A month after Weisburd’s announcement, a young Swede born in Serbia-Montenegro was arrested in a Sarajevo apartment as he was preparing a suicide attack. The Bosnians called British authorities about the man and his co-conspirators, based on evidence seized during their arrest. Working off that tip, the British police converged on a basement apartment in a quiet, middle-class section of West London, just a few minutes’ walk from the Shepherd’s Bush tube stop on the Central Line—and only five stops away from Ealing. In the apartment, the police found and arrested Younis Tsouli, a twenty-two-year-old of Moroccan ancestry who lived there with his father.
Last November, New Scotland Yard announced eight charges against Tsouli based in part on what had been found on his computer: video slides about how to make a car bomb, and photos of Washington, D.C., that included an emergency van used to test chemical, radiological, biological, and nuclear material. That evidence, the indictment charged, along with more items discovered at the apartments of two other men (Waseem Mughal and Tariq al-Daour), gave rise to the “reasonable suspicion” that Tsouli was involved in “the commission, preparation or instigation of an act of terrorism”—a rocket bomb attack on an undisclosed location. Tsouli was also charged with conspiracies to commit murder, to cause an explosion, to raise money for terrorist purposes, and to obtain “property belonging to others” with stolen credit cards.
A few months earlier, New Scotland Yard had learned from the Department of Homeland Security about the two stolen credit-card numbers that had been given to Loock to set up the strange sites with names in zeroes and ones. When investigators later entered the credit-card numbers found during their West London raid into their database, the Loock numbers popped up as matches. Tsouli, they realized with excitement, might well be Irhabi 007.
In February one of the terrorist-monitoring groups, the Search for International Terrorist Entities Institute, went public with the claim that Tsouli had been “recently revealed to be the infamous ‘Irhabi 007’ himself—a hacker whose “teachings and contributions to the jihadi Internet community reigned unparalleled until the summer of 2005.” A source close to the case has since discovered that Tsouli, who doesn’t speak Arabic fluently, was working in tandem with his alleged co-conspirators, Mughal and al-Daour, and perhaps others. The director and co-founder of SITE, Rita Katz, noted the volume of Irhabi’s posts, many of them “very time-consuming uploads,” and the numerous requests he fielded from the al-Ansar community as evidence that “he could not have been a one-man operation.”
At a preliminary hearing in May, Tsouli and his fellow suspects appeared by video link from the top-security prison in southeast London where they’re being held. Wearing a white T-shirt and jogging pants, Tsouli sat between Mughal and al-Daour, folding his arms over his chest and slouching in his chair. He showed little reaction to the procedural matters being discussed, uncrossing his arms only to muffle his laughter with his hand at something one of his companions said.
For some time yet, Tsouli will remain a distant figure, understood only dimly through the online identity he may have created. His trial has not begun, and British law strictly limits disclosures about ongoing cases. Still, whether Irhabi turns out to have been an individual—Tsouli—or a composite is less important than the legacy he has left behind.