MUMBAI EAC MEETING AND AHMEDABAD BLAST UPDATE

UNCLAS SECTION 01 OF 02 MUMBAI 000365 SENSITIVE SIPDIS DEPT FOR DS/TIA/ITA AND DS/IP/SCA E.O. 12958: N/A TAGS: PTER ASEC PGOV IN SUBJECT: MUMBAI EAC MEETING AND AHMEDABAD BLAST UPDATE REF: MUMBAI 364 ¶1. (U) American Consulate General Mumbai's Emergency Action Committee met to discuss the July 26, 2008 bombings in Ahmedabad, India. Since the initial attack on July 26, 2008 up to fifteen improvised explosive devices have been found and safely disarmed by police bomb squad personnel. EAC Mumbai continues to monitor this situation. ¶2. (SBU) On Saturday, July 26, 2008, 16 to 17 improvised explosive devices (IEDs) detonated in Ahmadabad, the major city in the Indian state of Gujarat. The devices detonated over a 70 minute period commencing at approximately 1845 with the final device exploding around 2000. The initial blasts appear to be low-intensity IEDs placed in markets, residential areas, bus stops, and finally hospitals. It appears that the IEDs at three hospitals were timed to detonate as causalities from the initial blasts were brought for treatment. Media reports state that a vehicle borne improvised explosive devices were used at LG Hospital and the Civil Hospital. The VBIED that targeted the Civil Hospital was a Maruti WagonR with a factory installed 22.5 liter liquefied petroleum gas (LPG) tank. The bomb makers then packed ammonium nitrate and additional liquefied natural gas (LNG) cylinders into the rear hatch back storage compartment of the WagonR where the LPG tank was installed. At this time all devices appear to have used a timer (possibly a microprocessor) and there are conflicting reports about the explosive composition of the devices. Approximately 50 people were killed in the attack. American Citizen Services personnel have received no reports of American citizens killed or injured in the attack. ¶3. (SBU) Prior to the attacks in Ahmedabad an email was sent to a number of media outlets in India by a group professing to be the Indian Mujahideen in the Land of Hind claiming credit for the attack, and promising further attacks against the India states of Rajasthan, Uttar Pradesh, Madhya Pradesh, Andra Pradesh, Karnataka, and Maharashtra. The email demands the cities of Indore, Ujjain, Mumbai, and other cities in Karnataka to release all detained members of the Student Islamic Movement of India (SIMI) or else these cities will become the group's next targets. For Maharashtra the email threatens action against the state for the treatment of Madrasa students and Muslim women on the Western railway line. The group also voiced their dissatisfaction with the lack of prosecutorial action against the perpetrators of 1993 Mumbai riots, when compared to the prosecution of Muslims involved in the 1993 Mumbai serial bombing. Media reporting over the weekend claimed that the Bombay Stock Exchange was listed as a potential target in the email which is not accurate. The email specifically mentions Indian industrialist Mukesh Ambani for "usurping" property from the Muslim Waqf Board to build his new multi-million dollar residence in Mumbai. The property was previously an orphanage. A copy of the email has been forwarded to DS/TIA/ITA. ¶4. (SBU) Indian police and security services determined that the email was sent from an IP address that resolved to an apartment in Navi Mumbai, a satellite community separated from Mumbai by the Thane Creek. At approximately 2230 hours on July 26, 2007 Mumbai Police Anti-Terrorist Squad (ATS) officers appeared at the apartment rented by American Kenneth Lee Haywood, initiating a search of his residence and began questioning Haywood about the email. Consulate personnel first learned of the Navi Mumbai email connection on July 27, 2008 when coverage in the Sunday Times of India stated that the Indian Mujahideen email originated from Haywood's apartment. DS and Consular personnel linked Haywood's to an American registered with the Consulate. Consular Section Chief verified with the Mumbai Police that Haywood was indeed being questioned by ATS personnel, but was not in custody. Latter in the day the Consular Section Chief was able to make contact with Haywood who stated he was being treated well and was cooperating with the investigation. Haywood did note that there was a heavy media presence outside his residence. ACS personnel spoke with Haywood on July 28, 2008 and related that the Haywood was doing well, but that ATS personnel had sealed his apartment office and confiscated his hard drive. The individuals who sent the email were able to exploit Haywood's wireless internet service, and send the email via his IP address. ATS personnel have not contacted the Consulate for assistance in the case, despite ATS Chief Hemant Karkare claiming on Monday that "we have requested the US Consulate and few other allied agencies to assist us in verifying Heywood's background," to Mumbai's Daily News and Analysis. ACS personnel have maintained regular contact with Haywood since Sunday. ¶5. (SBU) Heywood's corporate attorney provided ACS with a series of questions from Mumbai's Mid-Day News and Haywood's answers to those questions: MUMBAI 00000365 002 OF 002 Question: When did you realize the IP address had been hacked into? Answer: Saturday (26 Jul 08) at around 10pm I received a call from the ATS in Delhi asking if I ran a cyber cafi. I told them no I live here. Within 30 minutes, the ATS were at my door telling me my internet had been compromised. Question: Do you use wi-fi to connect to the net? If yes, do you think it has been hacked to steal your IP address? If not do you think a cyber hacker used software to clone your IP address? Answer: Yes, I have a wireless router. The ATS are certain that is what occurred. Question: Is your laptop/desktop secure? Answer: All computers are secure within my flat. However, the Tata/VSNL Technician who setup the wireless router said it was not necessary to setup security because the computers have firewalls. He also disables the routers logging capability. Question: What did the cops ask you? Answer: From the beginning the police were reassuring me that I had done nothing wrong. They wanted to know who had access to my network. I talked to them for 72 hours. They asked me many questions. The most often asked was has anyone had access to my computers? (Only my family and the Tata-VSNL Technicians.) We've come to know now that the router was not secure. Question: What impression (of India, its police) has this incident left on you? Answer: The police/ATS have been very professional and courteous. They have been have been helpful in addressing my concerns. We are fully confident they will find the culprits of this horrific act. Question: Has the Anti-Terrorist Squad given a clean chit officially? Answer: The top ATS agents have continued to tell me how we have completely cooperated. They have said nothing has been found to implicate us. We have not been arrested nor has it ever been suggested that we might be. I have been told that an official statement will be coming soon. ATS in Delhi told me on the phone that I was completely clear. Question: Do you suspect someone? Answer: I don't know who could have done this. The police are handling the investigation. Question: What is your biggest fear? Answer: I fear for the safety of my family. ¶6. (SBU) On Sunday July 27, 2008 two additional Maruti WagonR vehicles containing explosives were found in Surat, India. Both vehicles had counterfeit Gujarat license plates, but a search of their vehicle identification numbers indicated that the vehicles came from Maharashtra. The Marutis were stolen from the Nerul area of Navi Mumbai before being equipped with Gujarat license plates and moving to Surat. On July 28, 2008 post's Senior Foreign Service National Investigator spoke with Surat police contacts to gather more information on the vehicles. According to police sources one vehicle contained approximately 17 kg of ammonium nitrate fuel oil mixture (ANFO),20 nine volt batteries, one timer, and nuts and bolts which could be used for fragmentation. The second vehicle contained 32 kg of ANFO, 30 detonators, and one battery. It us still unclear if the vehicles were actually vehicle borne improvised explosive devices, or vehicles being used to ferry explosives and other materials to cells operating in Gujarat. ¶7. (U) Media reports on July 29, 2008 thirteen IEDs were discovered in Surat over a four hour period. Surat Police bomb squad personnel were able to defuse the each device. The devices were found in the Varacha area of Surat. One device was found in a tree near a police post. ¶8. (SBU) EAC Mumbai will continue to track the incident and provide updates as necessary. RSO Mumbai personnel are speaking with contacts in Ahmedabad to confirm the design of the IEDs as well as to gather further information on the tactics, techniques and procedures used in the hospital attacks. Post will also work to develop additional information on the two explosive laden vehicles recovered in Surat. RSO Mumbai plans to meet with Haywood on July 30, 2008. Post does note that both the Surat vehicles and the Indian Mujihadeen email originated from Navi Mumbai. EAC Mumbai will meet on July 30, 2008 to discuss the recent targeting of Surat. FOLMSBEE