U.S. officials are investigating connections between terrorists abroad and the two men shot dead as they were trying to attack a free speech event in Texas over the weekend.
The authorities want to determine to what degree the attack was directed from abroad. One U.S. official told CNN that the shooting was “certainly more than just inspiration” by ISIS but that assessment does not mean that the terror group gave the gunmen specific instructions.
The gunmen, who have since been identified as Elton Simpson and Nadir Soofi, were roommates in Phoenix. They were foiled in their apparent plot after they drove to Texas and tried to attack a free speech event that was displaying cartoons of the Prophet Mohammed. They wounded a security guard before police shot and killed them.
Related: What we know about Simpson and Soofi
A law enforcement official explained that the attack does not appear to be a clear cut case of a lone wolf inspired to act or a pure case of someone directed by others to act. Rather, the official said, it appears to be something in between.
The attack fits a well-known pattern of ISIS recruitment and incitement: encouraging sympathizers via a sophisticated social media campaign to join the fight in Syria or, if they cannot do that, to carry out terror attacks on their own at home, U.S. officials said Tuesday.
Simpson appears to have had online ties to a British ISIS recruit thought to be in Syria and an American jihadi operating in Somalia, according to a CNN analysis of tweets exchanged in the lead up to Sunday’s attack.
U.S. investigators suspect Junaid Hussain, a British hacker now believed to be with ISIS, might have played a key role in inspiring the Texan gunmen, a U.S. official told CNN.
And a CNN investigation has established that Simpson was in communication via Twitter a week before the attack with a man believed to Mohamed Abdullahi Hassan, an American who traveled to Somalia in 2008 to join the al Qaeda-affiliated terrorist group Al-Shabaab.
Hassan, believed to be tweeting under the name of Mujahid Miski, also put out a call one week before the event to attack the drawing contest for pictures of the Prophet Mohammed in Garland, Texas.
The British ISIS hacker
Several hours before the attack in Garland, Simpson urged his more than thousand followers on Twitter to follow Abu Hussain al Britani (Twitter handle: @_AbuHu55ain).
Last year, Junaid Hussain confirmed to CNN in an online exchange that he tweeted under the name Abu Hussain al Britani. Several American organizations tracking jihadi websites have also identified them as one and the same.
Related: ISIS claims responsibility for Texas shooting
Just minutes after news broke of the Texas attack, al Britani tweeted: “Allahu Akbar!!!!! 2 of our brothers just opened fire at the Prophet Muhammad (s.a.w) art exhibition in texas! #TexasAttack.”
An hour before this tweet, al Britani retweeted Simpson’s tweet, apparently announcing he and his fellow shooter had pledged allegiance to ISIS leader Abu Bakr al-Baghdadi.
Hussain, a British radical hacker from Birmingham, allegedly joined ISIS in Syria at some point in the past two years. He was convicted and sentenced to six months in prison in 2012 for stealing former British Prime Minister’s Tony Blair’s address book online and posting it on the Internet. Before leaving for Syria, Hussain was part of the hacker group Team Poison and known as TriCK, several analysts who have tracked his online activities told CNN.
According to the U.S. official, U.S. investigators are looking at the degree to which Hussain inspired or had a hand in the attacks. He’s looked upon as a double threat: technically savvy and somebody who understands Western media and someone who knows how to lead, said the official.
Another official described Hussain as “a real problem” because of his ability to recruit online and inspire others to launch attacks in the West.
A third U.S. official told CNN, “Hussain is a significant figure in ISIL. He’s a tech savvy public face. The belief is that he’s likely in Syria, but as you know it’s tough to know that for certain. One of the theories investigators are exploring is whether Simpson was just trying to gain Hussain’s approval and get on his radar or whether there was actually back and forth communication between the two men.”
In Syria, Hussain allegedly founded the pro ISIS “CyberCaliphate” hacking group, which came to prominence in January when it briefly took over the Twitter account of the U.S. Central Command.
“Hussain has been credibly linked to the CENTCOM Twitter account hijacking, and an account appearing to belong to him was also among those posting the hit list,” J.M. Berger, co-author of “ISIS: The State of Terror,” told CNN.
In an online exchange with CNN, Hussain denied involvement in the CENTCOM hack.
The American Al-Shabaab Fighter
Simpson was also in touch online with American Mohamed Abdullahi Hassan, according to an analysis of social media postings by CNN.
According to U.S. court documents, Hassan traveled to Somalia in 2008 from Minneapolis to join the terrorist group Al-Shabaab.
Court records also suggest Simpson wanted to also join the jihad in Somalia around the same time, investigators learned from taped conversations with an informant during a 2006-2010 FBI investigation.
It is not known whether Simpson and Hassan knew each other in person.
On April 23, a week before the attack, Simpson flagged the Texas event to Hassan over Twitter.
“When will they ever learn? They are planning on selecting the best picture drawn of Rasulullah (saws) in Texas,” Simpson tweeted, referring to Mohammed’s stature as the Messenger of God, illustrating he had grown angry about the event a week before it was held. He included a link to an online article by Breitbart about the event.
The tweet by Simpson was sent from a Twitter handle that is a small variation of the one he later used to claim allegiance to Baghdadi. Radical Islamists frequently change Twitter handles to circumvent suspensions.
Hassan retweeted his tweet. And then sent out this threat over Twitter, again linking the Breitbart article.
“The brothers from the Charlie Hebdo attack did their part. It’s time for brothers in the #US to do their part.”
CNN has located the thread he posted, which was also sent on April 23.
Hassan then followed up by posting pictures of several Jihadis including Paris kosher market shooter Amedy Coulibaly, with the message:
“If only we had men like these brothers in the #States, our beloved Muhammad would not have been drawn.”
The tweets by Hassan were sent from an account called Mujahid Miski. According to U.S. court documents, Hassan is also known as Miski.
The FBI had recently opened up a new investigation into Simpson’s radical activities, according to U.S. officials, but that did not keep him from driving across states to attack the event in Texas.