Thousands of New Yorkers named as apparent Islamic State targets

An online group claiming Islamic State ties threatened 3,600 New Yorkers and distributed their personal information last week on a secure messaging app.

Islamic State supporters published the names and addresses of 3,600 New Yorkers in an apparent "hit list" seemingly meant to escalate the group's campaign of sowing fear far from the battlefield in Syria.

While hacker groups claiming allegiance to IS have previously published these kinds of threatening target lists, those data dumps have typically included information about US military personnel, government officials, and diplomatic officers rather than citizens with no clear ties to the US government or the fight against the terrorist group. 

Independent security analysts who discovered the list and showed it to Passcode said it's unclear how IS supporters obtained the names and addresses on the list. The names were released last week by a group calling itself United Cyber Caliphate on the encrypted chat application Telegram, which IS supporters are known to use to recruit supporters and spread propaganda. 

So far no previous lists of individual targets have resulted in the physical attacks, said Matt Ortiz, head of cybersecurity at the SITE Intelligence Group, a firm that tracks the activities of IS and other terrorist groups. "As of now, it appears to be mainly a fear tactic," he said.

Still, the FBI is reaching out to people named on the list to make them aware of its existence and asking them to contact law enforcement if they notice anything suspicious. 

"The FBI has been made aware of the threats," says Kelly Langmesser, a spokeswoman at the FBI’s New York office, in reference to the data dump.

Ms. Langmesser declined to elaborate on specific details of the threat, answer questions about its credibility, or provide more information about how the bureau is following up on the list other than to say the FBI routinely alerts potential victims of threats it uncovers to assist them in taking proper steps to ensure their safety. 

"While our standard practice is to decline comment on specific operational and investigative matters, the FBI routinely notifies individuals and organizations of information collected during the course of an investigation that may be perceived as potentially threatening in nature," Ms. Langmesser said in an e-mailed statement. 

In the wake of deadly terrorist attacks in Paris and Brussels carried out by IS, the US is ramping up efforts to combat the group on the ground with additional forces and in the digital realm. According to a story this week in the New York Times, the US will initiate a digital campaign to "disrupt the ability of the Islamic State to spread its message, attract new adherents, circulate orders from commanders and carry out day-to-day functions, like paying its fighters."

Islamic State has proven so effective at using technology and social media to further its cause that Director of National Intelligence James Clapper called the group "the most sophisticated user by far of the Internet."

Last year, Ardit Ferizi, a suspected IS hacker from Kosovo, breached the networks of an unknown US retail store, leaking the data of more than 1,000 US government and military employees online. Mr. Ferizi was subsequently captured by Malaysian authorities and charged by US prosecutors in October.

In December, the pro-IS outfit known as the Cyber Caliphate Army tweeted the purported home addresses of ex-State Department and CIA officials.

Even though experts don't believe these pro-IS hacking groups are acting upon orders from the group's leadership, the releases follow a September 2014 speech by IS spokesman Abu Mohammed al-Adnani encouraging the group's supporters to carry out attacks against westerners.

"They want you to go out and kill military officials, police officers, the whole gamut, and just random civilians," said Michael Smith II, chief operating officer at Kronos Advisory, a defense consulting firm. "This is meant to further stimulate [the will] to act instead of sitting on the fence."

But even if the data dumps do not lead to actual attacks, the drumbeat of threats and intimidation online may raise the specter of Islamic State-inspired attacks in the US.

"They're trying to instill as much fear and garner as much attention as possible without going into highly sophisticated, highly coordinated cyberattacks," said Alex Kassirer, an analyst a Flashpoint, a cybersecurity firm. "[Terrorists] understand that you don't need a cyber version of a 9/11."