WEBVTT

00:00:00.633 --> 00:00:07.160
JACK: How did I get here? I’ve got such a strange job, you know? I never imagined I’d

00:00:07.160 --> 00:00:14.000
be a podcaster. For one, I failed English class at least twice in college, so there’s no way I’d

00:00:14.000 --> 00:00:21.200
ever be a writer, so I thought. Sometimes I like to step back every now and then and just wonder

00:00:21.200 --> 00:00:28.640
what crazy life events happened to me to put me in this place I’m in right now? [MUSIC] Let’s

00:00:28.640 --> 00:00:33.520
look at 9/11, for example. On 9/11, I woke up early and took a shower, and I walked over to

00:00:33.520 --> 00:00:40.120
my grandma’s house. She was gonna drive me to go see the FBI. The thing is, the FBI had a

00:00:40.120 --> 00:00:46.320
job-fair-type event and was recruiting people who were into computers. I was into computers.

00:00:46.320 --> 00:00:53.080
I wasn’t exactly thrilled about working for the FBI, but it could be a great adventure. Maybe I

00:00:53.080 --> 00:00:57.840
could be a spy or something. Alright, yeah, cool. Screw it; let’s go. Let’s go apply and see what

00:00:57.840 --> 00:01:02.880
happens. Come on, grandma, wake up. Let’s go meet with the FBI and see if they’ll hire me.

00:01:02.880 --> 00:01:07.640
But while I was waiting for her to get ready, I turned on the TV and the world

00:01:07.640 --> 00:01:14.360
was changing in front of my eyes. We were watching the TV on live in front of us.

00:01:14.360 --> 00:01:20.760
We saw a plane crash into a building in New York City. I’ve never seen anything

00:01:20.760 --> 00:01:27.720
like that on live TV before. This was wild. We were stunned by the events,

00:01:27.720 --> 00:01:32.800
but we still hopped in the car and drove to this job fair event. When we got there,

00:01:32.800 --> 00:01:39.760
the FBI wasn’t there. The job fair was a total dud. The FBI never even took my resume to look

00:01:39.760 --> 00:01:44.960
at it later, and I never tried to apply to work there again. I don’t blame them for not showing

00:01:44.960 --> 00:01:51.800
up. That was a crazy day. But it does make me wonder about an alternate universe, one where

00:01:51.800 --> 00:01:59.840
I became a fed and I listened to, I don’t know, your podcast instead of you listening to mine.

00:01:59.840 --> 00:02:28.714
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]

00:02:28.714 --> 00:02:36.320
JACK: On September 11, 2001, Shannen Rossmiller was watching the news just like I was. She was

00:02:36.320 --> 00:02:43.880
watching it from her bed, though. Planes were flying into buildings. What? How? Who? Why? All

00:02:43.880 --> 00:02:50.200
our heads were swirling with a million questions that morning. It was a tragic event. A terrorist

00:02:50.200 --> 00:02:57.840
attack on US soil? Shannen was transfixed by her TV. She was in bed that morning recovering from a

00:02:57.840 --> 00:03:03.480
fractured pelvis. She was a tough woman. [MUSIC] Being stuck in bed meant she was really injured,

00:03:03.480 --> 00:03:08.840
because she just didn’t let smaller injuries slow her down. She had a lot of grit and determination.

00:03:08.840 --> 00:03:13.600
She had three young children and a husband named Randy. He was a computer technician who had his

00:03:13.600 --> 00:03:19.120
own business fixing up computers and setting up networks. Shannen was thirty-two years old. She

00:03:19.120 --> 00:03:24.920
was a municipal court judge when 9/11 happened, which is a pretty surprising role to have at

00:03:24.920 --> 00:03:32.920
thirty-two years old. It just speaks to her drive to learn and succeed. As a judge, Shannen

00:03:32.920 --> 00:03:38.520
typically saw cases regarding traffic violations, thefts, and other minor offenses. She was an

00:03:38.520 --> 00:03:46.000
important person doing an important job. Now, this was all in a little town called Conrad in Montana.

00:03:46.000 --> 00:03:49.360
It’s a small place; we’re talking less than three thousand people live there,

00:03:49.360 --> 00:03:53.600
but it’s your typical small American town with locals who all know and support each other.

00:03:53.600 --> 00:04:00.680
It’s a nice, quiet place to live. So, Shannen is a super-focused woman. She absorbs information crazy

00:04:00.680 --> 00:04:05.240
fast and likes a challenge probably a bit more than most of us, learning new things and pushing

00:04:05.240 --> 00:04:10.800
herself mentally. It’s a part of what she strives on. But when she tried to go back to work after

00:04:10.800 --> 00:04:18.880
seeing what happened on 9/11, she just couldn’t shake those events from her head. [MUSIC] Someone

00:04:18.880 --> 00:04:26.080
attacked the United States. They flew planes into the Twin Towers. Who would do that? What

00:04:26.080 --> 00:04:32.760
were their ideologies? She wanted to understand what could have driven someone to do this. But

00:04:32.760 --> 00:04:40.400
more than all of that, it was a tragic event. A lot of people died. She wanted justice for those

00:04:40.400 --> 00:04:47.920
who died. I mean, that’s kind of what she worked her whole career on, right, being a judge and

00:04:47.920 --> 00:04:54.720
issuing justice. But how do you punish the people who flew planes into the buildings? They died in

00:04:54.720 --> 00:05:00.280
the crash. It was a very confusing time and we were all seeking guidance here, something to

00:05:00.280 --> 00:05:07.760
help us take those next steps in life. It’s like we all felt stuck, not knowing what to do next.

00:05:07.760 --> 00:05:13.480
9/11 put Shannen right in the middle of an intersection of being a proud American

00:05:13.480 --> 00:05:18.040
wanting to do something about it, being a judge who brings justice to people,

00:05:18.040 --> 00:05:25.720
and being endlessly curious. This added up to push her down a new road in life and shape her

00:05:25.720 --> 00:05:33.520
into becoming someone she never imagined herself being. Now, the internet back in 2001 was not the

00:05:33.520 --> 00:05:38.720
same as it is now. AOL and dial-up was still how most people accessed the internet then,

00:05:38.720 --> 00:05:43.520
and it was slow, like really slow. Instagram and Tinder could not have been possible then

00:05:43.520 --> 00:05:48.400
since each image would have taken three minutes to load, and everyone would have just got bored. But

00:05:48.400 --> 00:05:53.520
it was fine because we didn’t know what fast was and we were just going online to read things or

00:05:53.520 --> 00:06:00.200
check e-mail or message other people, not look at photos or videos. Now, Shannen’s husband Randy was

00:06:00.200 --> 00:06:04.760
a computer guy, so they had computers in the house and were pretty connected, and she’d get on them

00:06:04.760 --> 00:06:12.680
sometimes and check it out. But 9/11 brought her to the computer much more. [MUSIC] She had a lot

00:06:12.680 --> 00:06:18.080
of questions, and there were people online talking about it, too. So, she’d click around on forums

00:06:18.080 --> 00:06:22.880
and websites and chatrooms just reading more, reading everything there was about the subject,

00:06:22.880 --> 00:06:29.080
learning about radical Islam, jihadists, and terrorism. Early mornings were her time.

00:06:29.080 --> 00:06:33.560
Randy and the kids were still asleep. She’d get up and head downstairs into the little room that

00:06:33.560 --> 00:06:38.560
they used for a computer room and power up the computer and wait the five minutes for

00:06:38.560 --> 00:06:43.680
it to boot up. She’d read all the news she could about the attacks on the Twin Towers,

00:06:43.680 --> 00:06:48.920
and she’s got one of those brains where everything she reads just sinks in and stays there. So,

00:06:48.920 --> 00:06:56.080
she’d reading and absorbing everything. Then, one month after the attack, Osama Bin Laden recorded

00:06:56.080 --> 00:07:02.080
a video claiming responsibility for the attacks. He was the leader of a global terrorist group,

00:07:02.080 --> 00:07:08.080
Al-Qaeda. Al-Qaeda was a new word for most of us. We had never heard of this before,

00:07:08.080 --> 00:07:14.000
and she was learning about their affiliation with Islam and their radical ideologies. Al-Qaeda had

00:07:14.000 --> 00:07:19.040
wanted the US military out of the Middle East, and they were willing to go to some pretty scary

00:07:19.040 --> 00:07:24.160
lengths to get their message heard. It appeared that the United States had a new enemy to deal

00:07:24.160 --> 00:07:31.360
with, one they didn’t expect or know how to handle. The United States was forcing their

00:07:31.360 --> 00:07:37.160
military into places all over the world, perhaps interfering in areas they shouldn’t have. So,

00:07:37.160 --> 00:07:41.880
the people of the internet were expressing a variety of opinions on the whole event. Some

00:07:41.880 --> 00:07:46.840
people were sympathetic to Al-Qaeda. The internet was a hotbed of chatrooms and forums where people

00:07:46.840 --> 00:07:52.520
expressed their opinions. Online, everyone is anonymous, even in the early days of the internet.

00:07:52.520 --> 00:07:56.840
In fact, this was a big calling for a lot of people who had extreme views and wanted to

00:07:56.840 --> 00:08:01.680
share them. It made it easy to go online and be threatening without it coming back to your real

00:08:01.680 --> 00:08:07.160
life. Shannen heard the name of a website on a news report. It said there were chat rooms

00:08:07.160 --> 00:08:12.800
attached that people were using. She couldn’t help herself from having a look. [MUSIC] Is

00:08:12.800 --> 00:08:17.880
this where people who hate the United States were hanging out? She got on the website and

00:08:17.880 --> 00:08:23.880
was looking around, reading the words of people from all over the world. Some expressed sympathy.

00:08:23.880 --> 00:08:29.840
Some had hatred behind their words. She was fascinated by it and spent hours just reading

00:08:29.840 --> 00:08:35.640
and taking it all in, trying to understand everything she didn’t understand. A lot of it was

00:08:35.640 --> 00:08:42.240
in Arabic, too, and she had to translate it. By late 2002, Shannen had found some friends online,

00:08:42.240 --> 00:08:46.960
other people from around the world who shared her views. Osama Bin Laden was still on the loose,

00:08:46.960 --> 00:08:50.880
and it didn’t seem like any justice was happening for those who died. [MUSIC] She

00:08:50.880 --> 00:08:55.080
eventually gravitated towards people who were interested in the same thing as her.

00:08:55.080 --> 00:08:59.160
They were all interested in what Al-Qaeda was doing and wanted to share interesting

00:08:59.160 --> 00:09:04.160
links with each other about it. They formed a group and called themselves the 7-Seas Global

00:09:04.160 --> 00:09:09.080
Intelligence Security Team to represent their seven members from seven different countries.

00:09:09.080 --> 00:09:12.160
The group would get together online and share interesting news articles

00:09:12.160 --> 00:09:16.960
or forum posts from within more underground forums. Some of the members spoke Arabic and

00:09:16.960 --> 00:09:21.320
could spot things easier. This introduced Shannen to some deeper conversations that

00:09:21.320 --> 00:09:27.480
were happening around Islamic extremism. These chatrooms and forum posts were often in Arabic,

00:09:27.480 --> 00:09:31.840
and Shannen, being from Montana, did not speak Arabic, but she wanted to speak it

00:09:31.840 --> 00:09:36.200
so she could research all this better. She really wanted to understand their culture,

00:09:36.200 --> 00:09:41.760
so she started learning little bits of Arabic here and there, at least how to read it. Now,

00:09:41.760 --> 00:09:45.600
even though she was teaming up with the 7-Seas group to share information,

00:09:45.600 --> 00:09:51.320
she’d often stray off on her own like a lone wolf. She’d explore a lot on her own without telling

00:09:51.320 --> 00:09:55.880
the group what she found or what she was up to, and she also wasn’t entirely upfront with Randy,

00:09:55.880 --> 00:10:00.720
her husband, about what she was doing online, too. He knew she was interested in this, but he

00:10:00.720 --> 00:10:06.080
didn’t really know how obsessed she was with it. Every now and then she’d find a forum post or a

00:10:06.080 --> 00:10:10.720
person in a chatroom who would just give her the shivers. When people are chatting online, it’s

00:10:10.720 --> 00:10:15.080
hard to know when to take them seriously. People joke around a lot. There are trolls everywhere.

00:10:15.080 --> 00:10:20.680
But Shannen could sense when someone was being serious and would sometimes see a post that

00:10:20.680 --> 00:10:27.760
looked threatening. Like, a person might actually be in danger from this post, right? This person

00:10:27.760 --> 00:10:33.840
posting it might be really dangerous and try to hurt someone. What do you do about that? This

00:10:33.840 --> 00:10:40.000
really bothered her. She never forgot about the lives lost in 9/11. As a proud American, Al-Qaeda

00:10:40.000 --> 00:10:46.960
seemed to be her enemy now, too. But at the same time, she was like a moth drawn to the flame.

00:10:46.960 --> 00:10:52.600
You know the saying; keep your friends close but your enemies closer. [MUSIC] She was realizing her

00:10:52.600 --> 00:10:59.800
enemies were right there on the other side of her screen. The internet is a way to bring everyone

00:10:59.800 --> 00:11:05.040
closer to each other. These enemies weren’t in some faraway land or in a cave. They were right

00:11:05.040 --> 00:11:12.920
there in her little computer room, downstairs in her computer. That proximity intrigued her to no

00:11:12.920 --> 00:11:19.760
end. She wanted to talk with them, and they were right there. With them being so close,

00:11:19.760 --> 00:11:25.600
she got to talk with them. But it’s strange, you know? Like, what is she gonna say? Hey, listen up,

00:11:25.600 --> 00:11:29.480
you punks. I’m a respected judge, a mother of three, proud citizen of the United States,

00:11:29.480 --> 00:11:35.400
and I don’t like the tone of your voice. No, she knew that being herself in this situation would

00:11:35.400 --> 00:11:43.240
get her nowhere. Her IRL status had no power here. But on the internet, you can be anyone.

00:11:43.240 --> 00:11:50.720
So, to get closer to her enemies, she knew she had to be someone she wasn’t. Now, I want to imagine

00:11:50.720 --> 00:11:55.840
she disguised herself up by throwing on some camouflage clothes and covering herself in mud,

00:11:55.840 --> 00:12:01.520
but in reality she just picked a username and registered on the forum or chatroom and acted

00:12:01.520 --> 00:12:07.000
like an Islamic extremist herself, one of them. But it’s actually more complicated

00:12:07.000 --> 00:12:10.760
than that. Keep in mind, she had been lurking on these forums and chatrooms for months now,

00:12:10.760 --> 00:12:15.880
and she was analyzing hundreds of posts, thousands of messages, and was getting fairly well-versed in

00:12:15.880 --> 00:12:20.960
Arabic. She could understand some conversations without needing to run it through a translator.

00:12:20.960 --> 00:12:25.600
This let her pick up on little nuances such as how people talk or when they talk,

00:12:25.600 --> 00:12:32.200
and certain quotes that people often use. Shannen tried to fit in by talking like them, mimicking

00:12:32.200 --> 00:12:37.760
their traits. These individuals typically held extreme views of Islam. Some were claiming to

00:12:37.760 --> 00:12:43.400
be members of Al-Qaeda or supportive of them, and they were justifying and planning violence

00:12:43.400 --> 00:12:50.040
against Western countries. Shannen is such an interesting character. I’ve e-mailed her a few

00:12:50.040 --> 00:12:58.920
times asking for an interview, but sadly she died before I was able to get her on the show. However,

00:12:58.920 --> 00:13:05.520
the podcast SpyCast did an interview with her back in 2011, and here she is explaining what she did.

00:13:05.520 --> 00:13:09.680
SHANNEN: Well, one of the things I’ve got is I have notebook after notebook after notebook,

00:13:09.680 --> 00:13:13.720
and they’re all dated in chronology for the different things that I’m doing at the time. So,

00:13:13.720 --> 00:13:19.280
they’re my records. They’re my records of the identities I use, that I create, that has the

00:13:19.280 --> 00:13:25.760
different backgrounds as far as their cultural, their tribal, their clan, any of their — anything

00:13:25.760 --> 00:13:31.840
that I need to make that individual identity have all the appearances of being a real person

00:13:31.840 --> 00:13:35.180
sitting behind a computer screen in whatever part of the world I’m purporting to be from.

00:13:35.180 --> 00:13:39.640
JACK: She was pretty meticulous at building believable personas to act like in these

00:13:39.640 --> 00:13:45.640
areas of the internet, building backstories and keeping records of who this person is. She looked

00:13:45.640 --> 00:13:49.960
up how to hide her IP address so it didn’t look like she was connecting to these sites from her

00:13:49.960 --> 00:13:54.960
Montana home. She learned what a proxy was and how to connect to one and appear to be coming

00:13:54.960 --> 00:14:00.520
from Canada. So, Shannen made sure that when she was online, her virtual location matched up

00:14:00.520 --> 00:14:04.960
with the fake identity that she was using on the forums. She knew she was going into the belly of

00:14:04.960 --> 00:14:11.320
the beast, and wanted to be extra careful so that her family would be safe. But here’s the thing;

00:14:11.320 --> 00:14:16.280
in the wild world of the internet, you don’t have those usual cues to tell if someone is

00:14:16.280 --> 00:14:21.720
lying or not, no facial expresions, no tone of voice. It’s just words, black and white on

00:14:21.720 --> 00:14:26.720
a screen. That just makes everything way more complicated. It might sound fairly easy now,

00:14:26.720 --> 00:14:31.200
but back then, not many people were making up fake personas and connecting through proxies

00:14:31.200 --> 00:14:37.800
to infiltrate a terrorist group. Shannen was doing stuff on her own, treading new and shaky

00:14:37.800 --> 00:14:43.880
ground. She was entering a dark and dangerous part of the internet, and she was well aware

00:14:43.880 --> 00:14:48.600
that what she was doing wasn’t exactly the safest bet, but she couldn’t help herself.

00:14:48.600 --> 00:14:56.680
[MUSIC] Once she took that leap, there was no turning back. One person who became very

00:14:56.680 --> 00:15:01.520
interesting to Shannen was a guy who went by the username Abu Khadija. Now,

00:15:01.520 --> 00:15:08.160
he was a person who had a history of terrorist activity. She found him online and saw he was

00:15:08.160 --> 00:15:15.280
actively contributing to the Jihad Encyclopedia, and she discovered he was connected to Abu Hamza.

00:15:15.280 --> 00:15:21.080
He was an Islamic preacher who wore a prosthetic hook on his left arm. He was involved in all sorts

00:15:21.080 --> 00:15:27.840
of suspicious terrorist activities in the UK and the US. Shannen discovered that Abu Khadija’s real

00:15:27.840 --> 00:15:35.840
name was Oussama Abdullah Kassir. He was known and respected in this online community that she

00:15:35.840 --> 00:15:41.040
wanted to be involved with. So, she wanted to get connected with him because maybe if he trusted

00:15:41.040 --> 00:15:46.200
her, she could get some information that was useful. She wasn’t exactly sure, but thought to

00:15:46.200 --> 00:15:53.120
try. So, Shannen made a plan to get closer to this Kassir guy. Shannen created an online persona,

00:15:53.120 --> 00:15:59.240
calling herself Abu Zeida. It’s common for jihadists and Al-Qaeda members to use fake names,

00:15:59.240 --> 00:16:03.480
and this one fit right in. She pretended that she was a recruiter for a new group

00:16:03.480 --> 00:16:10.160
of Islamic guerilla fighters based in Canada. Now Shannen, acting as Abu Zeida, was able to attract

00:16:10.160 --> 00:16:15.000
Kassir with her posts. They started e-mailing each other, but she was like, oh, no, shh;

00:16:15.000 --> 00:16:21.080
don’t talk here. It’s not safe. E-mail leaves a record. Let’s move our chats to a safer place,

00:16:21.080 --> 00:16:26.280
one where we can delete the messages as soon as they’re read. Kassir was interested.

00:16:26.280 --> 00:16:30.840
Shannen suggested that they set up an e-mail account that they both could access,

00:16:30.840 --> 00:16:35.480
and to send messages to one another, one of them could start an e-mail and just leave it in the

00:16:35.480 --> 00:16:41.080
drafts folder unsent, and then the other one can log in, see the message, read it,

00:16:41.080 --> 00:16:48.360
and then delete it. Poof, no trace of the message anywhere. Kassir not only agreed to this idea,

00:16:48.360 --> 00:16:55.360
but actually gave her his username and password to his e-mail. He said, hey, just leave draft

00:16:55.360 --> 00:17:00.600
messages in my inbox and I’ll read them and delete them as soon as I see them. She was

00:17:00.600 --> 00:17:08.200
astonished that he gave her his password. I can only imagine she must have cheered. Yeah! I mean,

00:17:08.200 --> 00:17:16.000
yeah, okay, we’ll use your e-mail. Her husband Randy had no idea she was doing any of this. So,

00:17:16.000 --> 00:17:20.680
Shannen started chatting back and forth with Kassir from within his drafts folder. [MUSIC] But

00:17:20.680 --> 00:17:26.120
at the same time, she could see every e-mail coming and going from his inbox.

00:17:26.120 --> 00:17:31.880
It was unbelievable for her. She was saving everything she could. She just infiltrated an

00:17:31.880 --> 00:17:37.960
Islamic extremist influencer’s e-mail account. Unreal. She kept this going, chatting with him

00:17:37.960 --> 00:17:43.440
covertly but then snooping on his e-mails, but she really wasn’t finding anything incriminating

00:17:43.440 --> 00:17:49.960
on him. There was no smoking gun of things he’s done or plans to conduct more terrorist actions,

00:17:49.960 --> 00:17:55.600
but he was contributing to the Jihadist Encyclopedia, and extremists respected him.

00:17:55.600 --> 00:18:02.480
So she thought maybe he could still be useful somehow, and kept him close. [MUSIC] By 2003,

00:18:02.480 --> 00:18:06.600
she had created a number of fake personas on these forums and chatrooms. She was still

00:18:06.600 --> 00:18:12.280
using that Abu Zeida persona from time to time, building up its history and credibility. One of

00:18:12.280 --> 00:18:16.720
the things she tried to do with it is get it associated with the Army of the Righteous,

00:18:16.720 --> 00:18:22.880
or in Arabic it’s called ‘Lashkar-e-Taiba’. This is a known jihadist militant organization. She

00:18:22.880 --> 00:18:28.480
figured if she could get Abu Zeida in the Army of the Righteous, she might be able to get info

00:18:28.480 --> 00:18:33.560
on what the next terrorist attack might be. So, when Army of the Righteous would do some

00:18:33.560 --> 00:18:38.160
terrorist attack, she’d just claim that she was part of it and she was there for it or helped out

00:18:38.160 --> 00:18:44.960
in some way. Or I should say, her made-up persona Abu Zeida was claiming to be part of it. She kept

00:18:44.960 --> 00:18:50.360
up her relationship with Kassir. So, all this was building up her social credit in this community.

00:18:50.360 --> 00:18:55.880
So, with this persona being more established, she was ready to take things a step further. She

00:18:55.880 --> 00:19:02.120
wanted people to tell her things, incriminating things. What she really wanted to do was stop the

00:19:02.120 --> 00:19:09.120
next terrorist attack or find info on someone that could lead to an arrest. So, she really wanted

00:19:09.120 --> 00:19:15.640
someone to share with her a plan or admit to something they’ve done so she could take action.

00:19:15.640 --> 00:19:20.440
But it’s hard to know if someone is telling the truth online. There’s a lot of noise and it’s

00:19:20.440 --> 00:19:25.800
hard to find the signal. She also didn’t want to encourage anyone to do anything,

00:19:25.800 --> 00:19:31.880
so it became a really tricky dance, chatting with everyone to try to get the right information.

00:19:31.880 --> 00:19:37.640
Shannen had a distinct advantage here; she was a court judge and she knew the law. Ultimately

00:19:37.640 --> 00:19:42.760
she wanted a prosecution, charges, and potential convictions against people who were planning on

00:19:42.760 --> 00:19:48.040
violence and death. She knew if this ever went to trial, the way she obtained the information

00:19:48.040 --> 00:19:53.840
needed to be legal, and she needed to absolutely make sure that she didn’t stray into entrapment.

00:19:53.840 --> 00:20:00.960
She got a plan on how to navigate this dark part of the internet. [MUSIC] It was a pretty

00:20:00.960 --> 00:20:07.360
elaborate plan and she needed help to do it, so she turned back to her group, the 7-Seas,

00:20:07.360 --> 00:20:13.160
and looks for help there. One member of the 7-Seas group that she got on well with was a guy named

00:20:13.160 --> 00:20:19.640
Brent Ashley. He was based in Ontario, Canada, and was a nuclear physicist and a software developer.

00:20:19.640 --> 00:20:24.800
They both had similar opinions that these terror groups should be stopped. He, too, thought that

00:20:24.800 --> 00:20:29.560
working online together could enable them to spot patterns, maybe uncover possible threats,

00:20:29.560 --> 00:20:33.760
and then warn the authorities who could step in and stop more horrible things from happening.

00:20:33.760 --> 00:20:38.760
So, between them, they came up with a plan utilizing Brent’s software developer skills.

00:20:38.760 --> 00:20:43.840
They called it Operation Whirlpool, and this is how it worked. The plan was to put some

00:20:43.840 --> 00:20:49.500
malware on a potential terrorist’s computer, a key-logger, something that watched every key

00:20:49.500 --> 00:20:54.160
stroke that the target typed and reported back everything to Shannen and Brent. They

00:20:54.160 --> 00:20:57.440
could disguise it to look like a document where you needed to open it to read it,

00:20:57.440 --> 00:21:01.760
right? But it was really an executable program and once triggered, the key-logger would then

00:21:01.760 --> 00:21:06.120
run silently in the background, recording everything and uploading it. The user would

00:21:06.120 --> 00:21:11.320
see the document and be unaware that there’s malware still running. They were hoping this

00:21:11.320 --> 00:21:17.920
might get them chat logs or private messages that could be incriminating evidence. But yeah, I mean,

00:21:17.920 --> 00:21:23.080
this is snooping 2003-style, but still, it’s snooping, and they had to be careful because

00:21:23.080 --> 00:21:29.040
she was a sitting US judge. If she somehow put her malware on another American’s computer

00:21:29.040 --> 00:21:35.160
who was not a terrorist, it could be the end of her career. So, she wanted to try to only

00:21:35.160 --> 00:21:41.680
target non-Americans. So, Brent finished up this little spy program, and together they started

00:21:41.680 --> 00:21:48.360
thinking up ways on how to get it onto a target’s computer. The answer, Shannen thought, was simple.

00:21:48.360 --> 00:21:54.080
Self-training manuals were real popular with radical Islamists. The Jihadist Encyclopedia is

00:21:54.080 --> 00:21:59.280
a huge document, like over 8,000 pages huge, and there are chapters on everything from explosives

00:21:59.280 --> 00:22:04.240
to tactics to weapons and close fighting. It was something these guys followed and referred to a

00:22:04.240 --> 00:22:11.320
lot. So, Shannen and Brent decided to add this program to the encyclopedia. They packaged it up,

00:22:11.320 --> 00:22:17.040
nestled neatly inside a zip file, and called it something interesting to entice people to open it,

00:22:17.040 --> 00:22:24.840
then uploaded it to the Jihad Encyclopedia and waited. [MUSIC] They needed a victim to come

00:22:24.840 --> 00:22:29.760
and get it from the encyclopedia and open the zip file and run the program. Then they

00:22:29.760 --> 00:22:35.240
could see everything that person typed on their computer. Operation Whirlpool was underway. The

00:22:35.240 --> 00:22:42.360
eagle has left the nest. She started thinking about how she could get people to download,

00:22:42.360 --> 00:22:48.120
but just putting it up there didn’t quite attract anyone to grab it and look at it, so she needed

00:22:48.120 --> 00:22:53.640
to come up with ways to get people to download it specifically and run it. She thought about using

00:22:53.640 --> 00:22:58.920
her fake identity, Abu Zeida, to somehow trick someone to go download the malware and run it,

00:22:58.920 --> 00:23:07.880
but she didn’t want this to backfire and maybe it resulted in her being discovered and her identity is burned. She wanted to be extra sneaky here.

00:23:07.880 --> 00:23:12.560
Then she remembered her friend Kassir. He was respected in that community and was a regular

00:23:12.560 --> 00:23:18.960
contributor to the Jihad Encyclopedia. Kassir is influential enough to get people, many people,

00:23:18.960 --> 00:23:25.640
to download this file. She had full access to his e-mail, but didn’t have access to

00:23:25.640 --> 00:23:31.200
his account on the radical Islamic forum. She was watching him for months on how he acted on

00:23:31.200 --> 00:23:40.360
the forums. [MUSIC] Shannen decided to act like Kassir. She created a new username on the forum,

00:23:40.360 --> 00:23:46.640
same as Kassir’s, but with a 1 instead of the I. It was one letter off, and she did that in

00:23:46.640 --> 00:23:52.120
hopes that nobody would notice. Then she dressed up the user profile to look just like Kassir,

00:23:52.120 --> 00:23:58.560
and of course she did all this through a proxy. Shannen posted as Kassir with a 1 in three of

00:23:58.560 --> 00:24:04.440
the most popular forums. She simply said that the explosives manual inside the encyclopedia

00:24:04.440 --> 00:24:10.400
has been updated and attached is the updated version. People didn’t notice the difference

00:24:10.400 --> 00:24:15.800
in screen names. The ruse was working. Users were clicking and downloading it,

00:24:15.800 --> 00:24:20.720
trusting it because it appeared to be coming from Kassir, a trusted figure in the community.

00:24:20.720 --> 00:24:26.440
Operation Whirlpool was working. Now, I don’t know where the real Kassir was at this point,

00:24:26.440 --> 00:24:31.240
because he kinda went quiet around the same time. Abu Hanza was getting into trouble,

00:24:31.240 --> 00:24:35.560
and it might have spooked Kassir to just lay low for a while. So, he wasn’t even around

00:24:35.560 --> 00:24:41.160
to have noticed this or to warn people, and that worked very well for Shannen and Brent.

00:24:41.160 --> 00:24:45.720
The software Brent wrote recorded key strokes, e-mail addresses, password information,

00:24:45.720 --> 00:24:49.560
and that information could be used to see what those people were doing on their machines when

00:24:49.560 --> 00:24:55.040
there was no one looking. So, the two of them were watching the view count of the post go up and the

00:24:55.040 --> 00:24:59.840
download count on their file go up, and they were just waiting to see if anyone would install the

00:24:59.840 --> 00:25:04.720
program. Brent had it set up so all the data from the target’s machine would be uploaded straight

00:25:04.720 --> 00:25:10.280
into Brent’s database so they could see what was happening. It was a clever little app. So,

00:25:10.280 --> 00:25:16.720
they watched the database, waiting for activity. [MUSIC] Suddenly, something showed up. They

00:25:16.720 --> 00:25:21.520
snagged someone. Data was showing up in the database, and more data started showing up. Their

00:25:21.520 --> 00:25:27.560
malware was being installed on a few computers. It was working. But now they had to start sorting

00:25:27.560 --> 00:25:32.000
through this data that was coming in. They were seeing passwords and usernames and had to figure

00:25:32.000 --> 00:25:36.400
out what site was this even for, and more stuff was coming in as they were trying to sort it.

00:25:36.400 --> 00:25:41.640
Soon they were overwhelmed with data. Every keystroke was sent to them, and they could see

00:25:41.640 --> 00:25:46.600
half of every chat, e-mail, forum message, even Google searches or video games commands. It was

00:25:46.600 --> 00:25:53.720
an eye-opening view into who the readers of the Jihadist Encyclopedia were. One guy they started

00:25:53.720 --> 00:26:01.040
watching stood out. He went by the name of Samir. He had really captured Shannen’s attention. Brent

00:26:01.040 --> 00:26:05.640
had a way to deactivate the malware on victim’s computers, and they wanted to focus on Samir.

00:26:05.640 --> 00:26:09.960
So, he disabled the key-logger on everyone else’s computer just so they could look at

00:26:09.960 --> 00:26:14.920
what Samir was doing. [MUSIC] Samir was a Sunni Muslim of Palestinian descent,

00:26:14.920 --> 00:26:20.640
and he was a respected TV journalist known for his work at Al Jazeera and Abu Dhabi TV, too. He

00:26:20.640 --> 00:26:28.800
even interviewed Osama Bin Laden in 1998. But what intrigued Shannen about him is he appeared to have

00:26:28.800 --> 00:26:36.360
quite a lot of information about Al-Qaeda. Was he connected to them in some way? It wasn’t clear,

00:26:36.360 --> 00:26:44.760
but she was suspicious that Samir might be working for her enemy, and he might known Osama Bin Laden.

00:26:44.760 --> 00:26:52.480
The whole US military is looking for Osama, so she was definitely glued to Samir for almost a year,

00:26:52.480 --> 00:26:58.200
intercepting and translating his communications. It was a lot of work. At the same time,

00:26:58.200 --> 00:27:04.840
Shannen starts talking with this guy named Ayad Yolcu. He seemed to know people who conducted the

00:27:04.840 --> 00:27:12.400
9/11 attacks. By this point, since Kassir is still quiet, she can keep up using his username on the

00:27:12.400 --> 00:27:19.320
forum. Nobody had noticed there was a 1 instead of an I, so she just kept posting as Kassir,

00:27:19.320 --> 00:27:25.800
drawing in certain people and having private chats with this lookalike account. She starts messaging

00:27:25.800 --> 00:27:32.240
this Ayad guy as Kassir, and it was working quite well. It also helped that she could confirm that

00:27:32.240 --> 00:27:38.680
she really was Kassir because she had access to his e-mail. After gaining some trust with Ayad,

00:27:38.680 --> 00:27:43.640
she sent him the malware that Brent made and asked him to take a look at it and open it,

00:27:43.640 --> 00:27:49.000
and he did. He installed the key-logger on his computer, and now she could see what

00:27:49.000 --> 00:27:54.520
he was typing and every little thing he did on his computer. Keep in mind, Shannen had

00:27:54.520 --> 00:28:00.360
to play multiple characters, and this meant choosing her words very slowly and carefully.

00:28:00.360 --> 00:28:06.600
SHANNEN: Since 9/11, I took on the task of learning the Arabic language, and it’s still

00:28:06.600 --> 00:28:13.080
an ongoing process, but it’s fascinating. I just absolutely love it, and it’s a challenge. As a

00:28:13.080 --> 00:28:18.440
female, of course the identities that I’ve created and operated under in the various

00:28:18.440 --> 00:28:23.120
different internet sites over the years, they’re in — they’re as males, as radicalized jihadist

00:28:23.120 --> 00:28:29.440
males. So, obviously I couldn’t speak, couldn’t get on and be chatting verbally with any of these

00:28:29.440 --> 00:28:35.480
people. So, everything I’ve done has been either in writing and translating and reading, which has

00:28:35.480 --> 00:28:42.520
served me well because not being a native speaker or having had a whole host of different formal

00:28:42.520 --> 00:28:50.560
training — I have had intense language training, but that being able to just read it and write it,

00:28:50.560 --> 00:28:56.160
take my time in constructing my replies and what I want to say and how I want to proceed with any

00:28:56.160 --> 00:29:02.360
given communication stream that I’m working in, it’s worked out well that — the fact that I don’t

00:29:02.360 --> 00:29:07.100
need to speak it because frankly, who would I speak with? They wouldn’t speak to me, so…

00:29:07.100 --> 00:29:12.560
JACK: She sat at her computer downstairs in the computer room in rural Montana watching

00:29:12.560 --> 00:29:17.040
all the messages coming in, seeing what people were typing. She was trying to

00:29:17.040 --> 00:29:21.360
put all these pieces together, but it was a lot of work. She was looking for any intent

00:29:21.360 --> 00:29:26.000
to harm so she could act on that. There was certainly a lot of data here now,

00:29:26.000 --> 00:29:30.760
and it was just a matter of finding the right stuff. Obviously things people say in private

00:29:30.760 --> 00:29:35.560
is a lot more serious than whatever they post publicly or in chatrooms. While Operation

00:29:35.560 --> 00:29:39.880
Whirlpool hummed along, Shannen was still wandering around these chatrooms and forums,

00:29:39.880 --> 00:29:47.280
and one board was called Brave Muslims. It usually buzzed in Arabic, but in October 2003, she spotted

00:29:47.280 --> 00:29:55.240
a new post in English. [MUSIC] It stood out. The user said their name was Amir Abdul Rashid,

00:29:55.240 --> 00:30:02.400
and he was hinting at ties to Al-Qaeda and that he was making big plans. The ‘big plans’ part

00:30:02.400 --> 00:30:09.160
was suspicious to her. Shannen was very curious about him. He said that he was their brother from

00:30:09.160 --> 00:30:15.520
the far side of the world, but he would be closer to them soon. The more Rashid’s message evolved,

00:30:15.520 --> 00:30:20.640
the more uneasy she got. He was going on talking about defecting to the other side.

00:30:20.640 --> 00:30:27.000
Shannen felt something serious in his tone, so she replies to him saying his plans sound interesting.

00:30:27.000 --> 00:30:31.480
By this point her personas were pretty well-established, and it made it easy for him

00:30:31.480 --> 00:30:37.520
to believe her. She was posing as a recruiter and organizer for Al-Qaeda. She used an authoritative

00:30:37.520 --> 00:30:43.280
tone and tells him to contact her for an order on how to move forward. Rashid was quick off

00:30:43.280 --> 00:30:48.080
the mark. He was excited to be contacted by an Al-Qaeda recruiter and was eager to get things

00:30:48.080 --> 00:30:55.160
moving. He took Shannen’s bait, hook, line, and sinker. He says he’s about to enter the warzone

00:30:55.160 --> 00:31:00.360
and will be bearing the arms of the enemy. He’s just converted to Islam and is very against the

00:31:00.360 --> 00:31:05.640
war in Iraq which had kicked off in March that year, but he needs cash to get his genius plan

00:31:05.640 --> 00:31:11.480
off the ground. Shannen asks for more information, and what he tells her makes her blood run cold.

00:31:11.480 --> 00:31:18.560
[MUSIC] This guy Rashid was a US citizen and an active member of the US Army National Guard’s 81st

00:31:18.560 --> 00:31:27.240
Brigade. Someone in the US military is planning a terrorist strike? Against what? Who? When? Oh,

00:31:27.240 --> 00:31:32.320
this is not good, she thought. She does some more sleuthing on him and figures out his IP address

00:31:32.320 --> 00:31:39.600
and e-mail address, and from there she’s able to discover that Rashid’s real name is Ryan Anderson.

00:31:39.600 --> 00:31:44.200
He’s twenty-six years old and stationed at Fort Lewis in Washington State, just

00:31:44.200 --> 00:31:50.560
outside Tacoma. All her internal alarm bells were ringing. This was what she was working towards,

00:31:50.560 --> 00:31:56.040
but she needed to remain calm and know for certain that he’s planning something serious. So,

00:31:56.040 --> 00:32:02.080
she keeps the conversation going. She learned that his brigade was going to deploy to Iraq in

00:32:02.080 --> 00:32:08.000
a few months. When he said he would be with them soon, he wasn’t joking. She talks with him more

00:32:08.000 --> 00:32:13.280
and more, recording all the conversations. He said he liked guns and was a master army

00:32:13.280 --> 00:32:20.720
sniper with exceptional skills. While all this seemed very urgent, Shannen also knew it’s

00:32:20.720 --> 00:32:28.320
very delicate, so she played it very slow and methodical. She didn’t want to scare him off.

00:32:28.320 --> 00:32:38.960
She continues talking with him for two whole months, gaining more trust, gaining more information. Here, I’ll let Shannen explain how it all happened.

00:32:38.960 --> 00:32:44.320
SHANNEN: He stumbled into an Arabic site speaking English, so immediately he caught my

00:32:44.320 --> 00:32:48.840
eye. I’m thinking, well, we’re speaking Arabic here. Who’s this guy speaking English? So,

00:32:48.840 --> 00:32:53.320
one of the first things I always do is I go to and try and determine where their IP address might

00:32:53.320 --> 00:32:58.960
lead me, whether it appears as though there’s any other proxy elements in it. As it turned out,

00:32:58.960 --> 00:33:06.560
he traced right into Seattle. I had him within a two-to-four-block area radius in Seattle. As

00:33:06.560 --> 00:33:13.440
I — the further I looked, it appeared that he was in the National Guard and — anyway,

00:33:13.440 --> 00:33:19.760
as it turned out, he had converted to Islam after 9/11 and had, since that time,

00:33:19.760 --> 00:33:25.200
been seeking and becoming more radicalized. What he was trying to do was he wanted to

00:33:25.200 --> 00:33:29.960
defect to Al-Qaeda. He was offering up his role as a tank commander,

00:33:29.960 --> 00:33:35.320
the classified specs of the Abrams tanks, as well as troop locations and other things

00:33:35.320 --> 00:33:41.560
that he was continuing to provide me in order to continue to prove his salt or his worth to

00:33:41.560 --> 00:33:45.640
whom he believed to be an Al-Qaeda operative, which was the identity I was operating under.

00:33:45.640 --> 00:33:50.720
JACK: Shannen eventually had enough information to contact the feds. She goes to Homeland Security

00:33:50.720 --> 00:33:55.120
thinking they’ll know exactly what to do, but they don’t take her seriously. She tries to

00:33:55.120 --> 00:34:00.800
show them evidence, but they’re just like, eh, go show it to the FBI. She’s torn because she

00:34:00.800 --> 00:34:05.280
didn’t want to admit that she was the one that infiltrated these forums herself and was getting

00:34:05.280 --> 00:34:10.120
all this information because of the malware that she planted on different jihadist’s computers. So,

00:34:10.120 --> 00:34:15.880
she felt confused about how much to say. Most importantly, she didn’t want her online

00:34:15.880 --> 00:34:22.240
identity to get tangled up with her real life as a Montana mom and a judge. She drove sixty miles

00:34:22.240 --> 00:34:27.880
into Great Falls to meet with an FBI agent in the regional offices, determined for them to hear her

00:34:27.880 --> 00:34:32.520
out. She told them everything, admitting to everything she did to get this information,

00:34:32.520 --> 00:34:39.960
in full detail. For every word she told them, the air got thicker. [MUSIC] The FBI was listening to

00:34:39.960 --> 00:34:45.520
her. The FBI took her evidence and sprang into action. They called the army missile base a few

00:34:45.520 --> 00:34:49.800
miles down the road, and they had an intelligence officer who wanted to hear more from Shannen,

00:34:49.800 --> 00:34:54.040
so she had to go and brief the intelligence officer on the situation. She was kind of

00:34:54.040 --> 00:35:00.160
relieved to hand all this over. She knew she was in over her depths. Ryan Anderson needed to be

00:35:00.160 --> 00:35:05.360
stopped or at least looked into, and these were the people who could do it properly.

00:35:05.360 --> 00:35:11.040
She handed it all over and drove back home to let them deal with it. But a few days later,

00:35:11.040 --> 00:35:17.200
the FBI calls her back and they had a plan. The FBI wanted to pose as an Al-Qaeda member and

00:35:17.200 --> 00:35:22.680
meet with Ryan Anderson to see if they could get him to admit his plan to them firsthand,

00:35:22.680 --> 00:35:27.680
but they weren’t quite ready. The FBI needed to prep more to make this sting happen,

00:35:27.680 --> 00:35:31.560
so they told Shannen to keep chatting with him and keep him close and keep an eye on him, see

00:35:31.560 --> 00:35:37.080
what he’s up to, and they also wanted her to set up the meeting with him and the FBI. After all,

00:35:37.080 --> 00:35:42.400
she was posing as the Al-Qaeda recruiter, and she would be in a great position to tell Ryan

00:35:42.400 --> 00:35:48.760
about this meeting with another Al-Qaeda member. The FBI in Montana contacted the FBI in Seattle,

00:35:48.760 --> 00:35:52.680
and they got in touch with the Army Intelligence Agency in Fort Hood, Texas,

00:35:52.680 --> 00:35:58.560
to discuss the plan. Ryan was over in Seattle, totally oblivious to all this FBI stuff that was

00:35:58.560 --> 00:36:03.440
going on about him. He was starting to get jumpy, though. When Shannen told him about the meeting,

00:36:03.440 --> 00:36:08.640
he was excited. As the meeting drew closer, his excitement got bigger. He was getting antsy. He

00:36:08.640 --> 00:36:12.520
wanted the meeting to happen sooner than what was planned, and he really wanted to meet with

00:36:12.520 --> 00:36:17.840
someone from Al-Qaeda in Seattle before he got deployed to Iraq. So, he starts putting

00:36:17.840 --> 00:36:22.760
pressure on Shannen to make it happen quicker, and she has to stall so that the FBI and the

00:36:22.760 --> 00:36:27.600
army intelligence can get ready for the sting. Ryan’s paranoia started to creep up on him.

00:36:27.600 --> 00:36:32.680
An upcoming meeting with Al-Qaeda can do that to you. He starts getting worried that someone

00:36:32.680 --> 00:36:39.520
is gonna find out about all this, so he tells Shannen, listen, we need to be safe with this.

00:36:39.520 --> 00:36:45.120
I don’t want to get caught. So, what we should do is create fake names and use that from now

00:36:45.120 --> 00:36:51.040
on. She’s like, oh, okay, that’s a good idea. He’s like, yeah, but let’s not just use fake

00:36:51.040 --> 00:36:56.080
names. Let’s create this whole backstory for each other so it seems like it’s perfectly

00:36:56.080 --> 00:37:00.520
fine that we’d be having these conversations, and we’ll use code words for certain things,

00:37:00.520 --> 00:37:05.760
too. She’s like, oh, wow, you really want to be safe and really thought this through. Okay,

00:37:05.760 --> 00:37:09.760
great. Yeah, I’m on board. Now, by this time, Shannen was a master at wearing all

00:37:09.760 --> 00:37:14.600
these fake personas online, so this was just another page in her notebook. So,

00:37:14.600 --> 00:37:19.200
they start pretending that they’re old friends from college just chatting over e-mail. Shannen

00:37:19.200 --> 00:37:26.040
becomes George and Ryan Anderson starts calling himself Andy. He just doesn’t realize that he’s

00:37:26.040 --> 00:37:33.560
trying to hide in a shrinking fish bowl. Shannen is now leading a crazy double life. She’s a mother

00:37:33.560 --> 00:37:38.120
and a wife and a court judge, and these are some important duties, but on the other side,

00:37:38.120 --> 00:37:42.960
she’s trying to thwart terror attacks, conducting counter-terrorism operations that she’s just doing

00:37:42.960 --> 00:37:48.240
all by herself by infiltrating forums and chatrooms, acting like a jihadist.

00:37:48.240 --> 00:37:54.200
What takes priority here? She’s trying to fit her online life in and around her real life, switching

00:37:54.200 --> 00:37:59.720
back and forth between personas, and during this time, she still wasn’t telling her husband Randy

00:37:59.720 --> 00:38:04.200
about all her online crusades. She was waking up early before everyone else was getting up,

00:38:04.200 --> 00:38:09.680
and she’d go downstairs into the computer room and do all this on her own. She had notebooks

00:38:09.680 --> 00:38:15.720
and notebooks of secrets. Ryan Anderson — well, I guess he was calling himself Andy now; he kept

00:38:15.720 --> 00:38:21.240
saying he had a big plan, but he wasn’t telling Shannen what it was, which she suspected was

00:38:21.240 --> 00:38:26.440
going to be a terrorist attack. He said he needed some cash to carry out his plan, but what was he

00:38:26.440 --> 00:38:32.200
gonna use the cash for? Shannen didn’t know. Maybe to buy explosives or weapons? She said she could

00:38:32.200 --> 00:38:37.240
send some cash, but he needed to give up more information first. She wanted more details of the

00:38:37.240 --> 00:38:43.480
plan. He talked a lot about his plan, about how effective it would be and how proud he was of it,

00:38:43.480 --> 00:38:48.080
but he was getting frustrated about how long it was taking to get going. So, Shannen kept using

00:38:48.080 --> 00:38:53.440
the cash as a lure to try to get him to admit the details of the plan, and it finally worked.

00:38:53.440 --> 00:38:58.800
He eventually gave in and started explaining his plan in detail. [MUSIC] In fact, he was so excited

00:38:58.800 --> 00:39:03.920
about it, it just all came flooding out. He was talking weapons, tactics, and locations in Iraq,

00:39:03.920 --> 00:39:11.320
plus plans for the US Army tanks. Adding it all up, the plan was to kill US soldiers. It was

00:39:11.320 --> 00:39:18.600
elaborate and detailed and devastating. Ryan was planning on giving classified information

00:39:18.600 --> 00:39:23.920
to enemy forces, information that severely jeopardizes the safety of US soldiers once

00:39:23.920 --> 00:39:30.240
they’re in Iraq. He was clearly wanting to cause harm and chaos. He even went so far as to express

00:39:30.240 --> 00:39:36.280
how he’d hurt anyone who would try to stop him or capture him. All his rants and plans were quickly

00:39:36.280 --> 00:39:41.360
passed over to the FBI, and they knew they had to get this sting underway and arrest Ryan with

00:39:41.360 --> 00:39:47.720
firsthand evidence. So, the meeting was set up for January 3rd, 2004. Shannen told Ryan the FBI

00:39:47.720 --> 00:39:52.160
agent — or Al-Qaeda member — was ready to meet with him, and the location of the meeting was

00:39:52.160 --> 00:39:57.840
a Barnes and Noble bookstore in Seattle. The day of the meeting finally comes around. Ryan

00:39:57.840 --> 00:40:07.320
and the FBI agent both casually walk into the bookstore and act like shoppers browsing for books. They meet up and they chatted among the books.

00:40:07.320 --> 00:40:11.840
Little did Ryan know, hidden in the books were cameras and microphones,

00:40:11.840 --> 00:40:18.840
and it was recording their conversation. Ryan gave the agents scanned copies of his identification

00:40:18.840 --> 00:40:26.640
and a lot of classified information about US Army tanks and troop locations in Iraq. He had

00:40:26.640 --> 00:40:33.400
seriously incriminated himself. This information had the intention of getting US soldiers killed,

00:40:33.400 --> 00:40:38.640
but the agents didn’t arrest him on the spot. After all, his troop wasn’t deploying to Iraq yet,

00:40:38.640 --> 00:40:43.480
so there really wasn’t a rush just yet. Instead, they wanted to see if they could get even more

00:40:43.480 --> 00:40:47.480
information out of him, so they set up a second meeting to see what else he had to

00:40:47.480 --> 00:40:53.480
say. The next day, Shannen’s focus shifted back to Samir, the suspicious journalist that she had

00:40:53.480 --> 00:40:58.720
a key-logger installed on, and she saw that he was sending e-mails about some new base,

00:40:58.720 --> 00:41:04.360
a landing strip for transporting individuals to Pakistan for fighter training camps? Then

00:41:04.360 --> 00:41:09.800
an e-mail with a four-page Arabic attachment came in. She spent hours translating it,

00:41:09.800 --> 00:41:15.760
and it gave the details of where Taliban and Al-Qaeda units are stationed along the Afghan

00:41:15.760 --> 00:41:22.760
border. While Ryan had information about where US troops would be, Shannen now had information

00:41:22.760 --> 00:41:29.000
about where Al-Qaeda bases are being set up. It’s kind of wild that she gained this intel.

00:41:29.000 --> 00:41:33.720
So, she forwarded that to the FBI, confident that it was valuable information that the US military

00:41:33.720 --> 00:41:39.000
needed to know about, and she turned out to be right. US forces were able to use that intel for

00:41:39.000 --> 00:41:44.200
their advantage in Afghanistan. The FBI asked her to come to their offices, and she dropped

00:41:44.200 --> 00:41:49.240
everything and rushed over. The agents were ready to arrest Ryan, and she was excited. On

00:41:49.240 --> 00:41:55.840
February 12th, 2004, Ryan Anderson was arrested in Seattle. It was a joint operation with the FBI and

00:41:55.840 --> 00:42:01.440
the US Army intelligence. Ryan denied it all. He still thought his chats with Shannen were real,

00:42:01.440 --> 00:42:05.800
but as he saw the evidence come forward, he realized she was not who she said she

00:42:05.800 --> 00:42:13.520
was. He was now facing terrorism charges. Even though the FBI got firsthand evidence on him,

00:42:13.520 --> 00:42:18.640
Shannen was the star witness of the case. She’s the one who discovered him and collected tons of

00:42:18.640 --> 00:42:24.640
data on him. The FBI wanted Shannen to testify at his Article 32 hearing, which is kind of the

00:42:24.640 --> 00:42:28.760
equivalent of a grand jury. It’s there to figure out if there’s enough evidence to warrant a court

00:42:28.760 --> 00:42:34.000
martial. This is not something she wanted to do at all. She was afraid of doxxing herself,

00:42:34.000 --> 00:42:39.920
linking her online identity to her real life. The FBI said it would be a closed

00:42:39.920 --> 00:42:45.000
court. No one outside would know anything. Her identity and involvement would be protected.

00:42:45.000 --> 00:42:50.360
This assurance was the only thing that calmed her, but she knew she had to tell her husband what was

00:42:50.360 --> 00:42:58.320
going on, so she sits him down and tells him she’s been acting like Abu Zeida online. She has access

00:42:58.320 --> 00:43:03.080
to Kassir’s e-mails and has been impersonating him and has been planting malware on jihadists’

00:43:03.080 --> 00:43:09.560
computers, carrying on lengthy conversations with them, learning Arabic, and ultimately stopping an

00:43:09.560 --> 00:43:16.120
attack on US troops — and got someone arrested and is now a star witness. Randy was pretty

00:43:16.120 --> 00:43:23.320
stunned. She did all that? He was impressed, but he was concerned. The people she was infiltrating

00:43:23.320 --> 00:43:29.000
were obviously dangerous people, so he grew concerned for her safety and the family’s safety,

00:43:29.000 --> 00:43:33.880
and both really didn’t want their personal identities exposed in the case. On May 4th,

00:43:33.880 --> 00:43:40.720
2004, Shannen flew from Great Falls, Montana, to Seattle, and then drove south an hour to the

00:43:40.720 --> 00:43:46.480
Fort Lewis army base, and this is where the court case was being held. She was familiar with courts

00:43:46.480 --> 00:43:52.040
and she was a municipal judge, but she had never testified in court before. So, she was a little

00:43:52.040 --> 00:43:57.840
nervous, especially to face Ryan and to admit to him what she had done. Even though she felt

00:43:57.840 --> 00:44:02.180
good about her actions, it’s still nerve-wracking to have to face the person that you got arrested.

00:44:02.180 --> 00:44:08.000
[MUSIC] But while there, she discovered the media was setting up in the public gallery in court.

00:44:08.000 --> 00:44:13.160
They were gonna be taking notes during the case. Then she met with the prosecution team and she

00:44:13.160 --> 00:44:18.840
became even more uneasy. Even though she was their star witness, the lead prosecutor didn’t seem to

00:44:18.840 --> 00:44:23.520
like her. He made it pretty clear that protecting her identity was not something he was interested

00:44:23.520 --> 00:44:28.080
in. In fact, he felt that because she was a judge, it would add credence to her testimony. So,

00:44:28.080 --> 00:44:34.640
he wanted her to explain to the jury who she was online and offline. All this triggered her nerves.

00:44:34.640 --> 00:44:41.320
Like, whoa, hang on a minute; that’s my real name, address, job, everything. More than that,

00:44:41.320 --> 00:44:44.960
those fake identities that she had been using? Yeah, they were going to be exposed,

00:44:44.960 --> 00:44:50.600
too. The idea of exposing herself like that terrified her. On the stand, the judge agreed

00:44:50.600 --> 00:44:54.920
with the prosecutor that her real identity should be explained to the court. She was in

00:44:54.920 --> 00:45:00.480
a tough spot now. She did all this work and flew all this way to give testimony, and now the only

00:45:00.480 --> 00:45:08.200
way to testify is to dox herself. But what’s more important to her, bringing this man to justice or

00:45:08.200 --> 00:45:14.880
protecting herself? It all happened so fast, and she eventually told the court everything.

00:45:14.880 --> 00:45:22.720
The stenographer documented every last word, and the news outlets meticulously took notes. Within

00:45:22.720 --> 00:45:28.800
hours, her real name was on TV as the surprise witness in the case. The media printed her

00:45:28.800 --> 00:45:34.160
real name, undercover name, and e-mail addresses that she used to communicate with Ryan Anderson,

00:45:34.160 --> 00:45:39.720
which was actually Kassir’s e-mail address. All her details were exposed. Shannen and Randy’s

00:45:39.720 --> 00:45:44.640
worst fears were now a reality, with her real name out there as someone who’s been picking

00:45:44.640 --> 00:45:51.360
fights with jihadists online. What real-life consequences would that have? Well, her online

00:45:51.360 --> 00:45:57.840
presence was now blown. Kassir’s online name was abu kadaji[], and now his name and his alias were

00:45:57.840 --> 00:46:02.240
burned. Nobody would trust that name anymore, and they discovered the 1 in the name that she was

00:46:02.240 --> 00:46:06.960
using on the forum posts, too. It took years for her to build up these personas and to infiltrate

00:46:06.960 --> 00:46:12.440
these inner circles of Islamic extremism, and it all came crashing down after the testimony. The

00:46:12.440 --> 00:46:16.960
malware that she planted started to get discovered on target machines. Samir, the journalist who had

00:46:16.960 --> 00:46:21.680
all this insider information about what Al-Qaeda was doing, became aware of her and her attempts

00:46:21.680 --> 00:46:28.140
to spy on him. People were mad at her, very mad. Her situation became much more serious.

00:46:28.140 --> 00:46:34.040
SHANNEN: After the Article 32 proceeding, the press office at Fort Lewis released

00:46:34.040 --> 00:46:39.160
the undercover identity I was using at the time, which was also being used in other ongoing cases,

00:46:39.160 --> 00:46:44.560
and that was published in the newspaper. So, everybody knew that Shannen Rossmiller was

00:46:44.560 --> 00:46:53.040
Khadija1417, and after that, threats started to come in and changes had to be made of

00:46:53.040 --> 00:46:57.840
course for my family and my career. [MUSIC] I had been concerned about being a sitting

00:46:57.840 --> 00:47:03.600
judge at the time. I was very confident that what I was doing wasn’t unethical,

00:47:03.600 --> 00:47:09.360
but yet there wasn’t anything — there was nothing like this before. Trying to protect and balance

00:47:09.360 --> 00:47:18.640
those became another issue. But like I said — some people have asked me, why didn’t you just throw in

00:47:18.640 --> 00:47:25.960
the towel then? Wasn’t it too much? Well, I don’t quit. So, I wasn’t going to be defeated by it. So,

00:47:25.960 --> 00:47:31.640
I just had to learn to restructure my life and live it and go forward continuing to do what I do,

00:47:31.640 --> 00:47:38.480
because I’ve seen the importance of it. I know the importance of it, and I just — I

00:47:38.480 --> 00:47:43.240
can’t — I just can’t step aside just because of threats, so I’ll make the adjustments I need to.

00:47:43.240 --> 00:47:49.960
JACK: Holy crap, Al-Qaeda is threatening her life, placing her on their enemy list, and she’s

00:47:49.960 --> 00:47:57.360
fully doxxed and she’s just like, I don’t quit. I mean, wow, that is some fearless determination.

00:47:57.360 --> 00:48:04.320
She was quite a woman. Within weeks of her court appearance, a message was left at her courthouse.

00:48:04.320 --> 00:48:10.880
In a heavy accent in broken English, a male voice told the clerk to tell her we know who she is now.

00:48:10.880 --> 00:48:15.920
Reverse-dialing the number revealed a location in Toronto. The FBI instructed the local law

00:48:15.920 --> 00:48:22.160
enforcement to give her protection for a while. Ryan Anderson was found guilty of providing aid

00:48:22.160 --> 00:48:28.440
to the terrorist group Al-Qaeda. They demoted him from E-4 to E-1 and gave him a dishonorable

00:48:28.440 --> 00:48:33.480
discharge, which means he lost all his military benefits. The prosecution wanted to give him

00:48:33.480 --> 00:48:40.880
a death penalty for what he did. He wanted to kill a lot of US troops. But the court dropped

00:48:40.880 --> 00:48:46.320
the death penalty. So, the prosecution was trying to get Ryan sentenced to life in prison. Shannen

00:48:46.320 --> 00:48:52.400
was ordered under subpoena to testify again for the sentencing. She didn’t expect it to go well,

00:48:52.400 --> 00:48:57.160
and it didn’t. On August 30th, Shannen showed up to the courthouse, and she was standing in line

00:48:57.160 --> 00:49:02.200
for the security checks to get into the building. As she went through the scanner, all these alarms

00:49:02.200 --> 00:49:08.920
started going off. She was confused but taken to a back room, and she says she was strip-searched.

00:49:08.920 --> 00:49:13.280
It was humiliating ‘cause she knew she wasn’t carrying anything. When she finally got into the

00:49:13.280 --> 00:49:19.720
courthouse, her nerves were even more shredded. Her testimony lasted five hours in total.

00:49:19.720 --> 00:49:26.280
That’s a long time to be on a witness stand. She detailed everything that she did online and how.

00:49:26.280 --> 00:49:31.320
Yeah, so, all the communications with Ryan, it was all revealed. She just wanted it to be over,

00:49:31.320 --> 00:49:35.920
and she was relieved when she finally got to leave the courthouse that day. [MUSIC] But as

00:49:35.920 --> 00:49:43.440
she walked to her car, it was surrounded by people, people in white HAZMAT suits,

00:49:43.440 --> 00:49:49.080
like, hoods up, masks on. They were inspecting her car. They told her the bomb squad dogs had

00:49:49.080 --> 00:49:54.320
detected explosive residue on the door handle and the trunk. She just looked at him like,

00:49:54.320 --> 00:49:59.520
what? The media filmed it all while she just stood there, not knowing what to do or what to

00:49:59.520 --> 00:50:05.400
think. The police took her back to her hotel, and the forensics team came to her hotel with her to

00:50:05.400 --> 00:50:10.480
check it out. They also wanted to search all her belongings and put her in a different hotel room,

00:50:10.480 --> 00:50:15.720
one that wasn’t in her name. Nobody knew how serious of a threat this was. Was there real

00:50:15.720 --> 00:50:22.760
intention to kill her or just intimidate her? Whatever it was, all this got under her skin,

00:50:22.760 --> 00:50:27.200
but she had to see it through. A few days later, on September 3rd, she went back to court to watch

00:50:27.200 --> 00:50:31.960
closing ceremonies, and just under five hours later, the jury returned verdicts

00:50:31.960 --> 00:50:39.920
of guilty on all counts and that Ryan Anderson was sentenced to life in prison. Wow. She did

00:50:39.920 --> 00:50:45.560
it. It was over. She stopped a terrorist attack. She saved lives. She really did.

00:50:45.560 --> 00:50:50.400
That guy was dangerous, radicalized, and was bent on causing harm and destruction to US troops in

00:50:50.400 --> 00:50:56.720
Iraq. If it wasn’t for her, people would have surely died. She felt great. She wanted to do

00:50:56.720 --> 00:51:03.640
something and did something, but it came at an expense. Now her life was in danger. So,

00:51:03.640 --> 00:51:07.760
she got back home to Montana, constantly worried if there was an impending attack

00:51:07.760 --> 00:51:12.280
planned against her. It was harder to sleep at night for a while. The enormity of what she was

00:51:12.280 --> 00:51:18.960
involved with was starting to sink in. She kept getting threats online, but that’s just words.

00:51:18.960 --> 00:51:26.840
Day after day went by, and things were fine in person. Life sort of went back to normal for her.

00:51:26.840 --> 00:51:32.440
September, October, November passes. Life was kind of uneventful. Things were settling down.

00:51:32.440 --> 00:51:36.520
This is a good spot for us to take an ad break, but stay with us, because you’re not gonna want

00:51:36.520 --> 00:51:40.960
to miss what happens in December. December comes around and she starts planning for

00:51:40.960 --> 00:51:46.040
Christmas. Her three kids are excited about it, too. On December 5th, which was a Sunday,

00:51:46.040 --> 00:51:50.200
Shannen was woken up extra early by some loud banging on the front door. [MUSIC, BANGING] She

00:51:50.200 --> 00:51:55.160
ran to the door and when she opened it, two police officers were startled that someone answered the

00:51:55.160 --> 00:52:01.520
door. They seemed surprised to see her. She was certainly surprised to see them. They asked her,

00:52:01.520 --> 00:52:07.400
are you Shannen Rossmiller? She said, yes. Then they asked, where’s your car? She said,

00:52:07.400 --> 00:52:12.640
in the garage. Why? They said, can we see it? She comes outside with them and

00:52:12.640 --> 00:52:19.800
opens the garage door. As the door raises, she notices the car isn’t in the garage.

00:52:19.800 --> 00:52:24.280
Now she was the one startled that it was missing. The officers nodded and told her what was going

00:52:24.280 --> 00:52:30.640
on. Earlier that morning, the police in the next county over discovered a 2001 Pontiac Grand Prix

00:52:30.640 --> 00:52:37.360
in a ditch. There was no one around, and when they ran the plates on it, the car came back to Shannen

00:52:37.360 --> 00:52:46.080
Rossmiller. But that wasn’t all; the car had five bullet holes in it. Yeah, bullet holes. They were

00:52:46.080 --> 00:52:54.480
made by a 38. caliber gun. Together, with the officers in her home, they pieced together what

00:52:54.480 --> 00:52:59.800
must have happened. While she was sleeping upstairs, along with her husband and three

00:52:59.800 --> 00:53:06.720
children, someone had broken into the house, and they had stolen the car keys that were inside the

00:53:06.720 --> 00:53:14.680
house and then silently rolled the Pontiac out of the garage before driving away. This really shook

00:53:14.680 --> 00:53:19.960
Shannen. She knew the people she interacted with online were very dangerous, capable of

00:53:19.960 --> 00:53:25.640
conducting the most horrendous terrorist attacks, and they were in her house while she was sleeping

00:53:25.640 --> 00:53:33.040
last night. Whoa, whoa. Terrified, Shannen had no idea who did it, but she immediately

00:53:33.040 --> 00:53:38.520
suspected that this was revenge for her getting Ryan arrested and betraying the online terrorist

00:53:38.520 --> 00:53:44.560
community. She had become a target, and they knew where she lived. Now, if it was me, I’d probably

00:53:44.560 --> 00:53:52.040
leave town for a while or maybe move permanently, but not Shannen. She hunkered down. She went out

00:53:52.040 --> 00:53:56.680
and purchased a gun of her own and installed a security system and improved the locks.

00:53:56.680 --> 00:54:01.560
This was her domain and she was going to watch over it and protect it. The whole

00:54:01.560 --> 00:54:06.800
family was worried, though, wondering what was next. Clearly the bullet holes in the

00:54:06.800 --> 00:54:15.080
car was a threat that she might be next. But you heard Shannen; she doesn’t quit. In fact,

00:54:15.080 --> 00:54:21.360
this made her think what she was doing was actually working. 2005 rolls in and she’s

00:54:21.360 --> 00:54:26.000
still going downstairs into the computer room in the morning to stay up to date on what’s

00:54:26.000 --> 00:54:30.920
happening on these message boards, partly to keep tabs on if anyone is talking about her, too,

00:54:30.920 --> 00:54:37.440
you know? She’s using all-new personas now since the old ones were burned. It’s now fall of 2005,

00:54:37.440 --> 00:54:41.960
and while she keeps getting online threats, there weren’t any more scares in person after

00:54:41.960 --> 00:54:46.800
that. On October 25th, she stumbled across a new post that caught her eye. [MUSIC] She

00:54:46.800 --> 00:54:53.520
stared at it and wondered deeply about it. In a Yahoo message group called Osama Bin Laden Crew,

00:54:53.520 --> 00:55:01.000
a new user had appeared. Longtermonly2 was spouting all this Islamic extremist rhetoric,

00:55:01.000 --> 00:55:06.800
and then announced that he had a big plan that he was working on and needed help to carry it

00:55:06.800 --> 00:55:14.280
out. Just like Ryan, the message was written in broken English, posted on a mainly Arabic board.

00:55:14.280 --> 00:55:21.320
She wondered if this could be a terrorist attack plan in the making, and wanted to know more.

00:55:21.320 --> 00:55:29.200
Longtermonly2 was American and saying how furious he was that US had troops in Afghanistan and Iraq.

00:55:29.200 --> 00:55:35.640
He hated the US foreign policy and planned to disrupt it, forcing a mass recall of troops.

00:55:35.640 --> 00:55:43.680
Shannen read this but did not engage. This message board displayed IP addresses of users, and she saw

00:55:43.680 --> 00:55:52.320
that his IP traced back to a server at Assumption College in Bangkok, in Thailand. It was all just,

00:55:52.320 --> 00:56:00.360
well, curious. Shannen read all this like a fox quietly watching its prey. A few weeks later,

00:56:00.360 --> 00:56:06.360
longtermonly2 was back, and he was desperate for someone to respond to him. For days he had been

00:56:06.360 --> 00:56:10.040
posting to try to convince anyone reading this that his plan was a great opportunity,

00:56:10.040 --> 00:56:14.840
but he needed help. She was able to see the message headers of this post, and in there

00:56:14.840 --> 00:56:21.480
buried in the header was another name; Michael Reynolds. Okay, she felt strongly about this

00:56:21.480 --> 00:56:26.880
guy and needed to know more. This guy was talking about a big plan. Was the plan to cause harm and

00:56:26.880 --> 00:56:33.280
death like what Ryan had planned? So, she decided to act on this. This time though, she can’t act

00:56:33.280 --> 00:56:39.560
as Kassir since his name is burned. So, she starts looking at all her personas. She remembers one of

00:56:39.560 --> 00:56:45.360
the earlier ones she created, Abu Zeida. This one actually didn’t get named in the court documents.

00:56:45.360 --> 00:56:52.240
It wasn’t used in the Ryan Anderson case at all, so she never mentioned it to anyone. It’s clean.

00:56:52.240 --> 00:56:57.520
So, she gets back into that account, and at this point, it’s years old on the forum. Nice;

00:56:57.520 --> 00:57:01.840
easier to approach someone when your account is established versus having a freshly-made one.

00:57:01.840 --> 00:57:06.120
She also remembers this Abu Zeida identity of hers was trying to connect with the Army of Righteous,

00:57:06.120 --> 00:57:10.360
a jihadist militant organization out of Pakistan. She even claimed at some point

00:57:10.360 --> 00:57:14.760
her identity was actually involved with some of these hacks that this group conducted. Her

00:57:14.760 --> 00:57:19.720
Arabic was better than ever now, too; at least to a non-native speaker it was passable. Okay,

00:57:19.720 --> 00:57:25.040
cool. Yeah, this could work if she messages him from Abu Zeida’s account. Shannen was back to

00:57:25.040 --> 00:57:29.920
being in her full undercover mode. Shannen didn’t want to directly engage with him,

00:57:29.920 --> 00:57:35.680
though. She knows the tricks. If you can somehow get him to message you first,

00:57:35.680 --> 00:57:42.240
it’s much more effective than her messaging him first. So, the next few weeks, she gets active on

00:57:42.240 --> 00:57:48.200
the forum that Michael Reynolds was posting to. She’s posting as Abu Zeida, saying things trying

00:57:48.200 --> 00:57:53.000
to get Michael interested in. Michael notices her and starts to pick her out as someone who

00:57:53.000 --> 00:57:58.720
might be able to help him. He walks straight in her trap. He messaged her directly and told her

00:57:58.720 --> 00:58:03.800
he needed money to finance his plan. She told him, hey, let’s chat more securely,

00:58:03.800 --> 00:58:07.360
where we message each other from the drafts folder of an e-mail, just like she set up

00:58:07.360 --> 00:58:14.000
with Kassir. He agreed to this and they set up a new shared e-mail box to message each other from.

00:58:14.000 --> 00:58:20.840
Michael told her how much money he needed to carry out his plan; $80,000. Shannen was like,

00:58:20.840 --> 00:58:26.640
mm-hm, yeah, go on. But meanwhile, she’s looking at the e-mail account logs

00:58:26.640 --> 00:58:31.800
to check what IP he’s connecting to it with. Originally he was coming in from Thailand, but

00:58:31.800 --> 00:58:37.960
now she sees he’s connecting from Wilkes-Barre, Pennsylvania. She now had enough information to

00:58:37.960 --> 00:58:45.880
start building a dossier on him. [MUSIC] Michael Curtis Reynolds, forty-seven years old, American,

00:58:45.880 --> 00:58:51.120
discharged from the US Army. He had several financial problems and a criminal record. Two

00:58:51.120 --> 00:58:55.440
years after graduating from high school in New York, he tried to blow up his parents’ house.

00:58:55.440 --> 00:59:00.840
Whoa, that’s pretty extreme. He had an ex-wife, three kids, martial arts, weapons, and explosive

00:59:00.840 --> 00:59:07.600
training. This guy is kind of a loose wire and he could be a serious threat. So, Shannen wants

00:59:07.600 --> 00:59:12.720
to keep him on the hook to try to hear more about his plan, but he’s reluctant to tell her the whole

00:59:12.720 --> 00:59:18.040
plan or any more details. So, she kicks it up a notch. She tells him that she has contacts ready

00:59:18.040 --> 00:59:23.160
to mobilize across the US, in Pennsylvania and Georgia, and they have a lot of cash available.

00:59:23.160 --> 00:59:30.240
He’s like, yeah, okay, good to know. But she checks his IP again, and now he’s connecting from

00:59:30.240 --> 00:59:38.440
Pocatello, Idaho. He was on the move. She starts connecting the dots. Wait, he was in Thailand,

00:59:38.440 --> 00:59:45.240
and then Pennsylvania, now Idaho? Idaho is one state over from Montana, where she was.

00:59:45.240 --> 00:59:53.080
She starts to get paranoid. Is he coming for her? He had access to this e-mail account, too,

00:59:53.080 --> 00:59:57.840
and could check the IP of where she was connecting from. Did he see any connections from Conrad,

00:59:57.840 --> 01:00:02.880
Montana? That might immediately tip off that he’s talking with Shannen Rossmiller,

01:00:02.880 --> 01:00:09.760
not Abu Zeida. She triple-checks everything, her proxy servers, the e-mail logs, all her opsec. It

01:00:09.760 --> 01:00:15.200
all seemed okay. At least, she thinks so. She can’t find any mistakes that would have given

01:00:15.200 --> 01:00:22.920
her identity away. She feels somewhat relieved, but why is he in Idaho? She doubled down on him,

01:00:22.920 --> 01:00:26.720
told him again, look, there are some people on the move. They’ve got cash,

01:00:26.720 --> 01:00:30.880
but they’re uninterested in giving you in any money unless they know your plan first. So,

01:00:30.880 --> 01:00:39.560
he opens up. He tells her his grand plan is to attack fuel production in the US. [MUSIC] See,

01:00:39.560 --> 01:00:44.760
earlier that year in 2005, Hurricane Katrina hit land, and it was a massive storm. Part of

01:00:44.760 --> 01:00:48.880
the destruction was that fuel production was knocked out for two days. We’re talking 90%

01:00:48.880 --> 01:00:54.400
of oil production along the Gulf Coast was wiped out, resulting in gas prices hitting crazy levels.

01:00:54.400 --> 01:00:58.760
Michael Reynolds had watched over all this, and for him, he saw how vulnerable fuel production

01:00:58.760 --> 01:01:05.560
is in the US. That’s where he got his plan, to recreate what Katrina did to the fuel supply,

01:01:05.560 --> 01:01:09.440
but way bigger. He laid out the plan for her; he was going to blow up multiple

01:01:09.440 --> 01:01:14.360
production sites and the Alaskan Pipeline, one of the world’s largest oil pipelines.

01:01:14.360 --> 01:01:18.200
He explained that if he could do all this, there would be no way to switch to any backup,

01:01:18.200 --> 01:01:25.240
not easily, and the US would come to a halt. Now, this Alaskan Pipeline is massive, like,

01:01:25.240 --> 01:01:31.000
really big. It runs through Alaska for 800 miles. Michael’s plan was to disrupt the nation’s fuel

01:01:31.000 --> 01:01:35.840
for weeks. He wanted to cause riots to a scale high enough that the National Guard would be

01:01:35.840 --> 01:01:42.320
deployed to calm the civil unrest. Shannen was very concerned but kept him talking,

01:01:42.320 --> 01:01:47.200
and he kept going. His plan got even more crazy. At the peak of this civil unrest,

01:01:47.200 --> 01:01:51.880
he was going to make a statement that all this happened because the US has troops in Iraq,

01:01:51.880 --> 01:01:57.520
and he thought the people would all collectively demand that the US removes military from Iraq.

01:01:57.520 --> 01:02:00.760
He had a whole communication plan that he was going to give to the press about it all,

01:02:00.760 --> 01:02:06.640
too, exposing the government and stuff. Shannen realized he was crazy, but also potentially very

01:02:06.640 --> 01:02:14.200
dangerous. His idea involved blowing up busses and trucks alongside the pipeline to cause as much

01:02:14.200 --> 01:02:21.400
havoc as possible. Now he’s hitting up Shannen, who he thinks is part of Al-Qaeda for cash to pull

01:02:21.400 --> 01:02:28.000
it off. He was so proud of his big plan and just thought it was awesome and well-crafted. Shannen

01:02:28.000 --> 01:02:34.120
doesn’t hesitate. Soon as he admits all this, she rushes it all over to the FBI. He immediately

01:02:34.120 --> 01:02:40.200
became a person of interest to them. He was posing a big threat to the US. Her FBI liaison, Mark,

01:02:40.200 --> 01:02:45.160
suggested she drafted a final message for Michael Reynolds before they swooped in. So, Shannen does

01:02:45.160 --> 01:02:49.640
what the FBI says and tells Michael they’d give him half the money now and half later, but he had

01:02:49.640 --> 01:02:55.920
to tell her everything. So, Michael Reynolds agrees and tells her even more of the plan.

01:02:55.920 --> 01:03:00.080
To begin with, he said he was in Idaho because he was checking out the Williams natural gas

01:03:00.080 --> 01:03:04.920
refinery in Opal, Wyoming, which is a huge fuel production plant, and he had this place

01:03:04.920 --> 01:03:09.000
in mind to be his first target. He said it was much easier to hit than the Alaskan Pipeline,

01:03:09.000 --> 01:03:13.000
which was his initial plan. He said once he gets half the money, he’ll reveal the rest of

01:03:13.000 --> 01:03:18.760
the plan. She realized if this guy is traveling around the country checking out oil facilities,

01:03:18.760 --> 01:03:23.560
then his plans are much more serious than she originally thought. The FBI told Shannen they

01:03:23.560 --> 01:03:28.880
were ready for the sting. They told her to tell him when to pick up the $40,000.

01:03:28.880 --> 01:03:36.720
She gives the details to Michael. The trap was set. [MUSIC] The date was December 5th,

01:03:36.720 --> 01:03:43.680
2005. Michael Reynolds was still in Idaho and woke up in the Thunderbird Hotel in Pocatello, which is

01:03:43.680 --> 01:03:51.840
a two-star hotel. It was freezing out. Snow was on the ground. He was instructed to go down I-15,

01:03:51.840 --> 01:03:58.280
and just after mile marker 100 is a rest area, and there will be a red bag waiting for him there. He

01:03:58.280 --> 01:04:04.960
gets in the car and drives. He’s anxious, excited, and nervous all at the same time,

01:04:04.960 --> 01:04:13.840
thinking about his plan and the money, $40,000. He gets through town and out onto I-5, and the

01:04:13.840 --> 01:04:20.120
first mile marker he sees is 72. Twenty-eight more miles until he has his hands on the money.

01:04:20.120 --> 01:04:26.200
How exciting. He keeps driving. There’s nothing in this area of Idaho, no forests

01:04:26.200 --> 01:04:32.440
or mountains in this area. It’s pretty flat, and the landscape just beckons you to gaze off far

01:04:32.440 --> 01:04:38.920
into the distance and think big. It’s a four-lane highway, a nice, easy drive. The road was clear

01:04:38.920 --> 01:04:45.000
but everywhere else was white with snow still. He drives past Snake River, past some small towns,

01:04:45.000 --> 01:04:51.400
past some farmland. He arrives at mile marker 100, and he sees the rest area and pulls over.

01:04:51.400 --> 01:04:57.000
He was told to look for a red bag. He gets out of his car and looks around. A few other semi-trucks

01:04:57.000 --> 01:05:03.280
around and cars are stopped there. He sees a picnic table and something red underneath it. He

01:05:03.280 --> 01:05:08.400
walks over. It’s a red bag. This must be the bag with the cash. He goes to pick it up, but while

01:05:08.400 --> 01:05:13.640
he’s focused on the bag, he didn’t notice the FBI coming up behind him. They surrounded him,

01:05:13.640 --> 01:05:19.400
threw him on the cold, snowy ground before he could realize what was happening. On his way to be

01:05:19.400 --> 01:05:25.920
questioned, he started talking. He insisted that he was only acting and that he wasn’t actually

01:05:25.920 --> 01:05:30.880
going to blow up anything, but he was trying to get information on this Abu Zeida guy to report

01:05:30.880 --> 01:05:36.040
him to the FBI. Michael was insisting that he was the one working undercover and he was innocent,

01:05:36.040 --> 01:05:40.800
and says, hey, go arrest Abu Zeida; he’s the real terrorist here. Michael said he

01:05:40.800 --> 01:05:46.560
can prove it. Michael was held in jail until his trial date and was angry about everything.

01:05:46.560 --> 01:05:51.160
He actually wrote a letter to the judge. This guy was adamant about going home. He told the judge,

01:05:51.160 --> 01:05:57.360
just acquit him and call it a day, but the judge didn’t listen and set a trial date for July 2007,

01:05:57.360 --> 01:06:03.400
which is almost two years after his arrest. Shannen was called to testify at Michael’s trial.

01:06:03.400 --> 01:06:08.440
She was expecting it and was more prepared this time around than during Ryan’s trial. What she

01:06:08.440 --> 01:06:14.000
wasn’t prepared for was how her body was going to test her during those days on the stand. The

01:06:14.000 --> 01:06:19.440
night before, she flew to Scranton, Pennsylvania where the case was being held. The night before,

01:06:19.440 --> 01:06:24.720
she felt pretty unwell. On the first day of testimony, she did well on the stand,

01:06:24.720 --> 01:06:30.760
but by day two, she could hardly walk. [MUSIC] She was fatigued and vomiting, and she could

01:06:30.760 --> 01:06:37.200
see blood. Now she was getting scared. But she was determined to see through what she had gone

01:06:37.200 --> 01:06:43.400
there to do. Mark, the FBI agent, was there to support her. She somehow managed another full

01:06:43.400 --> 01:06:48.200
day of testimony, including cross-examination by Michael’s attorney, and when she was done,

01:06:48.200 --> 01:06:52.880
she immediately flew home and got outta there. But it just got worse from there. After arriving home,

01:06:52.880 --> 01:06:57.680
she just couldn’t take this sickness anymore and went to the emergency room. The doctors found

01:06:57.680 --> 01:07:04.120
a bleeding ulcer and two kidney stones. Whoa. This was a lot to handle for her,

01:07:04.120 --> 01:07:10.040
but she was treated and went home to recover. As she recovered, she knew she had to change how she

01:07:10.040 --> 01:07:15.040
worked. The thought of the trial must have caused so much stress and anxiety that it triggered all

01:07:15.040 --> 01:07:21.960
these health issues. It was too much. During his trial, Michael took the stand in his own defense.

01:07:21.960 --> 01:07:27.080
He maintained his story that he was the one working undercover, but it didn’t work. The jury

01:07:27.080 --> 01:07:32.360
just took forty-five minutes to come back with guilty verdicts for five of the six counts against

01:07:32.360 --> 01:07:37.640
him. He was convicted of attempting to provide material support and resources to a foreign

01:07:37.640 --> 01:07:42.920
terrorist organization and possession of an explosive device. Michael Reynolds was sentenced

01:07:42.920 --> 01:07:49.480
to thirty-five years in federal prison. That drive through Idaho was the last time he had a taste of

01:07:49.480 --> 01:07:59.040
freedom, and I wonder if he’s replayed that drive a thousand times in his head since then. [MUSIC]

01:07:59.040 --> 01:08:05.640
Well, Shannen Rossmiller had two high-profile cases taken to court and both found guilty. The

01:08:05.640 --> 01:08:10.960
events of 9/11 somehow turned her into a citizen counter-terrorist,

01:08:10.960 --> 01:08:18.240
a cyber spy. She was doing her part to try to thwart another 9/11, and she did. Imagine if that

01:08:18.240 --> 01:08:25.080
guy blew up all those oil facilities and caused a national emergency. It was rewarding for sure,

01:08:25.080 --> 01:08:34.200
but dang, the stress of it was really affecting her. July 2006 comes along. Shannen gets a job

01:08:34.200 --> 01:08:39.280
at the state attorney’s office in Helena, about two hours away from her home in Conrad. She was

01:08:39.280 --> 01:08:44.920
going back and forth between Helena and Conrad a lot. Randy and the kids were home in Conrad,

01:08:44.920 --> 01:08:49.000
and it was a Friday and she was looking to go home to see them for the weekend.

01:08:49.000 --> 01:08:53.700
But the Conrad Police Department call her on the phone, and the officer tells her a crazy story.

01:08:53.700 --> 01:08:58.680
[MUSIC] The kids are fine, Randy’s fine, but something strange happened. Last night at 10:00

01:08:58.680 --> 01:09:03.720
p.m., someone called 911 and said there was an accident. Highway patrol went to check it out.

01:09:03.720 --> 01:09:08.840
It was twenty-five miles north of Conrad out on a remote gravel road up towards Canada, and there

01:09:08.840 --> 01:09:15.480
was a Ryder rental truck that was nose-down in a ravine. The truck was mangled pretty badly,

01:09:15.480 --> 01:09:20.120
and it was all banged up and had been in a serious wreck. There were four men in

01:09:20.120 --> 01:09:25.840
the truck. All four had injuries and had to go to the hospital, but two were hurt pretty seriously.

01:09:25.840 --> 01:09:30.920
But at the hospital they were refusing treatment, saying something about unclean hands. The cops

01:09:30.920 --> 01:09:34.640
question them. They say they’re coming down from Canada. The cops ask where they came

01:09:34.640 --> 01:09:40.000
in from Canada, and they said some back gravel road. It sounded like they didn’t go through an

01:09:40.000 --> 01:09:44.840
official checkpoint. Each of them had US visas, but each of them were from different countries,

01:09:44.840 --> 01:09:52.280
and they were all wearing male chastity belts. It was all very weird. The cops look through

01:09:52.280 --> 01:09:59.520
the truck and found GPS, gadgets, laptops, phones, tracking devices, extra batteries,

01:09:59.520 --> 01:10:04.480
tons of cables, keyboards, monitors, mice, lots of high-tech gear. I think some antennas

01:10:04.480 --> 01:10:09.560
were in there, and there were also a few dissassembled weapons in the truck. Yeah,

01:10:09.560 --> 01:10:16.720
all neatly packed in boxes. Shannen’s like, okay, but what’s any of this have to do with me, though?

01:10:16.720 --> 01:10:24.800
The cop says the GPS in the truck was set to her home address, meaning they were likely on

01:10:24.800 --> 01:10:31.920
their way to her residence in Conrad when they crashed off the side of the road. They found her

01:10:31.920 --> 01:10:39.160
address and the courthouse address in one of their laptops. Of course, news like this is enough to

01:10:39.160 --> 01:10:44.920
make anyone’s blood run cold. So, instead of her heading home for the weekend as usual, Shannen’s

01:10:44.920 --> 01:10:50.400
told to stay in Helena. The police offered to give her extra protection for a while. They offered to

01:10:50.400 --> 01:10:55.560
park a squad car outside her house for as long as she wants. They didn’t want to take any chances.

01:10:55.560 --> 01:11:00.920
Randy and the kids packed up and got outta town over to a family member’s house so they could be

01:11:00.920 --> 01:11:06.680
safe. The cops questioned the men again. Now they were saying they were part of some traveling music

01:11:06.680 --> 01:11:12.680
show touring through Montana. The men were somehow let go or slipped away or something. It’s not

01:11:12.680 --> 01:11:20.080
clear, but they vanished and were never seen from again. After the Reynolds case, Shannen kept doing

01:11:20.080 --> 01:11:25.720
her undercover work online. But at this point, it was much less intense. For one, she simply sent

01:11:25.720 --> 01:11:30.600
the FBI information much sooner and then trained them on how to take over the conversations and

01:11:30.600 --> 01:11:35.560
find these terrorists online just like she was. She wanted to remove herself from the evidence

01:11:35.560 --> 01:11:40.680
chain so she would no longer have to testify in court proceedings, and it worked. She didn’t have

01:11:40.680 --> 01:11:45.900
any more cases that she needed to appear in, and the FBI was able to thwart more terrorist plots.

01:11:45.900 --> 01:11:55.520
SHANNEN: I’ve created thirty-two actual — over the years — primary characters, identities online

01:11:55.520 --> 01:12:01.080
that at different times I’ll spawn off other sub-identities in order to continue with making

01:12:01.080 --> 01:12:06.440
the whole appearance of who I am, what I say I’m doing, a little more real as it is in the whole

01:12:06.440 --> 01:12:12.680
virtual context that the internet provides. Those identities have led to different prosecutions,

01:12:12.680 --> 01:12:18.720
but the interesting thing was the two individuals that were prosecuted here in the United States,

01:12:18.720 --> 01:12:25.760
the two high-profile cases, they were the result of those individuals stumbling into

01:12:25.760 --> 01:12:31.120
the Arabic forums looking to make contact with Al-Qaeda. Thankfully,

01:12:31.120 --> 01:12:37.200
I guess, it was me that they were — that they grabbed onto, and I was able to rein

01:12:37.200 --> 01:12:42.080
them in and keep control of them up until the cases were turned over to the FBI.

01:12:42.080 --> 01:12:49.360
JACK: In 2006, Shannen received a Middle East Forum American Hero Award. In March 2009,

01:12:49.360 --> 01:12:54.840
she was honored with the Congressional Medal of Honor Societies Above and Beyond Citizen Award

01:12:54.840 --> 01:13:02.320
from Montana. Sadly, Shannen died in November 2020. She had Graves disease, which meant she

01:13:02.320 --> 01:13:07.880
had an overproduction of the thyroid hormone, and it caused all kinds of health problems.

01:13:07.880 --> 01:13:14.040
She was fifty years old. Shannen Rossmiller was fearless about stepping into the shadows of the

01:13:14.040 --> 01:13:21.040
unknown. She was fueled by an unwavering resolve to make a difference in the world, a lone wolf,

01:13:21.040 --> 01:13:27.000
yet a guardian angel. She had an impressive personal life, but an extraordinary spirit

01:13:27.000 --> 01:13:32.760
that guided her through some wild online adventures. Her story is more than the sum

01:13:32.760 --> 01:13:38.400
of her deeds. Who knows what lives she saved and what those people went on to accomplish.

01:13:38.400 --> 01:13:44.720
A rural mom and municipal judge by day, but a brutal cyber counter-terrorism spy by night,

01:13:44.720 --> 01:13:50.160
feeling just as comfortable wearing fake personas as she does with her real life.

01:13:50.160 --> 01:13:55.200
I think the world is still catching up to the significance of who Shannen was and what she

01:13:55.200 --> 01:14:01.520
accomplished. I hope she’ll be an inspiration for how to blend bravery and love and justice

01:14:01.520 --> 01:14:18.617
and technology. Her story stretches beyond the horizon and outlives the setting sun.

01:14:18.617 --> 01:14:21.120
(OUTRO): [OUTRO MUSIC] Shannen Rossmiller published a book about her journey called

01:14:21.120 --> 01:14:25.120
The Unexpected Patriot: How an Ordinary American Mother is Bringing Terrorists to

01:14:25.120 --> 01:14:29.000
Justice. I’ll have a link to it and all my sources in the show notes. A big thank-you

01:14:29.000 --> 01:14:32.400
to SpyCast for giving us permission to use the interview they conducted with

01:14:32.400 --> 01:14:36.960
Shannen back in 2011. SpyCast is a podcast that interviews spies. You gotta go check

01:14:36.960 --> 01:14:41.040
it out. You’ll love it. This episode was created by me, the packet snacker,

01:14:41.040 --> 01:14:45.040
Jack Rhysider. This episode was researched and written by the anxious algorithm,

01:14:45.040 --> 01:14:50.200
Fiona Guy. Our editor is the lucky logic bomb, Tristan Ledger, mixing done by Proximity Sound,

01:14:50.200 --> 01:14:56.240
and our interim music is done by the mysterious Breakmaster Cylinder. Why did the online spy go to

01:14:56.240 --> 01:15:12.600
art school? To learn how to draw conclusions from incomplete information. This is Darknet Diaries.