didn't want to break their own encryption, because then they couldn't guarantee privacy for anybody who used an iPhone. And so it was this big, abstract debate, like terrorism versus security.

And Rikmini's reporting about what happened in Paris, it totally informs this argument that we've been having in America. And in a lot of ways, it tells us that our argument is bullshit. Like, it's founded on premises that are totally wrong. One very fundamental reason our argument doesn't make a lot of sense is that it assumes that most terrorists even use Western technology. In fact, if you look at everything we learned from this interrogation, new ISIS-Rurbanes. recruits are told to stay away from any piece of technology made by a Western company. So, for instance, docia.co, they thought that this was a Turkish only website and were therefore directing traffic there. TrueCrip, because it's been around for so long,

it's open source, right, is again, I think software that can't be backdoored, right? Since the developers are anonymous as well, where are you going to send the request? Exactly. They're not using iPhones. So the debate in Congress, Congress is of course over, I think, if I get it right, it's over American companies and whether American companies can be forced into handing over the code or whatever is needed to get into their chats. What do you do if the technology they're using is not American? And ISIS, like Al-Qaeda before it, is paranoid of Western companies. Osama bin Laden used to say they made the internet. So be careful with it.

The other assumption it feels like we always make in our big argument about encryption is that we talk about it like it works all the time. And Rikmini's reporting actually suggests that terrorists are constantly screwing up when they try to use technology. ISIS is not sitting there wondering whether or not Apple is going to unlock their iPhone for the FBI. Instead, ISIS's big operational concern is actually teaching ISIS operatives to stop screwing up using technology. Last June, an Air Force General told a story of an ISIS member who accidentally included the geolocation on one of his tweets from an ISIS base. 22 hours later, U.S. warplanes bombed it. And fundamental mistakes like that are happening constantly.

So take Rada Hame, who gets arrested in August of last year. So just a couple months before the Bata Klan attack, he forgets the password to TrueCrypt. He wrote it down on a piece of paper. I feel like that is not the thing you're supposed to do. No. It's sort of like the pin, you know, to your debit card, right? You don't keep it with your debit card, right? Yeah.

Well, so he kept the password to TrueCrypt on a piece of paper next to the password to docea.com, which was then found at his house when he gets arrested. And Rikmini says ISIS made other mistakes. Remember that Dropbox style site that Rado was supposed to upload his encrypted messages to? Turns out it wasn't as secure as ISIS thought. Runa was able to find out that it's actually hosted on a French server. I don't know this for a fact, but my reading of what I saw in the documents is that they were using something in Turkey because they thought that that might be.

be out of reach of Western law enforcement. Got it. Runa actually pointed out that they were most likely wrong. Because it was hosted by a French company. Yeah, exactly. Huh. It's complicated. It's really complicated.

It's challenging. And when you're looking at this website, it appears to be Turkish. There's nothing on that page that tells you otherwise. How are you able to find out that it was hosted in France? You check the IP address of the website to figure out where the server is. Oh, that is find outable. That actually isn't that.

Huh. For example, me as a layperson, I never thought to do that. Right. And so it was Runa's expertise that actually pointed that out. I don't know if ISIS has somebody at the level of Runa,

you know, who could have pointed this out. But yeah, they were, in the last couple of months, they've been choosing people who have an IT background, specifically, I think, because they've had so many

failed plots that failed because of sloppiness on on computer related stuff. People sending Facebook messages to their mom. That was actually a thing that happened? Yeah. It wasn't to his mom. It was actually to a friend. But a guy who was arrested two years ago, February of 2014, he's the first, we believe, the first ISIS operative who goes from France to Syria, gets trained, and then turns around and goes back. He's arrested. in February in Khan with three TATP bombs, the same explosive that was used in Brussels and Paris. And the reason people, the authorities figured out what he was doing is because of his voluminous Facebook correspondence with various friends where he brags about being in Syria, where he brags

about being at certain battles, which place him at the very battles that ISIS was winning. And anyway, so he was sloppy, right? So the information technology aspect of it is seems to be preceding the military training. That that's more important than military training. And I think it's because they've realized that, you know, just from watching what's happened in the U.S., anybody with a gun can do enormous harm. You know, somebody opens fire in a movie theater. By the time that security gets there, you've already killed X number of people, right? Right.

So you just need to be able to open fire, you know, with a weapon. And the hard thing is just finding someone who knows how to use a computer very well. Somebody who is not going to essentially create more damage to the network through faulty, you know, internet or computer use. Listening to Rick Meena to talk about ISIS, I felt myself oscillating between fear of these violent, murderous criminals. But also this other feeling, which is just like, God, what I don't. a hard organization to run. They're in Raqa, in Syria, and they have to conscript strangers in other parts of the world to go commit acts of murder for ISIS in Europe. And the easy way to do this without ISIS getting caught is to never talk to those strangers directly, just put out a bunch of

propaganda online, DIY materials about how to commit terrorism attacks. And that works a lot of the time, actually. That's how you end up with attacks like the one in San Bernardino. But ISIS also wants to do bigger, more violent, more terrible attacks. And those attacks, like the ones in Paris, those attacks require communication. A lot of communication. Law enforcement is paying attention to the communication networks. And that means that ISIS now has to find candidates who not only have extremist views, not only are willing to murder innocent people and to die in the process,

but who are also computer experts. There are fewer people who fit that bill. And so when ISIS goes out to recruit new people, they have to take some risks. And Redahame, the IT professional who got arrested, he was one of those risks. He shows up and he looks like someone ISIS would want, a middle-class French guy who's also an expert in computers with a European passport. And he's really angry. He sounds like someone ISIS would want to use in a terror attack. But the thing is, he actually wants to fight in Syria.

Once he got to Syria, he had gone there to fight the regime of Bashar al-Assad. That was what he thought he was doing when he joined ISIS. Instead, he gets there and immediately they're like, you know, we're sending you back to Paris. Right. Because you've got a French passport. You look white and you're going to pass through a security. And when he waffled, Abawood took his passport and said, if you don't do it, we're going to give it to somebody else. Somebody else is going to take your passport and go in your place.

right? So he claims that he was actually very much on the fence. He wasn't sure he wanted to do it. And so it's possible that he, you know, lost interest, you know, in this mission, if you will. But what's unclear is he leaves in June from Syria. He doesn't get arrested until August. If he really had second thoughts, why didn't he just go turn himself in to police, you know, in the third week of June? I want to see if you believe it, but like, I think you'll say, like, I don't know. Because how can you know? I do think that Reda was at some level trying to be honest because the details he shared were very specific. And they very much checked out with other things that the interrogators were able to triage. So who knows? Like what? They ask him as well, why didn't you turn yourself in to police right when he got home?

And he said at the end, I was more scared of ISIS back in France than I was. of authorities. He suggests that ISIS has such a significant network in Europe that if he had tried to go to police, they could have hurt him or his family. You know, again, take it with a grain assault. Who knows? So the reason Rokmini does the work that she does, the reason she spent so much time eavesdropping on terrorists is because she thinks that ultimately they're understandable and that understanding them is important. Terrorists do not want this to be true. For terrorists, To work, terrorists have to seem like people with their minds made up. People who do horrible things and don't think twice about it.

That's what makes them so scary. And so if there's optimism in the story of Redahame, maybe it's just the optimism of finding ambivalence, of finding somebody who went through a lot of the steps doing a terrible thing, somebody who certainly wasn't a hero, but somebody who at least was human and confused. To ISIS, that is a terrifying. idea. Coming up after the break, the Ridler. Stick around. Welcome once again to yes, yes, no, the segment on the show where our boss, Alex Bloomberg, comes to us with stuff that he finds on the internet that he doesn't understand, and we explain it to him, and then afterwards he's like,

that's it? That's it? Okay, so this is like, this is not typical in that this is a thing that I found on the internet that I don't understand. But I'm mixing it up? Yes. Okay. Go for it. I don't mean to be ageist or whatever, but I did look at it. I was like, maybe this is the thing that's like a reference Alex knows that I don't know because of ageism. Oh. Which Alex? Happy to help you out, honey. That one.

Okay. This is a tweet that you don't know. It's not only do I not know, but like a lot of people are reacting to it. So it means something. So you guys know who Adam West is? Yes. Yes. He played Batman on the old campy Batman.

So I was looking up this Twitter account for other reasons. Hold on. Can we just have a breakout session here? What does other reasons mean? It's not like embarrassing here. He just feels like a long story. There's this Twitter account that just tweets that Batman, like the one from the 60s or whatever.

They just tweet the labels from that show. It's called like Batman labels and it's so funny because they're really specific. It's like anti-theft Joker spray or whatever. Like they were clearly the sign designer on that show was having a lot of fun. Yeah. So they tweet that. So I've just been like, by the way, I used to watch that show, had no idea it was comedy. Me too. Yeah, yeah. So Adam West, that Batman, I was looking at Twitter because I've been like thinking about a lot of having weird Batman dreams because of it. And this tweet, like he tweets stuff and people like or whatever, this tweet like went crazy and it makes no sense to me. So he says, at my age, I try not to let myself get bored. No nincompoery allowed. And then there's a picture of him and he looks kind of plaintive. and in one hand he's holding a bunch of grapes

and the other hand he's holding a garlic head what does that mean like I've never felt more profoundly no in my life like the old grapes and garlic joke you don't look in the at replies and get more clarity no because it's all people who are just responding to a famous person so they're like you sure aren't a nincom poop in my book

you look great for your age like he didn't ask that question um like that sort of thing what's crazy is like how much how many people are coming on to him in his ad mentions. What do they say? Are you modeling for a still life, Mr. West? You're still such a fine figure of a man. And then there's another one like,

wow, you're a real haughty. Stuff like that. It's just weird. It's not the point of the thing. No nincompoorri aloud. I have no idea. But here's what I wonder is if this is actually a pure no, no tweet? Like if this was something like a joke he had with his wife or like his kid,

and he was like, brach, put it on Twitter. People just tell me I look hot. It doesn't matter. Like, did anyone ever get this? I wonder if it's somehow a joke about, like, a classic painting featuring a still life. Called, like, the nincompoop? Called, like, still life with nincompoop, grape, and garlic. I looked up the definition of nincompoop to make sure it didn't mean something I didn't know about.

It means exactly what you think it means. This is one where, like, I want, if we don't know, I want to call Adam West. All right, so we have to call Adam West. Yeah. All right. All right. All right. Bring me back in when you find out.

Hold on a second. Okay. Okay. Alex. Alex. So it's been 24 hours and I have news. So Fia was able to get contact information for Adam West in under an hour. And I called him to find out what his tweet meant.

Yes. What? Yes. Shut up. Seriously. That's why you brought me back into the studio? Yes. Oh my God.

And I am now at a yes for this. I am dying. to know what it means. You said that sarcastically, but I know you mean it. No, I was not being sarcastic. I so desperately want to know what this means. Now more than ever, because I just don't like you having knowledge that I don't have. Oh, get used to it.

So I called him. Batcave. Hi, is this Adam West? It is. Hey, it's PJ. How's it going? It's going great. Did you say Desert Batcave? calling me in Palm Springs.

Oh, I've actually been there once. It is a beautiful, beautiful place. It is not like New York in spring, which is gray and cold and horrible. Yeah, I know. Like New York and what? I like New York in June. What song is that?

Well, that was a little cold portish song, I believe. He sounded like the most normal, nice man in the world. We talked for like probably 35 minutes, and at the end I was like, I hung up and I was like, wait, I never really asked him about the tweet. And then they called him back. It was like, hey, Adam West. I'm so sorry to bother you again.

So, okay. So the tweet, the deal is, it's a joke about vampires. The reason he's holding garlic and grapes is the joke is like, oh, what if you were such a ninkum poop? that you didn't know which of these things warded off vampires. Garlic or grapes? Yes.

Ah. Yes. What if you were such an income pope you didn't know and you thought it would be grapes and not garlic? That makes sense to me.

And so it was almost like a skit, but then the caption is being like, you're saying like, oh, I don't mess around, but obviously you're messing around. Yeah, I think I was too obtuse. he's like describing a joke that he made to himself.

Yes. It's now his Goldman tweet. Oh, it's totally an Alex Goldman tweet. I still don't get it. He's describing a joke that he made to himself about vampire. All right. Here's the scenario. Imagine a guy, a guy who is so old and dumb,

he doesn't know whether grapes or garlic ward off vampires. And he thinks to himself, it would be super funny to tweet this, but not give people the vampire reference, so they have no idea what I'm talking about. It took me 40 minutes to get where Alex just got in half a second. Except vampires were never mentioned in the tweets. Right. But then at my age, I try not to get bored.

What is that, what's that kind? So I come up with amusing scenarios to amuse myself and take pictures of them? I think exactly. Okay. Alex Goldman, so you've sent tweets like this? On April 12th, I was just looking through my Twitter feed. I'm sorry. On April 12th, I tweeted the words elk neck.

so anyway PJ yeah yeah it got eight favorites yeah and and similarly like if people really liked you like they like Adam West like that got like 100 retweets like there's a there's a point where people

were just like Adam West is goofing around I don't need to full I don't need to understand this on a one to one level I like him and he's goofing around I support it well that's what so that was so that was so it was like sort of like so like you're looking at that tweet and looking at all the all the responses to

the tweet. Like, we were sort of looking for meaning. Yes. And there was no meaning to be gotten. The meaning was... Like, what percentage of the people who were, like, actually commenting understood what his joke was? I'm going to say, like, maybe zero. There was no signal in that whole thing. It was all noise. It was all noise. Yeah. I love this tweet so much. I think I mentioned, but, like, we talked for a very long time. Like, longer than I talk to most people. No, a podcast Is like a radio show, isn't it? Yeah, exactly.

I started in radio. You did? Yeah. What kind of radio? Well, it was AM at that time. It was a beautiful voice. He really does. And he said that his big breakout hit was Batman.

And that role actually created a lot of problems for him. So the thing that everybody already knows about Adam West's Batman is, It was like a very goofy version of Batman. Oh, ha ha, remember me, old chum? You jolly devil. Harm one hair of that boy's head. Riddle me twice, Batman. What kind of pins are used in soup?

Terrapins, Batman? Right. Very good. And this was supposed to be funny. Like, Adam West thought it was funny. The people making the show thought it was funny. But some of the viewers thought that Adam himself was not in on the joke, that he was trying and failing to play a very serious Batman,

and that he was a dope. And so when Batman was over, it was hard for him to get other jobs, like other particularly serious acting jobs. You know, there were times when I was so poor and desperate to work that I was shot out of a cannon. Really? With my cape flying behind me. Wait, not really, though. Not really. Yes, once.

In order to survive and take care of family and so on, I had to do a lot of stuff. I didn't want to do. So he kept trying out for all these serious roles, but he couldn't get them because nobody took him seriously. And then finally, he was just like, you know what, fine, I will just embrace the joke that everybody's making about me. Well, shouldn't I love Batman? I am Batman.

So he started allowing himself to be typecast as Adam West, the guy who used to play Batman and used to make us all that. Right. And he credits that with saving him. I still don't quite get the no no no poop real out. Yeah, and every time I asked him about that, he would, like, tell him, he'd be like, oh, well, so a ninkum poop. I was like, no, I know what a ninkum poop is, but I feel like, erase that sense in your mind and just hear it as like, uh, JK or like, here's a joke or like smiley face emoji. Like, you know what I mean?

It's like, oh, right. No ninkum poop real loud is sort of like a smiley face emoji. Yes. Anyway, I better run, not take too much. Thank you so much. And, yeah, just thank you for existing in the world. You are a very wonderful person. Well, you sound like a great guy and my best, all your pals and fellow workers there.

I'll pass it on. Okay, kiddo. All right. Have a good one. You too. Thank you. Bye. Reply all is me, PJ Vote, and Alex Goldman. We were produced this week by Tim Howard, Shruti Pinnameney and Via Benin. Benin.

production assistance from Mervyn de Gagnos. We were edited by Peter Clooney and mixed by Rick Kwan. Matt Lieber is the chairman of Wayne Enterprises. Our theme music is by the mysterious breakmaster cylinder and our ad music is by Build Buildings. You can follow Adam West on Twitter at The Real Adam West.

You'd be insane not to. Also, this is your last week to vote for Reply All as your favorite podcast for the Webbies. We're in second place. It's going to be a nailer. better. Go help out. You can find more episodes of the show at iTunes.com slash reply all. You can also find us on Google Play as of this week. Our website is replyall.com. Thanks for listening. We'll see you next week.