The One-Man Intelligence Operation Against ISIS

You're listening to the CyberWire Network, powered by N2K. As organizations move faster into the cloud and adopt AI agents, there's a new security challenge hiding in plain sight. Identity. Every new workload, machine, or AI agent can create another non-human identity with access to sensitive systems. Traditional identity tools were designed primarily for people, though. That leaves organizations with a growing gap around machine and AI access, and attackers can take advantage by using valid credentials instead of breaking in. IDERA by Palo Alto Networks brings it all together. Human, machine, and AI. One identity platform for all. With IDERA, teams can unify authentication, privileged access, and governance, while replacing static access with dynamic, zero-standing privilege. That means security teams can continuously identify risk and enforce controls, while developers keep moving at the speed they need. Don't give adversaries another way to log in. Secure every identity at paloaltonetworks.com slash I-D-I-R-A. That's paloaltonetworks.com. That's paloaltonetworks.com slash I-D-I-R-A. Welcome to SpyCast, the official podcast of the International Spy Museum. I'm your host, Sasha Ingber, and each week I take you into the shadows of espionage, intelligence, and covert operations. Across the globe. It's not every day that we get a pitch with a book forward written by former CIA director David Petraeus and also Pope Francis. In fact, our producer didn't even believe this pitch at first. But this is a story about a scholar who became a spy without a spy service. That is exactly what Omar Muhammad did after he watched ISIS overrun Israel. His beloved city of Mosul back in 2014. Day after day, he would risk his life to gather information on the ground and share his findings on social media. And he did it under the name Mosul Eye, documenting torture, executions, women and girls being sold into sexual slavery, and key parts of ISIS infrastructure, sharing photos and video, disclosing names and locations of victims as well as perpetrators. Omar's memoir, Mosul Eye: A Scholar's Clandestine War Against ISIS, is out now. And for the first time, Omar reveals new personas and internal intelligence documents that he stole from ISIS, dangerous work which helped coalition forces drive these terrorists out of Mosul. And this is the first of a two part series. Omar, welcome to the show. Thank you, Sasha. So June 6th, 2014, ISIS has rolled into Mosul and then Mosul Eye starts June 17th. What happens in between? In fact, everything started on June 5th when they announced a curfew because ISIS had run some sort of a rehearsal in another city. When they attacked the city of Samarra, southern Mosul, they took over the city and then disappeared. As a result, a curfew was imposed on Mosul and other cities. We were rushed to go back home and then came the 3:00 AM of the 6th of June, which is the offensive, the attack that ISIS launched on the city and took control of Mosul within three days. By 9th of June. They sent that tanker that's full of explosives. And they sent it to the central command of the Iraqi security forces in what was then Mosul Util. And that's it. Everything went into silence. I mean, of course, on the sides, there was a lot was happening. People trying to flee, families mourning their dead, families not knowing what's going to happen. All of that motion. But the city was silent. No one was talking. But what I did before started on the first moments of the attack, because I had this vintage point of looking at everything happening from my window. Because the attack had happened from an area close where I used to live. I immediately started describing exactly what I saw. And in fact, one of the first things I wrote, I wrote it in Arabic. But says, here's what happened as it happened. After all, I'm a trained historian. So this is how I always write. But the 13th of June, I was writing through my real name. People were reading things that Omar was writing. But I was writing it in the circle where my friends are connected back then on Facebook. But then on the 13th of June, the Islamic State had distributed a document. And that document is called. The Charter of the City. The Constitution of the City. In which they describe in 16 articles. Exactly how they are going to rule. Why they are here. What they are going to do. What's going to happen. And their definitions of things in our life. I had thought immediately then. This is completely different from what we have seen. Because we had seen multiple terrorist attacks in the past years. This is completely different. Those people are not temporary. They are not going to just attack the city. Take hold of one checkpoint. And move after a day, two or even maximum three days. And then I received a note from a professor of mine telling me. Are you crazy? Are you out of your mind? Why are you writing your real name? And I thought about it. But it would have been dangerous to immediately emerge as a Mosulite. It would have been dangerous to immediately move from knowing into unknown. Because I had no way of knowing how to fill the gap. Because one had to disappear. Omar had to disappear for Mosulite to emerge. But then I thought about it. Why should I disappear? We can both exist. And this is how Mosulite was born on the 17th. I took my time from the 13th. Through the 17th. Thinking about how it should happen. I started cooling down. I started writing. But not in the same manners I used to. And this is how Mosulite emerged. Before we get into some of the personas that you created for Mosulite. Why did you write with your own name on Facebook initially? You saw what was happening. I think I did not have a choice. I had to write immediately. I did not have the time to think about how to disguise myself. Because I was still seeing everything happening from my window. I was actually grading my students that night. I needed that time to understand reality. I had moved out of the city. Returned. I had walked the streets. But it was still not completely clear. Until that document emerged. The gravity of the situation hadn't sunk in. It explained everything. This was a sophisticated operation. It is not temporary. Those people who arrived here are not disorganized. Like the other terrorist groups that emerged before them. They are well organized. Everything seems in order. The city started immediately changing. For example, the plagues of the Islamic police started immediately showing up on the walls. Changing the names. Their media point stations. Everything started becoming really very clear. And this is when I understood. That if they are disorganized. I cannot be disorganized. I have to be myself also organized. Now this began on Facebook. It moved over to WordPress. Also Twitter. And one of the personas that you created was this man, Maurice Milton. Explain who he was. And why he was so significant. Well. At one point I had to create a distraction. Because the pressure on Mosul was really heavy. It was a two-edged sword. I needed one because the pressure from the Iraqis on the people of Mosul was getting heavier and heavier. Of this accusation of the people being complicit with ISIS. Which the people were not seeing what this was doing. It was pushing the people more toward ISIS. And ISIS was finding it easier to really live comfortably in the city. And this was annoying to me. I needed to create something to stop the Iraqis. hierarchies, from pressuring the people of Mosul and continuously accusing them of being complicit with ISIS because I need the people on my side. If this continues to be, ISIS will always have them on its side. So I created the persona called Maurice Milton. And Maurice Milton is a combination of two names, not one. Milton is derived from John Milton, who wrote one of my favorite poems, The Lost Paradise. He's the British poet. And Maurice is the character from The Penguin of Madagascar, a cartoon of that. I don't know what type of animal was it, but he was always rebellious. He would always tell King Julia and things that makes him uncomfortable. And I put the profile photo of Denzel Washington in his film, The Book of Eli. And I created a kind of, people were confused. This character, writing in Arabic, in the Iraqi tongue, addressing Iraqis, but also showing a level of deep understanding of what's going on in the city, but completely disconnected from Mosul. To the extent that people, to this point, to this day, only few people have made, even though later I made it public, they have never made connection between Mosul. Mosul, I and Maurice Milton. It created that confusion in the city that the people started saying, well, this must be a resistance. It's not only one, because to them also, don't forget, Mosul, I, to many people, they did not view it as a one person. They never thought it's a one person. So for them, that has become a collective. The pressure eased, and I started actually functioning much better. And ISIS started having more difficult time. And it might have been, I don't know, it might have been, I don't know, it might have been, it might have brought some of the people who were so fearful, a little bit of hope in that moment. It definitely did. I mean, this is well evidenced in what the people themselves were saying, is that it allowed hope to take hold in the city, but also helped others to really act. As I mentioned, I brought back the people on my side, because it was also a battle between me and ISIS. You need the people. And Denzel? And Denzel Washington. I see, of course. Now, I know that there are other personas that you have not discussed. Tell us about somebody new. Well, I mean, there are two others. One is Ibn al-Athir, which is the name of the Mosul historian whose tomb was destroyed by ISIS. But this is also became known. And what people never heard before and never known is a name called Najibah. And Najibah was, that character that is completely different from what Mosul Eye is, from what Maurice Milton is, from Ibn Omar, was everything is completely different. It's a character of an older man, someone who is really into economics. He is not into history or anything. An older man, Kalmar, who is analytical, would always use economy as a way of describing events. A character that was working in the background. Because I needed to speak to people. I needed to communicate with the people. I needed them to speak about things that are ordinary, which eventually helped me to understand really the situation much better. I needed to understand because not everything to me was a battle. I needed to understand how life was running on day to day on the type of very ordinary conversations. So that was the actually the character of Najibah. What was his name? His image, his avatar. Yes. I mean, one time it was a painting of Socrates, sometimes a flower, sometimes an instrument, musical instrument. It kept changing over time. And you didn't have to worry about ISIS tracing your IP address. They couldn't because I had the habit of not reporting from the same location twice. I cannot. I mean, this was my role is I cannot report and use the same IP twice. But also I relied, even though it was really completely difficult. I relied on other methods, including stopping not reporting, changing timing of reporting, creating a behavior that really is unpredicted. But definitely, I understood even though with the risk of being exposed digitally, using the digital media, I was able to be exposed to a digital fingerprint. And there is also that back then, what was more important than the digital fingerprints was the actual fingerprints, real life on the ground. As I mentioned, it is going to be completely difficult to bring back everything, every step I have taken. But my biggest lesson back then was, if I behave correctly offline, I will behave correctly online, meaning I will never leave a trail behind me. It was not always the case. I mean, there were other cases when I really had to go to the extra mile to report information. And it was one of the riskiest things I've ever done in my entire life. So you've created these false personas online. You're also creating new identities on the ground to gather intelligence. Who were some of those people? On the ground, I had to become many things. One of them, I had to become a taxi driver. One, it gives me the advantage of seeing things myself with my own eyes. Second, it allowed me to move freely across the city. Third, which is the most important, is that the people who would stop a taxi might be ordinary people, but might be also ISIS itself. And then the type of conversations that happen in a taxi, you can't imagine how useful they were. They were very effective. They were very detailed. They were very useful. But also, I developed my way of, I don't make the person feel they are being asked questions. It's like I just create the… The biggest challenge back then is how do you collect valuable information without getting killed? I mean, it's as simple as that. That was the equation. At one point, being a taxi driver, it was not enough to get the information. I mean, there were times, certain type of information, I cannot get it as an ordinary civilian, as someone in ordinary clothes. And that type of information was inside a hospital. Because back then, I had realized I was missing information about who is getting killed and by who from ISIS. ISIS was projecting an image that they are undefeatable, they cannot be defeated, that they are powerful. But I had information that they were getting really hunted one after the other. But they were never reporting that. How could I know? The only way was hospital. The only way was the morgue. I eventually had to manipulate. My friend, who was a doctor, manipulating him into giving me his robe, the white dress, and I just went into the hospital, presenting myself as a doctor. I never prescribed anything to any people. And this is how I got information that became damaging to the Islamic State later. And it was very useful in the way that it started attacking that rock-solid type of image that ISIS was building. Another type of information that I cannot easily get, because the reason I mentioned that I had to create these personas is because questioning during that time was very dangerous. You cannot just out of the blue stop someone and tell, like, what do you think about this event? What is your opinion about what ISIS did today? You cannot do that. I had to create the natural environment in which I can operate to get information. Because in my opinion, and it has always been the case, I mean, people might call this spying. People might call this espionage. To me, it's not. Because to me, the best intelligence ever that can be collected is that when you don't have to act as a spy, when you don't have to look after this kind of, like, what they call it, secrets, etc. Sometimes information that is very visible and available with people, it just takes some effort to really take it. One of them becoming a baker. Once again, just like a taxi driver, people who want to buy bread, trust me, they talk a lot. But also, it gave me the view that I could see the conveys of the Islamic State. I could see them passing by. I could create understanding. I could establish patterns. I could understand what's going on. When we come back, how Omar collected intelligence on ISIS's own intelligence unit. you Every time your team deploys a cloud workload or AI agent, another non-human identity gets persistent access to your network. Legacy tools can't track those non-human accounts, giving adversaries valid credentials to simply log right in. That's why Palo Alto Networks introduced Idira. Idira replaces high-risk static access with dynamic, just-in-time permissions, protecting your system without slowing down developers. One identity platform to secure all identities, human, machine, and AI. Secure every identity right now at paloaltonetworks.com slash I-D-I-R-A. We all like to believe that if a group like ISIS invaded our towns, our cities, that we would be able to outsmart them. That we could act like spies even if we weren't spies. And you proved that you could do that. What were you channeling to have created. You created these different personas so convincingly before we move into some of the actual pieces of intelligence that you gathered and how that worked. I mean, it was not easy to do it. Oh, I bet not. I had to eventually, as a trained historian, adopt or learn how a spy would function, how an intelligence agent would function. And I had to immerse myself into these methodologies. How does it work? Also, the biggest challenge was my mission was not just collecting information. That's the difference between me and a spy. I was immediately putting that information into action. I had to go through a process of also not just verifying the information, but I had to choose what goes public, what does not. But even prior to that, I had to create a system in which I make a copy. Copy one. Copy two. Copy two and copy three. Because there was always the risk of losing it. Either I get killed or something happens or even an airstrike could hit the house and then everything is vanished. And then I had to create a digital one. I had to create a handwritten one and so on. But it was also a battle for the spirit of the city. And where were you doing this writing when we're talking about terrorists on the street, airstrikes from above? Where was the work being done once you had gathered the intelligence? Well, I mean, what I had called back then, it was my bedroom, you know, it was my what I called it the operation room. I had a fairly modest laptop. I had two. The reason I had two is because when I do a house search, you cannot say I don't have a laptop or I don't have a phone. You've got to present something. Otherwise, they become more suspicious. But I would go back home. And your family lived in the home. Of course. A big family. A family that knew nothing about what was happening in that room. They might have read. I mean, they did many times. They read Mosul Eye. Friends I knew were reading Mosul Eye, not knowing the person next to them is actually Mosul Eye. So it was it was my bedroom. As I mentioned, everything started from there and everything continued there. It became the habit that in that room, I would also continuously change. The way the room is organized. So I never fall for the comfortable behavior. If I was writing on the east side of the room, next day is going to be on the west side and so on. I move the bed from here. I move the table from here. What did your mom think? My mother, I mean, she told me later that she suspected something, but she never knew what it was, because as you can imagine, it might have been easier. Being Mosul Eye, being Maurice Melton, being every other person, it might have been easier compared to having to remain Umar. It was really like a torture. You know, how do you stay yourself? I had to remain the same person while I am simultaneously other people. And with your family right there, you don't want to endanger them. What are you telling them when maybe you suddenly don't have Internet? And now. You can't put out a piece of information that, you know, is crucial to put into the world. I feel bad about this one because I had one time asked my brother, I created the fake story. Well, we're used to that by now. We know that's what you do. You got here five minutes late. Like, can I even believe that? But what did you say to your brother? I had told him we're going to meet someone checking something in a certain part of the city, but I. Needed him to drive me. I needed him to come with me. And I also kind of like made an impression that made my mother want to come with us as well without having to ask them. You know, I never asked people what to do or do this, or it was my way of doing things. I make them doing it without them knowing. He said, yes, let's go. And my mother said, go to the front. I insisted on her going to the front. I said, like, I'd rather go in the backseat. It made me sometimes when I remember it made me really laugh at myself. Like I've been probably watched lots of mafia movies, you know, when they refuse to sit. So this is really the key to Mosul Eye, this mafia movies. Well, I don't, I don't know. I don't know. But there's a lot of influences. We got Denzel Washington, Socrates. We got some mafia flicks. Okay. You know, at one point I really, at one point I had to adapt things that I've never imagined. It was a survival mechanism, but it was even beyond that. That's why when, when my, my brother was driving, what he did not know is that I was desperately chasing a signal to transmit information. He was driving, the phone connected, information is gone. It's done. That's it. I feel satisfied now. Everything's mission complete, mission accomplished. I create another forces. Story. So my brother will drive back home. The level of stress that you must have felt before that signal came through for you before you could send it, knowing that maybe you were putting your loved ones in harm's way. Yes, definitely. I mean, I've thought a lot about this, not just in that ride, you know, not, not just in that, but continuously in the same house, in the same place, you know, I have accepted the price I would pay for what I did. And trust me, Sasha, if it happens again, I'm going to do it again. If it happens third time, I'm going to do it. As long as I'm alive, I'm going to always do it again and again. But the only thing that I could never tolerate is that my family would be harmed because of something I chose to do. They were never part of it. They are not involved in it. They never knew what was happening and going on, but also at one point, I mean, if I just kept thinking about. If my family would have done nothing, I mean, someone had to do something. I had to respond. I could have never forgiven myself if I did nothing. Where did that determination and conviction come from? I mean, for the simple reason is that what the Islamic state brought, everything they brought goes completely against everything we believed in as a normal life, as an ordinary life. It's unnatural whether those humans are religious, not religious. Muslims, Christians, Jews, it does not matter. It goes against the essence of being humans. The animalistic level of brutality that they carried with them, the instruction they wrote to the city of Mosul and its people. Every day I am more determined when I was there. I tell myself every day, everything I do, every day pass, I will be more determined to do it. But it's also from the sense of responsibility. The sense of the fact that the moment you've read history and the moment you've witnessed history, you are no longer excused by ignorance. That excuse is never going to work again. I can no longer justify to myself, well, I am just one among the people. I am not. I was not. I read history. I understood history very well to understand that what the Islamic state brought to the city must be stopped. And must be confronted. That is exactly how I changed from a completely ordinary person who really, I was, I was dreaming about continuing my studies, going to university, to my office, going to the library, continuing a normal, ordinary life, boring it may be, but okay, it's my life. But that changed completely, you know, changed forever. I mean, as I mentioned earlier, people call it spying. People call it espionage. People call it counter-terrorism. I mean, people are free to call it whatever. But to me, it was that. mission of stopping the erasure of our history. It's a mission to prevent the destruction of a nation that ISIS was determined to achieve, but also that anti-life, anti-nature, anti-human level of brutality that they brought. There was only one answer. It must be confronted. It must be stopped. And I also believed, Sasha, I believed that if I did not do it, there will be only one narrative of the history. It will be very difficult to tell people exactly what happened. Now, among the material that you collected, you gathered intelligence on ISIS's intelligence unit. How did that happen? Well, I mean, ISIS was really, as they call it, influential. Information animal. It's like they were living on information. They had spies everywhere in the city. Were they capable? I mean, not until I showed up, you know. I mean, they had a sophisticated network of informants. They had multiple divisions of intelligence, the internal intelligence. They had the military intelligence. They had, they learned a lot from the regime of Saddam Hussein back then. And with all what I was doing, Mosul, I, yes, it is publishing the information. It's making everything visible. It's exposing ISIS. But it was not enough. It was not enough. I had to do what really hits the enemy beyond the front lines, beyond the enemy lines. And that was only one way to do it. ISIS is spying on people. I'm going to spy on ISIS intelligence. I broke the intelligence unit. I broke the intelligence circle of the Islamic State. I had the mall inside the house of the head of the intelligence of the Islamic State in Mosul. How'd that happen? I mean, there are details. There are, I can also show you. I know that before we sat down together, you showed me some actual intelligence documents. Can you show us some of those? Absolutely. I mean, I can just pull my phone, if you'd like to see what I am displaying here. This is from the Department of the General Security of the Islamic State, the Division of Intelligence. And in that report, they are sending to the governor's office, which is the highest ranking office back then in Mosul. He is someone who comes immediately after the caliph. And it's signed and stamped by the Islamic State. They are saying that they have started collecting information about families who are being smuggled, livestock being smuggled from multiple areas, southern Mosul. And they are asking what to do with this information. There are other type of reports. So for example, this was one of the most consequential documents in that period. In 2014? Yes, it's in 2014. The very early beginning of ISIS takeover. In fact, in this one, because it also confirmed what people have always disputed, is that who took control of Mosul in the beginning. Here they are referring in a report, saying that we are attaching a list of the names of the members of the Naqshbandi terrorist group, which is another Naqshbandi terrorist group, is actually the terrorist organization that was directly connected to the former Baath regime. And they were all the members of the Baath who turned terrorist. And ISIS is also Baathist. They were heavily also influenced by Baathi former members of Saddam Hussein government. In that report, they are saying, we will start issuing arrest orders to arrest them through the internal security and through the Islamic police. And they put the list of everything. They even had this kind of unique identification number of their vehicles. They had collected every information. You can imagine that type of information back then was consequential because after all, there was a point where you had to create a fracture inside this terrorist organization. There's no other way to defeat them until you make them eat themselves from within. And this was one of the ways to do it. And I've always joked to myself secretly, is that I've always told the Islamic state, there is a new sheriff in town. You watch people, I watch you. Mosul Eye. Yes. So car numbers, we're not just talking about license plates. We're also talking about, I believe, the vehicle identification numbers to just monitor the Mosul Eye community. And you also found a document that suggested that ISIS had an embassy. Yes, that is a document that was really one of the most precious ones. I've never mentioned this. This is the first time I mentioned this document. Actually, it's a document that makes a reference to an embassy they have established to run their work. Apparently, ISIS had the ambition to run international missions. The document is a sole one, unique one. I could not identify other relevant documents. The office of that embassy might have been in Mosul or Raqqa back then. But it is really a striking thing to think about. ISIS might have had really plans to stay longer. They were definitely on a path to recruit more international people. But thinking about having embassy made me many times think, were they planning to run other wilaya or provinces abroad? Where was that? Were they planning something against the West? So what was the result of your gathering these intelligence documents on ISIS's intelligence unit? Did it help to dismantle the spy network? Or did it somehow give information to coalition forces to know exactly where to target, when to target? Well, I mean, they no longer exist. I mean. But can you take credit for it? I mean, I don't know. No, I don't. I can't. You've got a smile on your face right now. I think it needs to be noted. I think they no longer exist. You know, they disappeared. The head of intelligence, back then, vanished. Okay. So you can say more on that. I mean, I was connected to many people. I had connections. I had people. I mean, I'm a city person. I worked at the university. And in a city like Mosul that all of a sudden fell into the hands of the so-called Islamic State, but also a city that was running for over 15 years into civil war, terrorism, sectarianism, every violent thing that you can imagine. So people have continuously changed. One of the things that happened post-2014 is that all of a sudden this friend, all of a sudden he's a member of ISIS. This neighbor is a member of ISIS. This person that was a completely normal one is a member of ISIS. Everyone we knew is like all of a sudden they are members of the Islamic State. Well, I didn't let it slide. I said, well, I mean, it's bad for them. They are members of ISIS, but it's good for me because that is a unique source of information. These are type of ISIS members that I can freely talk to. I can easily talk to. I can easily communicate with, but I can also easily manipulate, you know. One of them was a relative of the head of intelligence of ISIS. And I understood the value of what I had. I mean, there are many, many, many things that I have used to transform him into a mole without him knowing. Of course, he never, he never knew. In part two, Omar talks about gathering intelligence on where ISIS manufactured car bombs and chemical weapons, his closest call and his harrowing escape. Thanks for listening to this episode of Spycast. If you liked the episode, give us a follow on Apple, Spotify, or wherever you get your podcasts and leave us a rating or a review. It really helps. If you have any feedback or you want to hear about a particular topic, you can reach us by email at spycastatspymuseum.org. I'm your host, Sasha Ingber, and this show is brought to you by N2K Networks, Podville Media, and the International Spy Museum in Washington, D.C.