India: Mumbai Attacks, Day Two; tech speculation

This post is an open thread for folks who'd like to share coverage, insight, or first-person accounts of the attacks in Mumbai. Some Boing Boing readers in yesterday's comment thread had friends or loved ones in the area at the time -- I hope all are well.

Global Voices has special coverage of the ongoing events -- a very comprehensive feature with links is here, and Sameer has an update here.

Looking through coverage last night, I noticed some speculation about an email said to have been sent to news organizations in India identifying the attackers as "Deccan Mujahideen" -- specifically, there are reports that this email was traced back to an IP address in Russia. Apparently, some state officials in India are saying that this is one of the pieces of evidence that suggests foreign involvement, but I don't know enough to judge whether that's likely (and I haven't seen the email). The fact that email evidence and IP analysis are now part of the story is an interesting new development, though. 24 hours after the first attack, the identity of those responsible has not been confirmed, and the crisis is ongoing.

Who knows, though -- the whole "Deccan Mujahideen" thing may be smoke. This Foreign Policy article is worth a read, on that note.

One must always be suspicious when a "new" terrorist organization crops up. Today's horrific attacks in Mumbai were claimed by a previously unknown group calling itself the Deccan Mujahideen. But one India journalist claims the pattern of the attacks suggests that Lashkar-e-Taiba, a nasty Islamist organization based in Lahore, Pakistan, and with a significant presence in Kashmir and links to al Qaeda, may be to blame.

Here's where it gets interesting -- and I stress here that I am just speculating. Lashkar-e-Taiba's main goal is to expel India from Kashmir. In the past, some have accused elements of the Pakistani military and intelligence services of having ties to the group. Pakistan's government has always hotly denied such accusations.

(thanks, Oxblood)

Previously on Boing Boing: India: 80+ Reported Dead, 200+ injured in Bombay Terror Attacks


  1. Aninsominac has commented earlier that the “Sikh problem is over and done with”. I don’t think so. Further I think this sheds light on to why there is a “Muslim problem”.

  2. Lashkar-e-Taiba’s main goal is to expel India from Kashmir.
    LeTs main goal is to bleed India through thousand cuts.

  3. Let’s bear in mind that “a fictitious IP address in Russia” does not in any way suggest the involvement of the Russian government, or even necessarily the knowing involvement of Russians. Russia has plenty of hackers, and I’d be surprised if they weren’t running public or semi-public email anonymisers.

  4. @Takuan (#1)
    The Sikh separatist movement has, to the large part, died… At least in India. (For instance, in Canada, some vocal advocates for a Khalistan are still active.)
    1. The Khalistan movement was brutally crushed by the Indian state; 2. The radical separatists lost (moral) support of the larger Sikh community, and the militants who had hitherto been provided shelter by villagers were flushed out by others.

    @Xeni (post)
    Experts doubt Al Qaeda link in Mumbai attacks
    By Mark McDonald
    Published: November 27, 2008

    “Christine Fair, senior political scientist and a South Asia expert at the RAND Corporation, was careful to say that the identity of the terrorists could not yet be known. But she insisted the style of the attacks and the targets in Mumbai suggested that the militants were likely to be Indian Muslims – and not linked to Al Qaeda or the violent South Asian terrorist group Lashkar-e-Taiba.

    “There’s absolutely nothing Al Qaeda-like about it,” she said of the attack. “Did you see any suicide bombers? And there are no fingerprints of Lashkar. They don’t do hostage taking, and they don’t do grenades.”

    “Hoffman agreed that the assault was “not exactly Al Qaeda’s modus operandi, which is suicide attacks.”

    “But he said the timed attacks, which he called ‘tactical, sophisticated and coordinated,” perhaps pointed to a broader organization behind the perpetrators. Fair also noted that the fact
    the group had not proclaimed its ideology in a manifesto was ‘not at all unusual’.”


    That is not to say I agree with any of the above analysis. I’m not qualified to. The point I’m trying to make is all this talk of “modus operandi” and “fingerprints” sounds like BS. Who is to say that a group that hasn’t previously taken hostages won’t do so in an extraordinary attack like this?

    These attackers managed to get a large amount of explosives (RDX). Trying to trace that back, etc., is IMHO the way to figure out their connections, and not speculations by various experts on the modus operandi of the group. Just as the standard response in the U.S. is to try to trace all attacks (and non attacks, as in the case of Iraq) back to al Qaeda, the habit in India is to trace it back to the ISI (Pakistani intelligence agency), the Lashkar-e-Toiba, SIMI (in the last six years only), and also to the Jaish-e-Mohammad, Hizb-ul-Mujahideen and Harkat-ul-Mujahideen. (Probably in that order.) is a good website for backgrounders.

  5. Al Q hallmarks: simultaneous co-ordinated attacks performed by individuals willing to die. Maximum bloodshed and panic, highly visible (globally famous) landmarks. These people either read the book, or were trained.

  6. This kind of thing doesn’t generally happen under powerful, totalitarian governments (think of USSR, Iraq w/ Saddam, etc.). Continued attacks like just push the world’s governments closer to totalitarianism. Extremists will be responsible for their own elimination, as well as the death of liberty.

  7. oh? Chechens beg to differ. I also still see no real al Quaeda link beyond islam. I believe the name means “base”. Handy for grabbing credit for everything.

  8. Sociopaths rule the world. Whether they be “terrorists” or a US president funding death squads in Central America it’s all the same thing.

    The older I get the more disgusted with the human race I become.

  9. If, as speculated earlier, this is internal Indian (miguided) Muslim violent protest (against Hindu treatment of Muslims, in the cause of getting India out of Kashmir, …) then why would terrorists with that type of motivation apparently target US and UK passport holders – unless it was simply a VERY cynical (and successful) attempt to get Western media attention.

    As to the Australian guy who was offended at Aussie media’s reporting of Aussie casualties earlier in this or the previous thread – why? It is just a question of relevance as far as the mass target audience is concerned. If there is a road accident with, say, 2 dead, in my town then the local paper would report “2 dead, 1 was a local man”. All “news” is only news because the newscasters think it is relevant to their audience.

  10. Well, I think there’s something to be said about this being non-Al Qaeda, but “merely” Indian muslims. The few pictures I’ve seen of attackers do not show people I’m used to seeing as conservative muslims, where you’d expect such an attack to come from.

    Possibly, religion itself was not a big motivator per se, and this attack is just a more “mundane” reaction against discrimination experienced by an Indian minority (who happen to be Muslim). Witness, for instance, the fact that they sprayed the train station with machine gun fire.

    Don’t know. India is a big complex place and it’s way beyond me to understand the dynamics and tensions there.

  11. Keeper – India is a big complex place and it’s way beyond me to understand the dynamics and tensions there.

    that may be true of Islam as well.

  12. Things are still going on, and things are foggy, but there is some talk that the attackers arrived by ship and may be looking for revenge for an Indian navy attack on Somalian pirates a few weeks back…but this is the rankest of rumors, bad things are still going on, Canucks are involved as well, and I have friends in India…so I hope the violence stops quickly.
    PS Happy Thanksgiving to the USians out there. Please take some time to think of your First Nations, too, they had some role in this Holiday, IIRC.

  13. @Takuan, and any others who may have been offended by my posts on the previous thread: I apologise for my rudeness.

    Posit: the more common groups capable of “spectaculars”[1] become, the lesser is their power to influence events, because (as this and the previous Mumbai attacks thread demonstrate) the “message” of grisily atrocities becomes increasingly opaque, when the perpetrators and targets are so unclear.

    [1] term coined by the IRA – hmmm, the best google + site:wikipedia can find:

  14. @george57l
    While you’re correct, I would find it much more palatable if the reports said: 125 die in horrific attacks, a Briton amongst them; instead of: Briton killed in South Bombay in terror attack, 124 other dead. While, frankly, I haven’t seen reports of the second variety, I believe the Aussie report might have been of that sort, and hence given rise to that comment. It’s just a matter of proportions and perspective.

    In your lack of knowledge (which you willingly admit), you have a very important point. In India, if after capture it is realized that the alleged Islamic terrorist doesn’t look “Islamic” or “terrorist” enough, we dress him up to look so: <>. The politics of identity is woven around appearances (clothes, beards, turbans, etc.), and that is often exploited. In this case (linked) it was to make the arrests more believable by making the arrested look more Muslim (despite the fact that the keffiyeh is more an Arab headdress than a South Asian one).

  15. Israeli media is tracking (somewhat hysterically) the situation at the Chabad center, where 8-10 hostages are still being held. This specific attack points, I think, to the involvement of Islamic elements from outside of India.

  16. Lots of credible eye-witnesses saying that they arrived by boat. OK, but how did they get the car bomb in the dighy?

  17. #22: XDMAG, to quote one of the attackers (identifying himself as Imran Babar) holding the hostages in the Chabad Centre:

    “We are here..You call their (Israeli) Army Staff to visit Kashmir.. why is it so?..Who are they to come to J & K..This is a matter between us and Hindus..the Hindu government..Why does that Israel come here..To say that Israel and Palestine..”

    That says to me that this is an internal matter (at least for that guy), or internal to Pakistan/India at the outside. It think the involvement of Jews/Israelis was largely tangential.

  18. #25 Kieran: I see what you mean. There has been some military cooperation between India and Israel, as well as weapon deals. I knew Pakistan didn’t like this, so I guess the Kashmir separatists share that sentiment.
    By the way, the aforementioned Israeli media has completely ignored the reports about the terrorists looking for U.S. and British passport holders. Someone is trying to paint this attack in very specific colours.

  19. Anybody come across any casualty figures for the Leopold Cafe? One of National Geographic Traveler’s contributing editors, now in New Delhi, ate there ten days ago and sent this report:

    “Leopold’s is a rarity in India, a relaxing bar and café where tourists and middle-class Indians mix; it’s on a corner, with wide, open doorways. You can sit under the high ceilings and fans at 30 or so tables covered in plaid cloth and read the Times of India or watch the throngs walking by outside or strike up a conversation with someone. I shared a table one evening with the chief electrical engineer of the Mumbai commuter trains; one afternoon at lunch I talked to a Dutch filmmaker. It’s been around for more than 100 years; it’s the center of action in the sprawling Mumbai novel Shantaram…
    Apparently grenades were lobbed inside. At ten or eleven o’clock Leopold’s would have been full, every table taken, with music throbbing and a mix of Indians, West Africans and westerners dancing and drinking upstairs, sellers of bangles and leather sandals and tobacco on the sidewalk outside, the air warm and humid and smoky…”

  20. “If, as speculated earlier, this is internal Indian (miguided) Muslim violent protest (against Hindu treatment of Muslims, in the cause of getting India out of Kashmir, …) then why would terrorists with that type of motivation apparently target US and UK passport holders – unless it was simply a VERY cynical (and successful) attempt to get Western media attention.”

    No doubt it is that exactly. The only hope of a group like that is drawing international attention to the issue. This is the crudest, most effective way to do so.

  21. drawing international attention? From who? To do what? There is nothing credible there. Unless provocation is the goal.

  22. I think I’ll have to agree with Takuan that the goal is provocation. In one of the news reports, I heard that one of the Government officials did not believe the tourists trapped inside the hostels were “hostages” because they were not treated in the usual way hostages are: they were left alone in their separate rooms, no on tried to lock them inside, no deliberate attempt was made to gather them, ransom them, guard them, etc.

    IMHO, they are still hostages, at least to the situation if not to the terrorists, but such a lackadaisical attitude towards them implies that causing a huge death toll or holding people for demands was not the goal; it is to attract attention.

  23. Then they hope to foment more oppression to gain energy for wider discontent. In India and elsewhere.

    It is essential that India not play into their hands. Will the Indian government act to protect Muslims in India?

  24. Well, the current Indian Government is the Supreme Overlord of Ennui, so I sincerely doubt if it will take ANY action whatsoever beyond paying compensation to victims and sending letters to the Pakistan Government. The point of concern will be among the masses who can be very easily riled up by the BJP (anti-Muslim) and RSS.

  25. Surely the ‘Traced to an IP address in ‘ is no longer valid with the existence or Tor?

    And say it was via Tor…
    What if the innocent who became the gateway, was picked on by their government for it – simply for the fact it ‘originated from him’.

    Not picking on Tor (I use it for many things as a network engineer), just it makes you wonder what deviants are using on it.

  26. I, an american university student, am supposed to be on an internship there currently, but I wasn’t able to find one. In the meantime, I’ve read Suketu Mehta’s book “Maximum City: Bombay Lost and Found”, which was quite the eye-opener.

  27. Aninsomniac: RSS is so widespread in India? jeez I’m just getting used to it, they’re pretty advanced.

  28. Pseudonym/ Comment No.9: perhaps you not hearing about them does not = they do not happen.
    Totalitarians are bigger on controlling what is said than what is actually happening “on the ground”.
    The US news media can (granted that it is only at specific times, and only in parts of the media) be said to follow a similar approach.
    Lieing is no cure for terrorism and violence. Even rigorously-enforced Official lieing.

  29. Further history teaches that it has happened that “terrorist” attacks have been staged in order to solidify the grip of tyrants…so such attacks are not “less likely” to happen under totalitarianism, but you are less likely to hear of it (so as not to impede the “ideological struggle”, natch), unless they really want you to know, to get you to do, or agree, with what they want to do – in which case it would be saturation coverage (usually displacing coverage of more interesting info).
    Putin/Chomsky got it right about the power of western propaganda mechanisms.


    About TOR, the TOR exit nodes have known IP addresses, so that it is possible to determine whether traffic originated from the TOR cloud.

    Traffic coming out of non-TOR nodes can be reliably said to have emanated from that IP address.

    Of course, if someone is accessing a service (such as gmail) via Tor, the IP address of the traffic originator says nothing about where the user of the traffic is (but this is true without TOR anyway).

  31. Vengeance both transcends politics and is the base upon which much of it rests. Mumbai is an act of revenge. Terrorism is fueled by people “getting even” for outrages, both real and imagined. Revenge is older than the laws and mores of civil society. It is primal.

    In the ebb and flow of our great energy-seeking species, human subsets called, variously, cultures, peoples, countries, etc. rob, subjugate, and kill other human subsets. It has always been this way. There is no qualitative difference between two tribes fighting over hunting grounds and two nations fighting over oil deposits. It is the natural struggle of competing thermodynamic systems; some win, some lose; it’s a story of ascendency and decline, survival and extinction. Stand back far enough and it’s nothing to marvel at.

    But people take it personally. No matter why the foreigners overran your village, if you’re a survivor, you’re honor-bound to try to kill every goddamned one of them you can, by whatever means necessary.

    We live in a world where most of its peoples are seeking revenge. Some grievances are long-standing, some are as recent as yesterday; but they all demand retribution. When the Hindus resume their bloody business in the northern states, it will be thought by many to be because of this week’s bloody business in Mumbai. Well, yes, it will be … and it won’t be. It’s much older than that. Both Hindu and Muslim fanatics are after the same thing: Vengeance. And they’ve been after it for a long time.

    It IS business as usual.

  32. The putative originating IP address has no significance and no value whatsoever.

    There are on the order of 10e8 fully-compromised systems around the world. They are used to send spam, to run C&C networks for spam operations, to distribute spyware, to conduct DDoS attacks, to harvest email addresses — in short, to do whatever their new owners wish them to do. Control of these systems is acquired via various means, often malware injection. Access to them is available on a bulk basis on the open market — so many Euros/Dollars for so many systems for such-and-such a time.

    The exact number is of course unknown and unknowable, since a fully-compromised system which presents no externally-visible behavior to appropriate sensors will go undetected indefinitely. Thus estimates are based on best-case analysis and very likely represent the lower bound on the actual number. These systems have been observed on public and private networks, at consumer ISPs, at corporations, at governments, at universities, even at military sites.

    Any of them could be used to relay email, either by someone who’s acquired control of it directly or who’s renting control.

    So while the originating IP address (and its location) are interesting, neither has any real significance; the same message could have just been as easily sent from nearly anywhere in the world.


    “Further history teaches that it has happened that “terrorist” attacks have been staged in order to solidify the grip of tyrants”

    Nothing to add, I just thought it bared repeating.

  34. #25 Kieran: I’ve followed up on that quote, and it appears to be a little out of context. First of all, it’s not from the last couple of days. Second, the speaker did not refer to cooperation between Israel and India, he was accusing Israeli backpackers traveling in Kashmir of being spies – in a possible attempt to gain favor in the Arab world.
    It now appears that the Chabad center was not a primary target, and the attackers just used it as a hideout. Since all hostages were killed, this point, I guess, is moot.

  35. RSK:

    Yes and no.

    It’s possible for ICAAN to shut down an IP address that has consistently vomited up spam, and this has happened a few times.

    And I would argue that the IP address of all that spam did accurately point to its origin.

    That said, routing (in the vast majority of cases) is based on the destination IP. It’s trivial to change the origination IP address in the packet header with little or no consequence to packet delivery.

  36. XDMAG:

    Well, not totally moot in terms of understanding the motivations of the attackers, or of understanding what the hell all of this was about.

    The Kashmiri angle makes more sense than it being merely more Islamic terrorist attacks.

    (My own angle was that these were a bunch of folks laid off at US and UK cost centers that discovered they happened to be mostly Muslim, so they launched an attack that they later branded as “Muslim”.)

  37. Re: #49

    You are confused about the role of ICANN, what “fully-compromised system” means, and why forging IP addresses — while possible — is largely not necessary.

    First, ICANN does not control IP addresses; it controls domains. ARIN and associated organizations control network allocations (still not individual IP addresses) which are delegated, sub-delegated, sub-sub-delegated, etc. to the entities who are actually responsible for them.

    Second, with a few hundred million such IP addresses (corresponding to a few hundred million such systems) in play, any changes to the status of a few are unimportant and irrelevant.

    Third, any such traffic originating from a fully-compromised system provides no clues whatsoever as to its true origin. Even a competent forensic-grade examination of such a system is unlikely to do so, since multiple levels of indirection are often used to obfuscate the origin of data as well as C&C.

    Fourth, because this is the case, few bother attempting to forge IP addresses: it is simply not necessary. It is far simpler, cheaper and easier to use as many fully-compromised systems as are deemed necessary, since there is — for all practical purpose — an inexhaustible supply of them.

    Finally, let me note in passing that many inexperienced observers make these same mistakes. We frequently read accounts in the popular press breathlessly claiming that attacks came “from systems in country X”. This is meaningless drivel, as country X, for all values of X, has plenty of systems available for use by anyone in country Y. Moreover, anyone from country Y with sufficient wit will of course judiciously choose to utilize systems in country X in order to generate these very same baseless assertions.

  38. the kernel of #52

    “Terrorism has become an everyday occurrence in India. From the metros, it has spread to newer areas such as Bangalore, Jaipur and Ahmedabad. More people have died from terrorism in India than anywhere else, barring Iraq and Afghanistan. Yet the problem hasn’t led to a backlash. A fatalistic, suffer-and-forget approach has become a national phenomenon. There are few political leaders who have developed any rounded understanding of national security. Most are only too willing to be driven by spooks and policemen of vastly uneven competence.

    Will the fidayeen attacks in Mumbai make a difference? Any event of this magnitude–it is being called India’s 9/11–is bound to leave an imprint on the national consciousness. The Mumbai attacks didn’t merely affect the proverbial Common Man; it struck at the heart of the Mumbai elite. The Taj Mahal and Oberoi hotels are at the center of Mumbai’s social and business life. If it could happen there, it could also happen in the Taj and Oberoi in Delhi, Kolkata and Bangalore. This Mumbai attack has brought terrorism to the doorstep of India’s opinion makers. It has also put this problem on the world map.”

  39. I am sorry aninsomniac , my post was a tasteless attempt at humor on my part, referring to Really Simple Syndication, still kinda nouvelle vague in my digitally backward country.
    As to the RSS you are referring to, I had not been aware of it/them. Violence haunts/stalks many lands it seems. Thanks for the link.

  40. Well Takuan an ancient civilization with a deeply-ingrained belief in re-incarnation, faced with violent attacks, might not react in the same way (especially in a ‘psychological’ sense) that other civilizations, which do not hold such beliefs, would.
    Just as beliefs as to the afterlife may have motivated the attackers.

  41. @ugly canuck: No worries. I got the joke, but wanted to make sure people knew what the Indian RSS was. Everyone in India knows the party, but I was not sure if anyone outside would. Didn’t even realize it coincided with the more friendly RSS. The brain compartmentalizes well, I say.

  42. #52 – In counterpoint:

    The kernel:

    “India, which for the past two decades has suffered from worse terrorist attacks than any other independent country, handles them very well: it does not let them grow into a national emergency requiring extreme measures. That is why the latest atrocity in Bombay, like the 1993 one, will soon be forgotten. It is tragic and wicked, but it is a relatively small event in the life of a nation.”

    It will be interesting to see which is right. I’m hoping for my side, but we shall see what we shall see.

  43. you still up?

    The Bader Meinhof,Sekigun-ha and other scions of education and priviledge all got killed,jailed,grew old and generally went away since apart from themselves, they had no base beyond an abstract. The Palestinians could have been but that went another way as well.

    The Muslims in India number almost 180,000,000 and half of them live in poverty

  44. #61: Lol, you still up too?

    Hmmm … Muslims aren’t the only poor minority in India, and in the global scheme of things this isn’t an event equivalent to, say, what would happen if India and Pakistan nuked each other.

    The counterpoint was that Swapan Dasgupta seems to be advocating a backlash at terrorism, with executions and increased police powers, while Gwynne Dyer is suggesting that this is exactly the wrong thing to do (providing the examples of the UK vs the IRA and the US vs Al Qaeda). A lot of the other points in both articles are very similar.

  45. “India, which for the past two decades has suffered from worse terrorist attacks than any other independent country, handles them very well: it does not let them grow into a national emergency requiring extreme measures. That is why the latest atrocity in Bombay, like the 1993 one, will soon be forgotten. It is tragic and wicked, but it is a relatively small event in the life of a nation.”

  46. he’s an embarrassment to the bitter end:
    “A team of FBI agents was on its way to India to help investigate, and President George W. Bush pledged full U.S. support.

    “As the people of the world’s largest democracy recover from these attacks, they can count on the people of world’s oldest democracy to stand by their side,” Bush said at the White House.”

Comments are closed.