Intelligence and terrorism experts say that the Islamist presence on the Internet has expanded rapidly in recent months, and it’s not just a matter of virtual violence. New Web sites have cropped up featuring gory games, comic strips and themes including enigmatic symbols such as flowers and trees–which could contain coded messages for terrorists, says private terrorism investigator Rita Katz. Driven even deeper underground than it was before the 9-11 attacks, Al Qaeda is using the Net to assert its presence far more than in the past. Before 9-11, intelligence officials say, bin Laden and his henchmen rarely claimed direct responsibility for terror incidents. But since then–especially in recent weeks–Al Qaeda and close affiliates have used the Internet to assert their role in the recent killing of Kenyans and Israelis in Mombasa, and to threaten future assaults.

Some U.S. experts suggest the new Net presence is a sign of Al Qaeda’s desperation. Robbed of its base in Afghanistan, fragmented by the arrests and deaths of its operatives, Al Qaeda’s leadership has few places to roost. But the terror group is proving that the Net is far more effective for propaganda and operations than a samizdat newspaper. Recently a site called Mojahedoon.net distributed an audio message from Qaeda spokesman Sulaiman Abu Ghaith, taking responsibility for the Mombasa attacks. After Abu Ghaith spoke to his Net audience, similar threats echoed through other Islamist Web sites.

For U.S. terror trackers, Al Qaeda’s invasion of the Net has posed a fresh challenge, one that raises some uncomfortable civil-liberties issues. Agencies like the CIA and the supersecret National Security Agency think they have to flirt with the kind of covert activities they have pledged to shun, like spying on Americans and bugging American Net companies (though not necessarily without their permission). “We’re living in a global telecommunications structure in which the communications you really want me to be [targeting] are coexisting with yours; they’re going on the same circuits,” says a senior Defense Department official involved in the tracking. “The trick we have is to convince you and the Congress to give up some money and the power to grab the [enemy] communications while you’re trusting we won’t touch yours.” The CIA also employs “psy-ops” agents and linguists who work chat rooms, trying either to trick radicals into revealing information or posing as moderate Muslims countering extremist arguments.

Sometimes U.S.-based Internet service providers can host suspect Web sites without even knowing it. Six months ago the operators of an obscure Internet service provider in a Northeastern U.S. city were astonished to learn from business contacts that their computers were hosting Jehad.net, which officials regard as a semiofficial Qaeda site. Jehad.net recently carried a message from bin Laden’s official spokesman, as well as copies of two purported jihadi training manuals: “The Mujahideen Explosives Handbook” and “The Mujahideen Poisons Handbook.” Sources say that the U.S. Internet company had subcontracted part of its capacity to another firm, which in turn may have subcontracted to others.

Increasingly, the Bush administration also worries that Islamic extremists may be among the owners of U.S. companies involved in sophisticated computer activity. In Dallas last week, a posse of FBI agents arrested the operators of Infocom, an Internet service firm allegedly financed by a leader of the militant Palestinian group Hamas. In mid-December, Customs agents searched the office of a Quincy, Mass., software firm called Ptech that had been financed by capital raised by Yassin Qadi, a Saudi businessman whose assets were frozen by the Bush administration after 9-11. The company had software contracts with several government agencies, including the FBI, Federal Aviation Administration, Navy and Energy Department. Both the company and Qadi have denied any connection to terrorism, and U.S. officials say there is no evidence national security has been compromised. “We do polygraphs and security background checks on our contractors,” the senior Defense official says. But in the borderless world of the Web, culprits could be anywhere.