Zarrar Shah


Zarrar Shah is the Lashkar-e-Taiba's communications and technology chief, and also one of its primary liaisons with the Pakistani intelligence agency ISI. According to The New York Times, Shah is "a senior Lashkar commander" and "a central character" behind the plot of the 2008 Mumbai attacks. Fox News reports Shah communicated with gunmen over the telephone and helped direct their activities as he watched the events unfold on television.

Early life

Shah was born on 16 April 1979, according to a report by ProPublica and Frontline. In a 2009 Pakistani First information report released by the South Asia Terrorism Portal, Shah's birth name was listed as Abdul Wajid, Zarrar Shah and Rana were said to be his aliases. The FIR revealed his father's name was Nazir Ahmed, who was a resident of Nangal Sahdan village in Ferozewala Tehsil, Sheikhupura District. Shah's existence was known to Indian authorities since 2006 at least. According to a BBC Urdu article, Shah's real name was Qari Zarar, he was a member of the Harkat-ul-Ansar and he was involved in the 1995 kidnapping of western tourists in Kashmir. The article claimed he then came to Pakistan and joined the Jaish-e-Mohammed, and was wanted for terror cases in Pakistan.
In his late 20s, Shah became the emir of the Lashkar-e-Taiba media unit. This relatively young chief attracted the attention of Indian, American and British agencies. By September 2008, British agencies including the GCHQ were monitoring most of his digital activity and communications. Shah was also the LeT's communications and technology chief, and one of its primary liaisons with the Pakistani intelligence agency ISI. Sometime in 2006, Indian terrorist Abu Jundal met Shah and Zakiur Rehman Lakhvi at the LeT camp in Muridke. LeT militant Aslam Kashmiri, arrested in August 2009, also admitted to meeting Shah and Lakhvi.

2008 Mumbai attacks

Planning

According to the confession of attacker Ajmal Kasab, on the 13th day of the month of Ramzan in 2008, Kasab and the nine other attackers met Shah, who taught them how to make an outgoing call from Pakistan appear like it was dialed from another country. They were told Shah had a media room with detailed information about places in other countries, chose targets from among them and then relayed the targets to Zakiur Rehman Lakhvi. On the same day, CD footage and maps of the targets were shown to the attackers. Kasab in particular was shown targets like the Chhatrapati Shivaji Terminus station, Malabar Hill and city roads going to these two targets. The two attackers going to the Taj Mahal Palace Hotel were shown a 3D model of the hotel, created by its management as an advertising tool. The attackers could thus familiarize themselves with the architecture of the hotel, its entries and exits, and the city roads going to Leopold Cafe.
Kasab met Shah at a new LeT base in Muridke, where he and other attackers trained under Shah in the Daura-e-Riba course. They were taught how to decrypt and encrypt digital communications and operate multiple communication channels. They were also tutored on digital reconnaissance and surveillance. Shah then distributed wireless radios, GPS equipment, and satellite phones of the Hughes and Ascom brands connected over Thuraya networks. Shah and his unit stayed at the base for a week to train the attackers. At the Baitul Mujahideen camp, they were told about the plan to attack Mumbai for the first time. At the camp, LeT chief Hafiz Saeed declared Lakhvi as the mission commander; the junior commanders appointed were Shah, Abu Hamza, Abu Kahafa, Yousuf Muzzamil, Alqama and Shahid Jamil Riaz. The ten attackers were then taken to the LeT base at Azizabad graveyard south of Gulberg Town. At this base, Shah had his media room with many electronic devices. In September 2008, Lakhvi and his junior commanders met to discuss the timeline of the attack.
On 20 October 2008, Shah contacted the New Jersey based company Callphonex to inquire about Voice over IP systems. He posed as Kharak Singh, a Mumbai-based telephone merchant. The VoIP system would make it look like calls between the Pakistani handlers and Mumbai attackers were originating in New Jersey and Austria. The VoIP services purchased by Shah were paid for by LeT members from Karachi and Barcelona. Meanwhile, at a training camp in Pakistan administered Kashmir, Shah and other LeT handlers showed the ten attackers how to navigate to their targets in Mumbai by using Google Earth. They mapped out the sea route to be taken, the landing area in Mumbai, and the city roads the attackers would use to reach their targets. According to Indian police officer Deven Bharti, the attackers were taught how to locate sites in Mumbai even before they arrived in the city, primarily by using Global Positioning System equipment. The attackers were shown video footage of their targets filmed by David Headley and received by Shah.
On 22 October, Shah looked up past terror attacks in India, and researched potential targets including the Taj Mahal Palace Hotel and luxury hotels in Delhi. He went over weather forecasts for the Arabian Sea, and checked if there were any ongoing naval exercises on the route. He put the VoIP system in place, which would make his outgoing calls appear like they were originating from area code 201 in New Jersey. In November, Callphonex asked why there had been no usage of its systems till then. Shah, using his disguise as Singh, said utilization would begin at the end of the month. Callphonex was also worried when the Kharak Singh email address, after every email sent, showed a new IP address located in different countries. The communications network used in the attacks was much more sophisticated, if not multiple generations ahead of Indian police systems.
Five Austrian Direct inward dial numbers were purchased from Callphonex and used by the terrorists. The New Jersey number also purchased was a virtual number, and it was used to route the calls from the handlers to the attackers. The New Jersey number was paid for by a MoneyGram payment. The five Austrian numbers were paid for by a Western Union transfer from Pakistan to an agent in Brescia, Italy. According to journalists Adrian Levy and Cathy Scott-Clark, this communication network was created by Shah working in concert with the Owls, a group of young and unemployed technology students recruited from Karachi, Dubai and Gulf countries. Callphonex inquired why the payment came from Pakistan when the services were purchased by an Indian, but did not receive a response.
On 21 November, Shah gave each attacker one Nokia cell phone with Indian SIM cards, which would activate only after they entered Mumbai waters. The attackers were told to switch their phones on only after they arrived in Mumbai. Lakhvi told the attackers Shah had stored a mobile number in their phones which they could call to talk to their handlers. The Nokia India and USA branches found these cellphones had unique IMEI numbers and were purchased from Nokia China by Pakistani sellers. On 22 November, Shah went along with the attackers as they travelled from the Azizabad base to Keti Bandar, where they boarded the boat going to Mumbai. Shah tracked and guided the attackers via GPS as they sailed towards Mumbai.
On 24 November, Shah arrived at Malir Town in Karachi, where he established a digital control room with help from Indian terrorist Abu Jundal. This room was used by Shah and other LeT commanders to guide the attackers. On 25 November, Abu Jundal checked if the VoIP system was working, while commanders Shah, Lakhvi and Sajid Mir waited for news updates on the attacks. On 26 November, the day of the attack, Shah wrote a press release claiming responsibility for the attack by the fake Hyderabad based group Deccan Mujahideen, and began to circulate it through his network. Before the attacks began, Shah looked up images of the Oberoi Hotel, and Wikimapia maps of Taj Mahal Palace Hotel and Nariman House.

Execution

Shah and other LeT members in the control room fasted throughout the day, and broke their fasts just before they started watching live news on the attack. Shah and the other handlers were constantly in touch with the ten attackers through cell phones, the VoIP system and Thuraya satellite phones. Upon entering CSMT, Kasab thought the crowd there was fewer than what he had seen in the CD shown by Shah. They tried to contact their handlers, but could not get through because of low network coverage.
The other handlers at the control room were reportedly Abu Jundal, Major General, Kafa, Wassi, and Buzurg. According to a US military intelligence official quoted by Bill Roggio, the Major General mentioned here was Hamid Gul. According to the call recordings analyzed by Indian authorities, all the handlers except Kafa talked to the attackers at Nariman House. However, only Kafa, Wassi and Shah talked to the attackers at the Oberoi Hotel; and only Wassi talked to the attackers at the Taj Mahal Palace. After attackers Fahadullah and Abdul Rehman killed their non-Muslim hostages at the tenth/eleventh floor of the Oberoi Hotel on 27 November, Shah told Fahadullah to search for routes to the lower floors. When National Security Guard commandos were para-dropped at Nariman House on 28 November, Shah started looking for news updates, searching for terms like Jew, Israeli and Chabad.

Aftermath

Officials of the Intelligence Bureau, India's internal security agency, claimed they were not monitoring Shah's online movements as reported by the ProPublica and Frontline investigation. They said Shah's laptop activity and the naval route he mapped were shared by the GCHQ only after the attacks began. Before the attacks, GCHQ believed the intelligence they had was not detailed enough to be shared with Indian agencies. British, Indian and American agencies did not share their information with each other before the attack. After the attack began, the agencies started collating their data to establish the planning and timeline of the attack. Shivshankar Menon, the Indian foreign minister at the time, said the data was available but the analysis was lacking. Menon said the monitoring of Shah showed the limitations of signals intelligence without proper analysis.
Investigations of Shah's computer and email accounts revealed a list of 320 locations worldwide deemed as possible targets for terrorist attacks similar to the Mumbai attacks. Only 20 of the targets were locations in India. Analysts believed the list was a statement of intent rather than a list of locations where LeT cells were established and ready to attack. Shah was researching targets in Kashmir, Punjab, India, New Delhi, and Afghanistan, as well as United States Army bases in Germany and Canada. M. K. Narayanan, then the Indian National Security Advisor, asked American officials to provide Shah's list of potential targets. In 2014, the New York Times released a redacted National Security Agency document, which revealed Shah had researched multiple locations like the Gateway of India, other tourist sites, dams, power plants, and potential landing areas for the attackers' boats.
On 2 February 2009, in an interview with Karan Thapar on the CNN-IBN channel, Narayanan said Shah and Lakhvi were practically under house arrest and were not actually imprisoned. On 29 July 2009, Manmohan Singh, the Prime Minister of India at the time, said the Pakistani Federal Investigation Agency had sent a dossier with details of its investigation. According to Singh, the dossier said Pakistan had extensive proof confirming the LeT carried out the attack. The dossier further detailed the charges filed against Shah and Lakhvi under the Anti-Terrorism Act 1997. Shah and Lakhvi were also charged with mass murder, abetment to murder, misuse of encryption and cyberterrorism. Analyst Prem Mahadevan argues Shah's arrest was allowed because the LeT's cybersecurity and communications were compromised under his watch. Mahadevan postulates Shah was "burned" to avoid blowing the cover of the ISI agents involved.
In March 2009, Shah, Lakhvi and Yousuf Muzzamil Bhat, all imprisoned at the time, were replaced as LeT commanders in Kashmir by Abu Anas, Hyder Bhayee, Huzefa and Walid. Also in March 2009, Shah's involvement and his real name were uncovered after a joint effort by the Federal Bureau of Investigation and Indian agencies. They recorded Shah's voice from the VoIP calls, and questioned LeT terrorists imprisoned in India and elsewhere about his identity. Kasab confirmed Shah's identity, however, he was not aware Shah's real name was Abdul Wajid. The FBI also wanted to interrogate Shah's co-accused Mazhar Iqbal, also known by his alias Abu Alqama.
On 26 August 2009, Interpol issued red corner notices for Saeed and Lakhvi. India also appealed for notices against Shah and Alqama after providing the evidence against them, Interpol said it was still examining this evidence. The red corner notices were issued after the Indian Central Bureau of Investigation submitted non-bailable warrants approved by investigating judge M. L. Tahaliyani on 23 June.
In December 2009, Indian authorities requested the FIA to send photographs and voice samples of Wajid/Shah so they could comprehensively confirm his identity. However, the FIA did not respond. The FBI wanted to interrogate Shah about any Pakistani officials or government organizations who helped them execute the attacks, among other things. According to Indian think tank Observer Research Foundation, Brigadier Riaz Chibb of the ISI regularly communicated with Shah and other LeT commanders. After the 2008 bombing of the Indian embassy in Kabul, India received intercepted calls between the attack's planners and ISI officials, provided by US agencies. Some numbers the Mumbai attackers called belonged to these officials, according to Indian journalist Prem Shankar Jha. Also, Shah was in touch with the ISI even after the LeT was officially banned in Pakistan. Sajjad Ahmed, an LeT militant captured in Rafiabad in Kashmir, claimed Lakhvi and Shah were the most prominent commanders at LeT training camps.
The FBI evidence named "A", a LeT commander the Pakistani government knew about, who had significant powers in the LeT. According to a Times of India journalist, "A" was actually Zarrar Shah. As of 2016, seven years after the attacks, Indian authorities were still waiting for the complete records GCHQ and other Five Eyes agencies had on Shah. Indian officials said GCHQ probably had access to all of Shah's emails, and the technology to record all the conversations in the Karachi control room. Western agencies also probably accessed all devices linked to the VoIP system. Indian officials said Western agencies did not share this information to avoid incriminating the ISI and damaging their relations. As of 2014, according to journalist Sebastian Rotella, Shah and other LeT commanders were able to execute acts of terror from their jail cells. According to former American intelligence agents, they had a control room in Adiala Jail similar to the one they had in Karachi.

Claims of fake persona

According to Indian journalist Praveen Swami, many Indian officials believe Zarrar Shah is just another alias of Sajid Mir. Swami says Abdul Wajid might be a junior Lashkar member who was arrested and said to be Zarrar Shah, because the FBI was denied approval to interrogate him. However, the FBI was also refused access to Lakhvi and Mazhar Iqbal. Swami says voice samples and photographs of Wajid were not sent to Indian authorities because this would confirm Wajid was not the person behind the Shah alias. However, voice samples and pictures of Lakhvi and Mazhar Iqbal were also not provided.

Trial

On 10 December 2008, Pakistan announced the arrest of Shah for his role in the Mumbai attacks. Shah was one among ten to twenty LeT militants arrested during raids in PaK. Shah and Lakhvi were reportedly arrested from an LeT camp near the PaK capital of Muzaffarabad. Admiral Michael Mullen, the US Chairman of the Joint Chiefs of Staff, praised the raid and arrests, saying they were initial steps towards peace in the region. On 31 December 2008, Pakistan announced Shah's confession of LeT's involvement and his own central role in the attack. According to Pakistani officials, Shah's interrogation confirmed most of the details obtained from Ajmal Kasab, the only captured attacker. However, Farhatullah Babar and Sherry Rehman said they were not aware of any such confessions. Shah was among 35 LeT operatives wanted by the Mumbai Police for planning and facilitating the attack between December 2007 and November 2008. Voice recordings of Shah, Lakhvi and three others were taken from the calls they had with the attackers. However, these recordings were not admissible in Indian courts as they could not be attributed to official sources.
In January 2009, the FBI sent its evidence to Pakistan, including the call transcripts of Shah, Lakhvi and the attackers; and the fake email claiming responsibility for the attack sent by Shah. As of February 2009, the FBI hadn't received Pakistan's approval to interrogate Shah and Lakhvi, according to David C. Mulford, the US Ambassador to India. There were also reports about the ISI refusing to hand over Shah and Lakhvi to the FIA. On 12 February, Rehman Malik, interior adviser to the prime minister, said Shah was still in custody and allegedly wrote the emails claiming responsibility for the attacks. Malik also refused Indian demands for the extradition of Shah and Lakhvi, and said they would be tried only in Pakistan. The government prepared for the trial to be held on camera, and checked its anti-terror statutes for potential amendments, as there were no provisions for prosecuting acts of terror executed outside Pakistan.
On 15 February 2009, Shah was remanded to FIA custody by Anti-Terrorism Court judge Sakhi Muhammad Kahut. Shah was to be held in FIA custody till 3 March. On 4 March, Kahut extended his remand by two weeks. On 7 March, the FIA told the interior ministry it might have to stop the investigation because India and other countries were not sending the required evidence. On 19 March, Kahut extended the remand by 14 days, as the accused were scheduled to see the CD footage of the attack sent by India. On 14 April, Kahut remanded Shah, Lakhvi and two others to two weeks custody till 28 April, as the FIA hadn't finished its charge sheet till then. On 28 April, an interim charge sheet was filed.
On 12 May, the ATC granted the FIA more time to submit the final charges against Shah and the other accused. The same day, the US Embassy in Islamabad sent a cable to the US Secretary of State which was published by WikiLeaks. The embassy appreciated the FIA's investigation and the strong case it had, but said the agency did not have enough evidence to convict the five accused. The embassy said such evidence was not shared by India, and in cases where evidence was shared, it was never judicially certified and usually of low quality. The FIA needed either the call recordings of the LeT handlers, "or a sworn testimony by suspects in Indian custody regarding the recordings". The FBI also could not share the evidence without Indian authorization. The embassy officials lamented the possibility of the LeT handlers' acquittal because of a lack of evidence.
Also on 12 May 2009, Anne W. Patterson, the US Ambassador to Pakistan at the time, sent a diplomatic cable which said the evidence India was sending to Pakistan was not judicially certified. Patterson said Pakistan would have to acquit Shah and Lakhvi because of this issue. On 6 June, the presiding judge adjourned the trial of Shah and others till 20 June. In July, the FIA submitted its report to the ATC with details of all the accused including Shah. On 18 July, the updated charges were filed. In August, presiding judge Baqir Ali Rana banned media coverage of the trial. On 5 September, Rana adjourned the case till 19 September. Rana reportedly received death threats from the LeT due to his role in the trial. He asked to be recused from the case, and was replaced by Malik Muhammad Akram Awan in October 2009.
Shah and the four other accused were tried on camera at Adiala Jail in Rawalpindi to maintain secrecy. Their lawyers were told to not talk about the case. Pakistani newspaper Dawn News claimed the trial was held on camera to ensure the safety of the judge, lawyers and witnesses. On 25 November 2009, all the accused pleaded not guilty when the charges against them were filed. Their trial was scheduled to begin on 5 December. The charge sheet stated Shah and Mazhar Iqbal ordered the attackers to murder as many people as they could. Defence lawyer Rajput said he could not estimate when the case would conclude, because the ATC was trying many other cases at the time. From May 2009 to May 2010, the court conducted more than ten hearings. According to Rajput, the charges levied against the five accused were not comprehensive, which would prolong the case.On 27 January 2010, Pakistani prosecutors said the evidence they had was enough to prosecute Shah, Lakhvi and five other accused. However, on 25 April, Pakistani officials suggested the trial of these seven could not conclude till India extradited Kasab to Pakistan as a witness. The prosecution's motion for permitting Indian witnesses to appear through video conferencing was scheduled on 18 September 2010. Defense lawyers protested the motion, saying it was not approved under Pakistani law at the time. On 24 December 2010, India suggested a commission visit Pakistan to question Shah and Lakhvi and get their voice samples.
On 13 September 2012, judges Hameedur Rahman and Noorul Haq Qureshi of the Islamabad High Court rejected the FIA's plea to record voice samples of Shah, Lakhvi and five other accused. On 11 November 2012, during an ATC hearing, Crime Investigation Department officials said Shah, Lakhvi and three others trained the Mumbai attackers at Yousaf Goth in Karachi's Gadap Town, and Mirpur Sakro in Thatta. The hearing was adjourned to 17 November. At the same time, the FIA asked the ATC to conduct daily hearings, and the Pakistani administration suggested amendments to the evidence law, removing the compulsory consent required for obtaining voice recordings from accused persons.
In May 2013, Chaudhry Zulfikar Ali, the FIA public prosecutor in the case, was assassinated in Pakistan's capital Islamabad. In April 2018, Chaudhry Azhar, the FIA prosecution chief in the case since 2009, was removed from the case and told to stop investigating it further. By then, the ATC had heard all the Pakistani witnesses, and said the case could not proceed until 24 Indian witnesses gave their statements in Pakistan. From 2008 to 2017, over a period of nine years, the presiding judges were changed nine times, and thus the case stalled indefinitely. In 2015, the Islamabad High Court ordered the case be concluded in two months. In April that year, Lakhvi was freed on bail while the other six accused remained in custody at Adiala Jail.
By January 2016, the ATC had heard 68 prosecution witnesses. The testimony of the last two witnesses was scheduled for May 2018, when the ATC resumed the case after Prime Minister Nawaz Sharif said 26/11 was probably executed by Pakistani terrorists, and the trial was delayed because of civilian-army intervention. Shahrukh Arjumand was the presiding judge, and he ordered the FIA to ascertain whether the 27 Indian witnesses in the case were willing to testify. The FIA hadn't informed the ATC about the position of the Indian witnesses since January 2016.

Books

*

Government documents

*

Research reports

*

News articles (in English)

  • '
*