On July 11 at the very end of the soccer World Cup, Al-Shabaab carried out multiple bombings in Kampala killing over 70 people. We’ve mentioned Al-Shabaab previously in the pattern of life analysis on Omar Hammami but now examine the organization more broadly as it takes violence outside of Somalia.

Kampala is usually a pretty quiet city on the “world scale,” but clearly online Momentum for the city rose sharply around the bombings.

Kampala 2010 Timeline

We might ask ourselves, who are these Al-Shabaab guys, and can we predict/monitor what they may be planning using open source intelligence?

We conduct the query Person Career Al-Shabaab in Recorded Future to find titles/descriptions of people and display a network chart which allows exploration of the organization over time. For example, we could look back into their early history when Aden Hashi ran the organization.

Aden Hashi - Al-Shabaab Network

Organizing our analysis

We use the new Recorded Future Workbook functionality, which will soon be deployed to all Premium users, to structure our analysis.

The workbook allows users to organize and annotate queries into analytic products that easily can be shared with colleagues or turned into Futures (our alert system).

[We believe shared workbooks will become one of the most powerful aspects of Recorded Future.]

Recorded Future Workbook

Using this we may now take a look at the head of Al-Shabaab – Mukhtar Abdurahman Abu Zubeyr – and in particular look at whether he had indicated Uganda as a target.

In fact he did, and not only that, but he very explicitly threatened the country a week prior to the attack. Below, you can see the excerpt from AFP reporting on the statements one week (July 4/5) ahead of the bombings.

Warning of Attack on Uganda

Who should feel threatened? What’s in the Future?

In the wake of Al-Shabaab’s actions outside Somalia, the obvious question appears to who/where may be next.  Exploring in Recorded Future we find Mukhtar Abdurahman Abu Zubeyr as well as his spokesperson Ali Mohamud Rage speaking about:

• July 4th – peace keepers in Somalia: “…released an audiotape that was broadcast on Somali radio stations in which he vowed to attack in Uganda and Burundi for sending troops…”. The peace keeping operation is organized by the AUO – and they have a key meeting in Uganda during late July.
• June 24th – democracies: “…The reality is that democracy is something Allah made unlawful, and someone else cannot make it lawful…”. Next year’s election in Uganda is a danger zone.
• June 26th – Somaliland voters: “…Days before Saturday’s presidential polls in the self-declared state, another key democratic test for Somaliland, the militant Islamist movement’s overall leader Ahmed Abdi Godane issued a chilling warning to voters…”
• May 1st – Foreign security companies – “… blamed the attack on the work of ‘foreign security companies’ whose aim, he said, was to massacre Muslims…”
• Jan 17th – American troops:  “…He also warned that if American troops are ever sent to Somalia they will end up dead…”

Al-Shabaab has proven that they can execute sophisticated and coordinated attacks beyond their borders, attract foreigners like Omar Hammimi, and are making threats (and executing upon them) against a broad set of targets.

Learn more about Recorded Future’s ground-breaking web-based media analytics. Developing your own application? Check out our news analytics API.

Previously we used Recorded Future’s temporal analytics to examine the short term evolution of information on a newly revealed security threat in our series on Faisal Shahzad, also know as the Times Square Bomber (or would-be bomber).

In this post we’ll show how we were able to utilize Recorded Future’s data extraction and visualizations for open source intelligence to quickly develop a pattern of life analysis for an American-born terrorist. Recorded Future paints a broad landscape spanning nearly 40 years depicting the transformation of Omar Hammami from an Alabama-born honor student to an Islamic Extremist indicted on terrorism charges.

Searching the full time range of Recorded Future’s index for the entity Omar Hammami, we find recognizable expressions of time back to Hammami’s parents first moving to Mobile, Alabama from Syria in 1972. This initial, extended timeline allows us to see upon cursory glance the dramatic increase in relevant data as we move toward the current date.

Timeline of Omar Hammami Patterns Of Life

Following this early event the next notable marker represents Hammami’s birth in 1984. Recorded Future harvested online content that  highlights early influences of religion in Hammami’s life through his father (Islam) as well as with his mother (Christianity). We also begin to see mention of his prayer in school and a vocalized aversion to violence in his earlier years:

Between 2000 and 2002, we see an uptick in momentum on Hammami as he reportedly defended the cause of Osama bin Laden during a classroom discussion his junior year of high school (2000). Soon after, Hammami enrolled in the University of Alabama where he became the president of the University of Alabama’s Muslim Student Association. He would drop out of the university in 2002 before graduating in order to devote himself to Islam, which may account for the gap in references that year.

Omar Hammami Pattern of Life

Moving forward, reports identify Hammami marrying a Somali woman in 2005 while he worked in Toronto before traveling to Africa – first Egypt, then Somalia. We can see his marriage and links to Toronto and Egypt by querying the event “Person Relation” and the entity “Omar Hammami”.

Hammami Marriage in Toronto

It is after his final move to Somalia that we identify his first connection to the terrorist organization al Shabaab in 2006. Hammami’s earliest affiliation with the group is discovered by querying the event “Person Career” and the entity “Omar Hammami”.

Recognizing the use of an alias in our research, we search for the entity “Abu Mansour al-Amriki” and find Hammami anonymously made his first public statement as part of al-Shabaab under this nom de guerre.

Hammami assumes nom de guerre as Abu Mansour al-Amriki

In addition to the temporal data, we can take a look at the diverse connections in Hammami’s network of personal relationships, travel and affiliations using the network visualization. When we analyze connections of Hammami we see a pair of dense loci including:

Hammami's link to Somalia is in the top right

al-Shabaab Link Analysis

As we continue to analyze his patterns of life we see peaks in momentum representing high profile events including Hammami’s identification in a March 2009 news report on Somali jihadists and his subsequent indictment on terrorism related charges in September 2009. Finally, online momentum hits a high in January 2010 driven by an introspective New York Times Magazine piece on Hammami’s transformation.

Clearly, the rabbit hole is deep and convoluted in Omar Hammami’s story. Using Recorded Future, we can drill deep into the events in Hammami’s life surrounding September 11, 2001, which appears to be a crucial moment in his shift to radicalism. Also of interest is the period where he traveled from Toronto to Egypt to Somalia and there ultimately landed with the al-Shabaab group.

Recorded Future provides intelligence analysts a tool, which is continually enriched through real time updates of live data sources, to quickly identify and visualize events from unstructured data, network linkages and identify emerging trends in the past, present and future.

Jump start pattern of life analysis with Recorded Future!

Over the past couple of days we’ve learned a lot more about Faisal Shahzad, and more facts are still rolling in. You can imagine someone must be responsible for delineating this information, and traditionally it’s not been an easy task. The ability to lay out the sequence of events temporally is quite powerful.

Using Recorded Future, we’re learning about when Faisal was born (1979), when he came to the US on a student visa (1998 or 1999), that he worked at Elisabeth Arden in 2001, that he had a student visa that expired in 2002, he got his MBA in 2005, etc.

We’ve also learned that Faisal communicated with Qari Hussain, a cousin of Hakeemullah Mehsoud – and that he’s made statements about the Taliban seeking revenge for Predator strikes in Pakistan (see linkage below). Lots of connections to explore here!

Below try exploring the interacting visualization of Faisal’s life yourself! Double click to zoom, drag to move it around or use the controls on the left.

[include file=/rf/embed.jsp?qt=/type/rf/entity(entity):/type/rf/entitytid/202524246:Faisal+Shahzad&qt_event=&qt_time=&qt_entity=/type/rf/entity:/type/rf/entitytid/202524246:Faisal+Shahzad&token=uNvBVzDX&hash=bf799c36&fmt=html-timeline iframe=true width=100% height=350 scrolling=no]

Enjoy!

BTW we’re obviously not making any predictions as to what may happen to Faisal, but we are demonstrating Recorded Future’s ability to delineate prior events. We can see how the set of materials gathered over the last 72 hours have grown, and are already becoming very rich with details.

By now there are loads of stories (but that doesn’t mean that all of it is interesting data!) out on Faisal Shahzad.  Even just the most immediate time line visualization nicely lays out what we know – and shows the explosion in Momentum around Faisal.

Click to enlarge

We know also know a little bit of his personal relations – his wife Huma Mian.

More to come!

Update- Check out Part 3 of our 3 part posting on Faisal Shahzad.

Not long ago Faisal Shahzad was arrested for the failed bombing in Times Square. We immediately used Recorded Future to take a look. At first there was very limited results (no surprise!). For example looking at his travel through the Person Travel event we can see the places he supposedly has visited.

Click to enlarge

Anwar al-Awlaki (born April 22, 1971 in Las Cruces, New Mexico) is an American Muslim lecturer, spiritual leader, and former imam believed to be a senior talent recruiter and motivator “for al-Qaeda and all of its franchises.” With a blog and a Facebook page, he has been described as the “bin Laden of the Internet.”  He is currently believed to be in Yemen and has been linked to two recent terrorist events (Ft. Hood shooter and the underwear bomber). In this post we’ll analyze Awlaki’s evolution, influence and momentum on the web.

Below we can see his links to these events are evident in the web.

Click to expand

Click to expand

When we analyze al-Awlaki with Recorded Future open source intelligence data we see some interesting trends. Below we see a time-line showing Awlaki’s momentum online (the curved gray line) from June 2009-June 2010. We can see that at the beginning of 2009 Awlaki had very little notoriety on the Internet — was able to gain momentum following two high profile terror incidents, and is currently losing momentum.

On 07APR10 news broke that a C/K order was issued for Awlaki, and one could assume that this is likely a contributor to the drop in his momentum online:

U.S. citizen Anwar Awlaki added to CIA target list
The Obama administration has authorized the CIA to capture or kill the New Mexico-born Muslim cleric believed to be in Yemen. He is thought to have taken on an operational role in terrorist plots…(LA Times)

Click to enlarge

The  Ft. Hood shooting took place on 5NOV09, this was the first time Awlaki was publicly linked to a terrorist incident since 9/11 (when hijackers Nawaf al-Hazmi and Khalid al-Mihdhar arrived in San Diego in mid-2000, they attended a mosque Awlaki ministered at). Even after 9/11 he was not well known enough to garner major media attention or a large following. Note the low momentum between 2001-2006 below.

Anwar Awlaki momentum

Momentum in the blogosphere increases

The above visualizations show momentum (curved line) as well as media sources (stacked bars; red=blogs, blue=mainstream media). We can see that traditional news-media coverage of Awlaki was very high following the Ft. Hood shooting, while his blog coverage was relatively low. However, following the Ft. Hood attack, he picked up significant momentum in the blogosphere heading into DEC09.  Awlaki may have gained such momentum because he is one a handful of radical clerics who have the respect of traditional extremists (think bin Laden and crew) while also having the ability to reach out to the English speaking world (as he proved through his talks with Ft. Hood shooter Maj. Nadal Hassan).

On 28DEC09, following consultation with Awlaki, Umar Farouk Abdulmutallab (the underwear bomber) attempted to detonate an explosive device while on-board a flight to Detroit. (See spike below) As the trend line shows, following the attempted airline bombing, traditional media was all over the event; which may have lead to his increase in coverage on the blogosphere for the next 2 months.

Following the attempted airline bombing, increase in coverage on the blogos for the next 2 months

He continued to grow in references in blogs throughout March, however, on 07APR10 the United States Government issued the C/K order (a first of it’s kind against a US citizen) for Awlaki. Following the issue of the C/K mission, his traditional media covered increased, while his coverage in blogs decreased (see below). It’s possible this shows the impact of this policy decision and announcement in the press. It’s also likely that those following Awlaki’s activities have realized that they could be targeted for C/K missions or targeted for surveillance. It remains to be seen if he was able to inspire any other terrorist actors, or what will happen to his trend should he be captured or killed.

Online momentum drop