Zarrar Shah (, born 16 April 1979) is the Lashkar-e-Taiba's communications and technology chief, and also one of its primary liaisons with the Pakistani intelligence agency ISI. According to The New York Times, Shah is "a senior Lashkar commander" and "a central character" behind the plot of the 2008 Mumbai attacks. Fox News reports Shah communicated with gunmen over the telephone and helped direct their activities as he watched the events unfold on television.
Early life Shah was born on 16 April 1979, according to a report by ProPublica and Frontline. In a 2009 Pakistani First information report (FIR) released by the South Asia Terrorism Portal, Shah's birth name was listed as Abdul Wajid, Zarrar Shah and Rana were said to be his aliases. The FIR revealed his father's name was Nazir Ahmed, who was a resident of Nangal Sahdan village in Ferozewala Tehsil, Sheikhupura District. Shah's existence was known to Indian authorities since 2006 at least. According to a BBC Urdu article, Shah's real name was Qari Zarar, he was a member of the Harkat-ul-Ansar and he was involved in the 1995 kidnapping of western tourists in Kashmir. The article claimed he then came to Pakistan and joined the Jaish-e-Mohammed, and was wanted for terror cases in Pakistan.
In his late 20s, Shah became the emir (chief) of the Lashkar-e-Taiba (LeT) media unit. This relatively young chief attracted the attention of Indian, American and British agencies. By September 2008, British agencies including the GCHQ were monitoring most of his digital activity and communications. Shah was also the LeT's communications and technology chief, and one of its primary liaisons with the Pakistani intelligence agency ISI. Sometime in 2006, Indian terrorist Abu Jundal met Shah and Zakiur Rehman Lakhvi at the LeT camp in Muridke. LeT militant Aslam Kashmiri, arrested in August 2009, also admitted to meeting Shah and Lakhvi.
2008 Mumbai attacks
Planning According to the confession of attacker Ajmal Kasab, on the 13th day of the month of Ramzan in 2008, Kasab and the nine other attackers met Shah, who taught them how to make an outgoing call from Pakistan appear like it was dialed from another country. They were told Shah had a media room with detailed information about places in other countries, chose targets from among them and then relayed the targets to Zakiur Rehman Lakhvi. On the same day, CD footage and maps of the targets were shown to the attackers. Kasab in particular was shown targets like the Chhatrapati Shivaji Terminus station (CSMT, previously the VT), Malabar Hill and city roads going to these two targets. The two attackers going to the Taj Mahal Palace Hotel were shown a 3D model of the hotel, created by its management as an advertising tool. The attackers could thus familiarize themselves with the architecture of the hotel, its entries and exits, and the city roads going to Leopold Cafe.
Kasab met Shah at a new LeT base in Muridke, where he and other attackers trained under Shah in the Daura-e-Riba course (intelligence gathering and accumulation). They were taught how to decrypt and encrypt digital communications and operate multiple communication channels. They were also tutored on digital reconnaissance and surveillance. Shah then distributed wireless radios, GPS equipment, and satellite phones of the Hughes and Ascom brands connected over Thuraya networks. Shah and his unit stayed at the base for a week to train the attackers. At the Baitul Mujahideen camp, they were told about the plan to attack Mumbai for the first time. At the camp, LeT chief Hafiz Saeed declared Lakhvi as the mission commander; the junior commanders appointed were Shah, Abu Hamza, Abu Kahafa, Yousuf Muzzamil, Alqama and Shahid Jamil Riaz. The ten attackers were then taken to the LeT base at Azizabad graveyard south of Gulberg Town. At this base, Shah had his media room with many electronic devices. In September 2008, Lakhvi and his junior commanders met to discuss the timeline of the attack.
On 20 October 2008, Shah contacted the New Jersey based company Callphonex to inquire about Voice over IP (VoIP) systems. He posed as Kharak Singh, a Mumbai-based telephone merchant. The VoIP system would make it look like calls between the Pakistani handlers and Mumbai attackers were originating in New Jersey and Austria. The VoIP services purchased by Shah were paid for by LeT members from Karachi and Barcelona. Meanwhile, at a training camp in Pakistan administered Kashmir (PaK), Shah and other LeT handlers showed the ten attackers how to navigate to their targets in Mumbai by using Google Earth. They mapped out the sea route to be taken, the landing area in Mumbai, and the city roads the attackers would use to reach their targets. According to Indian police officer Deven Bharti, the attackers were taught how to locate sites in Mumbai even before they arrived in the city, primarily by using Global Positioning System equipment. The attackers were shown video footage of their targets filmed by David Headley and received by Shah.
On 22 October, Shah looked up past terror attacks in India, and researched potential targets including the Taj Mahal Palace Hotel and luxury hotels in Delhi. He went over weather forecasts for the Arabian Sea, and checked if there were any ongoing naval exercises on the route. He put the VoIP system in place, which would make his outgoing calls appear like they were originating from area code 201 in New Jersey. In November, Callphonex asked why there had been no usage of its systems till then. Shah, using his disguise as Singh, said utilization would begin at the end of the month. Callphonex was also worried when the Kharak Singh email address, after every email sent, showed a new IP address located in different countries. The communications network used in the attacks was much more sophisticated, if not multiple generations ahead of Indian police systems.
Five Austrian Direct inward dial numbers were purchased from Callphonex and used by the terrorists. The New Jersey number also purchased was a virtual number, and it was used to route the calls from the handlers to the attackers. The New Jersey number was paid for by a MoneyGram payment. The five Austrian numbers were paid for by a Western Union transfer from Pakistan to an agent in Brescia, Italy. According to journalists Adrian Levy and Cathy Scott-Clark, this communication network was created by Shah working in concert with the Owls, a group of young and unemployed technology students recruited from Karachi, Dubai and Gulf countries. Callphonex inquired why the payment came from Pakistan when the services were purchased by an Indian, but did not receive a response.
On 21 November, Shah gave each attacker one Nokia cell phone with Indian SIM cards, which would activate only after they entered Mumbai waters. The attackers were told to switch their phones on only after they arrived in Mumbai. Lakhvi told the attackers Shah had stored a mobile number in their phones which they could call to talk to their handlers. The Nokia India and USA branches found these cellphones had unique IMEI numbers and were purchased from Nokia China by Pakistani sellers. On 22 November, Shah went along with the attackers as they travelled from the Azizabad base to Keti Bandar, where they boarded the boat going to Mumbai. Shah tracked and guided the attackers via GPS as they sailed towards Mumbai.
On 24 November, Shah arrived at Malir Town in Karachi, where he established a digital control room with help from Indian terrorist Abu Jundal. This room was used by Shah and other LeT commanders to guide the attackers. On 25 November, Abu Jundal checked if the VoIP system was working, while commanders Shah, Lakhvi and Sajid Mir waited for news updates on the attacks. On 26 November, the day of the attack, Shah wrote a press release claiming responsibility for the attack by the fake Hyderabad based group Deccan Mujahideen, and began to circulate it through his network. Before the attacks began, Shah looked up images of the Oberoi Hotel, and Wikimapia maps of Taj Mahal Palace Hotel and Nariman House (also known as Chabad House).
Execution Shah and other LeT members in the control room fasted throughout the day, and broke their fasts just before they started watching live news on the attack. Shah and the other handlers were constantly in touch with the ten attackers through cell phones, the VoIP system and Thuraya satellite phones. Upon entering CSMT, Kasab thought the crowd there was fewer than what he had seen in the CD shown by Shah. They tried to contact their handlers, but could not get through because of low network coverage.
The other handlers at the control room were reportedly Abu Jundal, Major General, Kafa, Wassi, and Buzurg. According to a US military intelligence official quoted by Bill Roggio, the Major General mentioned here was Hamid Gul. According to the call recordings analyzed by Indian authorities, all the handlers except Kafa talked to the attackers at Nariman House. However, only Kafa, Wassi and Shah talked to the attackers at the Oberoi Hotel; and only Wassi talked to the attackers at the Taj Mahal Palace. After attackers Fahadullah and Abdul Rehman killed their non-Muslim hostages at the tenth/eleventh floor of the Oberoi Hotel on 27 November, Shah told Fahadullah to search for routes to the lower floors. When National Security Guard commandos were para-dropped at Nariman House on 28 November, Shah started looking for news updates, searching for terms like Jew, Israeli and Chabad.
Aftermath Officials of the Intelligence Bureau, India's internal security agency, claimed they were not monitoring Shah's online movements as reported by the ProPublica and Frontline investigation. They said Shah's laptop activity and the naval route he mapped were shared by the GCHQ only after the attacks began. Before the attacks, GCHQ believed the intelligence they had was not detailed enough to be shared with Indian agencies. British, Indian and American agencies did not share their information with each other before the attack. After the attack began, the agencies started collating their data to establish the planning and timeline of the attack. Shivshankar Menon, the Indian foreign minister at the time, said the data was available but the analysis was lacking. Menon said the monitoring of Shah showed the limitations of signals intelligence without proper analysis.
Investigations of Shah's computer and email accounts revealed a list of 320 locations worldwide deemed as possible targets for terrorist attacks similar to the Mumbai attacks. Only 20 of the targets were locations in India. Analysts believed the list was a statement of intent rather than a list of locations where LeT cells were established and ready to attack. Shah was researching targets in Kashmir, Punjab, India, New Delhi, and Afghanistan, as well as United States Army bases in Germany and Canada. M. K. Narayanan, then the Indian National Security Advisor, asked American officials to provide Shah's list of potential targets. In 2014, the New York Times released a redacted National Security Agency document, which revealed Shah had researched multiple locations like the Gateway of India, other tourist sites, dams, power plants, and potential landing areas for the attackers' boats.