This article was first published in CTC Sentinel, the flagship publication of the Combating Terrorism Center at West Point.
On June 12, 2018, heavily armed German special forces police with gas masks raided a residential building in the city of Cologne (North Rhine-Westphalia) in Western Germany. A Tunisian national named Sief Allah H., who lived at the premises, was arrested. His wife, a German convert to Islam named Yasmin H., was also taken into police custody and was later accused of helping her husband in a terrorist plot. Police investigators and bio-chemical experts of the Robert Koch Institute, wearing full protective gear, then entered the residential block and searched several apartments. They were looking for the poison ricin.
Terrorist suspect Sief Allah H. had been monitored by German security services for a number of weeks prior to his arrest. Investigators discovered Sief Allah H. had ordered suspicious material and believed he was working to build an explosive device containing the deadly substance ricin. German intelligence had learned that Sief Allah H. had bought various materials via the internet, including more than a thousand castor beans and an electronic coffee grinder. During the police raid, a powdery substance was found, which subsequently tested positive for ricin. Holger Münch, head of Germany’s Federal Criminal Police Office (BKA), stated shortly after the raid, “There were pretty specific preparations for such a crime, using, if you want, a bio-bomb. This is a unique case, at least for Germany.”
ADVERTISEMENT
Ricin is a by-product of castor beans (the seeds of the Ricinus plant) from which castor oil can be produced with uses in various industries and products. Ricin can be lethal to human beings when ingested or if introduced to the blood stream because it interferes with protein production. According to the Center for Disease Control, as a warfare agent “ricin could be used to expose people through the air, food, or water.”
In 1978, ricin was used in the assassination of the Bulgarian dissident and journalist Georgi Markov. On Waterloo Bridge in London, an agent for the Bulgarian secret police shot a ricin pellet into Markov’s leg from a modified umbrella. He died several days later.
Jihadi terrorists have also shown an interest in carrying out attacks with ricin. In January 2003, a British counterterrorism operation was launched against a suspected al-Qaeda-linked cell allegedly plotting to carry out an attack on U.K. streets with ricin and other poisons. Twenty-two castor beans were retrieved from an address in Wood Green, in north London, as well as the equipment needed to produce ricin and a recipe for ricin. The main suspect, Algerian Kamel Bourgass, was later sentenced to 17 years in prison for “conspiracy to cause a public nuisance by the use of poisons and/or explosives to cause disruption, fear or injury.” Bourgass had already been sentenced to life imprisonment for the murder of detective Stephen Oake, whom he stabbed to death during his arrest in Manchester. All other suspects charged were either acquitted or had their trials abandoned.
In August 2011, The New York Times reported that U.S. counterterrorism officials were “increasingly concerned” that al-Qaeda in the Arabian Peninsula (AQAP) was “trying to produce the lethal poison ricin, to be packed around small explosives for attacks against the United States.”
There have also been a number of plots, including by extreme right-wing groups to carry out ricin poisonings in the United States. Weaponizing ricin into a component of an improvised explosive device is nevertheless regarded as very difficult.
If the allegations are proven, the Cologne case would be the first time a jihadi terrorist in the West successfully produced ricin. The main suspect, Sief Allah H., was born in Tunisia. Little is known yet about his path to alleged radicalization. While still living in Tunisia, he met a German woman on the internet. In October 2015, the pair married in Tunisia. Sief Allah H. legally entered Germany for the first time on November 24, 2016, and moved into an apartment in the Osloer Straße in Cologne-Chorweiler with his wife. At the time of their arrest, the couple had two children.
The first time Sief Allah H. appeared on the radar of German counterterrorism forces was on December 12, 2017, when city officials in Cologne informed police that he had reported he had lost his Tunisian passport. The suspicion was that Sief Allah H. had traveled to a conflict zone and was seeking to replace passports that might contain entry stamps or visas in order to hide terrorist activities. At some point after Sief Allah H. came onto the radar, German authorities asked Tunisian authorities for additional information on him and were told that while living in Tunisia, he was suspected of being a follower of salafi ideology.
Germany’s Federal Office for the Protection of the Constitution (BfV), the country’s domestic intelligence agency, at some point learned that Sief Allah H. had, in the fall of 2017, twice tried to travel to Syria—probably to join the Islamic State—but had been stopped in Turkey on both occasions. According to the General Federal Prosecutor’s Office, Sief Allah H’s wife, Yasmin H., had initially planned to travel to Syria as well. She allegedly was concerned about her children’s safety and instead only bought plane tickets for Sief Allah H.
There was an apparent dispute between the couple in the weeks that followed. On January 8, 2018, Yasmin H. contacted Cologne police and filed a legal proceeding against her husband for “domestic violence” in three cases since 2017. Yasmin H. claimed an argument between them relating to how Islam should be interpreted was the reason for the attacks by her husband. The same day, police came to the couple’s apartment and ordered Sief Allah H. to leave for at least 10 days.
On January 25, 2018, Yasmin H. and Sief Allah H. came to the police station for questioning. During the interview, Yasmin H. withdrew the complaint and stated the problems with her husband had been resolved.
On June 1, 2018, the BfV called for a meeting of the working group “Operative Information Sharing” within the Gemeinsame Terrorismus Abwehrzentrum (GTAZ) in Berlin. The Bundesnachrichtendienst (BND), the Federal Criminal Police Office (BKA), the Federal Police (Bundespolize), the German Federal Office GBA, the Federal Office for Migration and Refugees (BAMF), and various other security agencies took part in the meeting. At this meeting, the BfV had new information to share. After Sief Allah H. had come onto the radar screen of authorities for his missing passport, the BfV had received a tip-off from the public that he was probably a radicalized individual sympathizing with the Islamic State.
On June 11, 2018, the working group “Operative Information Sharing” met again at GTAZ and discussed the case. This time, BfV presented more detailed information regarding Sief Allah H. allegedly preparing for a possible terrorist attack using the poison ricin.
At some point in the preceding weeks, a British intelligence agency had warned the Bundesnachrichtendienst (BND) about suspicious online shopping activities by a Tunisian living in Germany. The British had discovered the purchases through some form of electronic surveillance. Further investigation established that this individual was Sief Allah H. In May 2018, he had bought at least 1,000 castor beans and an electronic coffee grinder via Amazon Marketplace.
After the British tip-off, German security agencies started to monitor Sief Allah H.’s activities. His phone was wiretapped, and he was put under 24/7 surveillance. Not long afterward, BfV and BKA came to the conclusion that Sief Allah H. had probably obtained material that could be used to build an improvised explosive device (IED).
Initially, investigators believed Sief Allah H. was “hiding his activities from his wife.” Sief Allah H., for example, sometimes stayed in a second unoccupied apartment in the same building he had access to, probably to store material. But German authorities subsequently alleged Yasmin H. helped Sief Allah H. order the material he needed by knowingly giving him access to her PayPal account, and she had bought the plane tickets to Turkey when he had allegedly attempted to join the Islamic State. According to German authorities, the couple even bought a hamster to test the ricin on a living being. When German police raided the apartment, they found the hamster alive in a cage. Investigators believe Sief Allah H. tested some of the toxin on the animal. They believe the animal’s survival was due to the nature of the test. According to a German security official, the ricin that was produced by Sief Allah H. was potentially lethal.
Furthermore, investigators found out that Sief Allah H. had bought a sleeping bag and an additional battery (power-bank) via the internet. He also asked his wife for 1,000 Euro in cash (which he never got). This behavior led to the conclusion that the suspect was probably preparing to travel—with concern that he was perhaps planning to flee the country after carrying out an attack in Germany.
On June 12, 2018, at 8:10 AM, Cologne police created a so-called “Besondere Aufbauorganisation” (BAO)a to deal with the imminent threat of a potential bomb plot. And Germany’s Public Prosecutor General filed a case for “Preparation of a serious violent offence endangering the state” against Sief Allah H. At around 7:00 PM the same day, Sief Allah H. left the residential building in Osloer Straße in Cologne-Chorweiler and was then arrested by police and taken into custody. Later in the evening, the apartments he used were searched.
By the time police launched the raid, Sief Allah H. had already allegedly started producing ricin. Investigators found 84.3 milligrams of already-produced ricin and 3,150 castor beans.
This was a greatly larger number than the 22 castor beans retrieved from the Wood Green residence in London in 2003. Of the castor beans retrieved in Cologne, 2,100 were bought via the internet. The origin of the other beans is still unknown. Two hundred fifty small metal balls, two bottles of nail polish remover containing acetone, light bulbs, cables, and 250 grams of a grey powder (aluminum powder and substances from fireworks).
Three mobile phones were also confiscated during the investigation. On two of these phones the BKA discovered around 180,000 images, 2,000 video and audio files, and around 33,000 text and chat messages. More than 9,000 chat messages, 11,000 contacts, and several files containing bomb-making manuals were stored on one of the devices. Amongst the content, allegedly, was a certain amount of jihadi propaganda, including items related to the Islamic State. According to the German Public Prosecutor General, Sief Allah H. had been in contact with supporters and probably even members of the Islamic State since the fall of 2017.
Police officers of a special unit wear protective clothes and respiratory masks during an operation on June 12, 2018, in Cologne’s Chorweiler district, western Germany, where police found toxic substances after storming an apartment. (David Young /AFP/Getty Images)
According to sources close to the investigation, Sief Allah H. was most likely following online video instructions on how to make and weaponize ricin posted by a jihadi terrorist group in 2016.
The same online video manual was allegedly found during an investigation against two Egyptian brothers in France. On May 11, 2018, French counterterrorism police arrested two terrorist suspects in the northern 18th arrondissement of Paris. French Interior Minister Gerard Collomb said that two men had been arrested for “preparing to commit an attack, with either explosives or ricin, this very powerful poison.” According to authorities, the suspects had communicated via the messaging app Telegram. “They had tutorials that showed how to make ricin-based poisons,” Collomb said. “We were able to detect them, detect this attack plan and were able to arrest them.” One of the Egyptian brothers, named as Mohamed M., was later charged with “association with a terrorist enterprise” by the French anti-terrorism prosecutor.
There is no indication Tunisian Sief Allah H. was in contact with the two terrorist suspects in France. But, as already noted, according to the German Public Prosecutor General, Sief Allah H. had communicated with Islamic State-linked suspects overseas since the fall of 2017. According to a German security official, those operatives were suspected to be based in North Africa or Syria. Earlier this month German authorities publicly alleged Sief Allah H. was in contact via Telegram with at least two people suspected of being associated with the Islamic State. One person allegedly gave him advice on the ricin production and the other one sent him information on how to build an explosive device. In early August 2018, the Tunisian Ministry of Interior stated two terrorist suspects had been arrested in connection with the Cologne ricin plot. Both men are suspected of being linked to Sief Allah H. It is unclear whether the two suspects arrested in Tunisia are the same two people who were allegedly providing advice on how to make ricin and explosives.
The investigation into the ricin plot in Germany is still ongoing. Some of the confiscated material was taken to the Robert Koch Institute for further examination. Sief Allah H. and his wife, Yasmin H., remain in custody.
The Cologne case saw a new threshold reached for the jihadi bio terror threat in the West. If the allegations are proven, Sief Allah H. would be the first jihadi terrorist suspect in the West to successfully produce ricin. Equally troublingly, the case suggests radicalized individuals are indeed able to produce a biological weapon using internet tutorials. Though the Islamic State is in rapid decline in Syria and Iraq, the manuals and how-to instructions for explosives and other weapons are still available online. This material, which is being shared via Telegram channels and other forms of communication, still has the potential to inspire jihadis across the globe.
In addition, German security officials are still very concerned about Islamic State operatives who survived the territorial collapse of the caliphate using social media to recruit and instruct possible attackers.
Furthermore, the Cologne ricin case highlights the importance of electronic surveillance to uncover such plots. It was only because Sief Allah H.’s online purchases were flagged by intelligence services that police were able to prevent a possible attack.
Florian Flade is Chief National Security Reporter for the WELT and WELT am Sonntag newspapers. He is based in Berlin and blogs about jihadism at ojihad.wordpress.com. Follow @FlorianFlade
