6/16/2016

The Current & Future Threat of ISIL – and AQ Affiliates

Dr. Richard Warnes University of Surrey & RAND Europe

Introduction

• The decline of the Core al-Qaeda , the emergence of Islamic State of the and the Levant (ISIL - ISIS, IS, Daish ) and the tensions between them, have seen a change in the nature and level of terrorist threat…

• Arguably this has resulted in a shift from the focus on more directed/ controlled ‘Spectacular’ attacks towards more ‘lone actor’ or self-contained cell attacks…

• Many of these conform to the Inghimaasi concept of attacks, which mirror Western military concepts of Influence Operations…

• As a result the future is likely to see an increasing tempo in such attacks, inspired, sanctioned and propagandised through the Web and Social Media…

Changing Nature of Threat 1

• Historical spectaculars : 9/11, , Rhyme, 7/7, Overt etc.

• However: • More Complex & Time consuming • More Individuals & C2 (OPSEC) • More Expensive – Financial Signature • = Larger Intelligence Signature • Greater likelihood of Identification

1 6/16/2016

Changing Nature of Threat 2

• Shift towards Smaller Self-Contained Operations : Individual ‘Lone Actors’ ( Lone Wolves ) or small cells - Smaller Numbers - Decentralised - Low Cost - Low Technology – Firearms, HME, ‘Cold Weapons’, Knives, Cars etc. - Often Self Directed or Semi-Directed - Increased Tempo of Attacks - Remotely Inspired and Sanctioned through web & social media

= Less Likely to be Identified (How do you identify a ‘conspiracy’ if it is in one person’s mind?) ISIL & AQ identify target groups, set priorities & individuals choose targets… Inspired and radicalised by their narratives

Changing Nature of Threat 3

Abu Mohammed al Adnani – ISIL Spokesman 22 nd September 2014

“If you can kill a disbelieving American or European, especially the spiteful and filthy French, or an Australian, or a Canadian, or any other disbeliever from the disbelievers waging war, including the citizens of the countries that entered into a coalition against the Islamic State, then rely upon Allah and kill him in any manner or way, however it may be… Smash his head with a rock, or slaughter him with a knife, or run him over with your car, or throw him down from a high place, or choke him, or poison him”

Related Concepts 1

• Terrorism – ‘The use or threat of violence, against civilians or non- combatants (including police officers & off duty or unarmed military personnel), for political, religious, racial or ideological objectives, by a sub- state group, cell or individual, with the intention of putting in fear an audience far greater than its initial victims ’

• Influence Operations - ‘Influence operations are the coordinated, integrated and synchronised application of… diplomatic, informational, military, economic and other capabilities in peacetime, crisis, conflict and post conflict to foster attitudes, behaviours, or decisions by foreign target audiences ’ (Rand 2009)

2 6/16/2016

Related Concepts 2

• Fourth Generation Warfare (4GW) (Lind et. al. 1989) – • Small Decentralised Groups • Targeting Society as a Whole • Replacing Traditional Modern Warfare • Greater Operational Flexibility • Less Dependence on Centralised Logistics • Dispersal & Increased Tempo of Action • Bypass Traditional Military Power • Focus on Technology & Ideology as Drivers • Psychological Warfare to Undermine Society • No Distinction between Military & Civilian Targets • Manipulation of Mass Media • Emergence from Non – Western Cultures

Related Concepts 3

• Inghimaasi Operations - ‘Immersing oneself deep into enemy lines to inflict damage or attain shahada – martyrdom’ • Increasing Reference in ISIL ‘ Dabiq’ and AQAP ‘Inspire ’ magazines… • Tactical Suicide, but Strategic Victory … • Likened by US SEAL to Viet Cong ‘Sapper’ attack on US Embassy in Tet Offensive 1968… • Influence Operation – Victory not measured in tactical military success, but length and amount of media coverage… and resulting impact on society … • Thus Terrorist ‘Spectacular’ not necessarily measured by number of casualties, but also its impact… ‘Propaganda of the Deed’

Operational Examples 1

• Mar 2012 – Toulouse - Mohammed Merah Shot Paratroopers & Jewish children… Attacked Police RAID tactical team when they entered his flat after a 30 hour siege, injuring several officers before being killed

- May 2013 – Murder of Lee Rigby – Michael Adebolajo & Michael Adebowale - Murdered off duty Fusilier, waited at scene justifying their actions and attacked Police ARV teams when they arrived

• May 2014 – Jewish Museum, Brussels Mehdi Nemmouche - Shot three tourists and critically injured a member of staff who later died of his injuries. Later arrested in Marseille with a bag containing a AK assault rifle and pistol

3 6/16/2016

Operational Examples 2

• Oct 2014 – Canadian Parliament, Ottawa – Michael Zehaf- Bibeau – Shot and killed a Canadian soldier at the National War Memorial before attacking the Canadian Parliament building where he was killed

Jan 2015 – Charlie Hebdo & Kosher Hyper Cacher - Kouachi Brothers – Killed 12, including protection & police officer, while Amedy Coulibaly killed a police officer and took hostages at a Kosher Hypermarket, killing 4. All counter-attacked police & Gendarmerie firearms teams, before being shot.

• Jan 2015 – Verviers, Belgium – Redwane Hajaoui & Tarek Jadaoun During a series of police arrests across Belgium of alleged ISIL cells, at Verviers police came under almost immediate fire and a heavy firefight developed. 2 Terrorists killed.

Operational Examples 3

• Feb 2015 – Copenhagen – Omar Abdel Hamid El – Hussein - Killed a film producer at an event featuring the cartoonist Lars Vilks and later shot a security guard at the main synagogue. Returned fire when challenged by armed police and killed Mar 2015 – Bardo Museum, Tunisia – Yassine Labidi, Saber Khachnaoui& Another – Attacked tourists at the Bardo Museum, Tunis, killing 22 people, mainly foreign tourists and Tunisian security personnel. Tunisian security forces intervened and killed 2 terrorists

• Jun 2015 – Sousse, Tunisia – Seifeddine Rezgui Aug 2015 - Thalys Attacked tourists on a beach and hotel AyoubEl Khazzani - near Sousse, Tunisia, killing 38 mainly Attempted attack on British nationals, before being killed by Thalys train armed with Tunisian security forces AK rifle and pistol, but overcome by passengers

Operational Examples 4 • This does not mean that ISIL & AQ affiliates will not launch more complex operations, when the operational environment is more permissive…

• Sep 2004 – Beslan – 385 dead

• Nov 2008 – Mumbai – 164 dead

• Jan 2013 – In Amenas, Algeria – At least 40 dead

• Sep 2013 - Westgate Mall, Nairobi – At least 67 dead

• Apr 2015 – Garissa, Kenya – 147 dead

4 6/16/2016

Operational Examples 5

• Nov 13 th 2015 – Paris – 130 dead - Series of co-ordinated attacks by three teams: • Bilal Hadfi, Ahmad al-Mohammad and M. al- Mahmod - 3 x Suicide bombers (PBIED) at the Stade de France during France vs. football match • Salah Abdeslam, Ibrahim Abdeslam and UI - ‘Marauding’ shooter attacks on restaurants in the 10/11 th Arrondissement • Omar Ismail Mostefai, Samy Amimour and UI - Hostage taking/ shooting at the Bataclan Theatre 11 th Arrondissement during a rock concert

• Nov 18 th 2015 – St. Denis – Police raid on a flat in the St. Denis area leads to the death of Abdelhamid Abaaoud, Hasna Ait Boulahcen and UI after a 7 hour siege, where the door was reinforced, police firearms teams came under accurate and sustained gunfire, a suicide vest was detonated and they allegedly fired 5000 rounds Nov 20 th 2015 – Bamako – 22 dead – Two terrorists, possibly from al- Murabitoun storm the Radisson Blu Hotel in Bamako, Mali, killing 22 – before around 120 guests were rescued and the building was secured by Malian Police & Security forces with the help of French and American advisors.

Operational Examples 6 • In examples of ‘Complex’ operations, with several stages and different attack techniques – On the morning of 19 th August 2011, the mounted a three stage attack on the British Council Building Kabul :

• Nearby Afghan National Police (ANP) traffic checkpoint destroyed by suicide PBIED

• This allowed the wall to breached by a suicide VBIED

• Compound and Council building stormed by heavily armed terrorists with PK Machine guns, AK Assault rifles, RPG Rocket launchers and grenades

• An 8 hour battle ensued, involving Coalition special forces, the ANP and security guards, before the last attacker was finally killed after holding out in an area of building protected by armored glass

Thus although ISIL & AQ affiliates will seek to launch more complex attacks when the environment and situation permit, in Europe more likely to see increase in tempo of smaller independent Inghimaasi type attacks by Lone Actors/ or Small Self-Contained Cells…

Relevance to Ports Security 1

• Many of those involved known to Authorities…Policing, Intelligence & Travel - First Line of Defence … • Mohammed Merah – Criminal background and known to French security services. Previously made several journeys to Afghanistan, and Egypt. Arrested in Kandahar in Dec 2010 while travelling as a ‘tourist’ and placed under surveillance when returned from Pakistan in 2011.

• Michael Abebolajo & Michael Adebowale – Both men known to UK security services. Adebolajo linked to Al- Muhajiroun. He was arrested in Kenya in 2010 while travelling under false passport and believed to be seeking to join Al- Shabaab. Subsequently deported back to the UK, but no further action taken.

• Mehdi Nemmouche – Criminal background and spent five years in prison where he was radicalised. Spent over a year in Syria where he was believed to be linked to ISIL and some reports linked him to the detention and torture of Western hostages. Had recently returned from Syria prior to his attack.

• Michael Zehaf-Bibeau – Criminal background and believed to have mental health problems. Converted to in 2004 and visited Libya. Previously expressed support for Jihadist groups and had raised concerns by staff at his local mosque.

5 6/16/2016

Relevance to Ports Security 2

• Kouachi Brothers – Cherif linked to ‘Buttes-Chaumont Network’ that had sent would be Jihadists to join AQI. Arrested in 2005 with another individual preparing to leave for Iraq via Syria, and met Amedy Coulibaly in Prison. In March 2008 Cherif was convicted of assisting in helping ‘foreign fighters’ travel to join AQI and was sentenced to three years. Said visited Yemen from 2009 – 10 on a student visa to learn Arabic and was believed to have known Umar Abdulmutallab (‘Underpants Bomber’). In 2010 both brothers named in connection with plan to free Islamist Ait Ali Belkacem (Paris Metro & RER bombings 1995) from prison, but not prosecuted. It was believed both brothers had received training from AQAP in Yemen during 2011 and as a result had been monitored by the French security services until the Spring of 2014.

• Amedy Coulibaly– Criminal background including armed robbery and drug trafficking. In 2004 sentenced to six years for armed robbery and believed to have met Cherif Kouachi in prison. Subsequently linked to the ‘Buttes-Chaumont Network’ along with the Kouachi Brothers . In December 2013 he was sentenced to five years for his involvement in a plot to free Ait Ali Belkacem , in prison for his part in the 1995 Paris Metro and RER bombings. Released in March 2014 and electronically tagged until May 2014.

• Redwan Hajaoui & Tarek Jadaoun - Both had returned from Syria the month before the Vervier incident, where they were known respectively as Abu Khalid Al Maghribi and Abu Hamza Belgiki. Vervier was linked to a wider national investigation into extremists returning from Syria.

Relevance to Ports Security 3

• Omar Abdel Hamid el-Hussein – Grew up in both Copenhagen and and was known to the Danish security services. He was previously involved in a criminal gang and had sentences for assault, illegal weapons and drugs. He was arrested in January 2014 for stabbing and radicalised in prison, being released in January 2015. He allegedly ‘swore’ loyalty to the ISIL leader on face-book shortly before his attacks.

• YassineLabidi & Saber Knachaoui – Although Labidi was known to the security services, neither was previously linked to a terrorist organisation. However, it was believed they had both managed to cross undetected into Libya in December 2014, where they allegedly received weapons training.

• Seifeddine Rezgui – Believed to have been radicalised over such issues as the conflict in Syria and the Libyan Civil War, leading to his recruitment by the Tunisian branch of Ansar al-Sharia

• Ayoub el- Khazzani – Originally of Moroccan origin he was resident in France since 2014 and had previously moved to from Morocco in 2007. During his time in Spain he had come to the attention of the security services for his outspoken speeches, his links to radical Mosques and for drug trafficking. As a result, when he moved to France, the Spanish authorities tipped off the French, and he was on their records. Reportedly, he spent time between May and July 2014 in Turkey and Syria, before moving to France.

Relevance to Ports Security 4

• Paris Attackers - The ringleader Abdelhamid Abaaoud was well known to security forces, regularly travelling between Syria and Europe, apparently escaping from Verviers, Belgium, coordinating a planned attack on a Church in Villejuif during April and the summer Thalys attack before returning to France for the Paris attack. Salah Abdeslam and his brother Ibrahim were known to the Belgian authorities and believed to have supplied drugs. Bilal Hadfi had trained in Syria, Samy Amimour gave up his job, travelled to Syria in 2013 and was the subject of an international arrest warrant, while it is believed that Ahmed al-Mohammad and possibly another attacker travelled from Syria into Europe through Greece disguised as refugees. The attackers met up in Belgium the day before the attacks and travelled by car over the border to safe houses in and around Paris, where they stayed the night before launching their assault.

6 6/16/2016

Related Concerns 1

• Travelling Overseas – Table : Western Europe ICSR, Kings College 2015

Per capita : Country Estimate • ‘Foreign Fighters’ per million

Austria 100-150 17

• Families Belgium 440 40

Denmark 100-150 27

• Juvenile Females Finland 50-70 13 France 1,200 18 • Elderly Germany 500-600 7.5 Brookings Institute: Byman & Shapiro 2015 Ireland 30 7 Italy 80 1.5

Netherlands 200-250 14.5

Norway 60 12

Spain 50-100 2

Sweden 150-180 19

Switzerland 40 5

United Kingdom 500-600 9.5

Related Concerns 2

• Direct Targeting of Police, Military & Security Personnel

• Mohammed Merah – Mar 2012 – Before an attack on Jewish school, killed three French Paratroopers

• Murder of Lee Rigby - May 2013 - Royal Regiment of Fusiliers drummer / Machine gunner

• Zehaf - Bibeau – Oct 2014 - Before attacking Canadian Parliament, killed Cpl. Nathan Cirillo

• Tours, France - Dec 2014 - A man of Burundian origin ran into a police station, shouting religious slogans and attacked three police officers with a knife, before a witnessing officer shot him dead

• Paris Attacks – Jan 2015 - Kouachi brothers killed a close protection officer at Charlie Hebdo and executed an officer outside. Coulibaly shot and killed a Municipal officer on traffic duty

• Verviers Cell - Jan 2015 - Believed to have been planning to imminently attack a police station – 4 x AK assault rifles, explosives and police uniforms were recovered from the location

Related Concerns 3 • ‘Trojan Horse’ – Extremists amongst Refugees? • Estimated around 550,000 Refugees & Economic Migrants in 2015 so far… • Up to Summer of 2015 around 530,000 asylum applications in Europe (BBC 2015) • Up to October 2015, top three nationalities: Syrian (53%), Afghan (16%) & Eritrean (6%) (UNHCR 2015) • ISIL clams to have smuggled ‘thousands’ into Europe amongst refugees… but • Evidence at least two of the Paris attackers travelled through Greece as ‘refugees’ • ‘It’s a very cumbersome way for terrorists to come into the , there’s a lot of easier ways to slip in, such as by using forged papers or stolen passports… the volume of people in contact with Islamic state – not only the ones who’ve gone, but sympathisers who decide to act – that’s what’s keeping security services awake’ (Magnus Ranstorp 2015) • ‘The idea of Islamic State exploiting the migrant crisis to spirit operatives into Europe is not inconceivable, but there is an element of this being seized on in a populist fashion… There’s not an over-riding need for them to send people right now… that may well change over time ’ (Shiraz Maher 2015)

7 6/16/2016

Related Concerns 4 • Returning Extremists • In relation to ‘foreign fighters’: • Many die in suicide attacks or perish quickly in firefights with opposing fighters • Many never return home, but continue fighting in a conflict zone or move to another • Many quickly become disillusioned and a number return home without further violence • Others are arrested or disrupted by intelligence services (Daniel Byman & Jeremy Shapiro 2015) • However, as the previous examples of attacks demonstrate, some have travelled overseas and returned… • Focus for likeminded individuals (mainly young men) in local community • As well as radicalised ‘Intent’, training & combat experience mean they have some level of ‘Capability’ - Firearms/Weapons Training, IED Fabrication, Close Quarter Fighting/ Fighting in a Built up Area (FIBUA), Possibly sniping • Darwinian ‘Survival of the Fittest’ • Number of previous historical terrorist attacks failed due to technical failure, inexperience or lack of training. Given the radicalising & brutalising nature of the ISIL conflict in Syria & Iraq, and the development of technical skills & experiences, those who survive to return less likely to make mistakes

Conclusion

• Given the Changing nature of the Threat outlined… … towards Independent ‘Lone Actor’ or Small Cell Inghimaasi type attacks

• The number of such recent attacks where the attacker was already known to the Police & Security Services…

• The amount of those individuals who had travelled abroad …

Ports Policing & Security continue to play key roles in both the identification of terrorist threats and as a point of intervention for Arrest, Deterrence or Intelligence Generation

Thank You

[email protected]

8