Quick Take On The Moscow Terror Attack

Wherein I try to parse things a little more nuanced than most analysts...

OK, everyone’s heard about the terror attack at Crocus Hall in Moscow, so I’m not going to waste time recounting the events.

I’ve been listening to various analysts over the last couple days; the usual suspects: Ray McGovern, Larry Johnson, Scott Ritter, Tony Schaffer, Colonel Lawrence Wilkerson, Aaron Mate and others. They all have various nuances and takes on who was likely behind the attack. Aaron Mate believes the ISISK attribution makes sense, and I think Schaffer and Wilkerson believe ISIS-K at least has the capabillity of pulling it off.

To keep it short, I tend to accept Scott Ritter’s analysis which is more precise and takes more points into account, in my view, than that of the others. I particularly don’t agree with Mate and Schaffer and Wilkerson although their opinions merit serious consideration.

There is also a mostly irrelevant discussion going on as to whether former State Department official Victoria Nuland, in her statement in late January in Ukraine concerning “unpleasant surprises” for Putin, was referencing the terrorist attack in advance - much like both her and Biden telegraphed the Nordstream Pipeline bombing.

Here is my take on all of this. This is subject to further information coming out from Russia or elsewhere going forward, obviously.

1. One of the three intelligence agencies - the CIA, the British Mi6, and the Ukrainian GRU was involved. Despite what Schaffer and Wilkerson believe about the capabilities of ISIS-K, this operation would seem unlikely to have been planned and carried off by a group such as ISIS-K and particularly this particular cell (more on that below). Which is not to say that they were not INVOLVED…

2. Given that ISIS-K is a creation of and supported by the US CIA, and probably with the assistance of the British Mi6, this immediately puts the onus on the US and the UK to prove they were NOT involved.

3. I believe that the CIA and/or Mi6 reached out to their networks of assets connected with ISIS-K and floated a plan to use THEIR asset networks to conduct a strike on Moscow, in the same manner that ISIS-K struck in Iran in January, 2024. It’s even likely that the Iran strike was INTENDED as a “dry run” for the purposes of establishing that ISIS-K was now a force to be reckoned with inside Russia.

4. ISIS-K (or the CIA/Mi6) as I said above used its network of assets to recruit the Tajiks which have been arrested as the actual operators who conducted the attack.

5. The Ukrainian GRU would have been recruited to assist this operation based on the fact that they have a support network inside Russia, which has been demonstrated many times over the past two years. While ISIS may have a support network inside Russia, it’s likely that many of its operatives are known to Russian internal security, so securing logistical assistance from Ukrainians unknown to internal security both inside Ukraine and inside Russia would have been preferable for operational security.

6. When Victoria Nuland was in Ukraine at the end of January, she would have had talks with both the local CIA station chief in Kiev as well as the head of the Ukrainian GRU, Kyrylo Oleksiiovych Budanov. While as other analysts such as Larry Johnson has stated that she would not have been privy to to the details of the operation - due to her having, as Larry put it, a “big mouth” - there is every reason to believe that she could easily have been informed that some major operation was going to be carried out without being given any details, thus leading to her “big surprises” comment. Beyond that, this is irrelevant.

7. The US State Department issued a warning - whether directly to the Russian government or merely through the US Embassy in Moscow to US citizens and others in counry is not clear - on March 7, 2024. The US now claims that it warned the Russian government. The Russians on the other hand claim any “warning” was “of a general nature”. The BBC reported 6 days ago:

   Three days before the attack, Russian President Vladimir Putin addressed the board of Russia's Federal Security Service (FSB), whose job is to defend the country. The top priority, he told the assembled leaders of the security service, was to support what he called the special military operation - the official phrase for the full-scale invasion of Ukraine.

   He claimed that Ukraine had switched to what he called "terrorist tactics". He also spoke directly to what he said were "provocative statements" from the West about potential attacks within Russia. He said the warnings "resemble outright blackmail and the intention to intimidate and destabilise our society".

This suggests that Russia attributed any warning or any notifications of an imminent attack issued by the US Embassy in Moscow as an attempt to disrupt the upcoming Russia election which occurred on 15-17 March, 224.

8. On March 7, whether coincidentally or not, Russia reported having arrested an Islamic State cell plotting an attack on a synogogue. Significantly, as quoted in the report: “The attackers opened fire during the attempted arrest and were ‘neutralized by return fire’, the FSB said.” We will return to this later.

9. Subsequent to the warning, a major concert was to be given by the very patriotic Russian band “Shaman” which would have included a number of Russia dignitaries on March 9th. The Russians now say that they have photographic evidence that at least one of the terrorists was seen near the venue prior to that date. However, apparently security was very high and the terrorists concluded they could not get into the venue without forcing a firefight with security, so the attack was postponed - but not called off.

10. Then the attack occurs on March 22nd. The attack began at 7:54PM with the terrorists opening fire at 7:58PM. The attackers, after opening fire on the crowd, remained in the building and set it on fire and did not leave the building until 8:11 PM so the attack lasted approximately 12 minutes, although depending on when one considers the attack to have “ended”, it could be as long as 20-25 minutes as many people could not get out the building for that long due to the fire.

11. Much is being made of the claim that the US denied that Ukraine was involved “within 55 minutes of the attack.” I am unable to locate any source which confirms this. There IS a report from Almayadeen Web site which was issued on 21:14PM (or approximately 9:14PM) at its location on March 22, which quotes John Kirby, the US National Security Council spokesman saying “"I would disabuse you at this early hour of any connection to Ukraine”. This appears to be the report being cited by Larry Johnson. If anyone can give me a link to any OFFICIAL US statement which was issued in that specific time frame, let me know in the commente below. It appears that this issue is central to many analysts’ opinion of what happened. In my view this is irrelevant, since it is obvious that the US would make that claim regardless of whether they knew Ukraine was involved or not.

12. As to the issue of Ukraine involvement, we have new information today. News outlets are reporting that Russia has evidence that the terrorists obtained funding in cash and cryptocurrencies from or in Ukraine. As Larry Johnson pointed out on Judge Andrew Napolitano’s Youtube channel today, it is possible that the blockchain, which keeps a record of every crytocurrency transation, will provide further evidence and possibly links to the terrorist’s support network or sponsors. However, I would caution that this is not necessarily the case, as there are mechanisms which hackers use to disrupt the trail of cryptocurrency transactions and such mechanisms may or may not have been available to these terrorists. Tass reports "Investigators’ work with the detained terrorists, the examination of technical equipment that was seized from them and the analysis of information about financial transactions prove their connection to Ukrainian nationalists," the statement said.” The reference to “technical equipment seized from them” would indicate that phones or computers were used to trace the transactions. If that’s the case, the evidence connecting them to Ukrainians should be available.

13. My main opinion has been formed by listening to Scott Ritter on several of his interviews (the latest Thursday) since the event. He makes the following arguments in various interviews:

    1. The “Islamic” terrorists were poor “Islamists.” They committed a terrorist act during the holy month of Ramadan which he believes actual pious Islamists would not do. Further they executed the ritual of pointing to the sky with one finger, a gesture which is associated with Islamic State and refers to the Muslim belief that there is only one god in the alleged video released by ISIS (see below) with the “unclean” right hand when it should have been executed with the left hand.

    2. They were also poor “terrorists”. ISIS terrorists in such an attack would not abandon the attack and attempt to escape. They would continue to open fire until shot dead by responding law enforcement. In the incident reported above which I noted, that is indeed what happened: when confronted, the IS cell opened fire and were shot dead.

    3. His conclusion is that these were Tajik “thugs” who were hired for money to commit this attack and that since they were fleeing in the direction of Ukraine that they had connections in Ukraine.

    4. IIRC he also mentioned that there were reports that the Russians had communication intercepts between the terrorists and a contact in inside Ukraine who reportedly had arranged for the terrorists to have a border crossing.

    5. He also criticized the publication of ISIS-K’s claim of responsibility on its Telegram channel, stating that this is not what ISIS-K does after incidents. According to Ritter, they strictly publish their communiques taking responsibility from their HQ and its official Al Bayan radio station and not via Telegram. What does get released from Telegram is from Amaq News Agency, a group which appeared some years ago and gradually grew “affiliated with” ISIS. This group is acknowledged as NOT being directly in the ISIS-K news media apparatus. I’ll return to this below. Also The Telegraph Web site mentioned the following in its report (archived) on the ISIS-K claim:

       Although the Telegram post did not attribute the attack to a specific branch of IS, the US believes it was conducted by members of the Islamic State-Khorasan, or IS-K. American security sources, including a senior counterterrorism official, have confirmed as such to the New York Times.

       Note the part in bold. The assertion that this is ISIS-K is made by US intelligence officials.

       Further, another report (archived - in Arabic - use a Web page translator) quoted the alleged ISIS group as saying the following:

       About an hour after the attack, IS claimed responsibility for the attack, noting that its members were able to withdraw from the site of the attack to their bases safely.

       Which clearly is not the case as the suspects were captured fleeing toward either the Belarus or Ukrainian borders in the same car they fled the Crocus Hall in. Aljazeera reported:

       Russian politician Alexander Khinshtein said the attackers had fled in a Renault vehicle that was spotted by police in the Bryansk region, about 340km (210 miles) southwest of Moscow on Friday night and disregarded calls to stop.

       He said two people were arrested after a car chase and two others fled into a forest. From the Kremlin account, it appeared they, too, were later detained.

       Khinshtein said a pistol, a magazine for an assault rifle, and passports from Tajikistan – a Central Asian state that used to be part of the Soviet Union – were found in the car.

       Note also that in the video released, the alleged four men are wearing baseball caps and face masks which means it can’t be said that it is indeed the same four men.

14. In addition to Scott Ritter’s reports, I just found this report by one Habib Al Badawi, described on LinkedIn as a Professor at the Lebanese University - Expert in Japanese Studies & International Relations. He published the following on March 23, 2024:

    2.1. Communication Intercepted: Electronic surveillance conducted by Russian security agencies intercepted suspicious communications between the perpetrators and individuals situated in Ukraine. These communications, which included discussions about the logistics of the attack and possible escape routes into Ukrainian territory, raise alarming questions about the extent of Ukrainian complicity in the incident.

    2.2. Travel Patterns: Examination of travel records and border surveillance data indicates that the perpetrators either had a recent travel history to Ukraine or maintained connections with individuals residing in the country. Such travel patterns suggest a plausible link between the attackers and elements within Ukrainian territory, casting further suspicion on their motives and affiliations.

    2.3. Weapon Procurement: Preliminary findings from the investigation suggest that the firearms used in the shooting may have originated from sources within the discovery of potential links to Ukrainian suppliers or arms traffickers underscores the need for a comprehensive investigation to trace the procurement chain and establish culpability.

    2.4. Financial Transactions: Financial records obtained during the investigation reveal a series of suspicious transactions involving individuals or entities based in Ukraine. These transactions, which may indicate financial support provided to the perpetrators or their associates by Ukrainian sources, raise significant red flags regarding the financing and orchestration of the attack.

    I can not vouch for this individual as he does not provide links to his sources. Worse, I can’t find any sources because Google Search - for some reason - has been amazingly unhelpful in providing valid responses to searches conducted with phases as “Crocus terrorist communications” and other such searches. I rarely get so many “It looks like there aren't many great matches for your search” responses from Google on relatively simply queries. One wonders…

Badawi prefaced his report with the following comment:

“In my draft study, titled 'Understanding the Roots of the Russian-Ukrainian Conflict: Causes, Course, and Future Trajectories,' published on September 27, 2023, I delved into the phenomenon of 'Delivery on Demand' as the standard operational procedure for ISIS's terrorist acts. This investigation is slated to be featured in 'East of Europe. Humanities and Social Studies Wschód Europy. Studia humanistyczno-społeczne' at Maria Curie-Skłodowska University (UMCS). The decentralized structure of the organization enables autonomous planning and execution by individuals or small cells without direct orders from central leadership, facilitating various operational strategies pursued by numerous international agencies.”

I submit that the last statement - particularly the clause “facilitating various operational strategies pursued by numeroud international agencies” hits the nail on the head. In other words, these cells, not being directly controlled by ISIS-K HQ, can easily be coopted by intelligence agencies or other groups into doing their bidding. Stated still further, as we all know, in intelligence circles nothing is what it seems, no one is who they claim they are and “false flags” - where one group operates under the guise of being another group - are common.

Which means that we can not be certain that the Amaq News Agency - which I noted above is the organization which released all the news, videos, and reports allegedly from ISIS-K claiming responsibility - is not itself a CIA/Mi6 “front”. One would presume that it would not dare to associate ISIS-K with such an operation if ISIS-K were not involved - but then, again, we don’t know the depth of ISIS-K’s involvement, if any, because we only have this group’s and western intelligence assertions of that. Can we even be sure that Amaq News Agency is who THEY claim to be?

I conclude at this point that what happened is as follows:

1. The CIA and/or Mi6 used their assets in the region either to suggest this operation to ISIS-K or coopted an existing operation or network by ISIS-K.

2. Ukraine was brought to launder the money - which would be easy given the level of corruption and the “black money” washing around in Ukraine - and also to provide logistical support as needed either inside Ukraine and/or inside Russia.

3. The Tajiks were recruited by either some CIA/Mi6 IS assets or by ISIS-K (if they were actually involved at some level.)

4. The Tajiks received their logistical support - weapons, etc. - from Ukraine.

5. The initial attack was intended by the CIA/Mi6 to disrupt the Russian election. When that failed due to heavy security, the operation was rescheduled.

6. An Islamic State cell was primed to conduct an operation shortly before the Crocus operation in order to provide “proof” that ISIS-K was operating in Russia and behind the Crocus operation.

7. The State Department issued their “warning” message to both 1) cover their butts due to the “duty to warn” protocol, 2) contribute to the disruption of the election, and 3) to establish further that an Islamist attack was forthcoming.

8. Once the attack occurred, the preprepared cover story was immediately put out by the US, UK and French governments that Ukraine had nothing to do with it and that ISIS-K was responsible.

9. Subsequently the Amaq News Agency put out what was allegedly ISIS-K’s report and videos on the terrorists and the attack. This in particular convinces everyone that the terrorists were ISIS-K and that ISIS-K operated entirely alone and was the entire sponsor of the operation.

In short, this was a perfectly prepared “false flag” operation designed, constructed and operated by western intelligence agencies with the intent of disrupting the Russian election - and when that objective failed, resorted to simple mass murder.

Unfortunately, unless the Russian investigation digs up more detailed information as to the connections with Ukrainian intelligence and/or direct evidence of CIA/Mi6 intelligence involvement, and also compiles and publishes that information either to the UNSC or elsewhere, we probably can never be sure who was behind it.

What we CAN be reasonably sure of is that this was not the simple ISIS-K terrorist attack that the West is pushing as its narrative, specifically that ISIS-K hates Russia and simply conducted this attack out of the blue with zero western or Ukrainian involvement. This is a valid conclusion simply because no western government or intelligence agency is capable of making a factual statement. In other words, it’s always lies.

If I get more specific information going forward, either supporting or debunking my current opinion, I’ll either do a follow-up piece or post a Substack Note.