Exclusive: The Secret Global Data Cell Infiltrating Jihadists
We knew the name: Operation Gallant Phoenix. But now Le Monde has exclusive access to details of the U.S.-led, Jordan-based effort to use digital tools to track, capture and convict some of the most dangerous perpetrators of Islamist terror around the wor
Hidden from view in the quiet heat of Jordan, a vast data war is being waged. Ground zero is an American military base in the heart of the Hashemite kingdom, where for the past five years, a silent tracking system has been developed based on meticulous archives. The goal of this painstaking project? Identifying and consolidating the traces of every kind of jihadist fighter to pursue them in any way possible — including in the courts.
This extraordinary project was long run by the Pentagon and kept completely under wraps. While it remains a confidential operation to this day, it's been mentioned briefly by official sources across the Atlantic and by a few intelligence unit insiders in European media. Yet the undertaking was never disclosed to the public in detail. Today, Le Monde can reveal the origins and the modus operandi of what is known under the code name "Operation Gallant Phoenix" (OGP).
A few years ago, this Big Brother-esque program would have been impossible to put into place. In counterterrorism, intelligence agencies have always favored bilateral, over-the-counter exchanges. Gallant Phoenix is the exact opposite: Since 2016, the countries that decided to join as partners in the project have been able to help themselves to whatever information they need or want. Inversely, they can also deposit any intel or evidence gleaned from their side.
Cell phones, cameras, computers, USB sticks.
The information held in the OGP is no ordinary data. It's what specialists call "proof of war." Essentially, this refers to any trace left on the web, social media or the field by jihadist groups, or anything found on their person when they are taken prisoner.
Initially focused on al-Qaeda and the so-called Islamic State (ISIS) soldiers in the Iraqi-Syrian zone, the Gallant Phoenix network now encompasses all of their affiliates, stretching across Afghanistan, Yemen, Libya and elsewhere in Africa, particularly in the Sahel-Saharan strip.
A wealth of information
The main contributors to this vast collection consist of the parties that have all found themselves militarily involved in the Iraqi-Syrian quagmire: The Iraqi army, the Kurdish forces and the numerous countries participating in the international coalition (the United States, United Kingdom, France, etc.).
Throughout their respective operations, they've all had occasion to collect devices, chips and documents. Special forces are especially well-versed in this exercise, as they have precise procedures in place for collecting this kind of evidence during targeted assassinations, producing photos and reports.
In the huge "data center" in Jordan — the exact location of which is kept secret and where the data collected now numbers in the millions — one can find anything and everything: cell phones, cameras, computers, USB sticks. Whether they used them to communicate or disseminate propaganda, al-Qaeda and ISIS fighters have left many such items behind, some in good condition, others intentionally damaged or partially destroyed so as not to be exploited.
Gallant Phoenix is also a huge database of identity documents, fingerprints and DNA — stored after they were found on explosive devices or corpses.
But the U.S. project was above all made possible by ISIS's administrative madness, by its political ambition — that of building a Sharia-governed proto-state — as much as by its "Soviet-like" will (to quote a security source) to control every move of its associates. Over the years, Gallant Phoenix has therefore managed to gather heaps of official handwritten documents, account books, enrolment sheets, payslips, hospitalization records, rent receipts or even proof of allowances payment.
Syrian Democratic Forces during an anti-terrorism operation in Raqqa, Syria — Photo: Morukc Umnaber/DPA/ZUMA
Back then, every time ISIS retreated, "document hunters' would rush to collect phones and computers belonging to jihadists to resell their content to the media. There is a high probability that these elements, which were collected in unclear circumstances and then ended up on USB sticks, have reached the OGP base in Jordan.
It was in this way that the U.S. television network NBC obtained, in 2016, thousands of documents from a man who was presented as a former jihadist. The documents were then authenticated as the recruitment records of more than 4,500 jihadists. These "Daesh Leaks," as they were called at the time, widely circulated and fueled several legal proceedings, especially in France.
The Gallant Phoenix system has taken that same logic to a whole new level — with two goals. The first is intelligence: The idea is to monitor as closely as possible how foreign fighters are spreading since the fall of the "caliphate." This is a particularly sensitive issue for Europeans, who want to limit the risk of an attack on their territory.
But Gallant Phoenix has also developed another aspect, this one intended for legal proceedings. And this is its real specificity. All the armies of the world have always been careful to collect the belongings abandoned by their enemies. But, in other times, a majority of these elements would have remained in the hands of military intelligence. Gallant Phoenix, in contrast, regulated and systematized the collection methods. In short, it's the industrialization of war crimes evidence. "It is a need that has met a process," a French legal source explains.
The idea is to monitor as closely as possible how foreign fighters are spreading since the fall of the "caliphate."
Originally conceived by the Americans in 2013, the OGP project came to fruition in 2016. U.S. authorities then started to present it to other countries, and in 2017, France agreed to get on board. Like other countries, France saw in this project, beyond the security issue, the opportunity to consolidate its hundreds of legal cases involving jihadists who had traveled to the Iraqi-Syrian zone. So far, the lack of strong evidence of their departure had led judges to sentence many jihadists "blindly," solely based on the accused's own story or limited mobile evidence.
"It's simple, if we manage to bring evidence that someone stayed in this zone, the average sentence in France is 12-13 years. If we can prove there was a commitment to join in combat, the sentence can reach more than 20 years," says an expert. "We're starting to learn that the French fighters were butchers and that they were fanatic, especially the older ones. They will never be judged at the level of what they have done, but with these new elements coming from Gallant Phoenix, it's starting to get closer," says another source, someone who's familiar with the subject.
Today, according to the information at our disposal, approximately 700 documents — evidence of war crimes — have been incorporated into French legal proceedings for terrorism. They are linked to some 500 jihadists, men and women. About 200 come from the "Daesh Leaks." But in cases still under investigation, more and more of these documents are provided by Gallant Phoenix.
Following a thwarted attack in Brest in January 2020, investigators were quickly able to track the ISIS recruitment record of one of the arrested men. The use of these new methods could rapidly increase. Full declassification of OGP data, with some exceptions, only dates back to 2018.
Still from an ISIS propaganda video — Source: Handout/Planet Pix/ZUMA
From the moment they're collected to their release, Gallant Phoenix data is subjected to a tight protocol, which is implemented by the U.S. military in cooperation with the FBI. All of this is to protect what lawyers call "evidence integrity," in other words to be able to trace the origin of the evidence (location, date etc.), its storage and exploitations conditions — to limit risks of litigation.
This is all the more important since the original version of the evidence can sometimes be physically sent and legally sealed — a challenge when it often comes down to hastily stuffing personal effects found on the corpse of a fighter in a plastic bag, in the middle of gunfire exchanges.
There is no way to verify where these documents come from, what hands they went through, who translated them.
"Some of this war evidence can also be used for exonerating purposes," a source at the National Antiterrorist Prosecutor's Office in Paris told Le Monde. "On their own, they are not enough to issue sentence," as exemplified by the way some ISIS-linked documents detailed with great precision which days combatants "had off" during battles, or proved that this or that jihadist was injured that day, or that they only played a very subordinate role.
"This data is treated as regular evidence," the source adds.
The Ulysses affair
In France, the first trial in which Gallant Phoenix intel was submitted took place last month before the Paris special assize court. Called the "Ulysses' affair, the complex dossier was centered around two separate attack plans that were foiled in November 2016, following a cyber infiltration operation in which the French counterterrorism DGSI agency, together with the Interministerial Technical Assistance Service (SIAT), managed to make their way into the ISIS headquarters in Raqqa, Syria.
This unprecedented operation led to the dismantling of two cells — one in Strasbourg, the other in Marseilles — as well as to the court referral of three men. Among them, 30-year-old Hicham El-Hanafi from Morocco, the main individual targeted by the OGP data.
"If these documents were everything we had, you wouldn't be here," the president of the court, David Hill, told Hicham El-Hanafi. And when the young Moroccan started raising his voice, insisting that there was no proof that his mother and his sisters had gone to the "caliphate" of ISIS, the magistrate replied: "What about the war evidence!" Asked by lawyers, during the hearing, about the reliability of said documents, the DGSI agent stated, "What the Americans give us is the truth."
"The problem is that what is presented to us as original evidence from ISIS files is shown as already translated Excel spreadsheets," says Fares Aidel, counsel for Hicham El-Hanafi. "I don't mean to sound conspiratorial, but there is no way to verify where these documents come from, what hands they went through, who translated them."
The United States began to reflect on the issue of war evidence during its involvement in Afghanistan, starting in 2001. The 9/11 attacks, planned in al-Qaeda camps in the Afghan mountains, triggered a first wave of judicial inquiry. But the American justice system very quickly stumbled over the lack of meaningful clues.
It was around that time, too, that the transfer of "enemy combatants' started, from Afghanistan or Pakistan to the U.S. military base of Guantanamo in Cuba. So too did their ensuing interrogation under torture — outside of any clear legal framework. Twenty years later, the trial of those behind the attacks has yet to take place. Scheduled for January, it was once again postponed.
Since 2003, the Americans have developed a laboratory specialized in the analysis of improvised explosive devices (IED). Spearheaded by the FBI, TEDAC (short for Terrorist Explosive Device Analytical Center) collects and compares papillary and genetic traces found on homemade bombs from over 50 countries. But this program is far from being on a comparable scale with Gallant Phoenix.
The OGP project, as useful as it is, also raises new questions. Granted, it contributes to making the battlefield — long considered a place devoid of any form of justice — a form of judicial "crime scene." But will the collected "evidence of war crimes' one day be used to bring justice to the local civilian populations? They're the ones, it's worth remembering, who suffered at the hands of jihadists in Syria and Iraq.