Funding Terror: History, Present State and Future Means of Financing the Global Salafi Jihadist Terrorism Diploma Thesis Bc

MASARYK UNIVERSITY FACULTY OF SOCIAL STUDIES DEPARTMENT OF POLITOLOGY

Funding terror: history, present state and future means of financing the global Salafi jihadist terrorism Diploma thesis Bc. Jakub Rafay

Supervisor: prof. JUDr. PhDr. Miroslav Mareš, Ph.D. UČO: 439505 Field of Study: Politologie Year of enrolment: 2017 Brno, 2019

Declaration of authorship I declare that I wrote the master’s thesis „ Funding terror: history, present state and future means of financing the global Salafi jihadist terrorism” entirely by myself and that I solely used the literature in the list of bibliography.

Brno, 21 May 2019 ……………………………………………… Bc. Jakub Rafay

Special thanks to: First and foremost, my work supervisor, prof. JUDr. PhDr. Miroslav Mareš, Ph.D., for his patience, guidance, cooperation and prompt reactions to all my enquiries during the thesis’ writing. Despite having started this effort remotely across Europe and having changed the topic several times, we made it to a successful finish. Thank you.

I would also like to thank my family for putting up with me over the past few years and tolerating (not only) my late-night writing and reading sessions. My friends, colleagues, professors and mentors, whether at school or in various organisations I had the honour of working at or cooperating with, they all deserve a big “thank you”, especially three of my closest colleagues, Marek, Michael and Juraj, and my three wonderful colleagues at Europol, Hanna, Beatriz and Inês.

Anotácia: Práca “Funding terror: history, present state and future means of financing the global Salafi jihadist terrorism” predstavuje analýzu fenoménu financovania džihádistického terorizmu, pričom sa venuje jeho minulosti, stavu v súčasnosti a na základe extrapolácie súčasných trendov a rozhovorov s odborníkmi na financovanie terorizmu taktiež aj poskytuje zhodnotenie možných budúcich foriem financovania teroristických aktivít.

Autor v práci dáva dôraz predovšetkým na operačnú rovinu terorizmu, tzn. analyzuje predovšetkým financovanie konkrétnych teroristických útokov; zároveň naprieč prácou dôsledne rozlišuje finančné praktiky dvoch v súčasnosti najrelevantnejších džihádistických hnutí, al-Káidy (AQ) a tzv. Islamského štátu (IS). Týmto spôsobom sa snaží prísť s uplatniteľnými závermi, ktoré čitateľovi ozrejmia rozdiely, spoločné znaky a vývoj uvažovania aktérov pri plánovaní financovania jednotlivých operácií týmito dvomi teroristickými hnutiami.

Kľúčové slová: ISIS, AQ, terorizmus, džihádizmus, financovanie

Annotation: Diploma thesis “Funding terror: history, present state and future means of financing the global Salafi jihadist terrorism” presents an analysis of the phenomenon of funding of jihadi terrorist groups, focussing primarily on its history, the current state of affairs and – based on extrapolation of current trends and interviews of terrorism funding experts and investigators – also provides an estimate of possible future means of funding the terrorists’ activities.

Throughout the thesis, author places emphasis on the operational dimension of terrorism, i.e. he focusses especially on how specific terrorist attacks have been funded. Furthermore, distinction is made between the two currently most notable groups representing this strain of terrorism, al-Qaeda (AQ) and the so-called Islamic State (IS). Author thus seeks to come up with relevant findings that bring clarity about differences, similarities and the development of thinking behind their respective funding strategies.

Keywords: ISIS, AQ, terrorism, jihadism, financing, funding

TABLE OF CONTENTS

List of abbreviations ...... 1

Introduction ...... 3

1. Conceptualisation, methodology and analytical framework ...... 4

1.1. Definitions of key concepts ...... 4

1.2. Methods and sources ...... 7

1.3. Limits of the research ...... 8

1.4. Chapters layout ...... 9

1.5. Analytical framework ...... 11

1.5.1. Organisational and operational capabilities ...... 12

2. History of Salafi-jihadi terrorism funding ...... 15

2.1. 1980-1989 – The beginnings ...... 15

2.1.1. State support ...... 16

2.1.2. Maktab al-Khidamat global funding activities ...... 20

2.1.3. Charities and government aid organizations (ab)use ...... 22

2.2. 1990-2001 – Al-Qaeda going global ...... 28

2.2.1. Sudan and bankrolling the jihadists ...... 29

2.2.2. Afghanistan and operations planning ...... 32

2.3. Operational financing 1989 – 2001 ...... 37

2.3.1. 1992 Aden bombing ...... 38

2.3.2. 1993 World Trade Center bombing ...... 39

2.3.3. 1998 Twin US embassies bombing ...... 40

2.3.4. 2000 USS Cole bombing ...... 41

2.3.5. 2001 9/11 attacks ...... 42

2.3.6. Failed plots 1989-2001 ...... 44

2.4. 2001-2011 – Global War on Terror and Salafi-jihadism funding ...... 46

2.4.1. Al-Qaeda financing going underground ...... 47

2.4.2. Al-Qaeda splinters, Salafi-jihadi movement broadens ...... 48

2.4.3. AQI ...... 50

2.4.4. AQIM ...... 51

2.4.5. AQAP ...... 52

2.4.6. AQ in Syria ...... 53

2.4.7. Al-Shabaab ...... 54

2.5. Operational funding 2001-2011 ...... 56

2.5.1. 2002 Bali bombings ...... 57

2.5.2. 2004 Madrid attacks ...... 58

2.5.3. 2005 London attacks ...... 59

3. Present state of Salafi-jihadi terrorism funding ...... 60

3.1. Current trends ...... 61

3.1.1. Low-cost attacks, lone wolves and lone actors ...... 62

3.1.2. Self-financing – legal means and criminality ...... 63

3.1.3. Novel means of value transfer ...... 64

3.2. Financing the caliphate ...... 64

3.2.1. Energy production ...... 65

3.2.2. Taxation and extortion ...... 67

3.2.3. Antiquities sales ...... 69

3.2.4. Looting ...... 69

3.2.5. Kidnapping for ransom ...... 70

3.2.6. Other reported sources of funding the caliphate ...... 71

3.2.7. Future of the IS funding? ...... 71

3.2.1. Other Salafi-jihadi groups of the modern era ...... 72

3.3. Operational funding ...... 75

3.3.1. 2015 Île-de-France attacks ...... 76

3.3.2. 2015 November Paris, 2016 Brussels attacks ...... 77

3.3.3. 2016 Nice attack ...... 78

3.3.4. 2017 Manchester Arena bombing ...... 78

3.3.5. 2017 Barcelona attacks ...... 78

4. Possible future means of Salafi-jihadi terrorism funding ...... 80

4.1. Cyber as an enabler of jihadi terrorism? ...... 80

4.2. Cryptocurrencies ...... 81

4.3. Crowdfunding ...... 83

4.4. Hacking ...... 84

4.5. Off-the-shelf malware, CaaS ...... 86

4.6. Credit card fraud ...... 87

5. Conclusion ...... 89

6. Appendix 1 – Visualisations, images, diagrams, tables ...... 91

7. Bibliography ...... 95

Number of characters: 232 657

LIST OF ABBREVIATIONS

AQ – Al-Qaeda AQAP – Al-Qaeda in the Arabian Peninsula AQC – Al-Qaeda Central AQIM – Al-Qaeda in Islamic Maghreb BH – Boko Haram BIF – Benevolence International Foundation BTC – Bitcoin CT – counter-terrorism CTF – counter-terrorism financing DDoS – distributed denial of service attack EC3 – European Cyber-Criminality Center, Europol ECTC – European Counter-Terrorism Center, Europol EIG – Egyptian Islamic Group EIJ – Egyptian Islamic Jihad EU – European Union FTF – foreign terrorist fighter GIA – Group Islamique d’Algérie GID – General Intelligence Directorate HUT – Hizb ut-Tahrir ICSR – International Centre for the Study of Radicalisation IIRO – International Islamic Relief Organisation IED – improvised explosive device IS/ISIS/ISIL – Islamic State (since June 2014), previously Islamic State of Syria and Islamic State of Iraq and the Levant LeT – Lashkar-e-Taiba MAK – Maktab al-Khidamat MENA – Middle East and North Africa region MILF – Moro Islamic Liberation Front MUJAO – Movement for Oneness and Jihad in West Africa RUF – Revolutionary United Front

INTRODUCTION

Over the past few years, one could observe that almost immediately after terrorist attacks attention is paid to many rather modern and news-worthy details surrounding their perpetrators – their activity on social media, pathways to radicalisation, their travel records, provable links to established terror groups, and many others. However, what is often ignored is probably one of the most important pieces of the puzzle, a factor enabling the whole atrocity to even take place – the funding behind it. This thesis seeks to comprehensively describe and analyse the funding of the terrorism inspired by Salafi-jihadism over time, namely its history, present state and possible future sources of funding. Over the course of analysis, attention will be paid to the distinction between the organisational and operational funding and to the comparison between the two currently most notable groups representing this strain of terrorism, al-Qaeda (AQ) and the so-called Islamic State (IS), in order to describe different modus operandi in funding their activities and to explain these inconsistencies. Author will move chronologically, starting in the 1980s and move up to present day, while noting important developments in each of the Salafi-jihadism-inspired terrorism’s phases and explaining the rationale of the movement’s main actors and operatives behind choosing specific funding methods. Particular attention is paid to operational funding in each of these phases – these short sub-chapters serve to demonstrate the actual application of terrorism financing trends and effect of circumstances mentioned in the broader phase-related chapters on terrorist attack preparation. They also portray the wildly divergent approaches terrorists take when funding operations instead of organisation as a whole. Throughout the thesis, author seeks to show that despite the ultra-radical and non-compromising ideology and seemingly wanton brutality behind the Salafi-jihadist activities, in the financial dimension they are surprisingly rational and highly adaptive. Main question guiding this research is whether over time Salafi jihadists simply broadened their array of financial tools or whether they had undergone an evolution, disposing of the old, less effective or perhaps compromised tools, and adopting new, perhaps more lucrative and harder to intercept ways of raising funds.

1. CONCEPTUALISATION, METHODOLOGY AND ANALYTICAL FRAMEWORK 1.1. DEFINITIONS OF KEY CONCEPTS

This thesis focusses on a particular strain of Sunni-based militant Islamism, Salafi- jihadism. In order to clearly denote which groups are being researched (and which in turn are excluded), this central label combines the two terms frequently used in this context, although often erroneously. As Shiraz Maher puts it, Salafism alone is “a philosophical outlook which seeks to revive the practices of the first three generations of Islam, who are collectively known as the as-salah as-ṣāliḥin, or “pious predecessors.” (Maher, 2016, p. 7) However, he correctly states that various Salafis hold different positions on deeply important issues such as the use of violence, apostasy or legitimacy of state, they seek different goals, often by diametrically different means, and it is therefore highly inaccurate and analytically wrong to group together entities such as Osama bin Laden and the Mufti of Saudi Arabia. Therefore using “salafi” as the sole building block of the operational definition is clearly not enough and begs deeper specification. To more definitely delineate the distinction, Maher uses Wiktorowicz’s politics- focussed, three-pronged categorisation of Salafis into “purists, politicos, and jihadis” based on their preferred method of political engagement (quietism, activism or violence, respectively) and their attitude towards the state (advise the state, challenge it or reject it completely; Ibid., p. 9). Within this categorisation, jihadis are labelled as “violent-rejectionists”, which stems from their ideological grounding; they see the state as “a heretical and artificial unit”, which via enacting the legislation and governing the territory (provided that neither is in accordance to teachings of Islam) makes a false claim on God’s sovereignty on Earth. By depicting the notion of a nation state as an affront to God’s will, jihadis claim that taking up arms in an effort to overthrow and dispose of the state – and by extension of the whole current international system based on nation states – altogether it is an individual duty of every pious Muslim. This is an important difference with “violent-challengers”, which in this typology represent entities that also see violence as a primary means for attaining their political goals, but they shy away from disposing of the state as a whole. If these actors were to violently seize power in their respective states, inside the international system they would most likely behave as pariah states, yet they would still remain an integral part of the system (for better illustration, compare Taliban’s behaviour after seizing control over Afghanistan in 1996 with the Islamic State in Syria and Iraq after 2014).

Therefore, this thesis will analyse exclusively those groups whose central ideology calls for or implies the destruction of the current international system and disposing of the idea of nation states. Following Marc Sageman’s explanation1 of the focus of modern Salafi-jihadist on the far enemy, as well as to refine the research scope, author will be dealing with global Salafi-jihadism, thus excluding jihadist group involved in localised struggles. While analysing the particular systems of funding that stand behind various isolated groups across the world may certainly be very interesting, these separate and heterogenous findings are of little use when trying to describe a structure of a globally-reaching terrorism financing scheme that is more characteristic of the efforts exerted by groups such as al-Qaeda and its affiliated sub- groups. Furthermore, due to the threat these groups and their activities present to the trans- Atlantic security complex, author will focus predominantly on their activities within this area. Practical constrains of the thesis disregarding, there are several valid reasons for this reduction. Policies and actions of these states towards Salafi-jihadist groups represent to their members some of the most strongly perceived grievances and the anti-Western sentiment thus ranks amongst the central themes mentioned throughout their propaganda products. It is not surprising then that these states are being depicted as one of the main adversaries of Salafi-jihadis and therefore are some of the most attractive targets. And as a result, a rising number of terror attacks that took place in this geographical region in recent decades only enforces this notion, making the choice of global Salafi jihadism focussed on the Western countries as the central analytical subject a logical one. In essence, the thesis will focus prominently – but not exclusively – on the two most prominent groups fitting this description of globally active Salafi-jihadi violent rejectionists, i.e. al-Qaeda (and its respective affiliates throughout the history and attacks committed on its behalf) and its ex-affiliate, the so-called Islamic State (also including its own affiliates, wilayats, as well as attacks inspired and executed in its name). While there may be claims that including attacks merely inspired by these groups’ propaganda products is not informative of the financing behind the groups themselves (as they supposedly did not provide any funds to the attackers), it certainly is pertinent to the funding of the Salafi-jihadism as a whole and shows what means of funding do adherents of Salafi-jihadism have access to and which ones they prefer (or which they avoid). Unless specified otherwise, “terrorism financing” will be understood throughout this thesis as an umbrella term, encompassing all steps of the process of financing terrorism, starting

1 See Marc Sageman’s Understanding Terror Networks, chapter 1, subchapter “Salafi Jihad” 5 with obtaining funds, transferring them, storing them and laundering them. Where author speaks about these particular processes and not the financing in general, respective terms related to these processes will be used. It is noteworthy that at certain points in the thesis, “terrorism financing” also refers to non-monetary support; however, these are generally cases where commodities valuable to terrorists, such as gold, drugs or firearms are used in lieu of monetary compensation for other commodities and/or rendered services and does not refer to simple donations of firearms or explosives. Importantly, this thesis deals with both funding of and in some parts also with funding by the Salafi jihadis – as will be demonstrated, often some of the involved actors used the assets at their disposal not only for financing their own organisations or operations, but also to fund other Islamist groups and even governments, seeking to simply support their activities, establish networks, buy their support and cover, or even to instigate terror attacks that would be ascribed to others, either for operational security or simple unwillingness to be (yet) branded as terrorists.

1.2. METHODS AND SOURCES

Research methods applied throughout this thesis vary depending on specific chapters. Whereas the first, historical chapter can be described as a simple descriptive case study of the funding behind the nascent al-Qaeda and its international following in its first three decades of existence, second chapter builds on the knowledge presented there but the chapter as a whole takes on a more of a comparative character, with the comparison of the movement’s two main representants – al-Qaeda and the Islamic State – taking central place. Finally, the third, future- oriented chapter builds on the information and trends mentioned in the preceding chapters and adopts a critical approach, confronting them with expert opinions of practitioners of CTF, criminal investigators and financial intelligence analysts with whom the author conducted several informal interviews between 1 July – 20 December 2018. Furthermore, the thesis is split along the organisational-operational financing divide; whereas the former case uses only descriptive approach, in the latter author uses short case studies to demonstrate the real-life application of broader trends mention in the other part. Choice of this cases was based on their relevance to broader trends of that respective era, so as to best illustrate how the trends materialised and influenced terrorists’ choice when picking specific sources of financing; by no means are they meant to be a complete list of all terrorist attacks of that era or a source on which author based his observations. Regarding the second point, observations made by author in the operational financing chapters are supported by findings of quantitative research projects that take into account comparably more cases and arrive at similar conclusions (Norwegian FFI in the historical part, GLOBSEC in the modern operational funding part). During his research, author has drawn on numerous sources of varying provenance, so as to arrive at most objective conclusions. These varied in each of the three chapters. The historical chapter provided for a well-researched and more-or-less neatly organised sum of information, especially its first part, and accounts of historians, government reports, analyses of former intelligence officers involved in investigating al-Qaeda were used, as well as academic research dedicated to later parts of that era. Given that the second chapter deals with very recent events, reporting on this time period was for obvious reasons more chaotic and author had to compare several sources for a single information, as their reporting often differed and some of their estimates were wildly divergent; to this end he drew on a number of reports of academic researchers, private research and consultancy institutions, think-tanks, media reports and reports of governments, as well as on his own research and work in organisations

7 involved in contemporary terrorism research. Finally, as mentioned above, the basis of the last chapter is built on sources of the previous chapters, but their findings are confronted with information gleaned from informal expert interviews author had conducted in the second half of 2018 during his engagement in EUROPOL’s Operations Directorate.

1.3. LIMITS OF THE RESEARCH

Terrorism research, and terrorism financing research in particular, suffers from some inherent problems that have manifested over the course of author’s research as well. Probably the greatest was the lack of precise and available information. Although finances are a highly personal and sensitive subject in many areas, verifiable and objective data on finances of terrorists are even harder to come by. As case studies below show, prior to 9/11, data on financing behind specific plots in the West was deemed unimportant and irrelevant for establishing their perpetrators’ guilt. Furthermore, the highly sensitive relationships of Western countries with the Gulf States funding Salafi-jihadism made any objective, thorough and high- level investigation into their financial activities a no-go subject. Situation improved only after 9/11, once it was discovered that some of their charities and donors had been involved in funding Islamist militancy around the world and data was made available to broader public. However, specific figures are known only in exceptional and high-profile cases and most of the time sources cite only ballpark figures and informed estimates, e.g. based on known operational costs, prices of weapons on black market, materials for explosives, prices of accommodation in the specific city etc. The situation is similar with regards to present affairs, as author had to rely only on published reports, which draw on information that has been made public, thus possibly omitting many other plots, financial schemes and methods used by terrorists today that remain unpublished. Although author has had access to CT, CTF and financial intelligence experts and investigators from EUROPOL and has made numerous interactions and several interviews with them, for obvious reasons they could not divulge operational data from live files and ongoing investigations. For these reasons, the thesis should be understood as exploratory, listing what is currently know, interconnecting it and putting into broader context of terrorism research; however, over time facts may arise that will render some of author’s findings inaccurate or incomplete.

1.4. CHAPTERS LAYOUT

The main body of the thesis is divided into three chapters, with each of the chapters dealing with a different era of terrorism funding – its history, present state and future, respectively. Each chapter deals with its respective era’s trends and then follows up with the sub-chapter on operational support, where applicable, to demonstrate the points made in the previous paragraphs on actual cases of operational preparation. Throughout each chapter and its sub-chapters, emphasis is laid on correct distinction between specific dimension of terrorism financing (see chapter 1.5 for the list of these categories). The first, historical chapter has to be divided into three parts: its first part deals with the funding of Salafi-jihadism since what can be called its inception, i.e. founding of Maktab al- Khidamat and its successor, al-Qaeda, during the Soviet war in Afghanistan. The second part analyses the most active phase of the group, i.e. its activities in the 1990s, and ends with the attack on the twin towers of the World Trade Center in New York City on 11 September 2001. After 9/11, the third part starts, dealing with the War on Terror and global Salafi-jihadism’s branching out and splintering, ending symbolically in year 2011 with Usama bin Laden’s death. This division is a logical one, as the systems of financing the global Salafi jihad were markedly different during these particular eras. Whereas in the first phase global Salafi jihadism enjoyed some state support and was limited to organisational investments, in its second phase it has restructuralised its funding scheme dramatically and started focussing on operational capabilities, even orchestrating several terrorist attacks. Finally, in its third phase, the attack of 9/11 brought Salafi-jihadism-inspired terrorism to the forefront of many states’ security agendas and sparked a vigorous push for countering of terrorism finances (CTF); in effect, sources and means hitherto used to fund terror attacks – 9/11 notwithstanding – became largely obsolete, as the resulting crackdown prevented the terrorists from using them again, or at least to such an extend as they did before, forcing the movement to adopt a completely different funding system again. (Passas, 2007, p. 30) The second chapter chronologically follows up and deals with the present state of Salafi- jihadism funding, beginning with the Arab Spring and covering the era of the Islamic State’s activities, with focus being on the funding behind the Islamic State’s caliphate project and the funding of the terrorist attacks in the West – again, this chapter seeks to illustrate the contrast with the previous era of global Salafi-jihadism funding, one that is characteristic by a rise of territory-governing, locally-funded jihadist groups on the one hand, and the “popularisation” of

9 jihadism, manifested in a number of unauthorised, low-cost, self-funded attacks perpetrated with little formal connection to any jihadist groups on the other hand. Finally, the last chapter will be dealing with the future means of terrorism funding; it will be based on current trends analysed in the previous chapter and complemented by information from expert investigators with whom author had an opportunity to conduct interviews. This chapter seeks to dispel some of the most widely-held beliefs and fears about the abuse of upcoming technologies, showing and explaining how experimental – albeit potentially highly lucrative – sources of financing are often avoided by terrorists due to their complicated nature, low guarantee of returns, low ease of use and general unwillingness of terrorists to “break what currently works”.

1.5. ANALYTICAL FRAMEWORK

The thesis will be guided, build on and further develop the analytical framework of terrorism funding provided by Colin Clarke in his Terrorism, Inc. Clarke structures his research around 3 main questions: 1. how do terrorists (and insurgents) fund their activities (either via gray economy 2 or dark economy 3, 2. what do they use these funds to achieve (either operational or organizational capabilities) 3. how do states/organizations counter these groups? (either by kinetic operations or non-kinetic operations)

While author does address the third question throughout the thesis only episodically and with less emphasis than Clarke, he adopts the categorisations used in the first two questions, albeit with some adjustments. The operational/organizational divide in investing mentioned in the second question is slightly reworked to suit the topic of global Salafi-jihadism and will create the backbone of every chapter. In the case of the first question, however, the categorisation used throughout this thesis is a departure from Clarke’s framework. While his categorisation is based on the activities’ legality, author opted for a different approach, making distinction in these activities’ role in the funding process instead. Four categories will be distinguished throughout the thesis – clearly delineating where one of them ends and the other one starts is important for making informed assessment of what tools may be used against each of them. This is an area where many researchers often make the error of putting everything in one category, which tends to portray notably more opaque, and consequently unnecessarily over-complicated picture of terrorism financing than the reality really represents.

2 By gray economy Clarke understands „a combination of licit and illicit activities perpetrated by terrorist and insurgent groups for monetary gain. As a whole, the activities that comprise the gray economy are not entirely illegal. The gray economy borders on the legal economy, interacts with the licit economy and intersects with ordinary business activities.” More specifically, he includes in this category activities such as diaspora funding, donations made through charities, fraud (including identity theft and cybercrime), legal businesses and front companies, and money laundering. (Clarke, 2015) 3 In turn, dark economy means in Clarke’s understanding activities that “are entirely illicit and illegal, with little room for interpretation. These activities usually, involve violence, or at least the threat of violence, and include kidnapping for ransom, armed robbery and theft, trafficking, smuggling and counterfeiting, extortion and protection, and external state support.” (Clarke, 2015) 11

The categories are: A. sources of finances, B. means of transferring the funds, C. means of value storage, D. means of laundering the funds.

There are clear distinctions between these categories and lumping them together is analytically erroneous and unhelpful. For example, a terrorist group-operated Islamic charity that skims off a portion of its adherents’ contributions for funding of terrorist attacks is by its nature different to a construction company that is used to launder these funds and make them appear legitimate; similarly, using a complicated international scheme of wire transfers through a series of offshore banks, shell companies and intermediaries is characteristically different to simply raising funds by selling smuggled gemstones or locally-produced opioids. Naturally, these categories should serve only as a simplified organising framework for the purposes of this thesis and author does not imply that in reality these activities can be as clearly delineated and condensed into well-defined boxes as the framework suggests – just the opposite, as his research has shown that often activities of a single entity can include being a source of finances, being a conduit for other funding vectors, providing a money laundering service on side and even a means of storing the value in something less traceable than bank notes. These categories should serve as an organising structure which can help the reader make a better understanding of the complexities of terrorism financing by delineating all the activities that entity in question undertakes to finance terrorism. 1.5.1. Organisational and operational capabilities Because these two terms create a backbone of all three chapters, they warrant a deeper elaboration for their proper definitional understanding. In a slight departure from Clarke’s framework, author tries to emphasise the difference between sustained organisational funding for a longer period of time and investments in one-off operations; this necessarily resulted in some of categories in Clarke’s framework being shifted from one area to another, some being specified, broken down, others being merged. By operational capabilities, Clarke understands “the activities that allow the insurgents to sustain a series of successful attacks (…) These operational tools include: weapons, sanctuary/safe haven, intelligence, training, and financing/funding” (Clarke, 2015, pp. chapt. 1, subchapt. "What are operational capabilities?") For externally-supported actors, Clarke adds factors of external weapons and direct military support as a sub-category of weapons, for

12 sanctuary he adds a category of operational space (that allows for planning, training for, and executing attacks), and as part of the intelligence factor he adds operational security (OPSEC) and deception skills. Understandably, for the purposes of this thesis and its focus on financing in general, these categories had to be adjusted to fit the topic; the new categories are: • arms and weapons purchases – all investments for the tools (and their components) used for the attack, ranging from knives, handguns to weapons of mass destruction • operational space funding – funding of safe houses, planning space and training grounds • OPSEC investments – investments in measures that enhance the operational security and lower the chance of the plot being uncovered by the authorities; the category includes specialised electronic equipment such as satellite phones or redundancy- establishing measures like multiple SIM cards, burner phones, means of anonymising one’s presence on the Internet, fake documents and others. • intelligence and planning investments – investments that help develop plan for the attack itself; may include financing for reconnaissance travels, renting of vehicles used in attacks or payments for equipment and services that aid in planning

On the other hand, organisational capabilities of an insurgent group are “comprised of those activities that sustain the group’s existence as a cohesive entity” – here Clarke includes leadership (and its sub-categories of command and control and structure), ideology, recruitment, and public relations. Again, for the purposes of this thesis these had to be adjusted and include: • funding for the group’s leadership and top echelons – so as to sustain the core of the group inside the organisation and prevent them from defecting to authorities and thus causing a potentially fatal security breach (e.g. desertion of AQ financier Jamal al-Fadl in mid-1990s to FBI; see below), • investment in spreading of ideology – i.e. financing of printed publications, videos, propaganda pamphlets, online presence, even financial support for organisations that may portray the struggle in favourable light and incentivise donors • funding for rank-and-file members and supporters – includes incentives for individuals to join the group and stay inside, measures to prevent low-level defections and allegiance shifts (i.e. double agents) and funding for broader supporter base that may produce new members for free

• funding of sanctuary – unlike in the operational category, this relates to funding to host government or organisation that allows the terrorist group to exist for a longer period on its territory, regardless of its activities

Interesting point may be made about payments to other Islamist groups, as this seems to be one of the dominant trends in bin Laden’s modus operandi during the early 1990s; these payments did not fund any imminent operations directly, but neither were they used to sustain al-Qaeda as an organisation. In a broader sense, however, they did indirectly help bankroll some violence (albeit not under the title of al-Qaeda) and did contribute to furtherance of political causes of groups that bin Laden had sympathised with (otherwise he would not have provided the funds). Therefore, financial support of other Islamist organisations will fall under organisational capabilities, as the apparent general and long-term purpose of those investments fits better this category than that of operations.

2. HISTORY OF SALAFI-JIHADI TERRORISM FUNDING

This chapter will elaborate on approximately the first three decades of funding behind globally-reaching Salafi-jihadist groups, their activities and attacks that targeted the Western countries and their interests abroad. As Maher puts it, Salafi-jihadism as a distinct ideological movement rose to prominence in the early 1990s, coinciding with the decline of political Islam (or simply “Islamism”) and its inability to deliver political goods.4 (Maher, 2016, pp. 17-18) Other resultant or related factors, such as the start of the Algerian civil war, violent seizure of power by the Taliban in Afghanistan and the end of the post-bipolar world created a climate where Islamists no longer felt that their political representation is attainable by peaceful, democratic means.

2.1. 1980-1989 – THE BEGINNINGS

Despite this, Salafi-jihadism’s roots, or more precisely roots of its main protagonists can be traced a few years earlier to the end of the war in Afghanistan. It was during this conflict that a Palestinian theologian Abdallah ‘Azzam, nicknamed “father of modern Islamic terrorism”, founded in Peshawar the organisation called the Services Bureau, better known by its Arabic name Maktab al-Khidamat (MAK), which served to “receive, supervise and organise the increasing number of volunteers and the growing flow of funds from the Middle East.” (Burke, 2003, p. 69) In essence, MAK functioned as a focal point for international (mainly Middle Eastern) popular Islamist support for the Afghan war – it raised funds for the jihad all around the world, helped recruit individuals for jihad, operated a system of guesthouses (known as Bait al-Ansar, the “House of Supporters”; Sageman, 2004, p. 35) to accommodate them and indoctrinate them and them redistributed them to various internationally-supported and funded mujahideen camps to receive military training and to be deployed in the field. It is in MAK that we can trace the roots of modern global Salafi-jihadism in its living form, no longer limited to theological exhortations and theories but as an active, combat-ready force of jihadists (albeit a very small one, counting several dozens of individuals), slowly cultivating and developing their political and ideological worldview, one that would operate not only in the Muslim world but would strive to wage jihad globally. Some of the most notable leaders of this ideological movement were present in Pakistan organising for the Afghan war at this time – after all, it was

4 For example, see the brutal crackdown of the Saudi government on their domestic Qutbist movement Al-Sahwa al-Islamiyya, similar fate of Ennahda Movement in Tunisia or that of the Muslim Brotherhood in Egypt or Syria. 15 in Peshawar while supervising MAK’s projects when one of its founders and its main sponsor, Usama bin Laden, met for the first time his later deputy and successor as al-Qaeda’s leader, Ayman al-Zawahiri. (Sageman, 2004, p. 35) It is noteworthy that what is today called al-Qaeda included back then only a handful of Arabs (often called “Afghan Arabs”, with the core being ‘Azzam, bin Laden and Abdullah Anas) training in a camp dedicated for foreign volunteers near Jaji, called al-Ma’asada (The Lion’s Den), built by bin Laden family’s construction company exclusively for this use.

Although the organisation enjoyed a significant budget ranging in several millions of dollars and sourced both from covert sources of some Middle Eastern countries and from private individuals sympathetic to the organisation’s cause, its activities for the war effort in Afghanistan were of a supportive character and seldom offensive; several accounts5 note how small the group really was, how marginalised and badly reputed among Afghan warriors Arab Afghans were and how their military engagement was limited to a handful of hastily-organised offensives, despite bin Laden’s notable investments into building of camps and arming his trainees. Their auxiliary activities, i.e. recruitment, popularisation of jihad worldwide, providing a network of guesthouses and distribution of recruits into training camps of other factions were comparably more effective. Therefore, with some reservations, it can be said that global Salafi-jihadism – in its beginning epitomised by Maktab al-Khidamat – at its onset invested heavily in both operational and organisational capabilities, although the returns on these investments varied drastically, making only the organisational dimension relevant for the purposes of this work. It was not until the end of the conflict, loss of state funding and drastic ideo-political shift in bin Laden’s thinking that global Salafi-jihadism started being operationally active.

2.1.1. State support Many actors, both regional and global, started taking interest in the conflict long before ‘Azzam’s established MAK, each pursuing their national interests and willing to invest money to secure them. The axis of US, Saudi, and Pakistani financial support in this era was particularly active, to some degree interconnected and for the purposes of this work very important, as it had laid the groundworks for the globally reaching capabilities of Salafi- jihadists in the 1990s. Although due to common interests (i.e. anti-Soviet orientation of their foreign policy) these countries had initially agreed on a joint scheme of funding the rebels, they

5 See works of Marc Sageman, Jason Burke, Peter Bergen or Steve Coll on this topic in bibliography section. 16 had their very distinct preferences on how these funds should be used. This is best apparent in the choice of mujahideen leaders that these states had decided to support; whereas the CIA preferred “moderates” like Abdul Haq or Ahmed Shah Massoud, Saudi Arabia had put the brunt of its support behind Abdul Rasul Sayyaf, an Afghan Wahhabist who went on to establish several of the most prominent mujahideen training camps. Finally, the role of Pakistan in this financing scheme was arguably the most important one, seeing as it had been given permission by both the US and Saudis to redistribute the provided funds and materiel as they saw fit – naturally, this resulted in the common budget having been used to pursue Pakistani national interests in Afghanistan foremost, with the support of ideologically aligned Islamists taking primacy over moderates.

The US support for Afghan mujahideen in this conflict – under the umbrella of CIA’s “Operation Cyclone” – varied every year throughout its duration and is estimated to have moved from $30 million in 1980 to $250 million in 1985. While it can be described as more pragmatic, Cold War policy-driven than the Saudi, ideologically-influenced support, their direct contributions eventually pooled into one that would be redistributed by the Pakistani Inter- Service Intelligence (ISI) through what was called the “Afghan pipeline”, starting in Karachi or Rawalpindi and ending up in Afghanistan. According to Napoleoni, from 1983 to 1987 the annual shipment of weaponry funnelled through it rose from 10,000 to a steady 65,000 tonnes. (Napoleoni, 2003, p. 80) She notes how “the CIA purchased all military equipment directly from countries friendly to the US, often after consulting ISI on the military needs of the Mujahedin. The supplies were then shipped to Islamabad; from there the ISI delivered them to the Islamic Parties, resistance groups which directly supported the Mujahedin.” (Ibid.) Aside from material support, ISI also demanded cash to ensure smooth operation of the pipeline and for the mujahideen salaries; altogether these expenses cost the sponsors of the Mujahedin no less than $5 billion a year. (Ibid.)

However, it would be an error to directly ascribe the US funding to Afghan mujahideen as a starting investment for the global Salafi-jihadism, or to connect Western state funds directly to MAK and by extension to al-Qaeda; in short, the popular misconception that the United States founded and funded al-Qaeda at its inception during the Afghan war is simply not true for several reasons. First of all, this material support has to be understood in the context of the war in Afghanistan, where the desire to support proxy groups that would fight the Soviets outweighed any long-term, post-war implication of this support and at its outset it was difficult to foresee any “blowback” to the funders. Secondly, al-Qaeda at this point did not exist and the

17 predecessor MAK (counting a handful of Arab jihadists from various Middle Eastern countries, mostly focused on their particular national problems) was not much different to other Islamist fundamentalist groups operating in the conflict – even worse, as many authors on this era noted, compared to local groups, Arab Afghans were significantly less capable militarily-wise and were largely side-lined during major offensives. More importantly though, the United States did not directly support any mujahideen group, as it was a Pakistani condition that any external material support has to be run through ISI and the service will be the only distributor of the wealth, directing who will receive what portion of the funding (Sageman, 2004, pp. 56-57); this gave Pakistan considerable clout on Afghan internal politics, as its Islamist president Zia ul- Haq tended to favour like-minded Islamist factions like Gulbuddin Hekmatyar’s Hizb e-Islami or Jamaat-e-Islami of Burhanuddin Rabbani. However, due to seeking the Pakistan national interest first and foremost, ul-Haq preferred to support local groups more than a heterogenous, ragtag group of inexperienced Arab fighters (albeit ideologically compatible), as they were of greater political use to Pakistan.

On the other hand, the Saudi support was particularly crucial in inadvertently establishing the infrastructure of the global Salafi-jihadism, as it had helped transfer thousands of willing individuals from across the Middle East to Afghan battlefields and had built some of the main mujahideen bases and training camps in Afghanistan and close to its border with Pakistan, including the major ones at Zhawar Khili and Tora Bora. (Burke, 2003, p. 73) The kingdom’s support in the conflict can be divided into two categories – state funding and funding by private entities. In the former case, the state’s swollen budged from recent oil explorations allowed it to invest newly-raised wealth into operations abroad with considerable largesse. Apart from public actions like a government-initiated encouragement for jihad by offering steep discounts on the national airline flights to Pakistan or publicly touted contributions by royal family members for the conflict, the kingdom also ran several covert funding programs. (Wright, 2006) In July 1980, Prince Turki, head of the kingdom’s intelligence agency, General Intelligence Directorate (GID), reached an agreement with the CIA to match the US funding for Afghan mujahideen dollar to dollar. As Steve Coll writes, Saudi portion of the money – which amounted to between $350 to $500 million a year – was annually transferred to its embassy in Washington, from where it was transferred to a CIA-controlled Swiss account, which the agency used to make its covert purchases on the international arms markets which in turn were funnelled via Pakistani ISI to Afghanistan. (Coll, 2004, chapt. 4, par. 40)

While this represented their covert joint support for Afghan mujahideen, GID, however, operated its own compartmented funding scheme, away from the US or Pakistani influence, relying on charities and humanitarian organisations operating in the region. These had been used as a front, soliciting public funding for building of madrassas in the Pakistani-Afghan border area, while actually being used as a cover for arms and money transfers to Saudi- preferred Afghan commanders and projects, such as Abdul Rasul Sayyaf or bin Laden’s Maktab al-Khidamat. Sayyaf was an ardent and well-connected Islamist-Wahhabist, as an al-Azhar alumni he spoke excellent Arabic and at the war’s outset he became the leader of the Islamic Union for the Liberation of Afghanistan, an umbrella group uniting various Islamist rebel factions. More interestingly though, over the conflict’s course he had developed a close relationship with bin Laden via their common donors and their efforts in the area centred around Arab volunteers. Using extensive Saudi funding, provided frequently (reportedly as often as twice a month) by Prince Turki’s chief of staff Ahmed Badeeb, Sayyaf had built several training camps, including a massive complex near Pabbi dubbed “Sayyafabad”, a well-provided refugee camp and a network of warehouses, military bases, mosques and madrassas, including the infamous “University of Dawa’a and Jihad.” Along with his other camps such as al-Farooq and Khaldan, these facilities were later to become the main training grounds of al-Qaeda-linked jihadists during late 1990s. (Burke, 2003, pp. 67, 73, 95) With regards to bin Laden, it is estimated that more than a tenth of this privately raised Saudi money went to supplement bin Laden’s unofficial activities that ensured that young recruits from across the Middle East would receive housing, salary, training, indoctrination (free of Pakistani influence) and deployment on the Afghan battlefields. (Wright, 2006, pp. chapt. 3, par. 17.)

Although the state support, both joint and bilateral, represented a majority of Saudi- originating funding, private sources were no less important and especially in the 1990s became the lifeline for al-Qaeda. Among the most important figures in this area was sheikh Abd ul- Aziz bin Baz, the head of the kingdom’s official religious establishment. Early in the conflict, bin Baz issued a fatwa authorizing a “wealth tax” to support the Afghan jihad and had endorsed ‘Azzam’s publication, In Defence of Muslim Lands. Bin Baz had organised a network of charities that operated independently of the Saudi state establishment, drawing on voluntary contributions of wealthy individuals, zakaat proceeds and mosque tributes. Due to the less controlled nature of these funds it is hard to precisely pinpoint either their origin or their final recipients in Afghanistan, but their importance lies in giving to the contributions to jihad in Afghanistan a public, crowdsourced character, painting it as a religious, identity-based

19 obligation, and in effect hazing the picture and providing a cover for the more clandestine funding efforts of GID. According to bin Laden himself, he personally took part in this private fundraising scheme in the early years of the conflict as a courier, delivering charitable donations from wealthy Saudis. (Wright, 2006, pp. chapt. 2, par. 42.) Later on, he is said to have raised “between five and ten million dollars” during the Ramadan of 1984 (with $2 million of that reportedly coming from his half-sister), which provided a start-up investment for Maktab al- Khidamat. (Ibid. chapt. 3, par. 11) Over the next years, bin Laden would become an adept fundraiser, creating a personal network of wealthy contacts in the Gulf that he would tour and ask for financing, raising millions in contributions. This network of wealthy Saudis, Kuwaitis and Emiratis was found to be dubbed “The Golden Chain”6 and later represented one of the most important sources of funding – a testament to their importance in al-Qaeda’s funding scheme is the fact that these individual wealthy donors proved to be bin Laden’s salvation after his largely unsuccessful business enterprise in Sudan collapsed and was seized, his personal funds were frozen and he was forced to flee to Afghanistan in 1996.

2.1.2. Maktab al -Kh idamat gl ob al funding activities Financing-wise, Maktab al-Khidamat (and later al-Qaeda) was designed to be self- sustaining over time, partially self-funded, and partially funded by sympathetic Muslims all over the world. As Abuza notes, the system was “built on layers and redundancies” created by a network of charities, NGOs, mosques, websites, fund-raisers, intermediaries, facilitators and banks and other financial institutions that helped finance the mujahideen in the 1980s, spanning across the whole Muslim world. (Abuza, 2003, p. 170) This system of funding survived the Afghan conflict and was adopted by the successor group, al-Qaeda; over the next two decades it remained more or less the same and represented the “core” of funding, with legal businesses and illegal activities being adopted and then abandoned for various reasons and at various points in the organisation’s existence.

To bolster its support for the war effort, between 1985 and 1989 MAK opened recruiting offices throughout the world (including in several Western countries), often relying on the funding and existing structures put in place by politically active Islamic organisations such as the Muslim Brotherhood, but also to large extent on support provided by the Gulf States (Burke,

6 The name comes from a document seized in March 2002 in Sarajevo, Bosnia during a raid of a suspected AQ-fundraising charity, Benevolence International Foundation; the list was allegedly created in 1988-1989 and contained names of at least 20 top Saudi and Gulf states sponsors, including top businessmen, bankers and former politicians. See subchapter on charities use for more information. 20

2003, p. 71). Many Islamic centres and sympathetic mosques that had been in place for years were being used for fundraising by foreign preachers and/or directly involved in the fundraising efforts for the war in Afghanistan. ‘Azzam himself is said to have personally travelled the Middle East, Europe and even the United States yearly to preach, recruit and raise funds for jihad in Afghanistan. (Soufan 2011, chapt. 1, par. 1.) First offices of MAK in the US were the al-Kifah Refugee Center in Brooklyn, and the Islamic Center in Tucson, Arizona. Due to their considerable usefulness, over the years of the Afghan conflict MAK opened permanent offices in 33 cities of the United States. (Wright, 2006, pp. chapt. 3, par. 26., chapt. 9, par. 11) These offices served as a channel for the funding sourced from local Muslims and diaspora members and for recruits willing to go fight in Afghanistan. Coupling this with the aforementioned tours of the Gulf States and considerable donations from private donors and state- and privately- run charities, MAK had at its disposal funds in millions of dollars.

By the time Soviets announced their withdrawal from Afghanistan, a power struggle took place inside MAK over its purpose and future strategy, pitting its founder Abdallah ‘Azzam against Egyptian elements within the group centred around Ayman al-Zawahiri. Marc Sageman posits that the conflict was twofold, with the core issues being ideological and practical differences. Firstly, ‘Azzam himself argued for the group to serve as a vanguard for Muslim uprisings in “infidel lands” on the periphery of the Muslim world, seeking to start revolutions in countries where Muslims were being oppressed by non-Muslim regimes, such as in Bosnia, the Philippines, Kashmir or his homeland of Palestine. However, his idea of “classical jihad” was strongly against inciting conflicts in Muslim-ruled countries, as it would cause fitna and would necessitate the use of takfir in order to designate their rulers as apostates, a practice that ‘Azzam strongly disapproved of. Conversely, Zawahiri and other veterans of the struggle in Egypt – many of them members of still-active the EIJ or EIG – took issue with this, as the end of conflict in Afghanistan opened up the possibility of turning organisation’s attention to their homeland from which they had to escape to Afghanistan. The second issue was with the use of the organisation’s training camp, al-Ma’asada, and its funds, for waging jihad in Egypt against the government; again, due to the reasons mentioned in the first point ‘Azzam could not approve of this heading, whereas the Egyptians saw them as crucial elements for their fight. It is claimed that it was because of these differences that Abdallah ‘Azzam and his two sons were killed by a remotely-controlled car bomb on 24 November 1989 in Peshawar, leaving Maktab al-Khidamat in hands of jihadi hardliners – including absent bin Laden, who by this time had gradually shifted his views from those of his mentor to the Egyptians’.

(Sageman, 2004, pp. 36-37) MAK’s successor group – now calling itself “al-Qaeda” – was a modest one, counting only about a dozen individuals, mainly EIJ members such as Zawahiri or Mohammed Atef. (Burke, 2003, p. 79) In comparison to their Afghan counterparts, al-Qaeda’s members then had very little combat experience and training, but they had contacts with wealthy individuals across the Middle East and some reputation among sympathetic Afghan mujahideen, both factors that would serve it in the 1990s to establish itself as the vanguard of the global jihad.

2.1.3. Chariti es and government aid organizations (ab )us e Crucial to the organisation’s existence at this point and in the coming decade was a network of charities, with some of them based and operating in the Gulf countries, while others had worldwide offices moving funds to Peshawar and other Pakistani frontier cities. More importantly though, bin Laden retained contact with many of them after the conflict’s end, using them to fund nascent al-Qaeda’s activities and subsequently even several terrorist attacks. The convoluted nature of these charities’ globally-reaching structures eventually helped keep the organisation alive even after the 9/11 attacks and after the global crackdown on terrorism financing. This chapter seeks to illustrate their world-spanning reach and series of linkages to al-Qaeda in order to demonstrate their importance in the organisation’s financial and logistical infrastructure during the 1990s and early 2000s.

First of all, it is noteworthy to specify their sources of funds. These organisations took advantage of two Islamic forms of charity. Zakaat is a form of alms and one of the five pillars of the Islamic faith. As it is a religious obligation and represents something of a tax (usually of about 2,5% of one’s income), its collection is mandatory upon all Muslims; in several countries, especially in Saudi Arabia, Sudan or Yemen its collection is governed over by the state. For jihadi organisations, zakaat represented a trickle of small, but numerous contributions from Saudi citizens and Muslims visiting mosques where these charities were operating. On the other hand, sadaqah or “charity” is a voluntary contribution for the sake of pleasing Allah and its payment is not mandated by the religion; sadaqah represents all the gigantic contributions offered by wealthy donors that often range in hundreds of thousands of dollars and are offered to charities for the needy.

By combining these two distinct financial sources (i.e. large volume of small donations and a handful of large-amount donations) in one charity it becomes almost impossible to ascertain whether the charity serves as a money-launderer for funding of terrorism, as it all comes down to the specific donor’s intention (which is obviously hard to estimate). Al-Qaeda 22 took advantage of this by diverting a portion of charity funds to its operatives – until that point the source (charity) looked legitimate and was nothing out of ordinary. It also merits mentioning that to paint these organisations as purely terrorism financing enterprises would be wrong – just the opposite, their vital importance for regions where they were active with humanitarian, development and dawa projects made them indispensable to local populations, thus discouraging the authorities to pursue and criminalise them, even when confronted with evidence that a portion of their funds were used to support terrorist activities (a case in point here being the Saudi hesitation to ban several charities connected to al-Qaeda after 9/11, such as BIF, al-Haramain or IIRO; see below). In many cases, their link to jihadi terrorist organisations was personal – a person sympathetic to or sent out by al-Qaeda took a position in these charities’ branch and started skimming off funds to AQ or redirecting funds for development projects to AQ shell companies, offshoots or local financiers; often it was a personal initiative of this person that made the abuse of charity possible.

These charities were founded at various points, with most of them being founded during or at the end of the Afghan war by the Saudis in order to take advantage of the vacuum and establish a geopolitical foothold in the region; a similar approach can be observed in many other post-conflict countries, such as Bosnia and Herzegovina, where some of these organisations operated and their influence there is notable. As has been mentioned above, these charities were used – knowingly or unwittingly – for various ends. For example, in the case of the Saudi state support for the war in Afghanistan, charities were used by the state (apart from the mentioned geopolitical ambitions exercised via building of schools, housing and cultural establishment) as a conduit for transfer of money and military materiel in order to make the transaction appear disconnected from the government. In the case of Saudi popular support, on the other hand, charities themselves were only a source of funding, with individual donations coming in from Saudi citizens sympathetic to the mujahideen cause. Bin Laden himself, along with his brother Khaled, is said to have founded the Islamic Salvation Foundation, a charity in Saudi Arabia that funnelled funds to MAK in Afghanistan. (Johnson, 2007, p. 103)

With regards to the applied analytical framework, charities served both as organisational and operational funding sources, with the trend being something of a curve. During the Afghan conflict, they served primarily as an organisational funding source, until the 1990s, when this dominance was evened out by some charities being directly involved in providing financing to several terror plots. After 9/11 attacks, they tuned down their operational support, some were banned, but their infrastructure and established contacts still remained vital

23 for the organisational funding of al-Qaeda core hiding in Pakistan. In the later eras, i.e. 2011+, there is little evidence suggesting that charities continue to be used for terrorism financing, with the most likely explanation being established control regimes being in place, thus preventing this source of revenue and forcing Salafi-jihadists to other means of funding; nevertheless, some of them are still used as conduits for private donations, especially l in the Middle East. Below are described some of the most prominent, along with their connections to AQ.

Benevolence International Foundation

Among Saudi charities established during the Afghan conflict for the support of the mujahideen was the charity Islamic Benevolence Committee (or Lajnat al-Birr al Islamiah), based in Jeddah and Peshawar. Its sister organisation, Benevolence International Corporation was established around the same time by Mohammad Jamal Khalifa, bin Laden’s brother-in- law and regional head of IIRO’s office in the Philippines (see below) and served as an “export- import” company, supporting the jihad in Afghanistan. After the conflict, the two organisations merged, renamed itself Benevolence International Foundation (BIF) and established offices worldwide, including an office in Illinois in 1992). (Comras, 2007, p. 120) Its CEO Enaam Arnaout had long-lasting relations with bin Laden, spanning back to 1980s when he was photographed inspecting the al-Ma’asada camp with him and the US Treasury directly linked the two men via bin Laden’s lieutenant and al-Qaeda’s chief financial officer, Mamdouh Mahmud Salim, who was implicated in al-Qaeda’s efforts to obtain nuclear weapon components and develop an in-house chemical weapons capability at the Darunta camp. (Ibid.) Apparently, under Arnaout BIF operated in accordance with AQ’s strategy of being present in countries where Muslims were being oppressed, as in the 1990s it held offices in Bosnia, Chechnya, Pakistan, China, Ingushetia and Russia. Arnaout was eventually indicted in the US for material support for AQ and for running BIF as a racketeering enterprise. More importantly, it was in the office of its Bosnian branch “Bosanska Idealna Futura” where the authorities found the documents detailing the so-called “Golden Chain”, a network of a few dozen high-profile Saudi and Gulf States financiers of Maktab al-Khidamat. (U.S. Department of the Treasury, 2002a)

International Islamic Relief Organisation (IIRO)

Founded in 1978, IIRO is a Saudi-based, Wahhabi-sponsored charity holding an affiliation with the Muslim World League and a consultative status with UN’s ECOSOC committee. The bulk of its contributions come from private donors from Saudi Arabia (Comras,

2007) The organisation operates dozens of branches worldwide, with several of them located in the Southeast Asia; its Philippine and Indonesian branches were banned in 2006 by the UN and US Treasury over allegations of providing funding for al-Qaeda-related groups and plots, especially during the 1990s. However, by 2014 the UN de-listed the two branches, with the US Treasury joining the fold in 2016. (Justia Regulations, 2016)

During the 1990s, these two branches were reportedly abused by bin Laden’s brother- in-law, Mohammed Jamal Khalifa, to fund terrorist groups in their countries. In 1985, Khalifa ran the Peshawar office of Muslim World League, siphoning Saudi youth into Pakistan for jihad; there he had established close ties to bin Laden’s top financiers, Wael Hamza Julaidan and Yasin al-Qadi (see subchapters on al-Muwafaq and Rabita Trust below). While Khalifa was serving as the IIRO’s regional head for Southeast Asia, the charity’s funds were funnelled to Abu Sayyaf Group (ASG) and Moro Islamic Liberation Front (MILF). Khalifa also founded another charitable organisation, called “International Relations and Information Center”; the organisation is alleged to have been the primary funding plan for the eventually botched “Bojinka plot”, an ambitious plan of Khalid Sheikh Mohammed and Ramzi Yousef to assassinate Pope John Paul II, blow up 11 airliners in flight from Asia to the United States and crash a plane into the headquarters of the CIA (Abuza, 2003) Furthermore, IIRO’s funds were allegedly used to fund at least 6 AQ camps prior to the 9/11 bombings and evidence provided in related Canadian court proceedings directly implicated the charity in funding the 1998 embassy bombings. (Comras, 2007)

Al-Haramain Foundation

Al-Haramain Foundation was founded by Saudi Arabia in 1988 in Karachi in order to (as many other charities at that time) support the jihad in Afghanistan and help with the post- war reconstruction; these conditions provided regional powers with a “vacuum” to establish or strengthen their foothold in the region, with both Saudi Arabia and Pakistan building dozens of mosques and madrassas. In 1992 it moved its headquarters to Riyadh. In the organisation’s pre- 9/11 existence, it is said to have raised approx. $30 million a year (although other sources speak of figures as high as 50 million), drawing largely on wealthy Saudi sponsors. These funds reportedly funded some 3000 Wahhabi missionaries and concentrated on building new Wahhabi mosques in the Balkans, Southeast Asia and Africa. (Comras, 2007, p. 121) During the 1990s, al-Haramain started going global, establishing offices across several countries, including Bosnia (then engulfed in an armed conflict), Albania, Croatia, Kosovo, the Netherlands and Oregon, USA, among others. However, at this time it maintained a rather low 25 profile. The situation changed by the end of the decade. Its staff was allegedly involved in providing material support for the twin US embassy bombings in 1998; an al-Qaeda operative closely involved in the operation’s planning named Mohammed Sadeeq Odeh is said to have been given funds by al-Haramain with instructions from Mohammed Atef to set up a fishing business in Kenya, use a part of the proceeds for his living and funnel the rest to al-Qaeda. (Cosgrove-Mather, 2004) The charity’s Oregon branch was eventually accused of receiving money from bin Laden and providing the funds to an American imam to attend a terrorist training camp in Pakistan in 1998. (Denson, 2013) In 2002, the Bosnian branch (an NGO called Vazir) was jointly with a Somali branch designated by the US and Saudi Arabia as al-Qaeda funding sources and were promptly banned; further investigations implicated the branches in Croatia, Ethiopia, Kenya, Tanzania, Kosovo and others as well. The Oregon branch was shut down over similar accusations in 2004, with the Dutch and Albanian branch following the suit shortly after. (Comras, 2007, p. 121) The NGO is said to have had been an intermediary between bin Laden’s senior lieutenant identified only as “Rashid”, representing a committee of Gulf-based sponsors, and militant groups in Southeast Asia, including ASG and Jemaa Islamiyah. (Abuza, 2003)

Muwafaq Foundation

The Blessed Relief Foundation, also known as the Muwafaq Foundation, was established later in 1991 and, in comparison to BIF, Rabita Trust or al-Haramain, it was not created as a Saudi tool for spreading their geopolitical influence. Its founder was Yasin al-Qadi, a Saudi businessman and a philanthropist, who is said to have met bin Laden on several occasions during the Afghan conflict. In 1998, al-Qadi had sent US$1.25 million from his account in Geneva to a Turkey-based travel and import-export company Maram, which was in fact a front company founded by Mamdouh Mahmud Salim, al-Qaeda’s chief financial officer. (Simpson, 2004) Al-Qadi was also suspected by the FBI to be financially involved in the 1998 twin US embassy bombings. Nevertheless, the stated purpose of al-Muwafaq was to “relieve disease, hunger and ignorance” and to this end operated in several countries, including Bosnia, where its office was shut down in 1998 over allegations of fund-raising and money transfer to al-Qaeda. (Comras, 2007)

Rabita Trust

Similarly to those organisations before it, Rabia Trust was founded in Pakistan in 1988, with its stated aims being “dissemination of dawah (culture) to expound the teachings of Islam”;

26 to this end a trust was established, which included Pakistani ministers of finance and interior, Saudi prince Talal ibn Abdul Aziz, secretaries general of the IIRO and Muslim World League and the president of the Saudi Chamber of Commerce, with most of the funding originating from wealthy Saudi businesspeople. (Ibid) The funds governed by Rabita Trust were reportedly used for several al-Qaeda activities such as recruitment and training in its camps in Southern Asia. Since 2000, the trust was governed by Wael Hamza Julaidan, one of the original founders of Maktab al-Khidamat and an associate of bin Laden and al-Zawahiri, who was eventually formally designated as such by the US and the UN in 2002. Julaidan was a former director of a Saudi Joint Relief Committee, an umbrella body for several Saudi NGOs with a multimillion- dollar budget partly financed by the Saudi government; a house rented by SJRC was reportedly involved in a planning of an attack on a US office in Pristina, Kosovo, and was raided by K- FOR forces in April 2000. During this incident, BBC reported that a classified document naming Julaidan as “an associated of bin Laden” and a man who had helped him “move money and men to and from the Balkans" was circulated to UN police forces. (Wood, 2000) This was confirmed by the top al-Qaeda leadership, when a 1999 al-Jazeera interview was discovered, where bin Lader names Julaidan as his associate. (U.S. Department of the Treasury, 2002b) On 17 October 2001, Rabita Trust was placed on the UNSC Al-Qaida Sanctions List for financing and facilitating terrorism and as of 10 March 2019 remains there; however, Julaidan himself was placed on the list almost a year later, on 11 September 2002, but in August 2014 he was removed from the list. (United Nations, 2014)

2.2. 1990-2001 – AL-QAEDA GOING GLOBAL

Financing-wise, the second phase in the lifetime of Salafi-jihadism – at this point represented only by the core al-Qaeda and sympathetic individuals – is characteristic by the comparative increase in funding for operational capabilities. The group has helped bankroll or has directly orchestrated several attacks, hitting both domestic targets and interests of countries that it has designated as its main enemies, with several high-profile attacks targeting the United States. It seemingly also developed a blueprint for external operations, emphasising strong compartmentalisation of these financing efforts from its more general, organisational funding, so as to make the two unconnectable and resistant to cut-off actions by state authorities. (Basile, 2004) With regards to its sources of finances, it also had to undergo a phase of “restructuration”, as the end of conflict in Afghanistan and the end of the Cold War more generally resulted in its main belligerents (the United States and the USSR and later the Russian Federation) ceasing support for rebels in the third countries fighting their rivals. Sources of financing in this era are no longer state actors, but mostly sympathetic charities and individuals, criminal activities and even legitimate businesses. While significantly less lucrative and more difficult to cultivate than a carte blanche from a foreign government, these sources allowed al-Qaeda to 1) diversify its funding, thus becoming more resilient to sudden cut-offs, 2) its legal businesses made the funds appear legitimate and therefore did not raise any alarms, increasing the groups operational security, and finally 3) “muddied the waters” as the increased number of sources complicated the picture, giving potential investigators too many leads to follow. In late 1989, bin Laden left Pakistan and returned to his homeland of Saudi Arabia. At this point, bin Laden’s personal shares in his family business amounted to 27 million Saudi riyals — a little more than $7 million. He also received a portion of the annual earnings from the company that ranged from half a million to a million riyals a year. (Wright, 2006, pp. chapt. 7, par. 2.) Spurred by Saddam Hussein’s invasion of Kuwait in August 1990, bin Laden, accompanied by a group of senior Afghan mujahideen commanders, offered al-Qaeda’s assistance with the kingdom’s protection to Prince Sultan, then Saudi minister of defence, only to be rejected. Instead, the government invited US troops, a highly controversial move that sent shockwave across Muslim nations, as the defence of al-Haramain (the two holy places, Mecca and Medinah) was left to an external, non-Muslim force. Dismayed by this (in his view hypocritical) move by the government that only a few years ago called for public support of jihad in Afghanistan and that had bankrolled some of the largest mujahideen training camps in the country, and coupled with the Saudi government’s crackdown on the young Salafi “Sahwa

28 movement” (or Awakening movement) that criticised the ruling family for the same reasons as himself, bin Laden had decided to publicly act against the kingdom’s rulers. His actions, however, had put him into a house arrest in Jeddah, as his passport was confiscated. Following the Mohammedan paradigm of hijrah, in this case a flight from the Saudi kingdom sheltering US soldiers to what he perceived as a land of pure Islam, bin Laden tricked Saudi authorities into releasing his passport and in 1991 he fled to Pakistan where he spent several months before leaving for Sudan in 1992. 2.2.1. Sudan and b ankrolling th e ji hadi s ts It appears that it was at this point while enjoying the safety of the Sudanese sanctuary that al-Qaeda has decided to diversify its sources of financing. In fact, this was the moment when most of the funding scheme for the organisation has been established, including its diversified funding sources, long-term investment schemes, money laundering systems and transfer systems. Furthermore, its increased organisational size, world-spanning ambitions and strategies – and most importantly, several operational requirements – necessitated increased funding, making bin Laden’s personal wealth insufficient for running a global terrorist enterprise – even more so, once his shares in his family’s company were seized in 1993, depriving him of his only stable source of income. Therefore, this diversification of sources must not be seen as an OPSEC improvement, but first and foremost as an existential necessity for sustaining the organisation itself; these financial hardships eventually became critical once they started taking their toll, with Jamal al-Fadl, one of bin Laden’s most trusted lieutenants, stealing $110,000 and deserting from the organisation in mid-1990s (Wright, 2006, pp. chapt. 10, par. 38-40). Following his and subsequently whole al-Qaeda’s move to Sudan – then ruled by a sympathetic Islamist leader Hassan al-Turabi – bin Laden started investing his wealth heavily in the country, although with dubious results. Within two years of his arrival, bin Laden invested in several development projects (such as building the highway across desert from Khartoum to Port Sudan or Sudanese radio and television facilities), but also backed al-Turabi’s 23 training camps for militants and government militias and al-Turabi’s government in general during several of its crises. He had started an immensely diversified portfolio of unrelated businesses under a shell corporation (Wadi al-Aqiq), which included companies working in construction (al-Hijrah), heavy machinery import, investment (Taba Investment), agriculture (al-Thimar al- Mubaraka), a tannery, honey and sweets production (Al-Ikhlar International Company, based in Yemen, along with al-Nur Honey Press Shops and Al-Shifa Honey Press for Industry and Commerce), bakeries or sesame and peanut cultivation firms. He also had set up scores of bank 29 accounts worldwide to both his own name and names of other al-Qaeda members, possibly to enforce the notion that he is merely a devout businessman as any other, necessarily making this enterprise more complicated, thus more secure, but harder to manage (Ibid, 132-133). Similar operations were started in Europe, where AQ operatives Youssef Nada and Idris Nasreddin established a series of shell companies in Liechtenstein, Switzerland and Italy, frequently changing their names and using them to move al-Qaeda funds into Europe, and in the Southeast Asia, where Mohammed Jamal Khalifa and Wadi Khan Amin Shah broadened the network of charities with locally-established businesses (Khalifa Trading Industries, ET Dizon Travel Pyramid Trading) used for the same ends. (Comras, 2007, p. 124) Despite the fact that most of these businesses were growing unsuccessful, investing in them temporarily allowed al-Qaeda to sustain its activities and helped them build some favour with the government, which in turn provided them with cover, establishing a sanctuary that “lowered overall needs of covertness, eased command and control, enabled extensive training and planning, and generally allowed terrorist groups to operate at a far lower marginal cost per attack,” according to Rabasa et al. (Clarke, 2015, p. subchapter "Sanctuary") What’s more, their character as shell companies provided al-Qaeda with several money laundering enterprises and its financial supporters with a sufficient degree of plausible deniability, as they could claim that they did not know that their investment in them ended up funding terrorism.7 At this time, al-Qaeda still organised fundraising trips across the world, similar to those conducted by Maktab al-Khidamat during the Afghan war. As Wright notes, somewhat paradoxically, after the conflict the United States were one of the main fund-raising destinations for Arab and Afghan mujahideen (Wright 2006, chapt. 9, par. 10-11.). Ayman al-Zawahiri – then still the head of EIJ – toured California in the spring of 1993, raising merely several thousand dollars at best, and Ahmed Said Khadr, organisation’s alleged main financier, made two fundraising tours in Toronto in 1994 and 1996. (Sageman, 2004, p. 43) To what extent were

7 As Comras demonstrates this point, an investigation within the US operation Green Quest into activities of a number of Middle Eastern businessmen operating out of Herndon, Virginia revealed a network of ca. 100 intertwined companies, Islamic charities, educational and cultural organisations, that were all registered to a common address with no physical offices and were revealed to be implicated in funding several terrorist group, including the al-Qaeda and Hamas. Due to the extremely complicated nature of its transactions across dozens of companies and several countries, investigating where exactly the money came from and where it ended proved to be very complicated and pinpointing any one donor as a “financier of terrorism” is close to impossible. Compounding this problem is the fact that in the end the accusation would depend on determining the donor’s intention – a very complicated matter, given that some of Saudi businessmen involved in the 1999 transfer of $3 million by Khalid bin Mahfouz, head of the Saudi National Commercial Bank to charities that posed as fronts for bin Laden’s organisation, claimed that this not was a sympathetic donation to a terrorist leader, but “protection money to keep the mad bomber away from Saudi Arabia.” (Napoleoni, 2003, p. 121) 30 these trips fundraisers for al-Qaeda and not for Zawahiri’s then still-independent EIJ, however, is hard to say; very underwhelming revenue of these trips might have contributed to his decision later on to merge EIJ with AQ. All the while – and in line with the then-dominant modus operandi of supporting but not instigating – bin Laden kept financially supporting a myriad of Islamist groups (many of them present in Sudan at the time on al-Turabi’s invitation as part of his “International Islamic Conferences”, an effort to make Sudan the center of Muslim world), spanning across most of the Muslim world. The main goal of these efforts was not to launch a wave of terror attacks (or not just yet), but to develop new and deepen the existing networks of contacts in the wider global Islamist milieu. Developing these contacts was consistent with the strategy that prevailed within al-Qaeda at the end of Afghan war, where the group was envisaged as a “shock force” of jihadists that would help foment revolutions in Muslim countries in order to install “true Muslim” regimes. As Burke illustrates, apart from material support for Yemeni militants in 1992 (see chapter 2.3.1 below), “the Jamaat-e-Jihad of Eritrea and the Abu Ali group in Jordan were both given grants of $100,000. Fighters were also dispatched to Chechnya via an office set up in Azerbaijan. Two men, an Egyptian and a Sudanese, visited camps run by Hizbollah, in Lebanon. (…) Libyans and Algerians close to bin Laden and al-Zawahiri set up contacts with their own domestic groups.” (Ibid) Particularly in the last case, Qari el-Said, an Algerian who was on the shura council of al-Qaeda, was sent to Algeria by bin Laden, carrying $40,000 to fund Islamist militants that would go and coalesce under the umbrella of Groupe Islamique Armé (GIA) a few years later. (Ibid.) However, as Burke also notes about this era, bin Laden’s primary goal to unify the broader Islamist-jihadist milieu, preferably by buying their loyalty, mostly failed. These groups’ struggles were still largely local, and they were unwilling to accept this humiliating arrangement offered by a young, little-known activist. It was only when the organisation moved to Afghanistan and orchestrated several successful plots between 1998 and 2001 that its reputation increased, bringing groups into its fold, along with significant donations from sympathetic donors impressed by the attacks. (Burke, 2015, p. 63) During this era, funds were transferred mainly via Islamic banks, as al-Qaeda was still flying low under the radar and was operating from Sudan, a country that was institutionally well-connected to the Muslim world (i.e. in comparison to the remote conditions of Afghanistan where the AQ leadership was later forced to flee to). During the trial of AQ operatives involved in the twin US embassy bombings of 1998, Jamal al-Fadl, an associate of bin Laden noted how his former emir used al-Shamil Islamic Bank (Sudan-based), Tadamon Islamic Bank (based in

Yemen) and Faisal Islamic Bank (based in Saudi Arabia) to channel money to his follower around the world. In the first case, US State Department claimed that bin Laden even owned the whole bank after paying $50 million towards its ownership; however, Napoleoni posits that it is more likely that he had merely bought a large share in the bank’s holding. (Napoleoni, 2003, p. 120) These funding efforts and their resultant uptick of activity of Islamist militants across the world (such as their attempt at life of Egyptian president Hosni Mubarak in Addis Ababa in 1995) naturally produced international pressure on Sudan to crack down on the responsible groups operating on its territory. Although initially unwilling, but gradually agitated by the rising Islamic radicalism generally and al-Qaeda’s actions particularly, Turabi and the Sudanese intelligence services started exploring the options of expelling al-Qaeda from their country. Aware of their complicated position and hampered by the growing financial costs of running the organisation (which according to Sageman amounted to approx. than $6 million a year), bin Laden reached out to his contacts in Afghanistan, Maulvi Younis Khalis and Jalaluddin Haqqani, leader of a Taliban offshoot, the “Haqqani network”, inquiring about the possibility of making Afghanistan al-Qaeda’s new sanctuary. On 18 May 1996, bin Laden and about 30 of his followers and family members returned to Afghanistan. (Burke, 2003, p. 142) 2.2.2. Afghanistan and operations planning Although the group was on arrival severely underfunded and completely reliant on foreign donors8 and charities (bin Laden’s Sudanese businesses were seized by the state), Afghanistan as a safe haven made al-Qaeda bolder – by acknowledging the leader of then- governing Taliban, Mullah Omar, as Amir ul-Mu’mineen (“Commander of the Faithful”) and eventually providing the Taliban with approx. $10–$20 million per year, bin Laden was granted freedom to move and conduct operations from Afghanistan, a condition that his organisation had not enjoyed in Sudan. (9/11 Commission, 2004, p. 171) It was also from Afghanistan that al-Qaeda started vigorously pursuing its primary strategy of funding insurgencies abroad, including groups in Kashmir, the Abu Sayyaf Brigade in the Philippines, Jemaa Islamiyyah in Indonesia and Tajik insurgents in Central Asia. (Johnson, 2007, p. 105) In the safety of this new refuge, in summer of 1996 bin Laden issued a fatwa titled “Declaration of War against the Americans Occupying the Land of the Two Holy Places”, thus officially launching global jihad. It was also at this point that Al-Qaeda started activating itself and incorporating other Salafi-

8 US 9/11 Commission’s Monograph notes that al Qaeda fund-raising was largely cyclical, with the bulk of the money coming in during the Islamic holy month of Ramadan, as this was ideal time to ask its donors for zakat contributions. (Roth, et al., 2004, p. 21) 32 jihadist factions into its fold, with many originating in the EIJ or Egyptian Islamic Group (EIG). Some of the most notorious members of the organisation joined its ranks after bin Laden fled from Sudan – Abu Zubaydah was tasked with activities in Khaldan training camp and Khalid Sheikh Mohammed joined the organisation’s military committee. This consolidation was cemented in February 1998 with establishing of the World Islamic Jihad and bin Laden issuing his second fatwa, “Jihad Against Jews and Crusaders”, uniting several jihadist groups in openly declaring war on the United States and its allies. The fatwa was particularly important in two points, as it had sanctioned the killing of both military personnel and civilians indiscriminately and declaring this killing a personal obligation upon every Muslim. (Sageman, 2004, pp. 46- 47) However, until the twin US embassy bombings late that year it went largely unnoticed. This event marked a new era in al-Qaeda’s operational activities, launching it forward on two fronts – orchestrating in-house planned attacks under al-Qaeda responsibility on the one hand, and supporting attacks by other, affiliated or sympathetic groups, usually by providing their members with training in their camps in Afghanistan and/or providing them with some seed money to prepare the operation, with exact targeting and operational details left to their initiative on the other hand. The twin embassy bombings, USS Cole (and previously the failed USS The Sullivans) bombing and 9/11 attacks represent the first case, whereas funding of Hambali’s activities in the Southeast Asia9 or Ahmed Ressam’s failed LAX bombing plot representing the latter. Concurrently, it seems that it was during his refuge in Afghanistan that bin Laden started exploring ways of converting his funds to other means of value storage than hard cash. Although al-Qaeda members had operated several trading companies (also dealing with gemstones) prior to the move to Afghanistan, they did so mainly for raising funds by selling them; value storage was not yet as accented. According to Comras, this issue gathered on importance in 1998, when the US and Europe imposed first sanctions on Taliban and its associates, prompting them to seek new ways to store money to make it untouchable by the authorities. (Comras, 2007, p. 126) This was a logical precaution, as converting one’s hard cash into other commodities provides three main benefits. First of all, funds stored in gold, diamonds or any other precious gems and metals have high and stable value on international markets and retain it better than national currencies that are comparably more volatile and dependent on political circumstances (which terrorists necessarily seek to destabilise). Secondly, and related to the previous point,

9 Related plots are the failed plan blow up a bus service used by US soldiers in Singapore, for which Hambali received seed money from AQ’s leadership, and the replacement 2002 Bali nightclub bombings. See Napoleoni 2003, Howley 2017. 33 by doing so investor obtains a high-value asset that is easy to smuggle, move around, sell, is hard to track, and in case of metals also easily malleable. Such an asset is a perfect “rainy day fund” for criminals and especially terrorists counting on the possibility that once their attacks provoke response, their accounts will be frozen, and assets seized. It may also be directly exchanged on black market for other goods necessary for attack preparation (weapons, counterfeit documents) without establishing a financial link (Lemieux & Prates, 2011, p. 373). Finally, by investing in these commodities of high value, investor obtains assets of high liquidity, which in turn allows him to launder his funds at rapid pace. Various commodities of high and/or permanent value were picked by the al-Qaeda operatives in this phase of the group’s existence. In 1997, FBI seized the diary of Walid el- Hage (bin Laden’s personal secretary, involved in the preparations of 1998 embassy bombings) that indicated he had been involved in procuring and selling smuggled tanzanite stones in London (Napoleoni, 2003, pp. 182-183). According to other reports, in 1994 el-Hage had moved to Kenya where he set up a gemstone mining and trading company Tanzanite King and became a central player in the AQ’s diamond and gemstone trading network; similar position was held by Abu Ubaydah al-Banshiri, who ran a similar concert, Taheer Ltd, in Tanzania. (Global Witness, 2003, p. 5) In a similar vein, in September 2002, European and Pakistani investigators said that al- Qaeda had recently sent several gold shipments to Sudan, indicating that the group had possessed significant funding reserves prior to 9/11 and was moving them away from the invaded Afghanistan (Byrne, 2002); Ehrenfeld posits that prior to the US airstrikes, Taliban and al-Qaeda raided the Afghan national bank, taking gold reserves that were subsequently hastily moved to the safety of Pakistan and from there deposited into al-Qaeda accounts around the world. Apart from Sudan, a large amount was supposed to end up in banks in Dubai, one of the world’s least-regulated gold markets. (Ehrenfeld, 2011, p. 69) Part of this amount is also said to have been laundered via hawaladars in Pakistan, as gold bullions were deposited with them and cash has been collected elsewhere in the world, thus covering the money’s illegal origin. (Global Witness, 2003) Finally, although much has been written about terrorism financing with conflict diamonds (Hezbollah reportedly frequently engages in these practices in Congo, Liberia and Sierra Leone and al-Qaeda is said to have followed the suit by using local contacts developed by the Hezbollah; see Levitt 2007: 147), there is little evidence to substantiate these claims vis- à-vis al-Qaeda. In 2003, reports surfaced that claimed al-Qaeda operatives appeared in Sierra Leone and Liberia in 1999, 1998 and 2001, buying diamonds from RUF and using the network

34 established by Aziz Nassour, a Lebanese diamond dealer with extensive connections in Antwerp and a history of diamond-dealing in conflict zones in Africa. However, both the CIA and FBI challenged the reports of this activity and could not verify them. The 9/11 Commission Staff Monograph on Terrorism Financing also noted that “no persuasive evidence exists that al Qaeda … had any substantial involvement in conflict diamonds.” (Comras, 2007, p. 127) Second important development is the switch in use of fund transfer methods, with greater emphasis on hawala and personal couriers. At this point, fund transfer methods were very diversified, and using Passas’ typology, al-Qaeda used all of them – exploitation of well- regulated financial systems (as was the case with 9/11 preparations, abusing Dubai-based and West-linked banks), poorly regulated formal banking and wire transfer systems (such as local banks or the Islamic banking system) and largely unregulated informal value transfer systems (IVTSs; an example here being the hawala network, couriers, invoice manipulation10, etc.). (Passas, 2007, p. 29). The move to IVTSs, however, was mainly compounded by the remote location of his new refuge in Afghanistan and the lack of financial infrastructure, which was unreliable and antiquated, thus forcing bin Laden to start using informal value transfer systems to greater extent than banks or other formal financial institutions. The increase in scrutiny by banks across the world following the 1998 embassy bombings even strengthened this necessity. As the operational case studies demonstrate, the remaining means of transfer were used for operational financing. However, what is also of interest are the sources that the 9/11 Commission and subsequent investigations ruled out as having been used by al-Qaeda up to this point, despite their use by other terrorist group or due to their mentioning by journalists and researchers as potential sources of AQ funding. The organisation was not funded by any government as an institution or any government official (but may have been funded by sympathetic individuals or organisations with ties to governments), with exception of some cooperation with its host government in Afghanistan, Taliban. Similarly, although Taliban did profit from drug trade, there are no indications that up to this point al-Qaeda itself also took part in this enterprise and

10 The method is essentially a financial transaction wherein the seller/intended recipient of funds (in this case a terrorist group offshoot or operational/logistical cell, often legally operating a business) overcharges the buyer/source of funds (terrorist group central or logistical cell operating a front company) for a commodity, pocketing the difference for terrorist purposes. For example, a US-based front company soliciting funds for a terrorist attack may sell computers worth $100,000 to a Pakistani- based, terrorist-connected company, charging them $150,000, and in effect obtaining $50,000 for the terror plot. In the globalised economic system these transactions are very hard to prevent, as uncovering them would require the financial authorities to know approximate prices of all goods currently on the market to spot the difference. 35 raised any funds from drug trafficking. Neither were conflict diamonds used to fund the group’s activities, nor were any funds raised via manipulation of the stock market, despite some claims to contrary. The bottom line is that up to the attacks of 9/11, the organisation was kept afloat by sympathetic donors and legal charitable organisations who either wittingly or unwittingly via highly-positioned AQ sympathisers skimmed off portion of their funds. It was these two sources that helped bin Laden survive his move to Afghanistan and subsequently his jihad on the run after the 9/11.

2.3. OPERATIONAL FINANCING 1989 – 2001

This era is particularly important, as it includes some of the most ambitious attacks of the Salafi-jihadists, with most of them ending in failures. These attacks were claimed and to varying extent financed by al-Qaeda. It is important, however, to note that although until the 1996 return back to Afghanistan bin Laden did not shy away from preaching violence towards Muslims’ enemies, he sought to not implicate himself and his organisation in it directly – simply put, at this point he was not a terrorist per se, but more resembled what we call today a terrorist financier, even in the context of wealthy Gulf states citizens that later helped fund al-Qaeda and bin Laden himself. Al-Qaeda as it is often imagined (i.e. as a terrorist enterprise planning terror attacks) existed in this form at earliest in 1996 in Afghanistan – until then, its dominant modus operandi emphasised throughout this chapter was to financially support like-minded Islamist organisations throughout the world. The organisation itself was not planning its own operations, as bin Laden was preoccupied maintaining his faltering business enterprise in Sudan, establishing contacts around the world and building infrastructure for his jihadist influencing, while al-Zawahiri was focussing on Egypt and his EIJ’s rivalry with EIG. They most certainly did hold radical views that propagated the use of violence against Jews and Americans, funded others that wanted to act on this ideology, maintained their contacts with important actors in the jihadist milieu (including in terror camps in Afghanistan which spewed out some of the main attackers of this era), funded other radicals, but there is little evidence that would suggest that al-Qaeda members were operationally involved in any of these attacks. Most of al-Qaeda links to violence caused at this time are either ideological (such as being inspired by bin Laden’s speeches or publications, either of him or Maktab al-Khidamat/al-Qaeda) or financial (and even then it is a second-/third-level link, such as funding the responsible group, not the attack itself, or having financial links to men running the terror camp that produced the attacker; the two case studies of Aden and New York presented below illustrate this complexity of attribution to al-Qaeda). The picture is markedly different between 1996 and 2001. After flight from Sudan to Afghanistan, al-Qaeda in general becomes much bolder, radical and very open about its desire to use violence. Nevertheless, it was still lacking in in-house operational capabilities. Jason Burke very correctly depicts this state by three models: al-Qaeda as a grant-disbursing university, venture capitalist enterprise or a TV production/publishing house. Generally speaking, Burke seeks to describe the main characteristics of the organisation at this time – it did not come up with its own proposals, plans or future ventures. However, it was ready to

37 disburse grants, dispatch its military experts, provide knowledge and training in affiliated Afghan camps, should one approach its top management (bin Laden, Atef, et al) with a proposal that would grab their attention, be sufficiently realistic and executable and be ideologically compatible11 (Burke, 2003, pp. 208-209); even then, perpetrators received only some seed money and should they need more, they were asked to raise it locally, most often via fraud or crime. In order to enhance OPSEC and increase its cells’ survivability, sometime between 1998- 2002 al-Qaeda divided labour among different cells, with some being clearly tasked with fundraising while others were purely operational. (Williams, 2007, p. 84) Closer examination of specific plots from this time underlines this internal lack of operational capabilities and the need to rely on externals – 1993 WTC bombing was organised by the clique around Ramzi Yousef and Omar Abdel Rahman, plans for the unsuccessful Bojinka plot were laid down by Yousef and then still unaffiliated Khalid Sheikh Mohammed, who had already had links to Islamist attacks before joining al-Qaeda around 1996, and groundwork for the 1998 East Africa embassy bombings was laid down by Ali Mohammed12, then still oscillating between AQ and EIJ. It was mostly with the arrival of KSM and Ali Mohammed that al-Qaeda achieved a useful degree of operational knowledge that it could tap into when planning attacks under its own banner. 2.3.1. 1992 Aden bombing Although there is dispute as to the exact extent of al-Qaeda’s involvement in this specific attack, it is well documented that the newly-created organisation took interest in Yemen as early as 1989 (back then as two separate states), with bin Laden financing Afghan mujahideen operating in the country and an al-Qaeda brigade working with tribal leaders in the north to organise raids and assassinations of socialist leaders in the south (Wright, 2006). It is often

11 Although the Afghan training camps at that time produced thousands of militants, due to their sponsors (mainly Pakistani ISI) majority of them were more suited towards the internal Afghan battlefield or for more localised struggles, e.g. Kashmir or Bosnia. Al-Qaeda at that time held a monopoly on globally- focussed Salafi jihad, one that did not aim at overthrowing local regimes, but one that sought to strike the far enemy, the United States. This made the organisation attractive and rallied many individuals from across the world under its banner and into its training camps. 12 As Soufan and Wright note, Mohammed was one of EIJ’s most daring and successful operatives and his joining al-Qaeda greatly improved its operational capabilities. Originally an Egyptian intelligence officer, he became a double agent for the CIA and although he eventually lost their trust, he quickly managed to obtain US citizenship, joined the US Army’s Special Forces, taught several courses on Middle East and Islam at John F. Kennedy Special Warfare Center and School at Fort Bragg, trained the anti-Soviet fighters in Afghanistan while on leave, and photocopied US Army training manuals that he later compiled into a multivolume terrorist training guide that became al-Qaeda’s playbook. Mohammed was eventually charged with conspiracy for his role in the 1998 East Africa bombings and in 2000 he pled guilty. (Wright 2006, chapt. 9, par. 12-16; Soufan 2011, chapt. 4, par. 1-5) 38 claimed that the group’s first terrorist attack – this time targeting US soldiers – was in December 1992, when bombs went off outside the two most expensive hotels in Aden, where US servicemen headed for Somalia were known to stay; one tourist and a hotel employee were killed. Bin Laden is said to have facilitated the attack by tapping into his network of contacts developed in Afghanistan and to have contacted a Yemeni tribal chief and Islamic militant Tariq al-Fadhli whom he had met while in Pakistan and Afghanistan, to provide support to his group. Although bin Laden claimed responsibility for the attack in 1998, Peter Berger’s investigation into the incident shows that it is more likely that it was al-Fadhli whose group orchestrated it, with bin Laden merely financing his group, thus funding the attack indirectly and starting what Jason Burke calls his “modus operandi of instigating and facilitating, rather than directly funding”. (Burke, 2003, pp. 128-129) Given his frequent visits by old friends and mujahideen during his stay in Sudan, it is unlikely that any complicated scheme of fund transfer was used and the money may have been handed over personally in cash, similarly to Qari el-Said’s donation to GIA that same year. 2.3.2. 1993 World Trade Center bombing The first bombing of World Trade Center in New York in 1993 is estimated to have cost a modest sum of about $19,000, with most of it being spent on materials for the nitrate-based bomb used in the attack.13 (Passas, 2007, p. 31) Similarly to the twin hotels bombing in Yemen in 1992, it is hard to ascribe it directly to al-Qaeda and although personal connections – and allegedly even financial ones – exist, this case is far from being a clear-cut al-Qaeda directed operation. Its main perpetrator, a 24-year-old Kuwaiti named Ramzi Yousef, spent some time in al-Qaeda training camp and guesthouses in Afghanistan in 1989 where he is said to have perfected his bomb-making skills; moreover, he is a nephew of Khalid Sheikh Mohammed, al- Qaeda’s later military council member and alleged mastermind behind the 9/11 attacks. However, the man behind Yousef and the plot is alleged to be an America-based Egyptian cleric and leader of the Egyptian Islamic Group, Omar Abdul Rahman, also known as “the blind sheikh.” Rahman met bin Laden and his Maktab al-Khidamat in Afghanistan during the war and after the conflict he moved to New York and New Jersey, where he was imam of three mosques, including the al-Farooq mosque, which served as one of the main Maktab al- Khidamat US-based funding sources during the Afghan war (Burton & Stewart, 2006). Several

13 Curiously enough, one of the more interesting aspects of this attack was revealed in 1995 when Yousef was arrested and admitted that the operation was underfunded and they were forced to build a smaller bomb than initially planned; interestingly, a breakthrough in this case was made when his accomplices attempted to reclaim the deposit fee for a van they had rented, loaded with explosives and subsequently detonated in the attack. 39 of its members surrounding Rahman were involved in the WTC bombing, unrealised New York landmark bombing plot and murder of a radical Jewish rabbi, Meir Kahane. Although at this time EIG was competing with al-Zawahiri’s EIJ for dominance inside Egyptian Salafi-jihadi scene, FBI later claimed that bin Laden was bankrolling both the blind sheikh’s activities and EIJ’s operations. Despite these claims, there is no evidence that bin Laden ordained or even knew about Rahman’s specific operations and it is more likely that he simply funded what he perceived as another Islamist cell that may at some point try to attack the United States, all the while keeping his own hands clean. The lack of information on financing behind this plot is also partially stemming from the fact that at the time authorities did not perceive Islamist terrorism as a national security threat and therefore did not push Yousef on these questions during his trial, as information on the trans-national network behind him was deemed unimportant in establishing his guilt. (Napoleoni, 2003, p. 8) 2.3.3. 1998 Twin US embassies bombing These attacks marked a shift in organisation’s strategy, moving from defensive operations on Muslim soil to offensive operations in dar al-kufr. Operationally, they are also the first demonstration of organisation’s compartmentalization, with different people being assigned to different cells (planning, logistics, execution, clean-up) with clear responsibilities and little to no interactions among them to improve OPSEC. Although bin Laden did not claim credit for the attacks, he had praised them, claimed he had instigated them and they were organised by his close associates, namely Abu Ubaydah al-Banshiri, who oversaw the cell in East Africa until his drowning in 1996 and then taken over by either Abdullah Ahmed Abdullah or Walid el-Hage. Apart from this, there is little information on the funding behind them and even less that suggests any direct bin Laden involvement. In fact, this may be the first operation where the cell itself (or its operational commander) was tasked with sourcing the funding for the operation on its own; however, the principal reason for this may be that al-Qaeda had already had established a presence in these countries long ago and therefore had a source of funding to tap into locally. Ali Soufan, an FBI agent involved in several al-Qaeda investigations running up to 9/11 has suggested than the attack was funded by legitimate businesses14 set up by cell members and directly and indirectly by several relief organisations. (Soufan 2011, chapt. 4, par. 2.) The most frequently mentioned are Help Africa People NGO, IIRO (Passas, 2007, p. 25)

14 Some of those may have been Kenya- and Tanzania-based tanzanite mining and dealing businesses operated at that time by el-Hage and Banshiri. See chapter 2.2.2 on the role of precious stones and metals in al-Qaeda’s funding structure. 40 and Mercy International, which was named as complicit by one of al-Qaeda members arrested shortly after the attack. (Piombo, 2007, p. 192). Al-Haramain is also said to be have been involved by acting as a conduit by which the seed money for Mohammed Odeh were sent for him to set up a fishing business whose proceeds eventually helped fund the operation. All of this points to the supposition that the cell was not established for this specific operation and neither was it a sleeper cell in its entirety. Odeh’s long-term business engagement in the region since 1993, along with Ubaydah’s activities there (including dealing in tanzanite and gold for profit) spanning back to AQ’s Sudan days, indicate that only the cell’s “infrastructural members”, such as financiers, materiel sources and logistical supporters were sent there in order to blend in and establish a foothold. Although the groundworks for embassy bombings in East Africa was laid as early as December 1993 when Ali Mohammed surveyed the US targets in Nairobi, it was only in early 1998 that attackers comprising the “active” component of the cell were picked by bin Laden. (Soufan, 2011) Given that the attacks’ cost was estimated at a modest sum of $50,00015, these sources seem sufficient to provide this amount, although individual payments made via more obscure means of transfer (such as hawala, frequently used in this part of Africa) cannot be ruled out. Furthermore, their apparently legal origin – coupled with the fact that this was al-Qaeda’s first high-profile attack and the organisation has hitherto attracted little attention – made them ideal for the operation as any funding via criminality could have attracted attention and was unsustainable over the span of several years when the cell was active. (Williams, 2007, p. 78) In a curious and unverifiable twist of events, the retaliatory US cruise missile strikes intended to be a revenge for the attacks not only failed to kill AQ senior leadership, but according to Wright, some Russian intelligence sources cited in Al-Majallah, an Arabic magazine in London, assert that unexploded Tomahawk missiles were sold by bin Laden for to the Chinese for more than $10 million, which he then used to finance operations in Chechnya. (Wright, 2002) 2.3.4. 2000 USS Cole bombing The plot to bomb the US Navy ship USS Cole off the coast of Aden was actually not directed at this particular ship and has been preceded by a plot to destroy another US military vessel, USS The Sullivans in January that same year. However, after the attack cell encountered problems getting the explosives-laden boat afloat during low tide, the whole operation was hastily abandoned and its perpetrators fled to Afghanistan until they were convinced that their plot was not uncovered. The executive component of the cell was replaced and the cell returned

15 See Williams, 2007, p. 78. 41 to Yemen to prepare for the bombing of another ship that would approach the port of Aden. (Soufan, 2011, pp. chapt. 11, last paragraph) As was the case with other plots, bombing the USS Cole was a very low-cost endeavour – its planners only had to purchase the ship, explosives, rent a primary safe house in Madinat al Sha’ab district of Aden, another safe house in al-Burayqat Kud al-Namer, which served as a vantage point from which the attack was supposed to be recorded for propaganda video (this effort failed) and obtain a set of fake passports to escape the country after the attack. To procure these, bin Laden’s point-man for the operation, Abd al-Rahim al-Nashiri enlisted several locals, like Jamal al-Badawi (obtained the truck used to transport the explosives and the ship to shore) or two Yemeni police officials, Yasser al-Surruri and Mohammed al-Murakab (helped terrorists obtain fraudulent passports), who did most of the legwork. Despite this information, there is little to go on regarding the plot’s finances, apart from the fact that it was a relatively low-cost operation – Williams (2007, p.78) estimates the attack have cost less than $10,000. In comparison to the 1998 embassy bombings, this was not a dar al-kufr operation – just the opposite, as popular sentiment in Yemen at that time was sympathetic to al-Qaeda, which in turn reduced the OPSEC requirements for the plotters. Al- Qaeda also had a stable base of supporters that it could use for the preparation, as well as use hawala and/or Islamic banks located there. Finally, given that the structure of al-Qaeda was not yet known and key couriers, go-between men and facilitators were unknown, it is also possible that money was transferred from the command’s position in Afghanistan in cash. Despite the extensive FBI investigation and the subsequent 9/11 Commission’s wide research into AQ’s history, specific sources of funding behind this attack remain to this day unknown. 2.3.5. 2001 9/11 attacks The deadliest terrorist attack in history was unique to other AQ plots in that it was funded in its entirety by al-Qaeda central (mostly with Khalid Sheikh Mohammed coordinating the funding), freeing its perpetrators from the usual woes of obtaining sufficient funds via fraudulent or criminal activities, thus increasing the cell’s operational security drastically. It was also unique in its financial requirements, which proved to be the highest so far for any AQ attack, yet relatively low compared to the effect the attacks had had; the 9/11 Commission Report posits that “the 9/11 plotters eventually spent somewhere between $400,000 and $500,000 to plan and conduct their attack.” (9/11 Commission, 2004, p. 169) Although hawala is very often mentioned by researchers as the most effective means of funds transfer for terrorists across the world, it is very interesting that this method was not used in the largest terrorist attack. Money was transferred in small instalments over time and in 42 simpler ways, combining perfectly legitimate methods with more obscure ones, while “chaining” these transactions and making their backtracking by investigators more complicated. Majority of the funds were moved via wire and bank-to-bank transfers (KSM passed possibly as much as $200,000, to his nephew Abdul Aziz Ali in Dubai, who subsequently disbursed it to the hijackers in the US) and the attackers used debit/credit cards for accounts in both major and smaller regional US banks and in foreign banking institutions to draw on these funds. Even more simply, the “muscle”, i.e. support operatives that stormed the cockpit during the attack, were prior to their deployment to the US housed in a safe house in Karachi, where each of them received $10,000 from KSM and shortly before their final travel in summer of 2001 they bought a total of $50,000 in travellers cheques in Dubai to live off in the US. (9/11 Commission, 2004, pp. 236-237) And until the late 1999, the Hamburg cell members, which constituted the key members of the plot, including its operational commander Mohammad Atta, supported themselves without any external help. Subsequently, they all received an amount of $5,000 to pay for their return to Germany from Afghanistan after they had been selected to join the plot and additional funds for travel from Germany to the United States. (Ibid, p. 172) Use of banks based in the Arabian peninsula proved crucial, as their formal link to the Western banking system on one side and to the rest of Muslim world on the other side (including to less secure financial institutions) allowed the attackers to draw on large funds of questionable origin and transfer them to the West via a chain of gradually more reputable institutions, making these transactions seem ordinary and their origin legitimate. Many operatives drew on these funds stored in the UAE to support themselves while in the US, either for pilot training or simple day-to-day expense.16 It was only after the twin embassy bombings in 1998 that banks started to set up new “due diligence” and “know-your-customer” (KYC) rules that enhanced their vigilance over the origin of funds and by the time of 9/11 preparations they were not sufficiently tested, emphasized and adapted to the al-Qaeda’s system of intermediaries and redundancies that masked their origin. Although not perfect, the operation demonstrated significant degree of OPSEC and consciousness during its preparation. As Basile points out, funds allocated to the attack were used intelligently and indicate a high level of carefulness throughout the operation – in the days prior to the attack itself, $20,000 in unused funds were wired back to AQ leaders in the Middle East, while extra expenses were made in buying business-class seats for the hijackers, so as to

16 For example, the operational commander Mohammed Atta received a wire transfer of $100,000 via UAE, while Hamzi and Mihdhar received $5,000 (see below). (Napoleoni, 2003, p. 126) 43 put them into the optimal position to take over the cabin. (Basile, 2004, p. 172) Furthermore, the 9/11 Commission notes, no person inside the US provided the attackers with financial assistance – likely explanation is that al-Qaeda wanted to limit the circle of people aware of the operation to the “insiders” and prevent untrusted supporters abroad from potentially revealing the plot to authorities. Although they had opened bank accounts to establish a living in the US, two of the hijackers, Khalid al-Mihdhar and Nawaf al-Hazmi consciously tried to avoid using them to obtain their funding and had persuaded the administrator of the Islamic Center in San Diego to let them use the administrator’s bank account to receive a $5,000 wire transfer from Aziz Ali in Dubai. (9/11 Commission, 2004, p. 220) 2.3.6. Failed plots 1989 -2001 The failed 1999 LAX millennium plot had its perpetrator, Ahmed Ressam, relying mostly, and perhaps too much on criminality to fund it. Although he was given $12,000 upon finishing his training in Afghanistan with instructions to “settle down”, Ressam later became involved in several instances of credit card fraud, he had robbed hotels and even held up a currency exchange office. As Williams notes, when his request for more money from AQ Central was turned down, he opened a store in Montreal where he collected credit card information for fraud. (Napoleoni 2003, p. 159; Williams, 2007, p. 84). Eventually, it was a random spot-check during his travel to the US that stopped his plan, as the US Customs official found his behaviour odd and instructed him to a secondary check, during which the explosives were discovered, along with a fake driver’s licence to a name of Mario Roig (although Ressam at that time used an alias of Benni Noris). The necessity to use a fake identity was determined by the fact that prior to his departure for terrorism training in Afghanistan, Ressam had already been involved in criminality, was arrested 4 times and was actively sought by the French and Canadian authorities (Kifner, 1999; Sageman, 2004, p. 100). Although it was by luck that the plot was discovered, in the end it was his involvement in criminal milieu and poorly exercised OPSEC that gave him away; whether this debacle made al-Qaeda to reconsider using non- criminals for future plots is a thought worth entertaining, although there is no direct evidence to support this theory.17

17 Nevertheless, Sageman’s description of the Hamburg cell that would go on to become the core of the 9/11 operatives shows a diametrically different lifestyle, one of pious young students that kept to their social group and strictly followed tenets of Islam, avoiding vices and apart from a handful of dubious contacts and disappearances for travels abroad they kept very low profile without attracting attention. See Sageman 2004, p. 103-107. 44

At the same time, AQC was overseeing plans for the plot to bomb four sites in Jordan on the eve of millennium. The plans were reportedly laid down in 1996, and shortly afterwards one of its main perpetrators, an American of Palestinian origin Raed Hijazi moved to Boston where he worked as a cab driver to raise funds for the plot, amassing and sending a total of $13,000 to his cell in Jordan. (Miller, 2001) The remainder of the cell based in Jordan raised its portion of funds through the sale of forged documents, robberies, and made journeys within the region to acquire to buy weapons and stockpile chemicals for explosives. (Ibid.) The cell made contact with AQC’s Abu Zubaydah and afterwards funnelled its operatives into AQ camps in Afghanistan to undertake terrorist training. However, in the end it was this direct contact with AQ high command that betrayed the plot, as the Jordanian intelligence had been paying attention to the plot already in early 1998 and started conducting surveillance on the cell’s communications, allowing them to intercept a go-ahead call from Abu Zubaydah in late November 1999 and execute a series of arrests and in process dismantle most of the cell.

In 2000, another failed plot involved a Germany-based cell planning to bomb the Christmas market in Strasbourg. One of its components, based in Frankfurt, engaged in drug pushing, while its other components sold false identities to raise money for the plot. Yet another, Milan-based group stole credit cards to provide funding for the attack cell, raising as much as $14,000 for buying the explosives. (Williams, 2007, pp. 82, 84) British authorities became aware of the terrorist plot only when one of German cell members contacted Abu Doha, a UK- based Islamist thought to be an AQ member and connected to the LAX plot, asking for more money for the bombings and informing him that the attacks would take place before the year’s end. (Finn, 2002) This prompted the British to contact German authorities and give them a reason to arrest the cell they had already been monitoring but had no reason to apprehend them. Although Williams claims that “the criminal activities of a terrorist cell designed to maintain the cell and provide operational funding can be an indicator that the cell is preparing for action”, in this case the group was being monitored and its financial flows were known, but the terrorist intent remained unknown – thus no plot could have been anticipated by the authorities. Again, it was an OPSEC blunder that gave the cell’s intentions away.

2.4. 2001-2011 – GLOBAL WAR ON TERROR AND SALAFI- JIHADISM FUNDING

Shortly after the attacks on 9/11, global community recognised the need for new approach to fighting terrorism, with countering terrorism financing (CTF) being its important component. Immediately after the attacks, on 28 September 2001 UN Security Council adopted Resolution 1373 aimed at combatting terrorism financing and a month later, intergovernmental organisation Financial Action Task Force (FATF) published its IX Special Recommendations that became the cornerstone for many governments’ CTF efforts. Countries around the world started establishing dedicated financial intelligence centres and established closer cooperation with private banking sector. To coordinate its CTF efforts as a part of the declared “Global War on Terror”, the United States created a separate agency, the Office of Terrorism and Financial Intelligence, and enacted new legislation, among other the PATRIOT act, especially its title III dealing with anti-money-laundering to prevent terrorism. However, while the new measures established by these institutions helped combat terrorism financing in the US, the resultant pressure also caused the terrorism financiers to move their funds to Europe, where no such homogenous and comprehensive legislation was enacted, mainly due to definitional incompatibility among member states. (Napoleoni, 2007a, pp. 180-181) Apart from the financial migration, some CTF efforts of the “Global War on Terror” came under strong criticism from CT professionals for their ineffectiveness. Freezing of assets of terrorists and entities linked to them was hastily adopted following the 9/11 attacks and was touted as a success. Especially the freezing of bin Laden’s, al-Qaeda’s and their associated individuals’ and organisations’ funds on the one hand prevented them from accessing these funds, but on the other hand hindered the authorities’ own chances of “following the money”, until then a principal tactic in tracing terrorism finances (e.g. see the 2000 Strasbourg Christmas plot above, where the discovery that the then-solicited funding would be used for an attack helped uncover a Europe-wide network of support cells). As Basile noted, by June 2002 $112 million had been seized from all terrorist groups (AQ including); however, a year later the overall number increased only by $10 million, putting into doubt the tactic’s effectivity, even more so once it was found to have had no impact on preventing the 2004 Madrid and 2005 London attacks. (Ehrenfeld, 2011, p. 19) In a similar vein, another important move in the US’ CTF efforts was the institutionalisation of Suspicion Activity Reports (SARs) by the US Treasury’s FinCEN, which obligate the financial institutions to report suspicious transactions over $5,000; similar

46 measures were adopted by FinCEN’s around the world, for example in Canada, where the threshold was set at $10,000. (Davis, 2019) However, this action is reactionary and cannot be seen as a pro-active CTF measure – while SARs would have caught the UAE-originating payments for the 9/11 attackers, this new measure missed the mark for preventing new plots, as al-Qaeda moved from centrally-controlled and funded cells to self-contained cells raising funds via criminality. A decade later, this measure would completely fail, as a majority of lone- wolf/lone-actor plots would cost very well under the amount of $5,000 and would be sourced by the attackers themselves. 2.4.1. Al-Q aeda finan cing going underground According to Comras, it was at this point that central al-Qaeda (AQC) has restructured itself, splintered, and its Finance Committee of its majlis ash-shura was no longer central to soliciting funds. With their funds frozen, legitimate businesses seized, bank accounts discovered, charities to large extent proscribed and trusted hawaladars arrested, AQC was forced to live off three main sources – whatever wealth it had stashed in bank accounts across the world, some of the still-operating charities and finally from sympathetic donors, who constituted the majority of AQ funding while it was on the run. Later on, contributions from its affiliates, mostly raised via criminality, began providing the central command with some financial stability and it appears that this approach applies still today. Nevertheless, in 2004 UN suggested that despite the global efforts on terrorism financing and significant asset freezes, al- Qaeda still managed to raise as much as $46 million from financiers in North Africa, Middle East, Europe and Asia. (Basile, 2004, p. 177) Due to the global crackdown on terrorist financing characteristic of this era, hawala saw greater use in this period, in spite of some of the organisation’s trusted hawaladars being arrested shortly after the attacks. (Roth, et al., 2004, pp. 26-27) As regulated banking systems came under closer scrutiny, IVTSs based on trust and personal connections became the best choice for funds transfer. The use of hawala, however, was confined to the Muslim world and as Passas notes, by 2007 there has not been a case of hawala being used by terror attack planners in the West, despite the rising trend of switch to IVTSs. (Passas, 2007, p. 29) Couriers also saw greater use during this era, with AQC using trusted couriers or main operatives (for greater security) for major cash transfers. While this increased the organisation’s security to some extent, it also slowed it down significantly, as personal transfer of funds takes longer, necessitates planning, coordination and is confined to the region where one’s travelling with large amount of money does not raise alarms. Naturally, and similarly to hawala, courier transfer is also centred around trust, and as 9/11 Monograph on Terrorism Financing notes, lack 47 of trusted couriers in far-flung parts of the world frustrated al-Qaeda’s attempts to send money worldwide. (Roth, et al., 2004, p. 27) Finally, as with any other means of funds transfer, repeatedly using trusted couriers establishes a pattern, thus opening another window for surveillance; after all, it was the identification of bin Laden’s personal courier, Abu Ahmed al- Kuwaiti, that led the CIA to his hideout in compound in Abbottabad. (Woodward, 2011) Over time, kidnapping for ransom (KFR) became one of the most important sources of funding (especially for AQ affiliates), along with the constant stream of funding from donors. As Rukmini Callimachi reported in 2014, at least $125 million in ransom money has been paid to AQ and its direct affiliates since 2008 for reported kidnappings, with al-Qaeda in the Islamic Maghreb (AQIM) taking the lion’s share of this ($91.5 million), followed by AQAP ($29.9 million) and al-Shabaab ($5.1 million). AQIM’s success in extorting dozens of millions of dollars for kidnapped European citizens reportedly impressed bin Laden to such an extent that he even considered basing whole AQ’s funding strategy on kidnapping. (Fanusie & Entz, 2017b, p. 8) Starting as early as 2009, AQC started overseeing kidnapping by its affiliates, who followed established common protocols on kidnapping; AQI deviated from this modus operandi when it started kidnapping foreigners solely for the purpose of killing them.18 (Callimachi, 2014a) 2.4.2. Al-Q aeda splinters , Sal afi -jihadi movement broadens Following the US attack on Afghanistan in late 2001, the central core of al-Qaeda (AQC) was nearly decimated and while operating from the remote Pakistani tribal areas, it started encouraging its affiliates and existing cells outside the region to carry out attacks, changing its role from the perpetrator to instigator. Its fortunes improved in 2003 when the US invaded Iraq and redirected significant portion of their military resources from Afghanistan. The newly-started conflict seemed to confirm bin Laden’s narrative about a global crusader plot against Muslims and helped incite sympathisers to heed the group’s call to jihad and either move to fight the US forces in Iraq or to start orchestrating attacks abroad on their own. Indeed, as Napoleoni confirms, European counter-terrorism and intelligence professionals and investigators at that time asserted that the al-Qaeda insurgency in Iraq, headed by Abu Musab al-Zarqawi, became a driving force behind new, self-funded terror networks in Europe and the Middle East. (Napoleoni, 2007b) Finding itself isolated, AQC started “externalising” its

18 This was compounded by the ideology followed by the group, which was more radical and in vital aspects deviated from AQC, as its leaders sought greater autonomy from the central command; this internal rift in the central-affiliate relationship eventually manifested itself even strongly in 2014 when the two groups split for good. 48 capabilities, primarily out of necessity. Over time, this shift in initiative from AQ central to AQ periphery would be even more emphasised, as the trend would move from broader AQ organisation to AQ supporters. As Hoffman notes, terrorist organisations – and al-Qaeda in particular – are much like a shark, which must keep moving forward in order to survive. (Mendelsohn, 2016, p. 54) Given that its efforts to stage attacks in this era were gradually being hindered and counter-terrorism and security services across the world were getting better at preventing plots, “franchising” and establishing offshoots became the second-best option for the organisation to remain relevant with its supporters, keep its donors and patrons and to keep itself financially afloat. (Ibid.) These affiliates’ financing efforts were largely dictated by the arena in which the found themselves in, with many of them relying in varying extents on territory governance, common crime and cooperating with criminal networks, in effect hazing the distinction between terrorists, insurgents and clear-cut criminals. While the central organisation certainly did disburse money as “starting investments” for many groups, it eventually became more dependent on its affiliates than the other way around, as their revenues dwarfed those of AQC. Although initially thought of in reverse, Bin Laden’s probably last letter written shortly before his death indicated that at that point of the organisation’s existence (i.e. in 2011), AQC was receiving, instead of distributing funds from its affiliate groups. (Burke, 2015, pp. 126, note 35; author’s emphasis). Hints of this switch from top-down to bottom-up financing appeared long before, when it was revealed that in 2005 al-Zawahiri wrote in a letter to AQI, asking its leader al-Zarqawi for financial assistance. (Mendelsohn, 2016, p. 55) The Iraqi offshoot, then flush with money from local sources and the heart of new jihad against America, had better chances of obtaining finances than the embattled central command hidden in Pakistani tribal areas. More importantly, though, it had the ability to draw on local sources from a conflict country, avoiding many CTF measures enacted shortly after 9/11 that were well-suited to stop large transactions among formal financial institutions in the West, but not so much to stop sympathetic Middle Eastern locals from chipping in at their local mosque, local financiers to pass the funds to their local hawaladar or to prevent personal couriers from travelling across the region. Sourcing funds locally – both to finance themselves in a more sustainable way and to fund the AQC – eventually became the dominant trend of this era, one that would remain relevant until today. Understandably, the affiliates’ financing options were dictated by their regional circumstances and their respective strategies, which at least in case of AQI diverged from the AQC strategy; interestingly though, their choice was not influenced by ideology, as

49 they had no qualms about trafficking in drugs, taxing their territories’ inhabitants drug dependencies, extorting legitimate businesses or kidnapping local fellow Muslims for ransom. 2.4.3. AQI The group’s foundations were laid in 1999 by a Jordanian militant Abu Musab al- Zarqawi, initially under the name of Jamaat al-Tawhid wal-Jihad, or the Organization of Monotheism and Jihad, when he was given an audience with bin Laden who begrudgingly provided him with seed money to start a training camp outside Herat in Afghanistan. (Burke, 2015, p. 62) However, it was not until October 2004 that the two groups formally merged, creating al-Qaeda in the Land of the Two Rivers (commonly referenced to as al-Qaeda in Iraq, or AQI). The financial strategy of AQI was determined by its broader strategy, in this case seeking to establish a caliphate and govern a territory. AQI – and by extension its subsequent incarnation, the Islamic State in Iraq (ISI) – had primed itself for local governance as early as 2006, when it adopted a bureaucratic top-down model based on AQC emphasising heavy central oversight of finances and applied it to different geographical area. It obtained its funding locally via diversified sources, both criminal and quasi-legal activities in an attempt to emulate state services (e.g. taxation); according to RAND Corporation research drawing on over 140 documents — personal letters, expense reports and membership rosters — seized by the US Forces in Iraq between 2005 and 2010, outside donations amounted to only 5% of the group's operating budgets, with the rest being raised within Iraq. The group had also demonstrated a gradual improvement of revenue collection, moving from petty crime, to more sophisticated mafia-style protection rackets, to direct involvement in oil production and smuggling. Interestingly, despite the vast sums at its disposal, monthly payroll consistently consumed the largest single portion of its revenues – a common trait found later also with AQIM or the Islamic State, whose territory-governance efforts burned most of its enormous budget. (Johnston, et al., 2016) In this analysis, however, AQI stands out as an outlying case. In its selection of funding sources, it deviates from the AQC and from other affiliates due to a) its divergent strategy (i.e. primary focus on land governance with the aim of establishing a caliphate first and foremost) and b) divergent ideology (more radical and brutal towards its out-group). As can be seen in the lines above, these two points became best apparent in AQI’s (and later ISI’s) decision to side- line external donations and use kidnapping for ideological/propaganda gains, not for financial ones.

2.4.4. AQIM Al-Qaeda in the Islamic Maghreb (AQIM) appeared for the first time as AQ offshoot in January 2007 and although it is primarily based in Algeria and Mali, it takes advantage of the region’s porous borders and ungoverned territories to operate, making it active also in Morocco, Tunisia, Libya, Ivory Coast, Niger and Burkina Faso. The group’s financial strategy was dictated by the regional circumstances it had found itself in, with the most relevant being a lack of local or international donors and the difficulty of transferring money after a decade of measures designed to restrict such financial flows. Due to this, AQIM was left to involve itself in a variety of locally-based profitable criminal activities including extortion rackets, kidnapping for ransom and the trafficking of everything from narcotics to people. (Burke, 2015, p. 125) Recently, the group began to rely more on its smuggling networks across the Sahel and Sahara, leveraging tribal alliances and cooperation with other militant groups in the region. This approach allowed it to become self-sufficient and establish a firm stronghold in the region, eventually becoming considered al-Qaeda’s wealthiest branch with budget that allows it to fund other sympathetic groups in the region. (Fanusie & Entz, 2017b, pp. 2-4) UN's 2014 estimate puts the group's budget at 15 million USD, but it can possibly raise tens of millions from ransoms, as seen in 2015, when a French state company paid 40 million in exchange for 4 French hostages. (Jones, 2014, p. 38) Although KFR was the primary source of revenue for the group for nearly a decade,19 by 2015 it started being replaced by smuggling as the main revenue source. In smuggling, AQIM has a considerable experience and takes advantage of its leaders’ personal connections to local clans and families to secure its routes. However, in drug smuggling business, AQIM tends to tax the smuggling routes instead of buying and selling drugs directly. At least since 2009, the group was also involved in people smuggling to Europe. (Fanusie & Entz, 2017b, pp. 2-4) Regarding its expenditures, a majority of group's finances is used for organisational purposes, i.e. paying its fighters' salaries, buying the loyalty of local clans and spreading its influence by providing rudimentary governance. (Ibid.) The last point also allows it to obtain further funding; this was clearly seen in 2012, when the group seized control of a portion of land in Mali and taxed the locals. In order to expand its reach and influence, the group has also provided funds to regional jihadi groups, including MUJAO, Boko Haram, al-Shabaab, and

19 Only between 2008-2013, the group made $91.5 million on seven ransom payments for 20 European citizens. 51 other al-Qaeda affiliates and sympathetic groups throughout the region with sums ranging in hundreds of thousands of dollars. (Fanusie & Entz, 2017b, p. 12)

2.4.5. AQAP The Yemen-based offshoot of AQ is currently considered the most active one, as it managed to seize control of territory and in parallel to this perpetrate several terrorist attacks. Its funding model seems to be a mix of AQIM and HTS (see below), combining the circumstances of financially poorly-connected conflict country with efforts at some localised governance. The group is said to be making low- to mid-tens of millions of dollars annually. (Fanusie & Entz, 2017a, p. 2) The spoils of war, from taxation and booty to hostage ransoms, had made the AQAP’s campaign in Yemen more or less self-financing. In a 2012 letter sent to AQ operatives in Africa, AQAP’s leader Nasir al-Wuhayshi mentioned that “thanks to Allah, most of the battle costs, if not all, were paid from through the spoils,” adding that “almost half the spoils came from hostages”, with Oman and Qatar reportedly acting as intermediaries in these transactions. (Callimachi, 2014a) Moreover, when the group held a port city of Mukalla between mid-2015 and mid-2016, it managed to loot the local bank (acquiring approx. $60 million in cash) and establish a rudimentary system of port taxation which reportedly brought in $2 million per day. (Ibid.) This allowed AQAP to create a backup fund that it can fall back onto, sustaining the group even if its other sources of funding are cut off. At that time, it also started providing direct governance over the areas it controlled but has since been pushed out. This made the group roll back to merely providing social services and infrastructure development in areas where it remains active, in order to ingratiate itself back into these societies. (Ibid., p. 10) While in control of coastal towns and ports, AQAP started taxing and directly smuggling oil transported along the coast; this continued even after the group was pushed out of the area. Interestingly, AQAP did not engage in international oil trade as IS did at the time, but merely moved it around the country to its other regions to make profits there. (Ibid., p. 8.) Nevertheless, foreign funds flowed into AQAP’s coffers anyway, as the sectarian nature of Yemeni conflict makes the group an ideal recipient of aid to counter the Iran-backed Houthi rebels. Apart from the Hadi government and support of Saudi AQAP financiers, the group has received external support from other AQ affiliates in the wider region, namely AQIM and al-Shabaab. (Ibid., p. 10)

2.4.6. AQ in Syria Foundations of the AQ’s Syrian offshoot (previously known as Jabhat al-Nusra and Jabhat Fatah ash-Sham, currently organised in a wider jihadi front called Hay’at Tahrir ash- Sham or HTS) were laid down at the start of the Syrian civil war, when the leader of ISIS, Abu Bakr al-Baghdadi, sent Abu Muhammad al-Julani and several other seasoned jihadists to establish an affiliate that could tap into the increasing chaos of the civil war. Al-Julani himself noted how Baghdadi “approved our plan to support the oppressed in al-Sham [Syria], and gave us money…and sent us a few brethren”. Over time, Julani’s organization, Jabhat al-Nusrah, became increasingly powerful and self-sufficient, securing its own donors and funding from sources in the Persian Gulf and Levant. (Jones, 2014, p. 7) This method differentiates it from other affiliates who source their funding predominantly locally; however, given the complex situation it has found itself in – i.e. a country deeply mired in conflict, with its ideological rival holding territory and plundering it for resources – and the high strategic priority of the Syrian battlefield for AQC, it is understandable that the group was provided with funding from abroad, so as to make its mission in the Levant easier. Currently, it is estimated that HTS earns tens of millions of dollars a year. (Fanusie & Entz, 2017c, p. 2) Coupling these turbulent conditions with a desire to portray itself as a more sensible, less brutal alternative to IS, HTS had to take more considerate approach to soliciting finances locally. Although it does tax personal incomes and local businesses, levies tariffs and fines locals for breaking rules, it re-invests these funds by providing free electricity, subsidized food, and charity services to locals; the group’s “gradualist” approach to governance reportedly enjoys a popular support and HTS has been said to said to have a reputation for relatively efficient governance. (Ibid., p. 3-4.) After the group’s fighters seized grain silos and flour mills in Aleppo in 2012, they started to operate them and sell their produce to local bakeries to produce free bread for locals, seeking to win their support. Apart from these, however, group does not currently20 run any local businesses and instead opts to tax the already active ones. (Ibid., 9.) Regarding the external sources, donations to HTS most often come from private entities based in Gulf States (transferred via Turkey by personal couriers or regional hajj pilgrims returning to their countries), although limited material and logistical support for acquainted groups was also provided by the governments of Turkey and Qatar as well. (Ibid., p. 7.) The

20 Previously JAN held several oil fields in the Idlib Governorate, however with the Russian involvement in the conflict it has lost them. 53 second vitally important foreign source of funding is KFR and as Fanusie notes, since 2013 at least $200 million has been paid in ransom, mostly for foreign hostages from Turkey, Lebanon, Fiji, Spain, Italy or USA. (Ibid., p. 8.) HTS’s strong connection to local population – an approach similar to AQAP – makes it a hard opponent to uproot from the region. In a paradoxical way, this is both its strength and weakness – while taking advantage of this connection would allow it to raise more funds locally, i.e. by deeper involvement in governance, this way it is still highly fluid, mobile, and should it be forced out of the areas where it enjoys popular support, low dependence on local sources would allow it to continue its fight in a more insurgent form away from population centres. 2.4.7. Al-Sh abaab The Somalian branch of al-Qaeda was formally accepted in 2012; however, it was active and well-positioned for extensive operations in the region long before that, as in 2009 it had seized the vitally important port of Kismayo, allowing it to engage in piracy and international trade of charcoal, which eventually comprised a significant part of its budget.21 In 2015, it was estimated that the group raises funds primarily from protection money, taxation of local businesses, trafficking and piracy (Burke 2015: 122) As the group seeks to govern a territory, Al-Shabaab operates a centralised money distribution system, similar to the one used by AQI and subsequently the IS. Given that territory control provides for a variety of sources usable for financing, al-Shabaab draws primarily on those, with the most important sources of revenue being taxation and extortion; taxes on charcoal sale were particularly important until 2016, when the sales declined due to regional politics and taxes on livestock and sugar gained prominence. Apart from these, however, group taxes virtually anything that may bring profit – transport companies and smugglers alike, port commerce, khat22 sales and humanitarian organisations active in the region, who are required to pay “registration payments” and subsequent fees. (Fanusie & Entz, 2017d, p. 3) To smaller extent, diaspora funding (some of it originating in the West) and KFR are also contributing to the group’s budget, however they are nowhere as important as local sources. These abroad-originating payments are usually transferred via remittance services such as hawala, other global money transfer services or couriers. Somali businessmen connected to the group and operating in the Gulf countries are reportedly also using these means to sustain their businesses and send their financial support. (Ibid., p. 4) A regional specific is the use of mobile

21 Between 2012-14, the group is said to have made $83 million per year from charcoal sale, despite UN ban on import of Somali charcoal. (Fanusie & Entz, 2017d, p. 3) .is a plant native to the region whose consumption has intoxicating effects ( القات Khat (or qat; Arabic 22 54 payment services, which allow locals to pay for goods not by cash, but by transferring their funds via their cell phones. Al-Shabaab supporters are known to have used these means, extortion payments were paid via mobile payment systems and in 2012, the UN sanctioned an al-Shabaab-linked individual who created an anonymous mobile money network, ZAAD, that the group likely used to transfer and pay funds. (Ibid.) Like other terrorist groups, Al-Shabaab spends most of its funds for organisational capabilities. With estimated budget of high tens of millions of dollars raised annually, the group is said to spend only about 10 million on its fighters’ salaries. (Ibid., p. 23) The group also finances its own media office, al-Kataib Media Foundation, in operation since 2009, and Radio Andalus, which creates and distributes propaganda for the group to maintain its influence over the population.

2.5. OPERATIONAL FUNDING 2001-2011

After the 9/11 attacks, al-Qaeda was forced to change its modus operandi for activities in the West significantly – it was no longer a relatively unknown group, it could not make young Muslims travel in and train them in Afghan terror camps basically without consequences and in volumes as before, its networks in place were being discovered, methods were becoming known and sources of funding were being cut off. Sending in operatives from the Middle East and wiring them necessary funding as was the case in the pre-9/11 era was simply no longer possible. As Napoleoni notes about 9/11, “these were the last attacks fully planned, funded and executed under the direct supervision of al-Qaeda’s leadership. In the 2002 Bali bombings, al- Qaeda played the role of terror venture capitalist, (…) and the most recent attacks in Europe are the work of individuals and whose only link to al-Qaeda is ideological.” (Napoleoni, 2007a, p. 177) Al-Qaeda Central managed to have had only tangential influence on European plots carried out or planned since 200123, but by 2007 even than waned in favour of simple inspired plots with no actual operational connection to AQC. Indeed, with the closer scrutiny brought about by the Global War on Terror, AQC cut itself off from the Western world. While this move might seem drastic for the organisation’s relevance, it was unsurprising and largely necessary. As bin Laden and the rest of the group’s leadership became the most wanted persons in the world, avoiding creating any links between them and the attack cells became imperative. And considering that sympathetic individuals desiring to join the jihad had started organising, funding, preparing, and executing attacks on their own and without AQC’s support, no such links were necessary. Apart from being the more dangerous option, attempting to provide seed money for attacks as has been customary previously would have been unlikely, as AQC had its funds frozen and was struggling to survive, and unnecessary, as it was easier for its sympathisers to raise these funds either via criminality or legal means that they had been using to provide for themselves. Even more, according to European intelligence agencies, it was the desire to emulate al-Qaeda attacks that made many would-be attackers turned to self-funding. (Napoleoni, 2007a) Given that these plots did not demand tremendous sums that had been used in 9/11 but a considerably smaller budget, self-funding became a very viable option.24 It is

23 This is best seen on several successful and failed plots in the UK, including the 2005 London bombings from 7 July and 21 July, 24 Some of this era’s attacks did not even approach the half a million-price tag of 9/11; apart from the plots analysed in this chapter, the failed 2007 London car bomb attacks carried an estimated price tag of 56 because of these reasons that after 9/11 one has to start clearly distinguishing between the operational and organisational funding – while in the past they were intertwined and a single, AQ-held budget was used to fund both, in this era it no longer holds true. In light of this, one has to focus on what specifically funded the attacks in this era if not centrally-disbursed funds. Napoleoni notes that it has been estimated that two thirds of terror financing in Europe originated from criminal and illegal activities. (Napoleoni, 2007a, p. 177) On the other hand, this points at another third that did not use illegitimate means. For example, jihadists in Italy and Spain have been found to have worked as mechanics and waiters (Ibid., p. 177). Regarding the London attacks, the funding methods have been found to be “extremely difficult to identify as related to terrorism”, as the attackers “played the system” by taking loans and overdrawing on their credit cards, making debts that they had had no intention on paying back. Over time, this trend of “legalising” the funding sources would become more pronounced, with the majority of jihadists arrested or killed in terror attacks in Europe 2015 using non- criminal means to funds their plots. (Rekawek, et al., 2018) These findings are supported by the research of Norwegian Defence Research Establishment (FFI), which in 2015 published a thorough research into financing of jihadi terrorist cells operating in Europe between 1994 and 2013. Some of its most important findings are that 1) jihadists involved in planning and executing attacks most frequently relied on funding from the cell members’ own salaries and savings, 2) 90% of researched cells were obtaining funding by themselves in some way and 50% of all were entirely self-financed, 3) only ¼ received any financial support from international terrorist organisation (e.g. al-Qaeda, and almost no cells relied fully upon external support), with this percentage over time gradually dropping in favour of self-funding via legal means, 4) despite their importance in funding AQC and attacks abroad, neither charities nor IVTSs (in this case hawala) played any significant role in financing terror plots in Europe, and finally 5) terror plots in Western Europe are generally cheap, with three quarters of the plots studied estimated to cost less than $10,000. (Oftedal, 2015) 2.5.1. 2002 Bali bombings In 2002, on second anniversary of USS Cole bombing, a series of suicide and car bombings struck two nightclubs in Bali, leaving 202 people dead, mainly Australians, Indonesians and Brits. The group behind the attack, Jemaa Islamiyah (JI), had some personal

about $14,000 and the foiled commuter train attack in Germany’s Cologne in 2006 was estimated to have cost only $500. (Schipper, 2017) 57 and financial links to AQC for many years, with the main point of interest in this nexus being Riduan Isamuddin, also known as Hambali, a JI operational commander and AQ’s local logistical coordinator. According to the US Congressional Research Service, Hambali was highly placed and involved in joint JI-AQ operations in the region, as well as in the 9/11 attacks. (Manyin, et al., 2009, p. 6) Following his arrest in 2003, Hambali revealed al-Qaeda had sent him $30,000 to fund the attacks, with more coming in after the attacks (totalling $100,000), reportedly because AQC was pleased with the result. (The Sidney Morning Herald, 2003) Following the established modus operandi between the two groups, AQC provided all the funding, while local group – in this case the JI – sourced bomb-making materials and local manpower to carry out the attack. (Manyin, et al., 2009, p. 6) Given that al-Haramain and other AQ-linked charities operated in the area, it is highly likely that funds for the attack were transferred to JI by these means (see chapter 2.1.3 and its subchapters on IIRO and al-Haramain for more information). Despite the trends mentioned in this chapter, Bali bombings appear to be a “border case”, deviating from most of this era’s trends and more fitting in the previous one. The explanation may be that the funds directed for the attack were transferred to JI long before 9/11 attacks and by the time authorities started paying attention to financial flows of AQC, plot planning was already underway. 2.5.2. 2004 Madrid attacks The 2004 Madrid attacks – reportedly not exceeding the price tag of $50,000 and entirely funded via criminality – represent a simple case where the previously established OPSEC rules were closely followed and unlike the failed Strasbourg plot it managed to succeed. The cell, comprised of Moroccan drug traffickers converted to Islam, adhered to the new modus operandi of sourcing the funds by themselves and tapped into their proceeds from drug trafficking and document falsification. The explosives were obtained over a period of a year by a paid coal miner working in a Spanish region of Asturias and were paid for by the proceeds from drug trade. (Ibid., p. 174; Williams, 2007, p. 78) What is of great interest, however, is the fact that the cell had amassed a considerable “war chest”, purportedly to be used for a sustained campaign of terror attacks. Apart for spending between €41,000 and €54,000 for the attacks themselves, the cell members had a contingency fund of €52,295 and drugs worth somewhere between €1.35 and €1.53 million. (Ibid., p. 85)

2.5.3. 2005 London attacks The 2005 London bombings follow the pattern started by the Madrid bombings, with the cell obtaining its funding (estimated in less than £8,000) by legal means and criminality, in part via credit card fraud. As the House of Commons report on the incident states, “the group appears to have raised the necessary cash by methods that would be extremely difficult to identify as related to terrorism or other serious criminality”, adding that Mohammad Sidique Khan, plot’s alleged ringleader, had provided most of the funds. (UK Home Office, 2006, p. 23) Khan had been in full-time employment for 3 years, had a reasonable credit rating, accounts in several banks, several credit cards and a £10,000 personal loan; on this he eventually defaulted and had overdraws on his credit cards, amassing a considerable amount that was sufficient to fund overseas trips (mainly to Pakistan, to learn bomb-making skills), bomb making equipment, rent, car hire and travels inside the UK for the whole ring. (Ibid.; Burke, 2015, pp. 166-168)

3. PRESENT STATE OF SALAFI-JIHADI TERRORISM FUNDING

Due to the Islamic State being probably one of the most defining characteristics of this era in terrorism in general, this chapter will focus heavily on the funding behind this organisation. However, other topics, such as most pertinent trends nowadays or funding behind other selected jihadist groups (including the AQC-related ones, mentioned in the previous chapter), as well as the organisational funding, are analysed as well. In the modern era, the picture of financing of Salafi-jihadism is even more complicated and diffuse than in previous eras and can be best described when divided into four general categories: • organisational financing of territory-governing terrorist groups (i.e. Salafi-jihadi groups that control territory, are involved in local governance and draw on funds sourced from that territory, e.g. the Islamic State, AQAP or al-Shabaab in Somalia, mentioned in the preceding chapters), • organisational financing of “kinetic” terrorist groups (those that are preoccupied with insurgent fighting, plotting terrorist attacks, and are considerably more low-profile and clandestine than the category above, e.g. the Indonesian Jemaah Islamiyah, Jamaat al- Nusra or al-Qaeda in Lebanon), • operational financing sourced from terrorist groups (i.e. plots that show clear operational links to established terrorist groups, such as providing of training, funds, logistical assistance; this category also covers “lone actor” attacks where abroad -based terrorists were in direct contact with the attackers; for example, the 2015 January and November Paris attacks fall into this category), and finally • operational funding behind lone wolf or merely inspired plots (this includes a myriad of smaller plots of various effectivity, such as the 2017 Manchester Arena bombing or the 2016 Würzburg train attack).

Each of these categories draws on different sources of funds and grouping them together would be analytically wrong. Whereas in the first case local sources and the method of “living

60 of the land” are the most prominent, non-governing groups still tend to stick localised external support, donations and more low-profile means. With regards to operational dimension, these also vary, as centrally-coordinated plots tend to be bigger, better financed and planned and as a result also more deadly (although this is not a rule; see for example the 2016 Orlando shooting in Florida or 2016 Nice vehicle attack) than their counterparts perpetrated by individuals with varying degree of connection to central “mother organisations”.

3.1. CURRENT TRENDS

Today’s trends of terrorism funding are following the pattern established in the previous era and are inter-related to more general trends within terrorism, which can be put under the umbrella term of “popularisation” of terrorism, which encompasses the greater ease of getting indoctrinated and acquainted with terrorist organisations, lower operational costs associated with attacks preparation, or less emphasis on undertaking a formal training in terrorist camps abroad. In simpler terms, Salafi-jihadi terrorism is no longer an exclusive affair demanding significant effort on the candidate’s part but can be accessed by nearly anyone with sufficient motivation, regardless of their finances, Islamic education, military skills or origin. Ideological impulse for this wave of individualised, dispersed wave of terror attacks was provided by American-Yemeni preacher Anwar al-Awlaki, who in the late 2000s started calling on his followers in the West to perpetrate attacks there, without regard for any concrete link to established terrorist groups. The message was further amplified by the Syrian civil war and the rise of the Islamic State, particularly by its extensive propaganda machine. As Neumann notes, beheadings of Western hostages near the Syrian city of Dabiq by the group’s perhaps most symbolic figure, Jihadi John, have brought across an important message: “one man with a knife had humiliated America (…) and placed its citizens into a state of fear. From that point on, lone attackers were no longer second-class terrorists, and everyone understood that a knife could be just as potent a weapon as a ton of explosive.” (Neumann, 2016, pp. 130-131) This individualised mentality started manifesting itself in the funding of jihad as well, with many perpetrators eschewing finding foreign donors for their attacks, opting instead to use their own funding or engaging in criminality to provide for their plots. It goes without saying that the conflict in Syria has provided a new impulse for funding of its own. In a vein very similar to that of fundraising during the Afghan war, Gulf states were involved in several campaigns to help raise funds for Islamist groups there, painting the necessity to finance the jihad in Syria as an Islamic obligation. As Keatinge notes, the most

61 frequently used religious argument was called ‘Tajheez al-Ghazi,’ or “arming a soldier.” This way, supporters who cannot, or will not, join the Jihad physically for whatever reason, can still achieve the honour and heavenly reward of waging jihad, provided they donate funds that will allow someone else to fight in their stead. (Keatinge, 2014, p. 55) With regards to operational financing, in his testimony to the House’s Terrorism and Illicit Finance Subcommittee, Matthew Levitt noted three main trends in the current era of Salafi-jihadism. They are: • low-cost attacks • self-financing • novel means of value transfer

3.1.1. L ow -cost attacks , lone wolves and lone actors Probably one of the most pressing and least preventable issues of today is the advent of low-cost attacks that are perpetrated by individuals with seemingly little or no connections to established jihadi groups. While these phenomena are not new to terrorism researchers25, it is their overlap within the jihadist milieu and their quantity that is new. Such attacks are immensely hard to prevent, as neither surveillance of the established groups’ external contacts nor OPSEC blunders on the attackers’ part (such as procurement of weaponry or materials for explosives) can reveal them, as their only link is ideological, and consumption of propaganda is a unilateral activity. The second dimension of the problem, i.e. low-cost attacks, is similarly pressing, as it breaks down the barriers that had previously prevented sympathisers from engaging in terrorist attacks, thus creating a greater pool of recruits with minimal financial requirements. Indeed, costs of some of the most recent attacks in the West did not exceed €100. For the murder of Lee Rigby in 2011 its two perpetrators had spent only £44.95 on knives and a little more on an old unloaded handgun purchased from unknown criminals, putting the total costs of attack into low hundreds; similarly, the Tsarnaev brothers, who reportedly had struggled financially before the Boston Marathon bombings, had to spend similar amounts of dollars on pressure cookers, nails and ball bearings and low explosives (extracted from fireworks costing only $200), which could have been sourced from Dzhokhar’s dealing of marihuana. (Burke, 2015, p. 159, 200)

25 After all, low-cost tactics such as stabbing have been used widely before, for example in Israeli Intifadas, and the concept of “leaderless resistance” and lone wolves/lone actors as its variation has been present as well, exemplified by Ted Kaczinsky or Timothy McVeigh. 62

3.1.2. S elf -fin an cin g – legal means and criminality With the increasing frequency of former criminals – and by extension criminal tactics – being involved in Salafi-jihadi terrorism plots, overlap of criminality and terrorism became one of the most researched topics in terrorism studies nowadays. However, as previous chapters, especially the operationally-focussed ones, demonstrate, this overlap is hardly new; what makes it novel is its scope, which has surpassed anything seen in previous years. This may well have to do with several traits of the popularisation of terrorism, with the greater inclusivity being one of the most pertinent. Indeed, the propaganda poster of British jihadist group Rayat al-Tawheed posted in March 2014 demonstrates this the best, with its main slogan being “sometimes people with the worst pasts create the best futures”, implicating that even criminals are welcome to take part in jihad (Basra, et al., 2016). As Oftedal notes, some of the most popular jihadi ideologues of the 2001-2011 era, Anwar al-Awlaki and the previously London-based Abu Hamza, have made claims in support of criminal activities targeting non-Muslims as a means of funding jihad. (Oftedal, 2015) Criminality as a financial source for Salafi-jihadists has several upsides, namely the ability to raise large funds relatively quickly, keep oneself (and by extension one’s plot) off the scrutiny of financial regulators and record-keepers, and in case of some criminal activities, such as forgery, terrorists can also obtain commodities that can further facilitate their plot (in this case counterfeit documents). (Ibid.) Criminality was found to have had some effect on another portion of recent attacks, with the link either being the criminal source of funds or their attackers being criminals themselves – examples are Ayoub el-Khazzani’s assault on the Paris-bound Thalys train in 2015, Mehdi Nemmouche’s shootings in Brussels’ Jewish museum in 2014 or the 2016 Brussels bombings, whose suicide bombers, the Bakraoui brothers, were involved in local criminal milieu for years. But it is not only criminality that terrorists use to fund their attacks. In a similar manner to London 2005 attacks, many terrorists nowadays use legal sources to provide for themselves and their plots, whether it is their savings, income, small loans or overdrawing on their credit cards. For example, Michael Zehaf-Bibeau, who in 2014 attacked the Canadian Parliament financed the attack by working in the Alberta oil sands, attackers at the 2015 Garland, Texas shooting were financially supported by their sympathetic flatmate who had also tried to make a fake insurance claim, Omar Mateen responsible for the 2016 Orlando nightclub shooting opened 6 credit cards accounts months prior to the attack to fund his $26,532 buying spree of weapons and ammunition and more recently, Salman Abedi, responsible for the 2017 Manchester Arena bombing funded his plot via taxpayer-funded student loans. (Davis, 2015;

CBS News, 2015a; Sorkin, 2018; Mendick, 2017) Using legal self-funding lowers the chances of the attack being discovered, as law enforcement authorities are missing any financial indicators telling them that attack is imminent; unless the attacker is already known to authorities and is being monitored, there is little chance to discover him (provided he actively tries to hide the plot). 3.1.3. Novel means of value transfer This trend refers to Salafi-jihadists attempting to abuse modern technologies such as cryptocurrencies to raise or move funds around to globe; the case of mobile payment services used by al-Shabaab in chapter 2.4.7 is the prime example of this. However, these methods have been used in more financially stable countries as well. For example, in 2015, a US national Mohamed Elshinawy received between at least $8,700 from ISIS operatives via both PayPal and Western Union, supposedly to fund an attack. (CEP , Undated) In another case, a 17-year- old Shukri Amin of Virginia was arrested for helping IS raise funds via Bitcoin. (Malik, 2018b) Although these technologies certainly pose challenges and these cases point at their actual abuse for terrorist purposes, they still remain isolated cases and there are still very strong barriers that preclude their widespread abuse. As the latest Europol’s TE-SAT report notes, despite the fears surrounding these technologies’, namely cryptocurrencies’ abuse, their actual involvement in terrorism financing in proportion to all other plots is currently minimal. (Europol ECTC, 2018, p. 12) Chapters below on future means of terrorism funding explains some of the most relevant arguments against these technologies’ use by terrorism on large scale.

3.2. FINANCING THE CALIPHATE

The so-called Islamic State has been repeatedly called the wealthiest terrorist group in history. Unlike its co-ideological rival, the al-Qaeda, the IS eschewed reliance on abroad-based deep-pocketed donors and instead raised its finances from everything the territory it was controlling offered. Burke pointed out already in 2014 that interviewed MI6 officers involved in monitoring the group’s progress called private donations “a negligible contribution to the group’s budget”. (Burke, 2015, p. 95) By adopting this financing strategy, IS essentially switched millions-worth of private donations for hundreds-of-millions-worth of its own governance and management profits. With the increasing desire to present itself as a legitimate “state” it also adjusted its methods of fundraising, turning from wanton violence and criminality to law-based taxation, complete with its own currency and established system of ministries, local treasury offices and revenue collecting services that collected, distributed and reinvested

64 the funds raised from the whole caliphate. The research of the International Center for the Study of Radicalism demonstrates this change in stark numbers – whereas in 2014 the majority of the group’s funding (52%) came from looting, confiscation and fines (which may be called the “bread and butter” of insurgency or conflict-time funding) and “state-like” sources such as taxes and fees represented only 25%, in 2015 these figures switched, changing to 20% and 44%, respectively. (Heißner, et al., 2017, p. 11) However, over time its statehood-building efforts fizzled out and as its territories were dwindling, sources of revenue were being eliminated by the US-led military coalition and the group started to fight for its caliphate project’s survival, IS became more reliant on the one thing it still controlled – the territory and its inhabitants. Gradually, it reverted back to less sophisticated and virtuous means of fundraising, breaking or adjusting even its own rules and codes of behaviour in order to make its behaviour passable with the population it controlled. Instead of corporal punishments, the groups started imposing cash settlements, levied higher taxes and slashed its fighters’ salaries by 50%. For example, by late 2015 it was being reported that the group allowed policemen, soldiers, and teachers living in its territory to atone for the “sin” of having worked under the previous, religiously inappropriate regimes by obtaining a repentance ID card costing up to $2,500. (Simpson & Philips, 2015) The group operated a centralised budget managed from Mosul and dozens of regional budgets based in their respective wilayats and managed by their governors, or walis. In December 2015, it has been estimated that the IS’s yearly budget amounted to about $600 million, with approx. two thirds of it having been invested in its offensive capabilities, including fighters’ salaries, materiel, local fighters’ wages, and security apparatus, which by itself consumes $10m-$15m each month (Jones & Solomon, 2015) The group operated a wealth redistribution system with different sums for different types of inhabitants based on their current familial status or specialised skill, (e.g. higher salaries for foreign fighters, married fighters with several wives, children and slaves, oil rig technicians, foreign doctors, etc.). Despite its seeming sophistication and thoroughness, the system was plagued by inefficiency, mainly due to weak record-keeping, and virtually no accountability, resulting in walis and commanders pocketing or ill-disbursing the funding (Ibid.). Naturally, as the group’s caliphate project started its downfall and finances became scarce, its leaders gradually started abandoning this model and instead turned to coercion by violence. 3.2.1. Energy production Crude oil – at times termed “the black gold that funds the black flag” – along with oil products, and gas have been some of the most lucrative resources the IS could have controlled 65 at its outset, when a majority of eastern Syrian and some major Iraqi oilfields has been under its control. Its prominence in the group’s strategy is probably best demonstrated by the fact that oil sales and distribution were not decentralised to its wilayats as other day-to-day issues, but it was centrally controlled by the group’s shura, i.e. top management – a privileged status granted only to military and security operations and its media outputs. Apart from being a vital source of finances, it was also crucial in enforcing the group’s nurtured image of a quasi-state capable of governance, employing well-educated and well-paid engineers and mining professionals, and securing hundreds of millions of dollars in international trade. At its peak, the group was estimated to have made approx. $500 million from oil a year. (Simpson & Philips, 2015) Although most of their produce has been used for internal consumption, a great portion of it has been smuggled via long-established smuggling routes through Kurdish areas into Turkey, as well as into Syrian regime-controlled zones. (Burke, 2015, p. 95) Oil has been a lifeblood of the region and apart from local regimes, other rebel groupings – even those at war with jihadist factions – also bought oil from IS-held wells, as diesel generators are used to power most of local infrastructure from water pumps, tractors and excavation machinery to hospitals and offices. (Financial Times, 2015) While such black- market deals were frequently vilified in the media at that time, from the economic standpoint it made perfect sense for anyone in the market to buy oil from the IS, as they drastically undercharged for their supply, asking only for around 20% of its market value, thus securing stable input of funds. Due to these dealings’ obscure nature, estimates on the exact profit for the IS vary dramatically – some analysts26 claim that at its output peak in 2014, the organisation could have been earning as much as $3 million per day from the combined revenues of Iraqi and Syrian oil fields, whereas the Financial Times investigators settled on a lower amount of about $1,5 million per day. (Financial Times, 2015) For comparison, bin Laden’s whole personal wealth was estimated at between $5 and $30 million. (Burke, 2015, p. 95) Understandably, these figures relate to the 2014-2015 period, and following the US-led coalition airstrikes at Iraqi and Syrian oil facilities – especially after the Operation Tidal Wave II, started in October 2015 – these revenues started to plunge dramatically. As a consequence of the increased French pressure in fight against the IS in wake of 2015 November Paris attacks, US forces increased their pressure, destroying 116 oil tanker trucks only on 16 November – an unprecedent move, as prior to the Paris attacks the coalition sought to avoid these targets due to their civilian nature. (Simpson & Philips, 2015) In late December 2015, US military

26 See Leigh 2014. 66 spokesman remarked that coalition airstrikes resulted in 90% of the Islamic State group's oil capacity being destroyed. (Harress, 2015) This pushed the group to establish tiny makeshift refineries, which helped keep it afloat with an estimated contribution of $20 million a month, a significant downgrade from the previous figures of about $50 million a month. (Warrick, 2016) By the early October 2017 and after a significant territorial gains by the Iraqi security forces and Kurdish militias in Syria, this figure has dwindled even further to less than $4 million a month. (Michaels, 2017) As the group was gradually losing control over more and more oil wells, it shifted to taxing oil consumption on its territory and transport of oil across the last swathes of lands it held. With its complete loss of territorial control in early 2019, it is very likely that oil as the IS’s funding source is finished. Oil was not the only energy source that had helped finance the IS. The organisation also took good advantage of numerous electricity-producing dams on the Euphrates and Tigris rivers, with the most important being Tabqa dam outside the northern Syria town of Raqqa, Haditha in Iraq’s Anbar governorate and Mosul dam outside the eponymous Iraqi city. While they were important for the governance and military reasons, at least in case of the Tabqa dam there are reports that in May 2014 ISIS maximized flows through the dam to increase productivity and subsequently portion of the produced electricity was sold back to areas held by the Assad regime. (Woertz, 2014) 3.2.2. T ax ation and extortion Although initially relying on what are normally called “revolutionary taxes” and brutality-enforced extortion payments, with the rising ambitions of becoming a viable alternative to previous state systems IS started enforcing regular taxes not dissimilar to modern state taxation systems. Given its self-nurtured religious image, IS levied taxes based on Islamic traditions, such as zakaat (a traditional Muslim tax on wealth) and jizya (a traditional tax paid by non-Muslims living in Muslim lands). Its “morality police”, Hisbah, also collected taxes for sharia transgressions and once the funding became scarce, out of necessity it also started taxing the crimes that had been until then punished severely, such as smuggling or distribution of cigarettes (considered haram). Apart from religious taxes, however, the organisation taxed the caliphate’s inhabitants as any other state would – collecting taxes for city cleaning, garbage disposal, water and electricity provision, security or import taxes for goods from outside the caliphate. (Weiss, 2015) The organisation also imposed taxes on businesses and services operating on its territory, such as telecommunications companies that had relay towers in IS-controlled territories, trucks passing through the caliphate (reportedly taxed a 10% of value of their cargo), 67 or commercial and construction companies based in its territory. (Thorndike, 2014; Solomon, 2015) According to RAND Corporation research, IS extorts between 2.5 and 20 percent of revenue from businesses in its territories and operates other racketeering enterprises that raise money. By October 2016, i.e. during the time of significantly increasing military pressure on the group’s territory, it still managed to raise $4 million in taxes per month in Mosul alone. (Clarke, et al., 2017, p. 7) In what turned out to be an interesting episode of the Syrian civil war, it has been revealed that a major French cement company LafargeHolcim was funnelling hundreds of thousands of dollars via intermediaries to rebel groups, including jihadists from al- Qaeda offshoot Jabhat al-Nusra and the Islamic State, to ensure that they would not attack its plants in northern Syria or kidnap its employees. Money was also paid to obtain raw materials from ISIS-held areas. Court documents suggest that this “protection money” was paid on a monthly basis, with $20,000 going to ISIS, and additional funds to the Nusra Front, even after the caliphate’s declaration. (Alderman, et al., 2018) In a more curious interpretation of “taxes-based funding”, it is important to note that it was not until well into 2015 that Iraqi government stopped disbursing salaries to government officials living in IS-held areas. As Clarke et al. note, prior to this move Iraqi government sent as much as $170 million per month in—the equivalent of $2 billion per year—into ISIL-held territory, where IS was imposing taxes as high as 50% on these salaries. (Clarke, et al., 2017, p. 13) The government in Baghdad was also late with prohibiting bank branches and exchange houses in IS-held cities from operating on both Iraqi and international financial markets. Eventually, this move proved to be crucial, as by cutting the group off from the international financial systems it was forced to store its funds in physical commodities stored someplace, making them vulnerable to airstrikes. However, until then the group was free to send money out of its territory and receive donations from across the world. Importantly though, although the group did tax local businesses, it has been often stressed that it did not simply extort the people but did in return provide security from bandits and other pillaging armed groups involved in the regional conflict; moreover, they made sure that these contributions would be lower than under the previous secular regimes. This was a sensible departure from its predecessor, AQI, which alienated local Sunni tribes by its heavy- handed approach, for example by simply appropriating their smuggling network; as such, it has turned out to be a successful way of buying popular support and further strengthen its image of a governance-capable entity. (Burke, 2015, p. 96)

3.2.3. Antiquities sales Starting as early as 2012, IS started selling antiquities looted in Syrian and Iraqi archaeological sites, with its primary market being enthusiasts and aficionados in Western countries. While these objects are seen as idols of the previous, un-Islamic cultures and therefore are forbidden and were frequently destroyed by IS forces, the group does recognise their financial value and deal with them, as with other similarly forbidden assets.27 Although not as profitable as other sources, antiquities sales provided the group with a foreign capital that was not as easily militarily countered as the oil sales and did not agitate the local population as much as extortion did. Apart from selling some antiquities by itself, the organisation also operated a decentralised system for sale of antiquities dug up on the land it controlled. First, one had to obtain a permit from ISIS authorities, then his discoveries had to be valuated by an ISIS-paid expert, and only then were they allowed to be shipped out into international black market. At some point in this process, ISIS imposed a “sellable antiquities tax” reported to be 20% of the sale price. (Rose-Greenland, 2016). Due to the criminal nature of the whole enterprise in all its points, it is hard to come up with a hard estimate of the final sum brought in by the antiquities sales, however, some expert put the amount in between tens of millions of dollars or as high as $100 million annually. (Fanusie & Joffe, 2015, pp. 3, 5-6) Naturally, with loss of territorial control this source of funding became lost, although it is possible that some artefacts were stashed away or serve as a means of value storage, waiting to be sold once funding is needed. 3.2.4. L ootin g Seizure of valuable commodities following the Iraqi Army’s flight from Mosul and much of northern Iraq provided the group with a major financial boost to its budget. US authorities estimated that the seizure of gold and money reserves from various banks in northern and western Iraq during 2014 – including the Iraqi Central Bank’s branch in Mosul in June 2014 – yielded assets in worth of approx. $500 million comprised of hard cash of various currencies and gold reserves; these estimates vary and some sources claim that with by adding similar institutions based in Syria, it seems possible that the IS started of with a budget of as much as $1 billion. (Clarke, et al., 2017, p. 10) Much of these finances, however, was destroyed

27 As Fanusie and Joffe note, several reports indicate that IS looted artefacts for sale from ancient city of Nimrud prior to blowing up portions of the site. (Fanusie & Joffe, 2015, p. 11) This dual approach of a clash between ideology and profitability can be observed in several other areas – for example, despite the existence of several propaganda videos showing IS burning stashes of cigarettes, some of interviewed CTF professionals mentioned how the group burns only a portion of the seized stashes and sells the remainder on the black market. 69 during the coalition’s Operation Tidal Wave II, when in late 2015-early 2016 its airstrikes bombed several IS-held financial facilities, including its Bayt al-Mal, or “general treasury” and the already-mentioned Central Bank branch, destroying between “tens of millions” and "a billion" dollars of bulk “Daesh cash,” according to coalition spokesman Col. Steve Warren. (Johnston, 2016) It is important to note that looting does not relate only to financial commodities as those mentioned above, but also to critically important goods for the general population’s regular life and whose seizure and subsequent taxation allowed the organisation to create more revenue out of the population it had controlled. As Simpson and Philips note, agriculture in this sense became a huge source of financing, as “before even starting the engine of a single tractor, the group is believed to have grabbed as much as $200 million in wheat from Iraqi silos alone.” By controlling the highly-fertile acreage along the Tigris and Euphrates rivers, the group obtained a high-value/high-utility asset, which in comparison to oil wells or gold reserves is very hard to fight against, both due to the population’s dependence on its yields (and potentially catastrophic humanitarian impact on it, should they be destroyed), and also because it’s bizarre and pointless to bombard agricultural fields and silos. (Simpson & Philips, 2015) Apart from wheat, barley and cotton were also singled out as a highly-valuable commodities the group controlled. Finally, valuable objects, such as cars, televisions or tables looted from abandoned households were reportedly also sold internally in “loot markets” to local population and its fighters. (Fanusie & Entz, 2017f, p. 9) 3.2.5. Kidnapping for ransom Kidnappings for ransom made IS up to $45 million in ransoms in 2014, up to $47 million in 2015, and up to $30 million in 2016 and can be regarded as a minor contribution to the organisation’s overall budget. (Fanusie & Entz, 2017f, p. 3) The method drew global attention especially in relation to the gruesome beheadings of US and UK nationals in mid-late 2014. Although these hostage-takings became the most high-profile and the most expensive in their asking prices, majority of the cases involved local citizens, with ransoms ranging in $500 to $2,000 for locals and $3-5 million for foreigners. (Ibid.) In the high-profile cases28 IS has asked for significantly higher ransom; for example, in 2014 the group demanded a €100 million ransom for journalists James Foley and Steven Sotloff each, and $200 million for two Japanese

28 What prevented these hostages’ release is the US’s and UK’s long-standing policy of not paying ransoms, differentiating them from other Western countries; families of the hostages were also allegedly threatened with lawsuit for material support of terrorism should they try to raise the money and pay it themselves. (Stahl, 2017) 70 hostages killed in early 2015. (Callimachi, 2014b; CBS News, 2015b) Although over time the kidnappings of Westerners subsided, they are currently cited as the next possible source of funding for the group, as it has been forced underground and made to revert back to more “classical terrorist” or criminal sources of financing, with KFR being one of the best options, as it is not dependent on territorial control, thus making it ideal for an insurgent group. (Fanusie & Entz, 2017f, p. 10) 3.2.6. O th er rep orted sources of funding the caliphate Apart from those mentioned above, in February 2015 FATF identified other sources of IS financing, including donations by or through non-profit organizations, material support provided by foreign fighters and fundraising through modern communication networks, such as in case of al-Shabaab (see chapter 2.4.1.) (FATF 2015). With regards to foreign donations, there is limited evidence to support these assertions vis-à-vis IS itself; most often reports cite the financial support given by the Gulf states early in the Syrian conflict, from which IS may have benefited directly and indirectly, especially prior to 2013 when it was not yet known as Islamic State. (Heißner, et al., 2017, p. 8) It has to be mentioned, though, that this reported source does not correspond with the group’s strategy and any funds obtained in this manner are most likely to be negligible. (Ibid.) An interesting variation of diaspora funding is a funding of FTFs departed for MENA battlefields by their families. Europol’s 2018 TE-SAT report monitoring these transactions shows that recently there had been “around 5 000 money transfers from around 2 000 senders to around 1 000 recipients, for a total amount of more than EUR 2 million”; interestingly, apart from providing proof of life of known FTFs they also helped identify previously unknown FTFs and sympathisers of IS. (Europol ECTC, 2018, p. 11) According to the same report, money transferred via hawala is generally outbound, i.e. it originates in Europe and is moved to entities abroad, most likely by support networks that fund terrorist organisations outside of the region. (Ibid.) 3.2.7. Future of the IS funding? Following the complete loss of territory, as of early 2019 it seems that IS has entirely transformed into an insurgency group, frequently perpetrating hit-and-run attacks in provinces of Syria and Iraq it once controlled. Naturally, this insurgent group still needs funding to sustain itself, despite the lack of “plunder economy” profits it once had had. It may still tap into other corners of its “war chest”, such as hidden antiquities, gold reserves and other valuable commodities that it had buried in the desert or funds stashed away in anonymous accounts in

71 correspondent banks in southern Turkey (Warrick, 2018), but these should be understood as a “rainy day fund” or a means of last resort and their use would be indicative of the group’s financial hardships; in order to sustain its campaign it is in its interest to establish more sustainable sources of funding. In fact, several reports show that its leadership has prepared exactly for this eventuality. In 2018, it has been discovered during security operations in northern Iraq that the group may have smuggled as much as $400 million in Western and Iraqi currencies and golden coins out of Iraq and Syria, investing it in small businesses in neighbouring countries in order to launder the funds and obtain a steady, sustainable source of funding. (Mansour & al-Hashimi , 2018) The group is said to have established a rather diversified portfolio of business in which it had invested, ranging from carwash businesses and automobile dealerships to hotels and real estate companies, with people in charge of these businesses not cooperating for ideological reasons, but for a cut of their profits (Kenner, 2019). While this is insufficient to run a pseudo-state of several million inhabitants, it may be more than enough to fund a clandestine organisation counting several hundreds or thousands of dedicated fighters in its ranks. As has been mentioned above, over time and with loss of territory, IS turned away from the “legitimate” fundraising, adopting more criminal tactics to support itself. Now that it had to flee completely into obscurity, it can take advantage of the situation and involve itself in criminality completely without fearing the loss of popular support. Even more, the group can use the meticulously collected intelligence on local families, clans and tribes that had created the backbone of its rapid progress across the Levant and extort locals for profit. (Clarke, 2018) More worryingly, though, the group is well-positioned to take advantage of the reconstruction of the two war-ravaged countries; its very nature as a localised armed group with history of violence puts it into a right spot to make “protection” offers to companies and organisations investing in post-conflict reconstruction. Combining the two tactics, it might not be that difficult for the organisation to use compromising information to influence local politics and insert its operatives into positions that would allow it to skim off construction contracts, inflating their prices and effectively funding the insurgency that would prevent them from being completed. (Ibid.) 3.2.1. Other Salafi -jihadi groups of the modern era Although the extend of IS’s finances was monumental, in a sense it was an isolated case; unlike the multi-billion enterprise fuelled by sales of oil and thousand-years-old antiquities, most of today’s Salafi-jihadi terrorist groups have at their disposal incomparably smaller funds ranging in dozens of millions, often obtained from the “classical” sources of terrorism 72 financing, i.e. “revolutionary taxes” or extortion of people living in their area of operations, criminal activities ranging from bank robberies, forging and drug smuggling to KFR, and in some marginal cases also on donations. Interestingly enough, where similarities can be drawn is that many of these groups – including IS and AQ offshoots – are increasingly resorting to at least some form of territory control, taking advantage of remote and mostly ungovernable or hard-to-govern areas of their states. This decision is rather logical, as by tapping into broken and marginalised societies of conflict or former conflict areas allows them to obtain a steady income that can’t be destroyed as easily as oil wells and requires a lasting commitment on part of the government to preclude jihadists from abusing it. As RUSI’s Tom Keatinge pointedly notes, ‘living off the land’ will always be favoured to relying on external sources and fundraising activities that may be vulnerable to interference. (Keatinge, 2019) It appears that terrorist groups are eschewing the old modus operandi of operating clandestinely and getting their money from abroad, and are increasingly opening up, attempting to supplement the government and solicit funding from their territory, or in some cases obtain it online (more on the topic in chapter 4.3) For example, Boko Haram (BH) shows clear move towards more sophisticated means of fundraising, abandoning external support and criminality for local sources. Like many other jihadist outfits mentioned throughout this work, BH is said to have received starting money from bin Laden, when in 2002 he donated $3 million to Nigerian Salafists, of which large part went to kickstart BH. (International Crisis Group 2014, p. 23) Despite their current ideological clashes, the group in early 2010s received support from other regional AQ-linked groups, namely AQIM and al-Shabaab; this changed in 2015 when BH joined IS. Nowadays, funds that BH has at its disposal are estimated at several millions of dollars. The group’s activities surged in 2011 and in 2014-2015, while controlling territory in northern Nigeria, the group is said to have made as much as $10 million from local sources. (Fanusie & Entz, 2017e, p. 2) Although originally dependent on criminal activities such as bank robbery and smuggling, the group now relies more on kidnapping of locals and extortion. During its phase of territory control, however, BH extensively taxed local farmers, became involved in cattle rustling and fish-trading and started providing micro-loans to locals. By 2014, bank robberies made up a huge part of the group's operating budget, amounting up to $6 million; especially in 2011, BH reportedly robbed at least 30 banks in northern Nigeria, distributing the money to locals to gain their support instead of keeping it. (Ibid, p. 8) Absence of external support and dependence on local sources is apparent also in the case of the IS’s offshoot in Somalia, the Islamic State in Somalia (ISS). Despite being an official

IS affiliate, in mid-2017, the group – facing competition with al-Shabaab at that time – was forced to resort to stealing livestock and extorting locals to provide for its few dozens of fighters. (Warner & Weiss, 2017, p. 29) Its other offshoots paint a similar picture; the wilayat in Libya started robbing banks, extorting locals and establishing retroactive taxes after seizing control of Sirte and wilayat Sinai turned to local drug trade after its external connections were cut off by the Egyptian military. (Center for the Analysis of Terrorism, 2015; Megahid, 2019)

3.3. OPERATIONAL FUNDING

As has been mentioned above, low-cost, low-tech attacks are being more prominent, with budgets for some of the attacks that took place in the past years not exceeding hundreds of euros. This complicates the situation for researchers, as the origin of money behind acquiring these weapons are of little interest, since they might have been procured anywhere and even ordinary household tools are being used in simple stabbing/slashing attacks, thus making the question of their origin pointless. It is for these reasons that the case studies below will focus on attacks that used more sophisticated weaponry (firearms, explosives) and hence required more funding and preparation prior to executing the plot. American attacks are a special case, as the constitution-guaranteed ease of access to firearms creates a completely different circumstances for terror plot planning than in Europe. Furthermore, one has to differentiate between centrally-funded and coordinated attacks (such as the 2015 November Paris attacks or 2016 Brussels attacks) and merely inspired, low- tech, low-cost attacks. Whereas the latter have significantly lower budgets and are in a sense isolated and thus harder to stop, in the former case perpetrators are vulnerable to interception as they either have to wire the funds from abroad, transfer them personally or via IVTSs or raise them locally, which might be problematic, should terrorists opt for criminality (see operational case studies in preceding chapters for demonstration of this). These “easier-to-catch” plots, unfortunately, are less numerous than the dispersed, self-financed attacks, which make up the majority of today’s terrorism plots in the West. Quantitative research of GLOBSEC Policy Institute29 demonstrates this trend in stark numbers. The research project is focussed on terrorism-related arrests and deaths of perpetrators in 2015 in 11 European countries; its database currently holds records on 322 jihadist arrests or deaths. Of those, almost 62% (199) funded their plots entirely by themselves, with salaries making up the greatest portion (almost 20%), followed by savings, criminality and benefits. The project has also found that less than 6% (19) of all individuals on whom data was available had solicited their funds abroad. These findings dovetail those of FFI mentioned in the previous Operational Funding chapter, depicting how funding of Salafi-jihadism is gradually becoming less dependent on “mother organisations” and conversely more dispersed and individualised, especially in the operational dimension.

29 These figures refer to the organisation’s crime-terror nexus research “From Criminals to Terrorists and Back?”, to which author is a contributor and research assistant; figures included herein are from a live database (accessed 10.5.2019) and are to be published in a quarterly report in autumn of 2019. 75

Mini-case studies presented below present some of today’s operational funding trends. Although there is a rather definite evolution with regards to geographical origin of funds (i.e. abroad- or locally-sourced) that was already apparent in the previous era, there is very little development in terms of actual methods used to obtain these funds. Put simply, terrorists no longer get their money for attacks from abroad, but neither they are involved in any hi-tech fraud, cryptocurrency speculations, hacking or any other overtly sophisticated schemes. Funding-wise, salaries, savings, benefits and low-tech criminality remain the most prominent. Transfer-wise, terrorists still stick to simple and safe methods, such as hawala30, personal transport or money remittance services, such as Western Union.31 As the record shows, these low-tech methods are still some of the most effective – funds for the successful 2015 January Paris attacks were raised in France, both legally and illegally, 2017 Barcelona attackers used petty crime and legal means to fund their operation and the perpetrator of 2017 Manchester Arena bombing drew on his student loans. 3.3.1. 2015 Îl e -de-France attacks The January 2015 attacks in Paris combine two different approaches to funding. The difference is caused by two different groups being behind their perpetrators – while Kouachi brothers were backed by AQAP, which was emulating the late 1990s AQC approach of hosting foreigners, giving them training and providing money, Amedy Coulibaly claimed his attack on behalf of the Islamic State, which was at this time inciting its supporters to low-skilled attacks using whatever means, even criminality to raise the necessary funds. Burke notes that both AQAP senior leaders and Chérif Kouachi himself claim that during the two brothers’ visit of Yemen in August 2011, Anwar al-Awlaki both inspired the brothers to launch an attack on Charlie Hebdo and provided some funding for it, reportedly as much as $20,000 (Keatinge & Keen, 2017, p. 11) Chérif Kouachi himself is also said to have taken part in illicit trading in branded clothing and footwear years prior to the attack (Bindner,

30 Although this information remains unconfirmed, during his interviews with CTF professionals and financial intelligence analysts, author was told that at least for one of 2015 Paris attacks funds were transferred from abroad via hawala. Allegedly, there was a street in Raqqa called “Al-Mansouri street” (35.947458, 39.016972) during IS’s reign that hosted dozens of hawaladars who accepted funds for the caliphate from around the world and sent out funds to affiliates and Amn al-Khariji cells active around the world. 31 It has been published that at least some elements of IS’s external ops apparatus, Amn al-Khariji, used a string of middle men and financiers to transfer funds through Turkey into Europe via Western Union. This scheme was used to “launder” tens of thousands of euros sent by concerned mothers to their children fighting in Syria; the funds were sent to the Turkish middle man, who moved the funds to Belgium, where another operative moved them to operative involved in attacks preparation elsewhere in Europe, in effect covering both their origin and the Turkish link. (Vlierden, 2019) 76

2016). In late 2014, Amedy Coulibaly, along with his spouse, Hayat Boumeddiene, started buying cars on credit using fraudulent papers and reselling them for profit; on 5 January 2015, shortly before the attack, Coulibaly travelled to Belgium to swap a Mini Cooper for weapons that were used in the attack. (Burke, 2015, pp. 238-239) Apart from these, FATF report also mentions a €6,000 consumer loan, obtained with forged documents and cashed out by one of the attackers. (Financial Action Task Force, 2015) 3.3.2. 2015 November Paris , 2016 Brussels attacks Although they are probably the deadliest terrorist attacks of this era in the West, the coordinated Paris attacks from November 2015 were estimated to have costed no more than $10,000 (accounting for weapons, explosives components, housing and transport expenses), with black market-sourced firearms being the most expensive part. (Windrem, 2015) This, along with the 2016 Brussels attacks, perpetrated by a closely-related operational cell, is also the only known complex attack perpetrated by a cell whose operational part was prepared for the attacks in the caliphate; drawing on this cell’s modus operandi32, it can be assumed that at least part of its funds was brought in personally from Syria. However, due to these extensive preparations behind the plot and behind the whole cell, there is little to go on in open sources regarding the specifics of funding these. One of novel means of funding mentioned in relation to these attacks were pre-paid debit cards. At the time of attacks, it was possible to recharge them without any identity checks with funds up to €2,500; this could have allowed the support operatives and financiers to load them with money and pass them on to executive component that would use it for day-to-day expenses and safe house bookings without raising suspicion or alerting anyone to their true identity. (The Straits Times, 2015) These particular funds could have been either moved from the caliphate into Europe (see note 32 for closer description of this mechanism) or the attackers could have loaded them onto their cards themselves along the way to Europe. Given the inter-connectedness of Paris cell to Brussels cell (Najim Laachraoui was a bomb-maker for both plots and following the Paris fiasco, Salah Abdeslam fled to Brussels along with Mohammed Abrini), there is a possibility that these two cells shared their funds. Abrini himself appears to be a logistical support operative and is said to have travelled to the UK prior to Paris attacks, where he reportedly received £3,000 taken from an account of a British FTF who had left for Syria. (Tessier, 2016)

32 This refers to practices of the alleged cell leader, Abdelhamid Abaaoud, who in mid-2015 had sent out from Syria two operatives, instructing them to hit a soft target in Europe and providing them each with €2,000, in €500 bills to fund the attack preparation. (Callimachi, 2016) 77

3.3.3. 2016 Nice attack The 2016 vehicle ramming attack in Nice that resulted in 87 deaths and hundreds of injured was in essence a very low-tech attack that required very little funding and prior preparations. Its perpetrator, Mohamed Lahouaiej-Bouhlel was a delivery driver by profession and prior to the attack he was known to police as a petty criminal. (Visser & Orjoux, 2016) Apart from the uncomplicated renting of a vehicle, he also had sourced a .32 pistol, provided by a married couple from Albania. (Willsher, 2016) Despite – but probably due to – his criminal history, Lahouaiej-Bouhlel stashed away a considerable fortune that he had reportedly sent to his family in Tunisia just days before the attack. The sum, amounting £84,000, was reportedly sent in cash by his friends whom he has allegedly convinced to smuggle the money to Tunisia. (Sims, 2016) The origin of these funds remains unknown. 3.3.4. 2017 Manchester Arena bombing Authorities believe that the attacker, Salman Abedi, used student loans and benefits to bankroll the terror plot. (Mendick, 2017) Abedi was given at least £7,000 from the taxpayer- funded Student Loans Company which provides loans to students starting university courses; this amount was received upon enrolling for a business administration degree at Salford University in October 2015. The following academic year he had received the same amount, despite dropping out of the studies and it is speculated that he might have been receiving a jobseekers’ allowance, allowing him to claim up to £57.90 a week. (Roberts, 2017) The funding he had access to allowed him to rent 3 properties around the Greater Manchester Area and frequent travels to his family in Libya, where he is also thought to have received training in bomb-making. All these funds (withdrawn from an account he had set up in 2016 and had not used until the attack preparation33) were sufficient to procure necessary components and compounds for the TATP-based nail bomb used in the attack, and even allowed him to send £2,500 to his brother Hashim in Libya, who was subsequently detained for allegedly planning a follow-up attack in Tripoli. (Bennhold, et al., 2017; Mendick, 2017) 3.3.5. 2017 Barcelona attacks Spanish security agencies, according to terrorism researcher Fernando Reinares, claim that the Ripoll cell members responsible for the attacks made several trips around the region, appearing several times in France, Switzerland, Morocco. These trips, along with the rent for several vehicles and the purchases of gas canisters and components for the TATP explosive intended to be used in the attack were reportedly paid for by their own legal income, but also

33 78 by sale of stolen gold and jewellery, with around €1,200 having been obtained this way. (Reinares & García-Calvo, 2018) Interestingly, their makeshift bomb factory was based in an abandoned building in Alcanar, with electricity having been taken illegally from the main supply. (Ibid) This was meant to increase the security and lower the overall operation costs by avoiding paying for a safe house and possibly allowing the authorities to track their financial movements. There are no indications about the cell receiving payments from abroad and similarly to the other Spanish cell responsible for the 2004 Madrid bombings, the cell was closed off and self-funded, in part with criminality.

4. POSSIBLE FUTURE MEANS OF SALAFI-JIHADI TERRORISM FUNDING

The following chapter will build on the trends mentioned in the preceding chapters to evaluate what might motivate Salafi-jihadists (and by extension terrorists in general, as these are tactics mostly unrelated to any particular ideology) in choosing any of these means of financing and whether they provide substantial benefits in comparison to more “classical”, time-tested means. What becomes apparent upon their examination is that only some of them present a truly novel means of financing and others are simply modern, more technological spins on the already-established financing tactics. Whether this is a benefit or a deterrent for terrorists remains the question. As in previous chapters, what has to be emphasised is the difference between organisational and operational funding. For example, while public crowdfunding is highly unsuitable for operations preparation for obvious reasons, it is more likely to be used for organisational purposes, most likely under the guise of humanitarian assistance to conflict areas. Conversely, blockchain-based transactions reveal themselves to investigation and unless the recipient uses sophisticated chaining methods, switching between several currencies and constantly moving funds (but losing portion of the value in the process), the whole chain, starting with donor and ending with the final recipient is out for everyone to see – this is a problem for crowdsourced organisational funding, as investigators will be led directly from the published wallet address to all supporters who had chipped in. On the other hand, for hidden transactions between two unknown operational cells or between a cell and logistical provider (e.g. arms dealer), this means of value transfer is a lot more secure than bank transfers or personal money exchanges.

4.1. CYBER AS AN ENABLER OF JIHADI TERRORISM?

Cybertechnologies were long mentioned as “the new frontier” in terrorism financing and the advances in recent years and a handful of relevant incidents fuel this suspicion. (Carroll & Windle, 2018) However, despite the trend of “popularisation” and the ever-increasing involvement of technology in terrorism, it would be erroneous to immediately suspect a link between the two and assert that every cyber-related avenue of financing mentioned below will be explored and abused by the jihadi terrorists of tomorrow on a large scale. Without a doubt, it is expectable that each of the presented phenomena will in some form materialise, whether

80 on individual or organisational level, but there is a certain, rationality-driven principle guiding which of them will be used consistently and repeatedly and which will be a one-time attempt. During author’s interviews with CTF and CT professionals, what was frequently repeated was this logic, condensed into a handful of characteristics – “simplicity, profitability, repeatability”.34 In other words, terrorists prefer means of financing that are not too skill- demanding and are easy to operate without any prior experience or knowledge in the area. Secondly, they prefer those tools that yield the biggest return on investment and in relation to risks involved. And finally, these means have to be repeatable – while large, one-time financial injections are desirable and helpful, sustained financing over long time is what keeps the organisation afloat and allows it to continuously operate. Ideal financing source would maximise the utility in all three of these areas – be very easy to use by anyone, yield high returns on minimal investment and by risking little, and be repeatable without any constraints. While no such thing exists and picking a financing source is often a zero-sum game where one sacrifices security for profitability or repeatability for profit, technological advancements help lower the offsets between these categories, making new tactics potentially more attractive to terrorists.

4.2. CRYPTOCURRENCIES

Due to their popularity, perceived anonymity, safety of transactions, high speed for international transfers and difficult traceability, cryptocurrencies (often shortened to “crypto”) were mentioned frequently as the next possible means of funding the terrorism, providing their users with the opportunity to move cash across borders while avoiding regular CTF safeguards. (Europol EC3, 2018, p. 53) Their very nature as a decentralised, people-governed currency without any institutional oversight makes it seemingly ideal for criminals and terrorists who wish to avoid financial scrutiny by state organisations. However, actual use of cryptocurrencies betrays some of these assumptions and makes the appropriateness and usefulness for terrorist ends very circumstantial and dependent on the final intended goal. This chapter will explore several uses of crypto for terrorism financing – crypto as a source of funds and as a means of value transfer and value storage. A major factor that plays against the crypto as a source of funds or a means of value storage for terrorists is its high volatility. Since January 2013, Bitcoin, currently the most

34 Author‘s interview with representatives of EUROPOL’s O43 Financial Intelligence unit of ECTC, 12 October 2018. 81 popular cryptocurrency, plateaued in the range of between ca. $11 to max $1,000 for about four years till the start of 2017. By the end of that same that year, it hit its all-time max price of $18,877 on 18 December, almost a 1900% increase in value. By the end of the next year, however, it was down to approx. $3,800, putting anyone who had bought the token at the all- time high very deep into red numbers. This situation is similar with other tokens, such as Ethereum, Litecoin, Dash or security-oriented Monero. Admittedly, in recent months their value started being relatively stable, but compared to other means of either funding or value storage (such as diamonds, gold, tanzanite or even honey) the price of crypto is still very oscillating and thus represents a very high-risk choice for terrorists. Making money out of crypto is therefore a gamble that is not likely to pay off, given that the initial hype over crypto has died out in past months. Apart from the mentioned volatility, crypto is unlikely to be used as a means of value storage because of its security – cryptocurrencies are transferred among and stored in wallets, which, if improperly secured or targeted can be breached. Reflecting on this, investing in physical commodities that terrorists have direct control over presents a more secure option.35 On the other hand, where crypto is likely to find some use is use in operational cells for attacks preparation, as quick transfers of funds that are to be used immediately avoid the risk of losing value over time. Furthermore, interviewed experts noted that “once money is in the loop, it will stay in the loop” – in simpler terms, any value stored in crypto (and owned by terrorists planning an attack) is very unlikely to be turned into hard fiat currency for OPSEC reasons. This assertion is a logical one – once terrorists have a sufficient amount of crypto to buy weapons and gear necessary for the attack, it is pointless to have it exchanged into hard cash, as they can obtain the necessary gear by spending their crypto funds on Dark Net marketplaces. Without a doubt, given the increasing attention and scrutiny provided to these places by law enforcement and intelligence agencies in recent years, terrorists would have to navigate a tricky terrain to avoid any vendors operated by these agencies’ officers; however, the challenge is not much different when looking for a personal contact and the anonymity provided by anonymising tools required to even access these virtual marketplaces makes this a lot less risky option that asking around in person. What also precludes crypto from being used universally as a vector of funds transfer is its exclusivity, i.e. usefulness only for electronic transfers between users, marketplaces and services with sufficient established technical

35 Author‘s interview with representatives of EUROPOL’s O43 Financial Intelligence unit of ECTC, 12 October 2018. 82 infrastructures and thus unusable for developing countries where crypto are not yet as popular. Nevertheless, this did not prevent jihadists and their supporters to use crypto as a way of making donations and as the next chapter shows, past years saw jihadists starting extensive crypto- based crowdfunding efforts, although with dubious results.

4.3. CROWDFUNDING

One of the most likely tactics to be used in the future – demonstrated by its occasional use already today to different extent by different terrorist groups36 – is crowdfunding via internet. In essence, it is not a new tactic per se, but merely a new twist on the old mass-sourced diaspora financing, similar to al-Qaeda’s funding efforts via charities in the early 1990s. Its novelty lies in the use of cybertechnology, with the most pertinent elements being the abuse of internet and crowdfunding sites by jihadists to advertise their cause and provide necessary financial details, dark net and anonymising tools usage for preventing discovery and cryptocurrency use to enhance the transfer’s security. Obviously, this method is relevant only for organisational funding, as it would be poor OPSEC to publicly advertise one’s terrorist attack prior to its execution and solicit funding for it. Nevertheless, online crypto-based crowdfunding is becoming a very popular method that will most likely see greater use in future. Indeed, past years have shown already several jihadi campaigns asking supporters to make donations in crypto – as Europol’s IOCTA report notes, IS started experimenting with the technology already in 2014, but it was in 2017 that its supporters triggered mass cryptocurrency (Bitcoin and the more anonymous Zcash) donation campaigns on IS affiliated websites and chatrooms. (Europol EC3, 2018, p. 53) A website called Akhbar al-Muslimin started calling for Bitcoin donations in November 2017, providing its supporters with several means of secure funding, and including an embedded cryptojacker37 on the webpage to maximise the profit. Other IS-linked websites, Dawaalhaq Islamic News Agency and Isdarat, also took advantage of crypto donations, but it has been reported that most of the funding was used for internet hosting, thus making the net profit for kinetic terrorist activities low. (Ibid.) In autumn of 2018, a novel way of crypto crowdfunding appeared, when a jihadi website called “SadaqaCoins” started allowing its visitors to donate Bitcoin and Monero to “help pay for 4×4 pickup trucks,

36 Already in June 2016, a Gaza-based online jihadist propaganda unit called Ibn Taymiyya Media Center added a crypto payment option to its 2015 crowdfunding campaign “Jahezona”. In January 2019, al-Qassam Brigades of Hamas started receiving donations in Bitcoin, providing its supporters with infographics and tutorials on how to convert and transfer the funds. See Fanusie: 2019. 37 See notes in chapter 4.5 for closer explanation. 83

.50 caliber bolt action rifles and ammunition, wind readers for sniping, silencers, and even combat training for aspiring jihadists”, by selecting specific product and donating towards it (Maloney, 2018).38 In early 2019, MEMRI’s Cyber & Jihad Lab published an overview of four separate jihadi groups soliciting crypto donations in their propagation videos, including the above-mentioned SadaqaCoins or Malhama Tactical, the self-styled first jihadi PMC.39,40 (MEMRI Cyber & Jihad Lab, 2019) Crowdfunding made in this manner is a mutually-beneficial endeavour, as in contrast to personal donations made in mosques or to charities the donor is given a relatively higher degree of security, thus lowering the fear that his material support of a jihadi group would result in his persecution and incentivising other, more reluctant sympathisers to donate. On the other side of the equation, a recipient jihadi group receives the funds almost instantly, regardless of their geographical location, possibly also in a security-based cryptocurrency and in a non-material way, allowing it to forward the funds around the world as it wants, either to support its offshoots or operational cells. This obviously raised concerns about possible advent of “lone wolf crypto financiers”, i.e. unconnected, sympathetic individuals raising funds and sending them to support terrorist groups abroad. These fears seem to have materialised in December 2017, when a woman was arrested in New York for obtaining $62,000 in Bitcoin to send to Islamic State; it has been reported that she had raised the funds via fraud, obtaining loans and credit cards on false information. (Malik, 2018a) This incident lays at the crossroads of several trends touched upon above – dispersed base of the terrorist supporters (in this case based in the US), willingness to use criminal tactics for benefit of a terrorist group and abuse of emerging technologies – and while it is only one of a handful of incidents, it is indicative of the new direction terrorism financing will take in the next years.

4.4. HACKING

Although the IS has established a considerable online presence unlike any other terrorist group in history, its offensive cyber capabilities remain extremely limited. Despite this, past

38 Although crypto addresses for donations to terrorist groups are often blackened out on snapshots of donation pages for good reasons, author’s OSINT research yielded directly related addresses for Bitcoin and Monero and 12 extra allegedly linked BTC addresses; as of time of writing (1 May 2019), their blockchain reverse analysis has shown no funds having been transferred onto or out of any of them. 39 For more information on the group, see Woods seminal article on this group. (Woods, et al., 2017) 40 However, author’s reverse analysis of the enclosed Bitcoin wallet addresses has shown only small amounts of BTC having been transferred, amounting to only several hundreds of US dollars. 84 years saw many commentators claiming that cyber-related threat posed by the IS is noteworthy. It seems this error stems from conflating of the two aspects, i.e. IS’s ability to exploit social media dynamics to amplify its propaganda and the ability to actually breach these IT systems and use them to their advantage. Although there has been a handful of cybersecurity incidents caused by IS-aligned individuals and grouplets, they were very low-tech in comparison to the picture that is being painted by some authors – a far cry from any ability to use “hacking” for financial gains on the scale seen exercised by some state-connected APT41 groups. (Europol EC3, 2018, pp. 52-53) In 2015, a supposedly AQ-linked hacking group called Al-Qaeda Electronic was established, with similar groups claiming allegiance to the IS appearing at around the same time; United Cyber Caliphate, Islamic State Hacking Division or Islamic State Hackers were some of them. (Bernard, 2017; Liu, 2015) However, it stands to note that neither of these group has demonstrated any significant level of threat, with most of their attacks being more of a nuisance than a threat, often picking their targets purely for publicity and propaganda gains. Most often, they took form of defacements, DDoS attacks or data breaches, thus causing temporary disruptions to low-level websites and leaking personal data that was previously available via other open-sources anyway. (Ibid.) Although there are more sophisticated and damaging tools available online on Dark Web forums, including those that can be used for financial gains, Bernard’s conversations with members of some of these groups show their very low technical understanding of their use. (Bernard, 2017, p. 261) Considering that Junaid Hussein – probably one of the most prolific and dangerous IS- related hackers, whose exploits led to a targeted US airstrike on his position in Raqqa in August 2015 (Ackerman, 2015) – was limited in his attacks to doxing and defacements, it is hard to expect any highly-sophisticated cyberattack from jihadist circles that would allow its perpetrators to earn amounts of money that would make the whole effort profitable, worthwhile and a viable alternative to conventional funding. As can be seen throughout this sub-chapter, these attacks are highly demanding in technical expertise, requiring skill levels and resources often available only to state-level actors, and necessitate the attacker to scout the cyber- landscape for a longer period of time in order to uncover abusable vulnerability. These factors make hacking a potentially highly-profitable endeavour for state-backed groups with plenty of

41 The acronym stands for “Advanced Persistent Threat” and often refers to state-associated hacking groups capable of mounting sophisticated attacks that exploit system vulnerabilities, remain undetected for a longer period to achieve a specific goal and their effects are considerable, often with physical impacts; ideal examples of such groups or attacks are the US/Israeli Stuxnet attack on Iranian enrichment centrifuges or the North Korea-linked Lazarus group. 85 resources, time, with safety to operate and with little pressure to attain their immaterial goals, but a highly-losing effort for someone seeking to make money quickly while being actively tracked by state security services.42 Nevertheless, should these hacking groups re-orient themselves from their ideology- driven strategy towards a more pragmatic, financially-oriented one, they still may make use of their limited skills for profit. As they have demonstrated an ability to breach unsecured databases and exfiltrate their contents, they may try to use these tools to hold these databases’ owners to ransom, threatening to leak their sensitive data, leading potentially to damaging lawsuits and loss of reputation. To date, however, no such incident is known to have occurred.

4.5. OFF-THE-SHELF MALWARE, CAAS

Following up on the arguments mentioned in the sub-chapter 4.3., cyber criminality does offer means of financing jihad that are not contingent on individual’s technical skills. According to Europol’s most recent IOCTA report, recent years saw increased use of RaaS, or ransomware-as-a-service, a practice that allows criminals to “rent” malicious software developed by others for a fraction of profits gained from ransoms. This corresponds with the increased frequency of other cyber-enabled crime-as-a-service incidents over the past few years (such as distributed DDoS botnets for rent that can overload and bring down sites or the spread of crypto-jackers43), in some of which IS was reportedly also involved (Europol EC3, 2018, pp. 29, 53) It is precisely these malware-based CaaS tools where jihadists may find the greatest cyber-crime utility for fundraising. Low entry costs are probably the greatest incentive, with many basic RaaS tools selling for less than $5044 and apart from being able to visit dark net- based black markets and making the necessary payment to developers, they require very low technology knowledge. Potential high profits are another big incentive, with the asked ransom being several hundred dollars – a perfect return on investment, especially should a self- propagating malware be used, thus necessitating only launching it and reaping profits from

42 Author’s interview with officers of EUROPOL’s O31 Cyber Intelligence unit of EC3, 1 November 2018. 43 Cryptojacker is a malware – either downloaded directly or launched upon visiting an infected site – that steals a portion of computer’s computing power to mine cryptocurrencies for the attacker. This type of exploit is less harmful than other intrusive techniques and its clever placement on a frequently-visited website can potentially raise thousands of euros in a relatively short time. 44 Author‘s interview with officers of EUROPOL’s O35 Dark Web team of EC3, undated. 86 multiple infected targets.45 Since the payments are made in cryptocurrencies, terrorists immediately gain significant sums of money that can be spent on dark markets for other tools necessary for their activities, such as forged documents, electronics, firearms or explosives. Given these benefits, it is rather surprising that no jihadi-related RaaS incident has been recorded so far, despite the demonstrated RaaS’s rising popularity among criminals. Should the usage of dark web marketplaces become more commonplace and/or should jihadists start experimenting with (and succeeding in using) ransomware, their greater use for financing terrorism can be expected. However, this activity has several pitfalls, with some of the most obvious being the necessity to possess at least some technical knowledge, be willing to wait in order to maximise the profits from as many targets as possible and effectively becoming a target of interest of law enforcement services. Coupling these with the possible OPSEC hazards for operational cells, it seems that any CaaS-based funding is most suitable for organisational funding, with ops-funding via isolated financing cell being the other, more risky alternative.

4.6. CREDIT CARD FRAUD

Although credit card fraud has been used in the past already (see the failed millennium plot to bomb LAX by Ahmed Ressam in 1999), modern technologies massively improve criminals’ chances at raising funds this way. While Ressam had to set up a physical shop with a compromised credit card terminal (or “skimmer”) that redirected payments and thus exposed him to investigation, nowadays one can find stolen credit cards readily available for sale on Dark Net markets for a fraction of their worth. This provides criminals and terrorists alike with the option of buying information from dozens of compromised credit cards in bulk and encoding it onto a counterfeit or stolen card for fraudulent use. Another possibility is to use the information for non-physical use (such as online payments), thus disposing of the necessity of encoding a card and using it at a physical terminal.46 Should terrorists use a network of individuals (such as a logistical cell tasked with supporting another operation cell) with pre- coded cards to withdraw funds from several terminals simultaneously, they may pilfer massive amounts of cash in a few hours; by abusing the rapidly spreading crypto ATMs, they may take

45 Author‘s interview with officers of EUROPOL’s O31 Cyber Intelligence unit of EC3, 1 November 2018. 46 Although modern payment transactions employ a variety of 2 factor authentication methods (2FA; such as submitting a code from a confirmatory text message, mail, or even sipmler and obvious measures, such as entering a PIN code) to prevent payment card fraud, this can be avoided by using compromised cards issued by less security-conscious banks, making contactless payments in amounts under the triggering threshold or using them on online pages that do not require 2FA. 87 this fraud even a step further and quickly convert the hard cash into cryptocurrencies, allowing them to transport it across the world rapidly.47 While this opens up a possibility of large-volume fundraising, it is hardly a sustainable source of funds. Unlike smaller, more covert and less directly damaging means of obtaining funds by criminality, discovered case of extensive credit card fraud would quickly involve many actors, law enforcement agencies (possibly in several countries) and would promptly launch an investigation, thus painting a target on the terrorists’ back. Terrorists seeking to raise funds this way need to strike a balance between greed and security or choose either for their intended ends – large-volume, high-profile fraud for quick funding prior to an imminent operation or for organisational funding abroad, or a fraud lower in profit, but also lower in danger to the cell’s OPSEC, more suited for an on-site raising of funds in the target country.

47 Author‘s interview with officers of EUROPOL’s O32 AP Terminal team of EC3, undated. 88

5. CONCLUSION

The thesis sought to describe and analyse almost four decades of terrorism financing, with separate focus on organisational and operational funding. With regards to the main research question, i.e. whether terrorists broaden their set of financing tools or replace the old tools with new ones, the conclusion is that it is dimension- and case-dependent and the answer lies probably somewhere in the middle. Generally speaking, in the organisational dimension Salafi-jihadists have definitely broadened their spectrum of financing tools while keeping some of the “traditional” methods, such as external donations (although they make up a considerably smaller portion of their budgets than they used to), but have almost disposed of others, like legitimate businesses akin to bin Laden’s Sudan days. Their specific choice of financial tools is dependent on both factors external (country of their operations, intra-state competition with other terrorist groups, external pressures) as well as on their internal factors (strategy, particular strain of ideology) which makes some tools more suitable while others less so. Regarding the means of transfer, couriers and hawala are still the most often used across the Muslim world, as it has been largely untouched by CTF efforts that sprung up after 9/11. In the operational area, however, the evolution is more observable. While in the past terrorists seeking to strike in the West relied on central organisations disbursing funds and start- up money, nowadays they largely rely on themselves, obtaining the necessary finances in equal measure legally and illegally. In the cases where this applies, methods of transfer also saw some change, but in the opposite direction. Given that terrorists can no longer use wire transfers as they did during 9/11 preparations, more low-tech means of delivering the money such as hawala and bringing it personally are becoming the preferred choice. Nevertheless, as mentioned above, this applies only to a handful of plots which were orchestrated abroad and their operatives had to be shipped in; vast majority of terrorist incidents these days is prepared locally, thus disposing of the problem of funds transfer. One has to ask what leads terrorists to pick any of these tools over others, whether they are new or old, time-tested. The common trait connecting of all these changes – or not changing – seems to be a rational calculation of what works (in a given area), what yields profit, what is easy and what is possible. It is a simple execution of the age-old logic expressed in the idiom “if it ain't broke don't fix it”. When charities became controlled and scrutinised, Salafi-jihadists stopped relying on them as much as they used to; however, as there has been no such crackdown on wealthy and influential donors based in Gulf States, they remained a viable source of funding up till today. A similarly rational and highly adaptive approach was demonstrated in cases when

89 there was no parallel alternative; once transfers of tens of thousands of dollars from Sudan/Afghanistan to European banks became impossible due to close scrutiny of global financial flows, funds started to be raised locally. Once AQC became unable to secure sufficient funds by itself, it branched out and started siphoning funds from other regions where its affiliates operated. When IS-controlled territory started shrinking and further taxing became impossible, the group invested its funds in local businesses, securing its financial lifeline for years to come. These conclusions naturally pose questions for the future and reflecting on the presented future means of terrorism financing, one has to ask which of these technologies and methods will be used and which will not. Following the assumption of terrorists’ rationality, it is tempting to say that all of them will be used – and that may be true, as all of them they will be tested to some extent – but it is unlikely that they will replace the old methods altogether. After all, today’s methods only complement the old methods and did not replace them entirely. Given that all of the presented future methods have some downsides that make their use highly case- specific, it is most likely that they will remain as such and will be used only by a handful of “progressive-minded” terrorists. The technological barriers to their safe use remain one of the greatest issues for terrorists and it seems that unless these methods become radically easier to use and “fool-proof”, there will be more cases of arrests for attempted material support of terrorism than executed plots.

6. APPENDIX 1 – VISUALISATIONS, IMAGES, DIAGRAMS, TABLES

Table 1 – Funding behind selected plots mentioned in the thesis. Source: author Centrally-funded Self-funded via direct via via Legal Criminality donations legitimate coordinated means businesses logistical cells and charities 1992 Aden X bombing 1993 WTC X bombing 1998 Twin US embassies X X bombing 1999 LAX millennium X plot 1999 Jordan millennium X X plot 2000 USS X, most likely Cole bombing 2000 Strasbourg X Christmas market plot 2001 9/11 X X attacks 2002 Bali X bombings 2004 Madrid X attacks 2005 London X attacks 2011 Lee X,

Rigby murder possibly

2015 January X X Paris attacks 2015-2016 Paris, X X Brussels attacks 2017 Barcelona X X attacks 2017 Manchester X Arena bombing

Table 2 – Funding sources of AQ affiliates. Source: author

Funding of AQ Territory Taxation and Foreign donors Smuggling KFR Looting Commercial affiliates control? extortion enterprises AQI yes yes, of local no yes, oil and yes, of local limited as no, apart from population related products population AQI; private donations extensive of sympathisers later as ISI AQIM yes, limited yes, of drug no yes, extensive yes, almost no very limited; a smugglers exclusively of Guinea Bissau- Western citizens; based cell raised former main funds for the source of funds group in 2016 by selling luxury vehicles.48 AQAP yes yes, previously previously yes, oil within yes, vital yes, of banks none known vitally important highly Yemen importance and financial taxation of ports important, institutions currently limited

Al-Shabaab yes yes, of local marginal yes yes, both none known yes, sale of coal population foreigners and locals AQ in Syria yes yes, of local yes, vital none known yes, previously yes, of banks no, apart from population importance extensive and financial local flour mills institutions not operated for profit

48 (Fanusie & Entz, 2017b, p. 3) 93

Table 3 – Overview of usefulness of new technologies for terrorism financing. Source: author Cryptocurrencies Crowdfunding Hacking RaaS Credit card fraud Simplicity of use medium high low low medium Profitability medium low potentially high potentially high medium Repeatability low high low high high Use for - as a source of likely; already unlikely likely very likely organisational revenue – unlikely being used funding - as a crowdsourcing option – likely - as a currency - likely Use for likely only as a highly unlikely highly unlikely unlikely very likely; extent operational currency between and form funding the perpetrator and dependent on the logistical operation’s prep supporters, phase although currently not practiced

7. BIBLIOGRAPHY

9/11 Commission, 2004. Final Report of the National Commission on Terrorist Attacks Upon the United States, Washington, DC: National Commission on Terrorist Attacks Upon the United States. Abuza, Z., 2003. Funding Terrorism in Southeast Asia: The Financial Network of Al Qaeda and Jemaah Islamiya. Contemporary Southeast Asia, 25(2), pp. 169-199. Ackerman, S., 2015. Junaid Hussain: British hacker for Isis believed killed in US air strike, London: The Guardian. Alderman, L., Peltier, E. & Saad, H., 2018. ‘ISIS Is Coming!’ How a French Company Pushed the Limits in War-Torn Syria, New York, NY: The New York Times. Anon., n.d. s.l.: s.n. Basile, M., 2004. Going to the Source: Why Al Qaeda's Financial Network Is Likely to Withstand the Current War on Terrorist Financing. Studies in Conflict and Terrorism, 27(3), pp. 169-185. Basra, R., Neumann, P. R. & Brunner, C., 2016. Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus, London: ICSR. Bennhold, K., Ali Zway, S. & Castle, S., 2017. Hunt for Manchester Bombing Accomplices Extends to Libya, New York, NY: The New York Times. Bernard, R., 2017. These are not the terrorist groups you’re looking for: an assessment of the cyber capabilities of Islamic State. Journal of Cyber Policy , 2(2), pp. 255-265. Bindner, L., 2016. Illicit Trade and Terrorism Financing - December 2016 - Interim results, Paris: Center for the Analysis of Terrorism. Burke, J., 2003. Al-Qaeda: Casting a Shadow of Terror. London: I.B. Tauris. Burke, J., 2015. The New Threat from Islamic Militancy. London: The Bodley Head. Burton, F. & Stewart, S., 2006. Consequences of the 'Blind Sheikh's' Eventual Death, Austin, TX.: Stratfor. Byrne, C., 2002. Funds continue to flow despite drive to freeze network's assets, London: The Guardian. Callimachi, R., 2014a. Paying Ransoms, Europe Bankrolls Qaeda Terror, New York, NY: The New York Times. Callimachi, R., 2014b. Before Killing James Foley, ISIS Demanded Ransom From U.S., New York, NY: The New York Times.

Callimachi, R., 2016. How ISIS Built the Machinery of Terror Under Europe’s Gaze, New York, NY: The New York Times. Carroll, P. & Windle, J., 2018. Cyber as an enabler of terrorism financing, now and in the future. Journal of Policing, Intelligence and Counter Terrorism, 13(3), pp. 285-300. CBS News, 2015a. Arizona man involved in Texas attack charged with supporting ISIS, New York, NY: CBS News. CBS News, 2015b. New ISIS hostage video includes change in tactics, New York, NY: CBS News. Center for the Analysis of Terrorism, 2015. ISIS Financing, Paris: Center for the Analysis of Terrorism. CEP , Undated. Mohamed Yousef ElShinawy, New York, NY: Countering Extremism Project. Clarke, C., 2015. Terrorism, Inc.: The Financing of Terrorism, Insurgency, and Irregular Warfare. Santa Barbara, CA: Praeger. Clarke, C. P., 2018. ISIS’s New Plans to Get Rich and Wreak Havoc, Washington, D.C.: Foreign Policy. Clarke, C. P. et al., 2017. Financial Futures of the Islamic State of Iraq and the Levant, Washington D.C.: RAND Corporation. Cockburn, P., 2015. The Rise of the Islamic State. ISIS and the New Sunni Revolution. London: Verso. Coll, S., 2004. Ghost wars : the secret history of the CIA, Afghanistan, and bin Laden, from the Soviet invasion to September 10, 2001, New York, NY: Penguin Group. Commission, 9., 2004. Final Report of the National Commission on Terrorist Attacks Upon the United States, Washington D.C.: National Commission on Terrorist Attacks Upon the United States . Comras, V., 2007. Al Qaeda Finances and Funding to Affiliated Groups. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state respones : a comparative perspective. Stanford, CA: Stanford University Press, pp. 115-133. Cosgrove-Mather, B., 2004. Al Qaeda Skimming Charity Money, s.l.: CBS News. Davis, J., 2019. A Canadian Cryptocurrency Caper in the Sri Lanka Attack? Unlikely, s.l.: Intrepid. Davis, O., 2015. Paris Attacks Highlight Difficulty Of Stemming ISIS’ Terror Financing, New York, NY: International Business Times. Denson, B., 2013. Ashland Islamic charity seeks removal from U.N. list of entities associated with al-Qaida, s.l.: The Oregonian/OregonLive.

Droogan, J. & Peattie, S., 2017. Mapping the thematic landscape of Dabiq magazine. Australian Journal of International Affairs, 71(6), pp. 591-620. Ehrenfeld, R., 2011. Funding Evil: How Terrorism Is Financed - And How To Stop It. 2. ed. New Rochelle, NY: MultiEducator, Inc. English, R., 2010. Terrorism: How to Respond. Oxford: Oxford University Press. Europol EC3, 2018. Internet Organised Crime Threat Assessment (IOCTA) 2018, Den Haag: Europol. Europol ECTC, 2018. EU Terrorism Situation and Trend Report (TE-SAT), Den Haag: Europol. Fanusie, Y., 2019. Hamas Military Wing Crowdfunding Bitcoin, Jersey City, NY: Forbes. Fanusie, Y. J. & Entz, A., 2017a. Al-Qaeda in the Arabian Peninsula: Financial Assessment, Washington D.C.: Foundation for Defense of Democracies. Fanusie, Y. J. & Entz, A., 2017b. Al-Qaeda in the Islamic Maghreb: Financial Assessment, Washington, D.C: Foundation for Defense of Democracies. Fanusie, Y. J. & Entz, A., 2017c. Al-Qaeda’s Branch in Syria: Financial Assessment, Washington D.C.: Foundation for Defense of Democracies. Fanusie, Y. J. & Entz, A., 2017d. Al-Shabaab: Financial Assessment, Washington D.C.: Foundation for Defense of Democracies. Fanusie, Y. J. & Entz, A., 2017e. Boko Haram: Financial Assessment, Washington D.C.: Foundation for Defense of Democracies. Fanusie, Y. J. & Entz, A., 2017f. Islamic State: Financial Assessment, Washington D.C.: Foundation for Defense of Democracies. Fanusie, Y. J. & Joffe, A., 2015. Monumental Fight - Countering the Islamic State’s Antiquities Trafficking, Washington, DC: FOUNDATION FOR DEFENSE OF DEMOCRACIES. Financial Action Task Force, 2001. FATF IX Special Recommendations, Paris: Financial Action Task Force. Financial Action Task Force, 2015. Emerging Terrorist Financing Risks, Paris: Financial Action Task Force. Financial Action Task Force, 2015. FINANCING OF THE TERRORIST ORGANISATION ISLAMIC STATE IN IRAQ AND THE LEVANT (I, s.l.: Financial Action Task Force. Financial Times, 2015. Isis Inc: how oil fuels the jihadi terrorists , London: Financial Times. Finn, P., 2002. Five Linked to Al Qaeda Face Trial in Germany , Washington D.C.: The Washington Post. Freeman, M., 2011. The Sources of Terrorist Financing: Theory and Typology. Studies in Conflict and Terrorism, 34(6), pp. 461-475.

Giraldo, J. K. & Trinkunas, H. A., 2007. Terrorism financing and state responses : a comparative perspective. Stanford, CA: Stanford University Press. Giraldo, J. K. & Trinkunas, H. A., 2007. The Political Economy of Terrorism Financing. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspective. Stanford, CA.: Stanford Unifersity Press, pp. 7-20. Global Witness, 2003. For a Few Dollars More - How al Qaeda moved into the diamond trade, London: Global Witness. Harress, C., 2015. Amid Anti-ISIS Fight, 90% Of Islamic State Oil Destroyed By US-Led Coalition Airstrikes In Syria And Iraq, New York, NY.: International Business Times. Heißner, S., Basra, R., Holland-McCowan, J. & Neumann, P. R., 2017. Caliphate in Decline: An Estimate of Islamic State’s Financial Fortunes, London: ICSR. Hewitt, S., 2008. The British War on Terror. London: Continuum. Hoffman, B., 2006. Inside Terrorism. Revised and Expanded Edition. New York: Columbia University Press. Howley, S., 2017. Australian terror attack plots detailed in accused Bali bombing planner's charge sheet, Sidney: ABC News. IISS, 2003. Financing Islamist Terrorism. Strategic Comments, 9(10), pp. 1-2. Jacobson, M., 2010. Terrorist Financing and the Internet. Studies in Conflict and Terrorism, 33(4), pp. 353-363. Johnson, T. H., 2007. Financing Afghan Terrorism: Thugs, Drugs, and Creative Movements of Money. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspective. Stanford, CA: Stanford University Press, pp. 93-114. Johnston, P., 2016. Islamic State's money problems: Column, McLean, VA: USA Today. Johnston, P. B. et al., 2016. Foundations of the Islamic State: Management, Money, and Terror in Iraq, 2005-2010 , Washington, D.C.: RAND Corporation. Jones, S. G., 2014. A Persistent Threat - The Evolution of al Qa’ida and Other Salafi Jihadists, Washington DC: RAND Coproration. Jones, S. & Solomon, E., 2015. Isis Inc: Jihadis fund war machine but squeeze ‘citizens’, London: Financial Times. Justia Regulations, 2016. Sanctions Actions Pursuant to Executive Order 13224, 67431, s.l.: s.n. Keatinge, T., 2014. The Importance of Financing in Enabling and Sustaining the Conflict in Syria (and Beyond). Perspectives on Terrorism, 8(4), pp. 54-61.

Keatinge, T., 2019. Reinvigorating the Forgotten Financial Fight Against Al-Shabaab, London: RUSI. Keatinge, T. & Keen, F., 2017. Lone-Actor and Small Cell Terrorist Attacks: A New Front in Counter-Terrorist Finance?, London: Royal United Services Institute. Kenner, D., 2019. All ISIS Has Left Is Money. Lots of It., Washington, D.C.: The Atlantic. Kifner, J., 1999. Terrorists Said to Hide In Canada's Melting Pot, New York, NY: The New York Times. Kilcullen, D., 2016. Blood Year: Islamic State and the Failures of the War on Terror. London: Hurst & Company. Kiser, S., 2005. Financing Terror: An Analysis and Simulation for Affecting Al Qaeda's Financial Infrastructure, Arlington, VA: RAND Corporation. Leigh, K., 2014. ISIS Makes Up To $3 Million a Day Selling Oil, Say Analysts, https://abcnews.go.com/International/story?id=24814359: ABC News. Lemieux, F. & Prates, F., 2011. Entrepreneurial terrorism: financial strategies, business opportunities, and ethical issues. Police Practice and Research, 12(5), pp. 368-382. Levitt, M., 2007. Hezbollah Finances - Funding the Party of God. In: H. A. T. Jeanna K Giraldo, ed. Terrorism Financing and State Responses - A Comparative Perspective. Stanford, CA: Stanford University Press, pp. 136-151. Levitt, M., 2017. Low Cost, High Impact: Combatting the Financing of Lone-Wolf and Small- Scale Terrorist Attacks, Washington, DC: The Washington Institute for Near East Policy. Liu, E., 2015. Al Qaeda Electronic: A sleeping dog?, s.l.: American Enterprise Institute: Critical Threats Project. Maher, S., 2016. Salafi-jihadism: The history of an idea. London: Penguin Books. Malik, N., 2018a. How Criminals And Terrorists Use Cryptocurrency: And How To Stop It, Jersey City, NY: Forbes. Malik, N., 2018b. Terror in the Dark: How Terrorists use Encryption, the Darknet, and Cryptocurrencies, London: The Henry Jackson Society. Maloney, C., 2018. Crypto Crowdfunding Terrorists: Marketplace For Jihadist Crowdfunding Found on Dark Web, Asker: Crypto Currency News. Mansour, R. & al-Hashimi , H., 2018. ISIS Inc., Washington, D.C.: Foreign Policy. Manyin, M., Chronin, R., Niks, L. & Chanlet-Avery, E., 2009. Terrorism in Southeast Asia, Washington DC: Congressional Research Service. Megahid, A., 2019. ISIS Sinai turning to narcotics to bankroll operations, London: The Arab Weekly.

MEMRI Cyber & Jihad Lab, 2019. MEMRI CJL Compilation Video Shows Examples Of Jihadi Groups Using Bitcoin, s.l.: MEMRI. Mendelsohn, B., 2016. The Al-Qaeda Franchise. Oxford: Oxford University Press. Mendick, R., 2017. Exclusive: Manchester suicide bomber used student loan and benefits to fund terror plot, London: Telegraph. Michaels, J., 2017. U.S. coalition slashes ISIS oil revenue by more than 90%, McLean, VA: USA Today. Miller, J., 2001. Dissecting a Terror Plot From Boston to Amman, New York, NY: The New York Times. Napoleoni, L., 2003. Modern Jihad: Tracing the Dollars Behind the Terror Networks. London: Pluto Press. Napoleoni, L., 2007a. Terrorism Financing in Europe. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspective. Stanford, CA: Stnaford University Press, pp. 171-184. Napoleoni, L., 2007b. Terrorist financing beyond 9/11. The Economics of Peace and Security Journal, 2(1), pp. 41-44. Neumann, P., 2009. Old & New Terrorism. Cambridge: Polity Press. Neumann, P., 2016. Radicalised. New Jihadists and the Threat to the West. London: I.B.Tauris. Oftedal, E., 2015. The financing of jihadi terrorist cells in Europe, Kjeller : Norwegian Defence Research Establishment (FFI). Pallister, D., 2002. Terrorist material found in Sarajevo charity raid, London: The Guardian. Parker, M. & Taylor, M., 2010. Financial Intelligence: A Price Worth Paying?. Studies in Conflict and Terrorism, 33(11), pp. 949-959. Passas, N., 2007. Terrorism Financing Mechanisms and Policy Dilemmas. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspecite. Stanford, CA: Stanford University Press, pp. 21-38. Picarelli, J. T. & Shelley, L. I., 2007. Organized Crime and Terrorism. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspective. Stanford, CA: Stanford University Press, pp. 39-55. Piombo, J., 2007. Terrorism Financing and Government Response in East Africa. In: H. A. T. Jeanne K. Giraldo, ed. Terrorism Financing and State Responses. Stanford, CA: Stanford University Press, pp. 185-202. Raphaeli, N., 2003. Financing of terrorism: sources, methods and channels. Terrorism and Political Violence, 15(4), pp. 29-82.

100

Reinares, F. & García-Calvo, C., 2018. "Spaniards, You Are Going to Suffer:" The Inside Story of the August 2017 Attacks in Barcelona and Cambrils. CTC Sentinel, 11(1), pp. 1-11. Rekawek, K. et al., 2018. WHO ARE THE EUROPEAN JIHADIS? - Project Midterm Report, Bratislava: GLOBSEC. Riedel, B., 2011. The 9/11 Attacks’ Spiritual Father, Washington, D.C.: Brookings Institution. Rose-Greenland, F., 2016. How much money has ISIS made selling antiquities? More than enough to fund its attacks. , Washington D.C.: The Washington Post. Roth, J., Greenburg, D. & Wille , S., 2004. Monograph on Terrorist Financing, s.l.: National Commission on Terrorist Attacks Upon the United States. Rudner, M., 2017. "Electronic Jihad": The Internet as Al Qaeda's Catalyst for Global Terror. Studies in Conflict and Terrorism, 40(1), pp. 10-23. Sageman, M., 2004. Understanding Terror Networks. Philadelphia, PA: University of Pennsylvania Press. Sageman, M., 2017. Misunderstanding Terrorism. Philadelphia, PA: Univesity of Pennsylvania Press. Salami, I., 2017. Terrorism Financing with Virtual Currencies: Can Regulatory Technology Solutions Combat This?. Studies in Conflict and Terrorism, pp. 1-22. Shapiro, J. N., 2007. Terrorist Organizations' Vulnerabilities and Inefficiencies: A Rational Choice Perspective. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a comparative perspective. Stanford, CA: Stanford University Press, pp. 56-71. Schippa, C., 2017. This is how terrorists finance their attacks, Cologny: WEF. Simpson, C. & Philips, M., 2015. Why U.S. Efforts to Cut Off Islamic State's Funds Have Failed, New York, NY: Bloomberg Businessweek. Simpson, G. R., 2004. Terror Probe Follows the Money, New York, NY: The Wall Street Journal. Sims, A., 2016. Nice terror attack: Killer Mohamed Lahouaiej Bouhlel sent ‘£84,000 to family in Tunisia days before massacre’, London: The Independent. Solomon, E., 2015. The Isis economy: Meet the new boss , London: The Financial Times. Sorkin, A. R., 2018. How Banks Unwittingly Finance Mass Shootings , New York, NY: The New York Times. Soufan, A., 2011. The Black Banners: The Inside Story of 9/11 and the War Against al-Qaeda. New York City, NY: W. W. Norton & Company. Stahl, L., 2017. Should the U.S. government pay ransom money?, New York, NY: CBS News. Stern, J. & Berger, J. M., 2015. ISIS: The State of Terror. London: HarperCollins Publishers.

101

Tessier, B., 2016. Two UK arrests over funding for Paris attacks, Paris: Radio France Internationale. The Sidney Morning Herald, 2003. 'Al-Qaeda financed Bali' claims Hambali report, Sidney: The Sidney Morning Herald. The Straits Times, 2015. Paris attacks: France targets prepaid debit cards in fight against terror finance, Singapore: The Straits Times. Thorndike, J., 2014. How ISIS Is Using Taxes To Build A Terrorist State, Jersey City, NJ: Forbes. U.S. Department of the Treasury, 2002a. Treasury Designates Benevolence International Foundation and Related Entities as Financiers of Terrorism, s.l.: s.n. U.S. Department of the Treasury, 2002b. Treasury Department Statement on the Designation of Wa’el Hamza Julidan, s.l.: U.S. Department of the Treasury. UK Home Office, 2006. Report of the Official Account of the Bombings in London on 7th July 2005, London: The Stationery Office. United Nations, 2014. On 26 August 2014, the entry specified below was deleted from the Al- Qaida Sanctions List, s.l.: United Nations. Visser, S. & Orjoux, A., 2016. Who was Mohamed Lahouaiej Bouhlel?, Atlanta, GA: CNN. Vlierden, G. V., 2019. How Unsuspecting Mothers Funded the Islamic State’s Terror Machine, s.l.: European Eye on Radicalisation. Warner, J. & Weiss, C., 2017. A Legitimate Challenger? Assessing the Rivalry between al- Shabaab and the Islamic State in Somalia. CTC Sentinel, 10(10), pp. 27-32. Warrick, J., 2016. Satellite photos show Islamic State installing hundreds of makeshift oil refineries to offset losses from airstrikes , Washington DC: The Washington Post. Warrick, J., 2018. Retreating ISIS army smuggled a fortune in cash and gold out of Iraq and Syria , Washington, D.C.: The Washington Post. Weintraub, S., 2002. Disrupting the financing of terrorism. Washington Quarterly, 25(1), pp. 53-60. Weiss, M., 2015. Inside ISIS’s Torture Brigades, New York, NY: The Daily Beast. Williams, P., 2007. Warning Indicators and Terrorist Finances. In: J. K. Giraldo & H. A. Trinkunas, eds. Terrorism financing and state responses : a compartive perspective. Stanford, CA: Stanford University Press, pp. 72-92. Willsher, K., 2016. Nice attacker 'plotted for months and had accomplices' , London: The Guardian.

102

Windrem, R., 2015. Terror on a Shoestring: Paris Attacks Likely Cost $10,000 or Less, New York, NY: NBC News. Woertz, E., 2014. How Long Will ISIS Last Economically?, Barcelona: Barcelona Center for International Affairs. Wood, N., 2000. US fears terrorist attack in Kosovo, s.l.: BBC. Woods, E., Borys, C. & Komar, R., 2017. The Blackwater of Jihad, Washington, D.C.: Foreign Policy. Woodward, B., 2011. Death of Osama bin Laden: Phone call pointed U.S. to compound — and to ‘the pacer’ , Washington D.C.: The Washington Post. Wright, L., 2002. The Man Behind Bin Laden, New York, NY: The New Yorker. Wright, L., 2006. Looming Tower: Al-Qaeda and the Road to 9/11. Kindle edition ed. New York, NY: Alfred A. Knopf.

103