The Code Used In The Anthrax Letters
By Ross E. Getman
(Reprinted in full with consent of Author)
Director of National Intelligence Mike McConnell told a recent
conference in Washington, D.C.:
"People often ask me what keeps you up at night; what do you worry about?
If someone were to have a sophisticated attack on our financial services system,
let's just say cyber networks broadly, at the same time that they mailed through
U.S. mail, FedEx, and UPS the equivalent of letters sprinkled with anthrax
throughout the country, it would have a devastating impact. If you chose the
right time, right place, right season, it may have a maybe even more
overwhelming devastating impact."
While by his account in that speech, he starts his day at 4:00 a.m.,
let's consider whether Mr. McConnell has made the time to brief the
President on the code used in the earlier anthrax letters.
(1) Atta's "Jenny" Code and the Jennifer Lopez Letter
The goofy letter sent to the publisher of the National
Enquirer and Sun tabloids in Florida sought to dissuade Jennifer Lopez
from a planned marriage. “Wedding” is known Al Qaeda-speak for “event”
or “attack.” In the Summer of 2001, Mohammed Atta was communicating
with a terrorist contact in Germany. He used tradecraft code in these
contacts -- he used the code "Two sticks, a dash and a cake with a
stick down" to convey to his contact the intended date of the 9/11
attack. In sending these emails to Germany, Atta pretended to be
writing to an imaginary girlfriend named "Jenny." Khalid Mohammed
used a similar code in communicating with Ramzi Binalshibh during the
period, instructing Binalshibh to send "the skirts" to "Sally". (The
9/11 Commission Staff noted that "Sally" was Zacarias Moussaoui.) KSM
admits that upon the death of military commander Atef, he came to
supervise the cell planning on attacking the United States with
weaponized anthrax. In 2003, after the interrogation of regional
operative Hambali, "extremely virulent" anthrax was found at a house
in Kandahar that could be readily weaponized. Al Qaeda had it prior to
9/11.
Stevens noted at the time it was especially odd given that the
Sun did not deal with celebrities, which was the subject of the
sister-paper Globe. Stevens' fellow photo editor Roz Suss was looking
over his shoulder: "With that Bob says to me, 'Hey, I think there's
something gold in here. It looks like a Jewish star sticking out of
the powder.' I walked up behind him and reached over his shoulder. I
pulled this little star out of what looked like a mound of powder in
this letter." "It looked like something from a Cracker Jacks box," she
says. She picked it out of the powder and tossed it in her
wastebasket. Stevens' colleague Bobby Bender recalls opening a large
envelope to Jennifer Lopez, care of the Sun. In it was a cigar tube
containing a cigar, a small Star of David charm, and somethiing that
seemed like soap powder. According to an early National Enquirer,
Stevens held it up to his face and then put it down on the keyboard
(where traces of anthrax were found). The publisher's wife was the real
estate broker who rented to two of the hijackers. Small world, eh?
KSM’s assistant in supervising the anthrax cell was Hambali, who along
with two colleagues considered attacking an Israeli restaurant, with a
Star of David above it, in the Khao San Rd. backpacker area in Bangkok.
Jennifer Lopez' fame had withstood a number of underperforming
movies, to include the movie "The Cell" in the year 2000. In the
movie, following a trail of bodies, an FBI agent tracks down and
captures a disturbed serial killer. Before the killer can reveal the
whereabouts of his next victim (a woman trapped in a cell on the verge
of drowning), he falls into a coma. Enter FBI psychologist Lopez, who
uses a radical link to the killer's brain that could destroy her own
sanity. "Her mission: Find the cell's location before time runs out,
and avoid getting trapped inside the killer's head." How apt.
Mrs. Stevens explained:
"They get strange letters sometimes, and the consensus seems to be that
if Robert wasn't wearing his glasses and if it was something funny, he
would hold the letters up to his face. They think perhaps that's how he
got it. Just bad luck."
The CIA knows that wedding is Al-Qaeda-speak for an event. That,
according to New York Times journalists, is why the CIA got so anxious
to have the Buffalo boys arrested. Apart from an email about a "big
feast," they had started talking about a planned wedding. Interpreting
such code is not without risk. The CIA kicked down the door in Bahrain
and dragged him away from the altar to the horror of his bride-to-be.
What does the J.Lo letter tell us about the sender, or senders?
J.Lo is what they used to call a "sex bomb" - and the biggest one at
the time. She had international fame. The vehicle had a "weird" love
letter, a Star of David, maybe a cigar. Who has "issues" and weird
obsessions with women, sex (with a cigar being a crude symbol) and
Jewish symbolism? Atta, for example, had strict instructions in his
will about what women would be allowed to do at his funeral. Follow
the anomalies.
Two of the hijackers had subscriptions to AMI publications, as did
at least one other Al Qaeda operative in contact with Atta in the
summer of 2001.
(2) "School"
"Greendale" School is the return address of the anthrax letters to
Senators Daschle and Leahy -- two Senators who played key roles in
both appropriations to Israel and Arab secular regimes and the
rendering of senior Egyptian Islamic Jihad leaders. In December 2002,
the Arabic paper London Al-Sharq al-Awsat reported that correspondence
on Zawahiri's computer (which was obtained by the Wall Street Journal)
shows Zawahiri uses "school" as code for Egyptian Islamic Jihad. The
letter was found on Al Zawahiri's computer. The letter was designed
to look innocent. It was dated 3 May 2001 and signed "Dr. Nour,
Chairman of the Company." Nour was one of Zawahiri's aliases. In this
context, it was Egyptian Islamic Jihad, not Al Qaeda, of which he was
Chairman.
"We have been trying to go back to our main, previous activities. The
most important step was the opening of the school. We have made it
possible for the teachers to find openings for profitable trade."
The letter read:
"To: Unknown
From: Ayman al-Zawahiri
Folder: Letters
Date: May 3, 2001
The following is a summary of our situation: We are trying to
return to our previous main activity. The most important step was
starting the school, the programs of which have been started. We also
provided the teachers with means of conducting profitable trade as much
as we could. Matters are all promising, except for the unfriendliness
of two teachers, despite what we have provided for them. We are
patient. [This apparently refers to an internal dispute with two
senior London Egyptian islamists].
As you know, the situation below in the village [Egypt] has become
bad for traders [jihadis]. Our Upper Egyptian relatives have left the
market, and we are suffering from international monopolies. Conflicts
take place between us for trivial reasons, due to the scarcity of
resources. We are also dispersed over various cities. However, God had
mercy on us when the Omar Brothers Company [the Taliban] here opened
the market for traders and provided them with an opportunity to
reorganize, may God reward them. Among the benefits of residence here
is that traders from all over gather in one place under one company,
which increases familiarity and cooperation among them, particularly
between us and the Abdullah Contracting Company [bin Laden and his
associates]. The latest result of this cooperation is … the offer they
gave. Following is a summary of the offer:
Encourage commercial activities [jihad] in the village to face
foreign investors; stimulate publicity; then agree on joint work to
unify trade in our area. Close relations allowed for an open dialogue
to solve our problems. Colleagues here believe that this is an
excellent opportunity to encourage sales in general, and in the village
in particular. They are keen on the success of the project. They are
also hopeful that this may be a way out of the bottleneck to transfer
our activities to the stage of multinationals and joint profit. We are
negotiating the details with both sides."
The full message, decoded, is thought to say:
"We have been trying to go back to our military activities. The most
important step was the declaration of unity with al-Qaeda. We have
made it possible for the mujahideen to find an opening for martyrdom.
As you know, the situation down in Egypt has become bad for the
mujahideen: our members in Upper Egypt have abandoned military action,
and we are suffering from international harassment."
But Allah enlightened us with His mercy when Taliban came to power.
It has opened doors of military action for our mujahideen and provided
them with an opportunity to re-arrange their forces. One benefit of
performing jihad here is the congregation in one place of all
mujahideen who came from everywhere and began working with the Islamic
Jihad Organization. Acquaintance and cooperation have grown,
especially between us and al-Qaeda."
Dr. Jean Rosenfeld, a researcher associated with the UCLA Center for
the Study of Religion, and an expert on the symbolism of religious
extremist movements, wrote me: "Greendale' to me signified a conscious
choice to use the symbolic color of Islam." She continued: "The
franked eagle on the envelope of the anthrax letters was identical to
the one I caught on a documentary that showed a one-second shot of the
site where Sadat was assassinated -- the huge eagle above the podium
where he was when he died. That assassination was of great
significance to Egyptian Jihad and produced the pamphlet by Faraj that
justifies "fard 'ayn"/individual duty as the basis of jihadist
doctrine." She explained that "AQ is rooted in Egypt and Salafism,
not Saudi Arabia and Wahhabism. Al-Zawahiri, I believe, is intensely
nostalgic for the Nile Valley."
The CIA factbook explains that the color green -- such as used by
anthrax lab technician Yazid Sufaat in naming his lab "Green Laboratory
Medicine" , and by the mailer who used the return address "Greendale
School" -- is the traditional color of islam. Green symbolizes islam,
Mohammed and the holy war. In its section on Saudi Arabia, and the
"Flag Description:," the CIA "Factbook" explains that the flag is
"green with large white Arabic script (that may be translated as There
is no God but God; Muhammad is the Messenger of God) above a white
horizontal saber (the tip points to the hoist side); green is the
traditional color of Islam."
"Green is the color of the prophet Mohammed who himself declared
it his favourite color and who's cloak and turban were green. Even
today only his direct successors - the Kaliphs - are allowed to wear a
green turban. The Holy Banner - the most precious relic of Islam - is
green with golden embroidery. Mohammed supposedly carried this very
banner into the holy war which resulted in conquering Mecca. Green is
also the predominating color in Paradise where it stands for flowery
fields and eternal oases. Green is the color of the Arabic League and
many Arabic countries have included green in their national flags as it
symbolizes the unity of all arabic nations. Green is also the
life-giving color of all desert peoples."
Al Qaeda anthrax lab technician Yazid Sufaat and Zacarias Moussaoui
used the name Green Laboratory Medicine as the name of the company that
he used, for example, to buy 4 tons of ammonium nitrate, and that he
used to cover his anthrax production program. In a Hadith the
Messenger of Allah explains that the souls of the martyrs are in the
hearts of green birds that fly wherever they please in Paradise.
Green dale refers to green "river valley" -- Egypt, Cairo, Egyptian
Islamic Jihad and/or Egyptian Islamic Group. Put it all together and
you have their new official name (though the American press does not
use it) -- Qaeda al Jihad. For what it is worth, at the Darunta
complex where jihadis trained, recruits would wear green uniforms,
except for Friday when they would be washed.
A similar type of coded talk was used around the same period
between Atta and Binalshibh as they approached the zero hour of 11
September. Code phrases included:
Faculty of Fine Arts/arts = Pentagon
Faculty of Town Planning = World Trade Center
Faculty of Law = The Capitol
politics = White House
White Meat = Americans
Terminal = Indonesia
Market = Malaysia
Hotel = Philippines
Village = Egypt
In the conversations that the blind sheikh's spokesman, Sattar,
had with people like Taha, al-Sirri, and the sheikh's son, Ahmed, they
used the same language found in emails between Zawahiri and the Yemeni
cell. If a brother was in the hospital, it meant he was in
prison. If he had an accident, it meant perhaps that Egyptian
security services had killed him.
Given that using the same address helps the second recipient
receiving the letter to identify it and avoid opening it, the perp
would have no reason to use the same address unless he was
communicating something and wanted to draw attention to it.
On the return address, Greendale School purported to be in
Franklin Park where fugitive Adnan El-Shukrijumah worshipped along with
others who now have been indicted. The pilot El Shukrijumah is said to
be at the level of Mohammed Atta and is thought to have been associated
with Aafia Siddiqui, an MIT-trained biologist. Mohammed Atta lived 11
miles away from this mosque across from Franklin Park. Holy Cross
hospital -- where Dr Tsonas treated Flight 93 hijacker Ahmad
al-Haznawi for a suspicious leg lesion that he and other experts think
was due to cutaneous anthrax -- is only 7 miles from the mosque.
Al-Haznawi had just come from Kandahar where the "extremely virulent"
anthrax had been found and where Sufaat's anthrax lab was located. Is
it all a coincidence? Possibly. Certainly, it is speculative and the
relevant information is classified. Sufaat's two principal assistants,
a Sudanese man and an Egyptian man, were captured in 2003.
The coded e-mail Faris wrote back to KSM suggesting that the idea
of removing bolts from the span of the Brooklyn Bridge was not a
viable idea was but one of many examples of the simple codes used by
Al Qaeda operatives. Sometimes it might be Iyman Faris' reference to
the weather or Ramzi Binalshibh's "shirts" for Sally. Sometimes the
code might be as simple as Adham Hassoun's "stuff" for the local soccer
team in places like Bosnia or his references to a young man who wanted
to go out and get some "fresh air" [go join the jihad]. Sometimes
it might be a reference to Greendale School or a marriage proposal to
Jenny such as in the case of the anthrax mailings.
But putting aside this question of nuptials, impending or annulled,
the fact remains that the sender of the anthrax letters would have had
no reason to use the same address on the second letter unless he was
communicating something. That identical return address, in fact,
helped authorities locate and intercept the letter to a Senator.
(3) "In The Hearts Of Green Birds" (Inside Green Birds)
It was widely published among the militant islamists that
martyrs go to paradise "in the hearts of green birds." The stamp used
in the anthrax mailings was designed by artist Michael Doret. Mr.
Doret advises me that the color of the eagle is a “teal” or
greenish-blue.
In the very interview in which they admitted 9/11, and
described the codes used for the four targets for the planes, KSM and
Ramzi Binalshibh admitted to the Jenny code, the code for representing
the date 9/11, and used the symbolism of the "Green Birds." Osama
Bin Laden later invoked the symbolism in his video "The 19 Martyrs",
describing a hijacker as "A man of worship who enjoined good and
forbade evil. His body was on earth but his heart roamed with the
green birds that perch beneath the Throne of the Most Merciful."
9-11 plotter Ramzi Binalshibh a few months earlielr in his
interview with al-Jazeera, in a lengthy and articulate essay "The
Nineteen Lions" published by Azzam Publications on December 2002,
explained:
"One of the explanations of the Quranic verse [3:169] in which Allah
says that the shuhadaa (martyrs) are not dead, is that as well as their
souls being inside the hearts of green birds, they are alive because
the shaheed (martyr) gives life to those around him. Indeed evidence of
this is apparent throughout the Ummah today."
Peter Finn of the Washington Post explains the symbolism:
"Around 7 one evening during Ramadan in 1998, the believers filed down
a long corridor leading to the prayer room of the Al Muhadjirin mosque
here, placing their shoes on the dark brown shelves before stepping
onto a carpet the color of turquoise, a mixture of green for Islam and
blue for heaven. Among the worshipers was a small group of men who
clustered around a severe, slight Egyptian named Mohamed Atta. ..
In the [9/11/2002] interview with al-Jazeera, Binalshibh, said that
Al-Shehhi, even before he learned of the operation, used to have
beautiful visions that he flies in the sky with huge green birds and
crashes into things."
A FAQ on Al Qaeda's website, the Azzam Publications website,
explained that "In the Hearts of Green Birds" refers to what is
inside: “The actual Arabic word used in the Hadith is not Qalb
(heart) but it is Jowf which can mean any of interior, inside, or heart
(as in center).” There was a video based on the hadith with the title
"In The Hearts of Green Birds" about foreign mujahideen that had been
martyred in Bosnia. The audiocasette was created in August 1996 and
its 3rd edition was released in January 1997. The azzam.org website
selling the "In the Hearts of Green Birds" audiocassette was shut down
after 9/11 because authorities thought it might contain codes and
instructions to militants.
Azzam.com posted an exclusive interview with Ayman al-Zawahiri
and stressed the importance of cash donations and gas masks and
chemical-resistant suits. Ibn Khattab, the Arab Chechnyan fighter who
was Bin Laden's good friend, had told his public that azzam.com was
highly recommended and that only the two charities identified by the
website should be used to route donations -- announcing in 2000 that
Benevolence International Foundation was one of the charities that
should be used. The other was the Islamic Assembly of North America
("IANA"). Ibu al-Khattab, the late Arab-Afghan commander of foreign
mujahideen in Chechnya (who in March 2002 was killed by a poison
letter), expressly endorsed Azzam Publications.
Azzam.org had "no bricks and mortar address, but operates a post
office box in London, and bill[ed] itself as "an independent media
organisation providing authentic news and information about jihad and
the Foreign Mujahideen everywhere." One posting datelined from the
southern Afghan city of Kandahar and was a message to Muslim youth from
top terror suspect Bin Laden. A farewell message from Azzam
Publications .. exhorts "Muslims all over the World (to) render as
much financial, physical, medical, media and moral support to the
Taliban as they can." Azzam also urged those with computer expertise
to mirror the website so as to keep it up after authorities took it
down. One can access old websites as they existed on past dates
through www.archives.org and its wonderful Wayback Machine.
British and US intelligence sources suspected that some of
Azzam.com's jihad photos and graphics contain messages embedded with a
technology known as steganography. The code instead perhaps was there
separately for all to see on the stamps of the lethal missives being
sent.
A man formerly known as Paul Hall, was arrested in Phoenix on a
federal criminal complaint in March 2007 and agreed to be removed to
District of Connecticut for further prosecution where there has been
investigation of Azzam Publications website located on a server there
He is alleged to have provided classified information to the
London-based Azzam Publications about a U.S. Navy battle group as it
traveled from California to the Persian Gulf region in 2001. He
allegedly "described a recent force protection briefing given aboard
his ship, voiced enmity toward America, praised Osama bin Laden and the
mujahedeen [and] praised the October 2000 attack on the USS Cole."
Even Zarqawi invoked the imagery in a 60-minute audio message:
"The martyrs rejoice in the bounty provided by God. Their souls are
inside the bodies of green birds that fly in heaven."
In Fall 2004, the federal authorities indicted the fellow behind
Azzam Publications selling "Green Birds," Babar Ahmad, pointing, in
part, to the "distribution of videotapes and compact discs depicting
fighters in Bosnia, Chechnya and elsewhere, and the eulogizing of dead
fighters, for the purpose of recruiting individuals and soliciting
donations to support the mujahideen in Afghanistan and Chechnya." Of
Pakistani descent, Ahmad is a British computer specialist. He is
associated with KSM, who had anthrax production documents on his laptop
and admits to having headed the cell (after Atef’s death) planning to
use weaponized anthrax against the United States. Ahmad is also the
cousin of Muhammad Naeem Noor Khan, who was arrested mid-2004 in
Pakistan. Khan’s computers carried detailed surveillance of five
financial buildings in New York, Newark and Washington and once
prompted the Department of Homeland Security to elevate the threat
alert level to orange.
In an affidavit, an FBI special agent and computer investigative
specialist, alleged that a New Brunswick, NJ man, Mazen Mokhtar,
assisted Babar in maintaining the continued operation of the Azzam
sites, through the use of mirror sites, when the administrators of
Azzam sites shut down the Azzam.com site down after 9/11. The mirror
sites, www.qoqaz.net and www.waaqiah.com, allegedly routed people
trying to access www.azzam.com. The affidavit alleges that Mr. Mokhtar
is listed as the administrative contact for the mirror sites. He also
operated minna.com. A friend reports: "He said he used to run a
hosting service four or five years ago that used to resell Web hosting
services to people. He said he didn't know those guys (mentioned in
court papers) and he is not involved in anything like that." An
Egyptian-born imam and political activist, he is a supporter of
Palestinian cause and frequent speaker before groups in Brooklyn and
the Bronx. He is said to be nice and seems a man of peace.
Of course, given that the symbolism used in this regard in the
anthrax mailings had an origin in religious writing, there is no
direct tie with the website -- the tie could be with the hadith. The
webmaster has said that the FBI allowed it to remain up (while it moved
from server to server) for another year hoping to get leads on
supporters.
Bin Laden was using "Green Birds" in the same way he used the
repeated phrase "Looming Tower" to hint of what was to come with the
planes attack on the World Trade Center. He would say:
"Wherever you are, death will find you,
even in the looming tower."
On October 7, 2001 in a prerecorded tape aired October 7, Bin Laden
said "The winds of faith have come." This would be enough to keep
Director of National Intelligence Mike McConnell up at night -- or when
he does sleep, to keep him dreaming about green birds.
(4) KSM and Clouds (Al-Sahab)
In admitting that he had taken over supervising the development
of anthrax for use against the US, Khalid Mohammed separately noted
that "I was the Media Operations Director for Al-Sahab or 'The Clouds,'
under Dr. Ayman Al-Zawahiri.
The flagship of American Media, Inc. described the letter sent
AMI as follows:
“Bobby Bender came around the corner with this letter in the upturned
palms of his hands,” said photo assistant Roz Suss, a 13-year Sun
staffer.
“It was a business-size sheet of stationery decorated with pink and
blue clouds around the edges.”
(5) Allusion to Both Atta and Genomic Sequencing of Ames Strain
The writing of the text of the letter is also interesting in that
the "As" and "Ts" are double-lined -- to suggest ATTA, the lead
hijacker.
When the US Centers for Disease Control first identified that the Ames
strain had been used in the mailng to Florida in October 2001, Dr.
Paul Keim and his colleagues at The Institute for Genomic Research
(TIGR) had nearly finished a project to sequence Bacillus anthracis—
specifically, the chromosome of an anthrax isolate from a laboratory in
Porton Down, U.K. Ayman had a microbiologist attending Porton
Down-sponsored conferences at which presentations were made about the
sequencing of Ames. The Defense Intelligence Agency provided me the
correspondence between the scientist and Zawahiri. And, sure, enough,
the letter writer appears to have even double-lined A's and T's in the
letters possibly to simultaneously allude to Atta and the genomic
sequence. The hazmat courier who delivered anthrax to Dr. Keim’s lab
emailed me this past week to say that he was interviewed twice -- once
in March 2002 and then in January 2003. It was in January 2003 that
the FBI had come to be fixated on whether any middle eastern man had
come to have access to anthrax at the lab. The FBI thus apparently has
been clued into the code used in the letter years ago.
As explained at the Porton Down conferences attended by Ayman's
operative Abdur Rauf, Keim's research team eventually discovered 60 new
'markers' in the Bacillus anthracis genome—DNA sequences that may vary
from one isolate to another. These include insertions or deletions of
DNA, and short sequences that are repeated at different lengths in the
genome known as VNTRs (variable-number tandem repeats). A decade
earlier, it had been determined that one of three proteins comprising
anthrax toxin, and the first nucleotide sequence to be reported from B.
anthracis (by USAMRIID authors no less), had a consensus TATAAT
sequence located at the putative -10 promoter site. It is all greek to
me but apparently something with meaning to the person who drafted the
letter. Perhaps the sender was saying that the bacteria was pathogenic
unlike what had been sent to the Canadian immigration minister six
months earlier when a bail hearing was announced for the manager of Bin
Laden’s farm in Sudan. The man was a shura member of the Egyptian
Islamic Jihad.
This and the other coding together may have served to tell the
world, for example, that Mohammed Atta and the others were going to fly
to paradise on a green bird and that the anthrax was courtesy of
Zawahiri’s Vanguards of Conquest. Ayman simultaneously framed the US
Army and UK biodefense establishment while telling them who did it.
DNI McConnell, in acknowledging at the recent conference that he
perceives this threat, seems to be abiding long-honored
inside-the-beltway code: CYA.
Comments