Clues on Twitter Show Ties Between Texas Gunman and ISIS Network

Hours before he drove into a Texas parking lot last week and opened fire with an assault rifle outside a Prophet Muhammad cartoon contest, Elton Simpson, 30, logged onto Twitter.

"Follow @_AbuHu55ain," Simpson posted, promoting a Twitter account believed to belong to Junaid Hussain, a young computer expert from Birmingham, England, who moved to Syria two years ago to join the Islamic State and has become one of the extremist group's celebrity hackers.

This seemingly routine shout-out is an intriguing clue to the question of whether the gunmen, Simpson and Nadir Soofi, 34, both of Phoenix, were acting in concert with the Islamic State, also known as ISIS, in carrying out an attack outside a community center in Garland, Texas. The Islamic State said two days later that the two men, who were killed by officers after shooting a security guard in the leg, were "soldiers of the Caliphate." It marked the first time the terror group had attempted to claim credit for an operation carried out in its name on American soil.

As the gunmen were driving toward the Curtis Culwell Center, Hussain logged onto Twitter himself from half a world away, firing off a series of posts in the hour before the attack began at 7 p.m. on May 3. One message posted to his account at about 5:45 p.m. seemed to predict imminent violence: "The knives have been sharpened, soon we will come to your streets with death and slaughter!"

After the attack, Hussain was in the first wave of people who praised the gunmen, before his account was suspended.

Law enforcement has not presented any conclusive evidence that the Islamic State planned or directed the attack. Yet Simpson appears to have been part of a network of Islamic State adherents in multiple countries, including at the group's hub in Syria, who have encouraged attacks and had highlighted the Texas event as a worthy target.

Counterterrorism officials say the case shows how the Islamic State and its supporters use social media to cheerlead for attacks without engaging in the secret training, plotting and control that has long characterized al-Qaida. But a close look at Simpson's Twitter connections shows that he had developed a notable online relationship with some of the Islamic State's best-known promoters on the Internet, and they had actively encouraged such acts of terror.

Speaking of the Texas case last week, James B. Comey, the director of the Federal Bureau of Investigation, said that the distinction between an attack "inspired" by a foreign terrorist group and one "directed" by the group "is breaking down. It's not a useful framework."

Simpson was radicalized years before the Islamic State announced in 2014 that it was creating a caliphate, a unified land for Muslims, and drew global attention for territorial gains and brutal violence. He was investigated by the FBI starting in 2006 and was sentenced to probation in 2011 for lying to investigators. Like many young Muslims drawn by the sensational image of the Islamic State, he enthusiastically joined its virtual community of supporters.

An analysis of Simpson's Twitter account by the SITE Intelligence Group found that Simpson followed more than 400 other accounts, including "hardcore I.S. fighters from around the world." They included the alleged British fighter for the Islamic State "Abu Abdullah Britani," who according to SITE is believed to be Abu Rahin Aziz; a radical British national who skipped bail to join the terror group; an alleged American fighter, "Abu Khalid Al-Amriki," and numerous female Islamic State jihadists.

Many of Simpson's posts announced the new Twitter handles of ISIS members whose accounts the social media company had suspended, tweets commonly called "shout-outs."

"He was taking part in shout-outs of ISIS accounts that were previously suspended, and this shows a pretty deep involvement in the network online," says J.M. Berger, a senior fellow at the Brookings Institution and co-author of a book about the Islamic State. "He was wired into a legitimate foreigner fighters network."

Starting last fall, the Islamic State has repeatedly called for attacks in the West by supporters with no direct connection to its core leadership, and there have been at least six attacks in Europe, Canada and Australia by gunmen who appeared to have been inspired by the group. Each attacker left an online trail similar to that of Simpson, though not all were in contact with ISIS operatives in Syria.

A review of Simpson's Twitter account shows that he interacted not just with sympathizers of the Islamic State, but also with fighters believed to be in Syria and Africa. Some of these fighters later tweeted details of Simpson's biography not yet in the public sphere, suggesting that he had shared details about his life with them.

"The thing that clearly stands out if you peruse the Texas shooter's timeline is his third to last Tweet," the one promoting Junaid Hussain, said Daveed Gartenstein-Ross, a senior fellow who researches extremism at the Foundation for the Defense of Democracies and who shared a PDF of the shooter's Twitter history with The New York Times.

Veryan Khan, who helps run the Terrorism Research and Analysis Consortium, said that Simpson probably urged others to follow Hussain in order to draw broader attention to his forthcoming attack. "He wanted to make sure everyone in those circles knew what he'd done," she said. "It was attention-seeking - that's what it looks like," added Khan, whose organization tracks some 5,000 Islamic State figures and supporters.

While still living in Birmingham, Hussain rose to notoriety as a hacker working under the screen name Tr1Ck, and he was believed to be a core member of what was called TeaM p0isoN. The team claimed a string of high profile cyberattacks, hacking into a Scotland Yard conference call on combating hackers and posting Facebook updates to the pages of the platform's chief executive, Mark Zuckerberg, and former French President Nicolas Sarkozy.

Hussain was eventually arrested, and he served a six-month prison sentence before traveling to Syria. He has since been linked to a number of Islamic State hacking attacks overseas, though some security officials have doubts about his role.

Another well-known promoter of the Islamic State who engaged with Simpson was a jihadist known on Twitter as "Mujahid Miski," believed to be Mohamed Abdullahi Hassan, a Somali-American from Minnesota. Though Hassan lives in Somalia, he has emerged as an influential recruiter for the group.

On April 23, the account "Mujahid Miski" shared a link on Twitter to a listing for the cartoon contest in Garland and goaded his followers to attack it. "The brothers from the Charlie Hebdo attack did their part. It's time for brothers in the #US to do their part," he wrote. Among the nine people who retweeted his call to violence, according to SITE, was Simpson.

Three days later, Simpson reached out to "Mujahid Miski" on Twitter, asking him to message him privately. Whether they actually communicated, or what they may have said, is not publicly known. Minutes before Simpson arrived at the cartoon event in Garland and began shooting, he went on Twitter one last time to link the attack to the Islamic State. "The bro with me and myself have given bay'ah to Amirul Mu'mineem," he wrote, using the vocabulary of ISIS to say that they had given an oath of allegiance to the Emir of the Believers - the leader of the Islamic State, Abu Bakr al-Baghdadi.

"May Allah accept us as mujahedeen," he wrote, adding the hashtag "#TexasAttack."

Among those who retweeted this last post was Hussain, the ISIS hacker in Syria. "Allahu Akbar!!!!" he wrote. "2 of our brothers just opened fire at the Prophet Muhammad (s.a.w) art exhibition in Texas!" he added, using the Arabic abbreviation for "peace be upon him."

After Simpson's death, "Mujahid Miski" tweeted a series of posts, calling Simpson "Mutawakil," or "One who has faith," a variation on Simpson's Twitter handle of "Atawaakul," meaning "To have faith."

"I'm gonna miss Mutawakil," Mujahid Miski wrote. "He was truly a man of wisdom. I'm gonna miss his greeting every morning on twitter."