MUMBAI EAC MEETING AND AHMEDABAD BLAST UPDATE

UNCLAS SECTION 01 OF 02 MUMBAI 000365

SENSITIVE
SIPDIS

DEPT FOR DS/TIA/ITA AND DS/IP/SCA

E.O. 12958: N/A
TAGS: PTER ASEC PGOV IN
SUBJECT: MUMBAI EAC MEETING AND AHMEDABAD BLAST UPDATE

REF: MUMBAI 364


1. (U) American Consulate General Mumbai's Emergency Action
Committee met to discuss the July 26, 2008 bombings in
Ahmedabad, India. Since the initial attack on July 26, 2008 up
to fifteen improvised explosive devices have been found and
safely disarmed by police bomb squad personnel. EAC Mumbai
continues to monitor this situation.


2. (SBU) On Saturday, July 26, 2008, 16 to 17 improvised
explosive devices (IEDs) detonated in Ahmadabad, the major city
in the Indian state of Gujarat. The devices detonated over a 70
minute period commencing at approximately 1845 with the final
device exploding around 2000. The initial blasts appear to be
low-intensity IEDs placed in markets, residential areas, bus
stops, and finally hospitals. It appears that the IEDs at three
hospitals were timed to detonate as causalities from the initial
blasts were brought for treatment. Media reports state that a
vehicle borne improvised explosive devices were used at LG
Hospital and the Civil Hospital. The VBIED that targeted the
Civil Hospital was a Maruti WagonR with a factory installed 22.5
liter liquefied petroleum gas (LPG) tank. The bomb makers then
packed ammonium nitrate and additional liquefied natural gas
(LNG) cylinders into the rear hatch back storage compartment of
the WagonR where the LPG tank was installed. At this time all
devices appear to have used a timer (possibly a microprocessor)
and there are conflicting reports about the explosive
composition of the devices. Approximately 50 people were killed
in the attack. American Citizen Services personnel have received
no reports of American citizens killed or injured in the attack.


3. (SBU) Prior to the attacks in Ahmedabad an email was sent to
a number of media outlets in India by a group professing to be
the Indian Mujahideen in the Land of Hind claiming credit for
the attack, and promising further attacks against the India
states of Rajasthan, Uttar Pradesh, Madhya Pradesh, Andra
Pradesh, Karnataka, and Maharashtra. The email demands the
cities of Indore, Ujjain, Mumbai, and other cities in Karnataka
to release all detained members of the Student Islamic Movement
of India (SIMI) or else these cities will become the group's
next targets. For Maharashtra the email threatens action
against the state for the treatment of Madrasa students and
Muslim women on the Western railway line. The group also
voiced their dissatisfaction with the lack of prosecutorial
action against the perpetrators of 1993 Mumbai riots, when
compared to the prosecution of Muslims involved in the 1993
Mumbai serial bombing. Media reporting over the weekend claimed
that the Bombay Stock Exchange was listed as a potential target
in the email which is not accurate. The email specifically
mentions Indian industrialist Mukesh Ambani for "usurping"
property from the Muslim Waqf Board to build his new
multi-million dollar residence in Mumbai. The property was
previously an orphanage. A copy of the email has been forwarded
to DS/TIA/ITA.


4. (SBU) Indian police and security services determined that
the email was sent from an IP address that resolved to an
apartment in Navi Mumbai, a satellite community separated from
Mumbai by the Thane Creek. At approximately 2230 hours on July
26, 2007 Mumbai Police Anti-Terrorist Squad (ATS) officers
appeared at the apartment rented by American Kenneth Lee
Haywood, initiating a search of his residence and began
questioning Haywood about the email. Consulate personnel first
learned of the Navi Mumbai email connection on July 27, 2008
when coverage in the Sunday Times of India stated that the
Indian Mujahideen email originated from Haywood's apartment. DS
and Consular personnel linked Haywood's to an American
registered with the Consulate. Consular Section Chief verified
with the Mumbai Police that Haywood was indeed being questioned
by ATS personnel, but was not in custody. Latter in the day the
Consular Section Chief was able to make contact with Haywood who
stated he was being treated well and was cooperating with the
investigation. Haywood did note that there was a heavy media
presence outside his residence. ACS personnel spoke with
Haywood on July 28, 2008 and related that the Haywood was doing
well, but that ATS personnel had sealed his apartment office and
confiscated his hard drive. The individuals who sent the email
were able to exploit Haywood's wireless internet service, and
send the email via his IP address. ATS personnel have not
contacted the Consulate for assistance in the case, despite ATS
Chief Hemant Karkare claiming on Monday that "we have requested
the US Consulate and few other allied agencies to assist us in
verifying Heywood's background," to Mumbai's Daily News and
Analysis. ACS personnel have maintained regular contact with
Haywood since Sunday.


5. (SBU) Heywood's corporate attorney provided ACS with a series
of questions from Mumbai's Mid-Day News and Haywood's answers to
those questions:

MUMBAI 00000365 002 OF 002



Question: When did you realize the IP address had been hacked
into?
Answer: Saturday (26 Jul 08) at around 10pm I received a call
from the ATS in Delhi asking if I ran a cyber cafi. I told them
no I live here. Within 30 minutes, the ATS were at my door
telling me my internet had been compromised.

Question: Do you use wi-fi to connect to the net? If yes, do you
think it has been hacked to steal your IP address? If not do
you think a cyber hacker used software to clone your IP address?
Answer: Yes, I have a wireless router. The ATS are certain that
is what occurred.

Question: Is your laptop/desktop secure?
Answer: All computers are secure within my flat. However, the
Tata/VSNL Technician who setup the wireless router said it was
not necessary to setup security because the computers have
firewalls. He also disables the routers logging capability.

Question: What did the cops ask you?
Answer: From the beginning the police were reassuring me that I
had done nothing wrong. They wanted to know who had access to
my network. I talked to them for 72 hours. They asked me many
questions. The most often asked was has anyone had access to my
computers? (Only my family and the Tata-VSNL Technicians.)
We've come to know now that the router was not secure.

Question: What impression (of India, its police) has this
incident left on you?
Answer: The police/ATS have been very professional and
courteous. They have been have been helpful in addressing my
concerns. We are fully confident they will find the culprits of
this horrific act.

Question: Has the Anti-Terrorist Squad given a clean chit
officially?
Answer: The top ATS agents have continued to tell me how we have
completely cooperated. They have said nothing has been found to
implicate us. We have not been arrested nor has it ever been
suggested that we might be. I have been told that an official
statement will be coming soon. ATS in Delhi told me on the
phone that I was completely clear.

Question: Do you suspect someone?
Answer: I don't know who could have done this. The police are
handling the investigation.

Question: What is your biggest fear?
Answer: I fear for the safety of my family.


6. (SBU) On Sunday July 27, 2008 two additional Maruti WagonR
vehicles containing explosives were found in Surat, India. Both
vehicles had counterfeit Gujarat license plates, but a search of
their vehicle identification numbers indicated that the vehicles
came from Maharashtra. The Marutis were stolen from the Nerul
area of Navi Mumbai before being equipped with Gujarat license
plates and moving to Surat. On July 28, 2008 post's Senior
Foreign Service National Investigator spoke with Surat police
contacts to gather more information on the vehicles. According
to police sources one vehicle contained approximately 17 kg of
ammonium nitrate fuel oil mixture (ANFO),20 nine volt
batteries, one timer, and nuts and bolts which could be used for
fragmentation. The second vehicle contained 32 kg of ANFO, 30
detonators, and one battery. It us still unclear if the
vehicles were actually vehicle borne improvised explosive
devices, or vehicles being used to ferry explosives and other
materials to cells operating in Gujarat.


7. (U) Media reports on July 29, 2008 thirteen IEDs were
discovered in Surat over a four hour period. Surat Police bomb
squad personnel were able to defuse the each device. The
devices were found in the Varacha area of Surat. One device was
found in a tree near a police post.


8. (SBU) EAC Mumbai will continue to track the incident and
provide updates as necessary. RSO Mumbai personnel are speaking
with contacts in Ahmedabad to confirm the design of the IEDs as
well as to gather further information on the tactics, techniques
and procedures used in the hospital attacks. Post will also
work to develop additional information on the two explosive
laden vehicles recovered in Surat. RSO Mumbai plans to meet
with Haywood on July 30, 2008. Post does note that both the
Surat vehicles and the Indian Mujihadeen email originated from
Navi Mumbai. EAC Mumbai will meet on July 30, 2008 to discuss
the recent targeting of Surat.
FOLMSBEE