Paris Attacks: Updated Assessment

(Updated as of 3 December, 2015)

Intelligent Security Solutions Limited www.issrisk.com

Overview

The ability for ISIS to effectively deliver its agenda of terror and to affect an ever evolving threat on an incrreasingly global scale has been clearly demonstrated through the Paris attacks of November 2015. Intelligent Security Solutions (ISS Risk) has for some time focused on the threat presented by ISIS (and other Islamic extremist groups) to various sovereign and commercial concerns across Eurasia, with a specific focus on not only ISIS‟ motivations and actions to date, but more importantly a focus on how the threat is being shaped and how it will be driven and manifested in the coming 12-18 months.

As detailed in this report, and in several other engagements for a growing number of clients in Asia and Europe, ISS Risk has looked to present clients with the benefits of our threat trajectory assessments at local, provincial, sovereign and transnational levels. Indeed, owing to our proven ability to make the correct initial assessment through the effective extrapolation or interpolation of trends in ISIS activities, we are uniquely positioned to see what are the „new denominators‟ to their activities and therein recognise factors rightly as fixed not emergent or irrelevant. As shown with the Paris attacks the absence of coherent and rooted answers to core security questions, such as how did they perform such a complex attack? why and how was this achieved? will they strike again? how under- prepared are the security services in Europe? is this the beginning of an orchestrated campaign? etc… have been as near shocking as the events themselves.

For ISS Risk the critical deliverable is to ensure the specific needs of our client are serviced effectively and in full. Given the very high security walls around what is being found in the trans-national investigations so far, both our aforementioned existing knowledge of ISIS‟ modus operandi and most current driving forces to its actions, and our connections within the intelligence communities in Europe have proven seminal.

This report examines the answers to the critical questions of what is known about the attackers and the terrorist cell so far? How did the terrorists enter Europe, and move undetected? What do the combat indicators from the Paris attack reveal of ISIS‟ wider intentions towards high profile cities in Europe going into Christmas 2015 and in 2016? How will further escalation most probably manifest itself, and are attacks of such size likely again? Who will perpetrate these attacks, and how effectively can security services respond to contain threats from ISIS‟ existing operatives and cells already in Europe?

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Paris Attacks: Updated Assessment

The world was shocked by a series of bombings, suicide explosions and shootings which took place in Paris overnight on 13-14 November, killing 132 people and injuring more than 300 others. It was a meticulously planned and coordinated attack on 8 targets involving at least 9 attackers targeting the Bataclan Concert Hall during a rock concert, the Stade de France during an international soccer game and 5 different bars and restaurants in central Paris.

A total of 89 people were killed in the concert hall, one was killed near the stadium and the remaining victims were killed during attacks on the bars and restaurants. Six of the attackers died by exploding their suicide vests, the seventh shot by the security services, with the remaining two perpetrators remaining at large as at the time of the release of this report. The security forces were able to bring the situation in Paris under control at around 12.20 AM (local time) on 14 November. The terrorist group Islamic State in Iraq and Syria (ISIS) later claimed responsibility for the attack as retaliation against French airstrikes in Syria and Iraq, and for the French policies against Muslims worldwide.

On 18 November, French security forces launched a major security operation at an apartment in St-Denis, north of Paris city centre, targeting Abdelhamid Abaaoud, the suspected mastermind of the 13 November attacks. Three people were killed in the raid – including Abaaoud and his cousin Hasna Aiboulachen.

Second round of attacks were imminent

Immediately following the St-Denis raid, investigators revealed that the killed terrorists were in the final stage of preparing and carrying out „imminent‟ attacks at Charles de Gaulle airport and the Quatre Temps shopping centre in La Defense, west of Paris. A few days later, confidential statements from witnesses of the Paris attacks were leaked to the French media, which indicated that Abaaoud had approached his cousin Hasna asking her to hide him while he prepared for further attacks. Abaaoud had reportedly told Hasna that he had planned imminent attacks that would do far greater damages in Jewish majority districts of Paris, as well as against public transport systems and schools. Abaaoud also boasted how he slipped into Europe with Syrian refugees and remained undetected prior to the 13 November attacks.

Timeline of attacks

The attacks were carried out by three teams, with each team comprising of three members. We have colour coded the different teams in three colours – green, pink and red and plotted

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis their targets and timeline of attacks in the map below. As evident from the map, the green and pink teams initiated their attacks almost simultaneously, while the red team commenced their operation 29 minutes after the first incident was reported. The attacks were planned and coordinated to create multiple pockets of chaos within the target geography, so as to overwhelm the security forces and maximise civilian casualties.

From the perspective of the terrorists and as later demonstrated from the number of fatalities, the Bataclan Concert Hall was the prized catch – a location where they were expecting to find a large number of unarmed civilians cramped in a confined space with limited exit options. In other words, the maximum number of people could be killed in that concert hall target. It is our assessment that the green and pink attacks were diversions, aimed at providing sufficient time to the red team to attain vantage points inside the concert hall and to kill as many people as possible before the security forces arrived. In line with this logic, it is most likely that the three most competent operatives from the nine attackers were selected to carry out the attacks in Bataclan.

What is known about the attackers and the cell so far? The identities of the following attackers/conspirators have been identified so far:

1. Ibrahim Abdeslam – suicide bomber: Ibrahim Abdeslam was a suicide bomber who blew himself up outside the Comptoir Voltaire restaurant in Paris. He rented one of the principal operational vehicles of the terrorist cell, a Seat Leon car, which was found abandoned in a Paris suburb with Kalashnikov rifles inside. He was a Belgian national, a former resident of the Molenbeek district of Brussels, who had spent time in Syria.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Investigations have revealed he had possible links with the Verviers terrorist cell in Belgium, which was destroyed by police raids in January 2015. 2. Salah Abdeslam – on the run: An international arrest warrant has been issued for Salah Abdeslam - a Belgian national who rented a black VW Polo in Belgium which was found abandoned near the Bataclan concert hall. He is the brother of Ibrahim Abdeslam and is also suspected of having spent time in Syria. He was stopped near the Belgian border on 14 November morning in a grey VW golf also carrying two suspected accomplices, but was not arrested at that time. 3. Omar Ismail Mostefai – suicide bomber: Aged 29, was one of the three men who blew himself up in the Bataclan concert hall. He was a French national of Algerian origins and had trained with ISIS in Syria in 2014. 4. Bilal Hadfi – suicide bomber: Hadfi blew himself up outside gate H of the Stade de France. He was a French national, who lived in Belgian and is believed to have fought with ISIS in Syria. 5. Ahmad al Mohammad – suicide bomber: A Syrian passport holder, he died in the suicide attack near the Stade de France. 6. Sami Aminour – suicide bomber: A French national who blew himself up at the Bataclan concert hall. He was charged in a 2012 terrorism investigation by the French authorities and was placed under judicial supervision. Authorities lost track of him, and following the discovery that he had travelled to Syria, an international arrest warrant was issued against him. 7. Abdelhamid Abaaoud – attack mastermind: A Belgian national, he is believed to be the mastermind of the Paris attacks. He joined ISIS in Syria and was an active member in its propaganda division. Abaaoud was also involved in the planning of the Thalys train attack in France in August 2015. 8. Hasna Aiboulachen – female terrorist: A French national of Moroccan origins and the cousin of Abdelhamid Abaaoud. She died during the St-Denis police raid. 9. Four unidentified terrorist – three dead, one remains a fugitive: The identity of four terrorists remains uncertain. Two of them were killed during the Paris attacks and one was killed during the St-Denis police raid. The fourth one is believed to have participated in the Paris attacks and has since evaded arrest. Unconfirmed comments from an anonymous French senator suggest that two of these unidentified terrorists had fake Turkish passports. 10. Hamza Attou – suspected accomplice: A Belgian national aged 21, he was one of the two individuals who exfiltrated Salah Abdeslam from Paris following the attacks, driving him to Brussels. Police found ammonium nitrate – a fertiliser that can be used to make

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

bombs – and assault rifle ammunitions at his residence. He has been arrested on charges of terrorist murder and conspiracy. 11. Mohammed Amri – suspected accomplice: A Belgian national aged 27 who accompanied Hamza Attou in driving the escape vehicle from Paris post-attacks for Salah Abdeslam. He has since been arrested and police have reportedly found bomb making materials at his residence in Brussels. 12. Ali Oulkadi – suspected accomplice: A French national, aged 31 lived in Molenbeek. He drove Salah Abdeslam through Brussels a day after the Paris attacks. He has since been arrested on charges of terrorism. 13. Abraimi Lazez – suspected accomplice: A Belgian national of Moroccan origin, he also drove Salah Abdeslam in Brussels after the Paris attacks. He has been arrested by Belgian authorities with police recovering two handguns and forensics identifying traces of blood from his vehicle. Abraimi‟s brother is known to be currently in Syria. 14. Mohammed Abrini – suspected accomplice – remains a fugitive: He was seen with Salah Abdeslam on a highway to Paris two days before the Paris attacks. Abrini was driving a Renault Clio car which was later used by the attackers. He currently remains a fugitive at large, with a Belgian court having issued an international warrant for his arrest. 15. Jawad Bendaoud – suspected accomplice: A French national, identified as having rented his apartment in St-Denis to Abdelhamid Abaaoud, where the Police raid took place on 18 November. He is the first person from Paris who has been charged with helping the Paris attackers. Bendaoud is himself a convicted killer and notorious gangland leader, having served jail sentences, with 13 criminal convictions alone since 2010. 16. Mohammed K – bomb maker – remains a fugitive: Belgian police have issued a search warrant for an individual named Mohammed K, who is believed to be the bomb maker who prepared the suicide vests used in the Paris attacks. He is originally from the Caribbean, has lived in Roubaix in northern France and is currently believed to be in Belgium. 17. Unnamed man from Brussels – suspected accomplice: The Belgian authorities on 27 November arrested a man from Brussels on charges of involvement in the Paris attacks. No details have been made available yet about the identity of the suspect. 18. Unnamed man from Germany – suspected accomplice: The German authorities have arrested a man for selling assault rifles to the Paris attackers. No further details are available. 19. Additionally, a few other people have been arrested in Belgium, although there are no confirmed details about their identity or possible involvement in the Paris attacks.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Thus far, 10 terrorists have been killed, 4 suspects remain fugitives and another 9-10 have been arrested – bringing a total of 23-24 people identified by authorities as being involved in the Paris attacks. Of the 15 people identified so far, seven are French nationals, another seven are from Belgium, one from Germany and one supposedly a Syrian national (although conflicting reports are emerging that he might have used a stolen identity). All 15 people of these persons have been identified as being Muslims of Middle-Eastern or North African origins. Importantly here, at least seven of the identified individuals had been to Syria in the recent past. Additionally, a small number of people have been arrested in Turkey following them being identified as having exchanged messages with the Paris attackers. Thus, the total number of perpetrators involved in the attacks is likely to be above 25 – at least for the time being and has the potential to grow as the ongoing investigations reveal more people involved in the attacks. This specific is in contravention to the initial estimates given by the Belgian authorities that a cell of 20 people was involved in the Paris attacks. The growing number of suspects involved in the attacks in fact conforms with our initial assessment (dated 22 November, 2015) that a complex, well-coordinated and simultaneous attack of such a scale would realistically require much higher manpower to properly plan and execute. These points are discussed later in this report.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

How did the terrorists enter Europe?

As mentioned above, at least seven of the suspects involved in the Paris attacks were veterans from the war in Syria. It is our assessment that the three unidentified attackers also needed military training to execute the attacks in the way they did, something which they would have most probably undertaken in Syria. So, in total, at least 10 individuals travelled from Syria to France via Europe without detection.

As mentioned in a later section of this report, we believe that the group entered Europe in the very recent past, somewhere between late September and early October of this year. Although, very little information has thus far been made available on how these suspects entered Europe, we have been able to piece together the possible routes taken by five of these attackers.

1. Sami Aminour: French authorities believe he entered Europe via Greece. He was in the Fiche-S or S-Card watch-list of the French authorities and is most likely to have not used his French passport to gain entry into the Schengen Zone. The only other option is thus to gain entry as a refugee, as demonstrated by Aminour entering Europe via Greece. 2. Salah Abdeslam: He entered Europe via Greece using his own Belgian passport. He was spotted at the Austrian border on 9 September, where he mentioned he was on a one-week vacation in Austria. 3. Bilal Hadfi: An international arrest warrant was issued against him by the Belgian authorities early in the year and he is believed to have entered Europe disguised as a migrant. 4. Ahmad al Mohammad: Holding a Syrian passport (although he might have been using a stolen identity) al Mohammad was rescued by authorities after the boat he was travelling from Syria wrecked off the coast of Greece. Ferry tickets revealed that he travelled to Europe with another individual named Mohammad al Mohammed and he used his passport to buy tickets from the island of Leros to the Greek mainland. He then joined a convoy of refugees and claimed asylum in Serbia, before travelling to Paris. 5. Abdelhamid Abaaoud: The mastermind of the Paris attacks also reportedly entered Europe via Greece, posing as a Syrian refugee. This seems quite plausible as Abaaoud was already a most-wanted man in Europe given his already documented involvement and position within ISIS in Syria. As mentioned later in this report, Abaaoud even faked his own death to facilitate his entry into Europe as a refugee.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

How did the weapons reach France?

Automatic assault rifles such as Kalashnikovs were used by the perpetrators during the Paris attacks. Given the fact that acquiring weapons in France is an extremely regulated process, where an individual is required to undergo psychological examinations and identity verification before he/she can obtain a license for the weapon, it becomes important to understand how the Paris attackers were able to source these military grade weapons.

German police have recently arrested a man from Magstadt (Baden-Wurttemberg state) for running an illegal arms business and selling guns over the so-called „dark web‟ section of the internet, where he had his own trading platform named „DW Guns‟. Dark web is a part of the internet that is not indexed by search engines, therein will not be found through any Google search and is accessible only with specialised software installed by users. Investigations revealed that this suspect, identified as Sascha W, had sold two Chinese made Kalashnikovs and two Serbian Zasatava assault rifles to an „Arab in Paris‟ on 7 November. Reports indicate that a few M70 assault rifles made by Zastava were indeed used by the Paris attackers and Milojko Brzakovic, director of the Zastava Arms factory, has confirmed that the serial numbers of those weapons indicated were indeed manufactured in Serbia (Yugoslavia) in the late 1980s. Additionally, security raids in Brussels have also recovered a large collection of firearms from the residence of one suspect.

It is our assessment that the German dark web arms dealer was only one of the several sources used by the Paris attackers to procure their weapons. It is most likely that they would have bought weapons in small consignments, from multiple sources, so as not to raise any unwanted suspicion. Some of the weapons were also reportedly procured from the Brussels underworld.

French investigators are also looking at the possible importation of deactivated assault rifles from Slovakia. A deactivated weapon is a firearm which was originally produced as a fully operational weapon, but has been subsequently deactivated mechanically so that it can no longer discharge any ammunition. The deactivation process is intended to be permanent and irreversible. However, according to experts, due to specific deactivation techniques used in Slovakia, reversing the process is considered to be very easy for a person with the right skills. Additionally, the Slovakian neutralisation process fails to affect the firing rate of the weapon. Consequently, any illegal conversion will reconvert any deactivated Slovakian weapon to its fully operational state and capabilities. Additionally, it is very easy to purchase deactivated weapons in Slovakia, even the heaviest machine guns – any person with a valid

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

ID can purchase them. Perpetrators of the Charlie Hebdo attacks in January 2015 had also legally purchased deactivated weapons from a Slovakian shop.

Additionally, it has now emerged that in October 2014 Salah Abdeslam had bought approximately a dozen electric detonators from a pyrotechnic wholesaler north of Paris. During the purchase, Salah was reportedly curious about the reliability of the devices. In the likely scenario that the same detonators were used for the suicide vests in the Paris attacks, it leaves open the possibility that the plan for executing a Paris like attack was made more than a year ago. Unless Salah bought those detonators to carry out a lone-wolf attack - which seems highly unlikely as he did not participate in any combat role during the Paris attacks - he had purchased those detonators under instructions from ISIS high command. This in turn would logically infer that ISIS leadership had committed command decisions and assets to carrying out attacks outside Syria and Iraq at least before October 2014.

It is our assessment that ISIS leadership took this command decision to perform attacks „abroad‟ in the wake of Western airstrikes, including those made by the French Air Force, against ISIS targets in Iraq and Syria beginning in August 2014. ISIS‟ decision, simply put, reflects the fact that they wanted to develop the capabilities to strike any country which was waging war against them.

Molenbeek Cell

We shall identify the terrorist cell as the „Molenbeek Cell‟ as the mastermind of the cell, Abdelhamid Abaaoud, was based in and planned the Paris attacks from the Molenbeek district in Brussels. Moreover, several of the terrorists were also based in Molenbeek from where they travelled to Paris to carry out the attacks. While Belgian intelligence officials have claimed that 20 people were involved in the cell, as per our initial assessment we firmly believe that attacks of such complexity in nature required greater manpower than 20. As the investigations progress a number of points continue to support ISS Risk‟s initial assessments and continued position.

Firstly, the Molenbeek Cell had planned to carry out two sets of attacks – the first one undertaken on 13 November, the second thwarted through the St-Denis police raid. As mentioned earlier, a total of 8 locations were targeted in the first phase of the attacks with a further 2-3 reportedly planned for in the second phase – bringing the total to roughly 10 planned targets. While some of these targets were modest sized restaurants and bars, the remaining 5 were very large targets – a large shopping mall, a famous concert hall, the largest soccer stadium in France and the nation‟s most important airport.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Terrorist cells planning to carry out simultaneous coordinated attacks in major urban centres need different teams of people to carry out a successful attack, with specific respective duties – target location scout, surveillance, logistics, bomb-maker and the actual attackers. Historically, these different responsibilities have been carried out by different members of the cell, with the attackers usually not involved in any of the other activities and the bomb- makers (considered too valuable to lose) usually not taking part in the actual attacks. To illustrate this very point, in the 2008 Mumbai attacks, while 10 terrorists were involved in the actual attacks, another 20 individuals were involved in support activities involved with the execution of the attacks.

Returning back to the Molenbeek Cell, thus far, 9 attackers have been killed (including the mastermind Abaaoud), and 2 remain as fugitives. Out of these, 9 were involved in the first phase of the attacks and the remaining 2 were likely to be involved in / perform the second phase, which involved attacking Charles de Gaulle airport, the Quatre Temps shopping mall in Paris as well as a few other unidentified targets.

It is our assessment that there was no chance that only two people would have been involved in this imminent second phase of attacks, as described by the French authorities. If the cell was willing to dedicate 9-10 assets for the first phase, it would have required at least another 10-15 actual attackers‟ for the second phase, particularly when one of the planned targets was one of the busiest and most secure airports in the world. For example, the 2014 Karachi International Airport attack involved a group of 10 highly trained and armed attackers.

As per our initial assessment (dated 22 November 2015) where we estimated that potentially 20-25 actual attackers would have been involved in the terrorist cell given the scale of the planned and executed attacks, this should bring the total number of support personnel to anywhere between 40 and 50. Therefore in all likelihood, the Molenbeek Cell would have had an actual strength of anywhere between 60 to 75 personnel. Investigations thus far have been able to identify around 30 people from different European nations as being involved with the cell. Given that the investigation is still in its early stage, we believe that an additional number of accomplices are likely to be identified and / or arrested in the coming days. Therefore, we continue to hold to our original assessment that between 60 to 75 people were involved with the Molenbeek Cell. What is most worrying is that approximately 10 to 15 of those potentially unaccounted for individuals are extremely motivated, most probably trained in Syria, have direct contact with ISIS leadership in Syria and hence remain extremely dangerous.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Major escalation of ISIS modus operandi

Since the Paris attacks, several international media outlets are reporting on the emergence of ISIS‟ external operations unit. Even the CIA‟s Director stated on 16 November that ISIS had developed an external operations agenda, plotting attacks far outside its havens in Iraq and Syria. However, such units do not become operational overnight; rather they require significant gestation periods to setup overseas units, mobilise assets, plan and execute attacks. In fact, as early as January 2015, reports had emerged that ISIS had formed the „Anwar al-Awlaki Batallion‟ (AAB), a unit composed solely of English speaking foreign fighters whose purpose was to plan and execute attacks in western nations. At the same time, ISIS also formed a unit named „Katibah Nusantara Lid Daulah Islamiyah‟ (KNLDI), which consists of Southeast Asian foreign fighters with the intention of spreading terror in Southeast Asia. So, it is clearly evident that ISIS had been planning to expand its activities outside MENA for well over a year now. In the context of the Paris attacks, as described below, AAB becomes a very important unit.

On 27 September 2015, French jets carried out air strikes on an ISIS training camp in Syria, which the French President Francois Hollande described as a “threat to our country”. While no information was provided as to how that camp was a national security threat to France, further investigation into the air strikes have revealed that the camp was most probably one of several locations where foreign fighters recruited by the AAB were being trained for future operations inside the European Union - in particular France and the UK. Consequently, in light of such specific targeting, although the situation in Paris is being labelled as a failing on the part of the intelligence services, this may only apply to the domestic intelligence agencies and raises significant concerns about coordination and intelligence sharing protocols. That is something that can be addressed, but time is off the essence.

According to Kurdish intelligence officials, ISIS had sent 20 specially trained foreign fighters of the AAB to Europe in September 2015 mixed with the refugees. This particular batch consisted of jihadis of Tunisian and Moroccan origins and was reported to have received special training in IED and terrorist tactics, techniques and procedures (TTP) implementation. These personnel were advised to return to their countries of origin and establish attack cells.

What makes this group very important is that Abdelhamid Abaaoud was the leader of that group. Abaaoud faked his own death in late September 2015, most probably to ease his re-entry into Europe via Greece. As mentioned in the earlier section of this report, we had identified at least ten Syrian war veterans as being involved in the Paris attacks. We also

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis identified that at least five of them had entered Europe via Greece. Immediately after the Paris attacks, French intelligence agencies were able to identify Abaaoud as having played a pivotal role in coordinating the movement of the attackers and by linking them with the local cell in Europe. It is worthwhile noting that throughout this time he was still presumed to be dead for over a month following an airstrike in Syria. Survivors of the Paris attacks later claimed that the attackers were all of Middle-Eastern appearance yet spoke perfect French without accent, fitting perfectly with AAB‟s stated objective of sending native language speakers to Europe as well as the Moroccan and Tunisian origins of the group of 20 people we discussed earlier.

While, 10 people from this group of 20 specially trained AAB fighters were found to be directly involved with the Paris attacks, it is our assessment that the other 10 remain in Western Europe, most probably in Belgium or France – or were at least until 18 November (the day of the St-Denis raid). We believe these individuals were scheduled to attack Charles de Gaulle Airport and the Quatre Temps shopping centre in Paris in the second phase of the attacks planned by Abdelhamid Abaaoud and which were only prevented by the St-Denis raid. Additionally, this unaccounted for group of 10 Syria veterans fits in with our initial assessment that additional manpower was required to execute the second stage of the attacks.

Many media reports are claiming that Abaaoud was close to ISIS‟ leader Abu Bakr al- Baghdadi. However, there is no verifiable information in that regard. What we know for certain is that Abdelhamid Abaaoud was the right-hand man of ISIS‟ spokesman and external operations unit chief Abu Muhammad al-Adnani. Abaaoud was actively involved in training foreign fighters in camps inside Syria and also was a „star-campaigner‟ in recruiting fighters from Europe. He was featured in the ISIS propaganda magazine Dabiq on a regular basis and had travelled to several European countries during the last year.

Abaooud has been identified as trying to execute attacks in France since at least the beginning of 2015, and has held links to the perpetrators of the Charlie Hebdo attacks. A jihadist arrested in August 2015 in France confessed that he was also trained and motivated by Abaaoud to carry out attacks in French soil. Additionally, Abaaoud also had links with the perpetrator of the failed Thalys train attack in August 2015.

Chronology of Jihadi attacks that took place in France during in the last year:

1. December 2014: Knife attack against Police Officers; Tours. Lone wolf attack carried out by self-radicalised individual.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

2. December 2014: Vehicular attack, 11 pedestrians attacked; Dijon. Lone wolf attack carried out by self-radicalised individual. 3. December 2014: Vehicular attack, 10 pedestrians attacked; Nantes. Lone wolf attack carried out by self-radicalised individual. 4. January 2015: Charlie Hebdo attack and multiple shootings; Ile-de-France region. Cell based attack with foreign training. 5. April 2015: Unsuccessful attack against 2 churches in Villejuif; Ile-de-France region. Lone-wolf attack carried out by individual motivated by ISIS handler Abaaoud. 6. June 2015: Killing (decapitation) and attempted explosion by perpetrator; Lyon. Lone-wolf attack, perpetrator had links with ISIS. 7. August 2015: Attempted mass-shooting on an Amsterdam-Paris train; Paris. Lone-wolf attack carried out by individual trained in Syria and was handled by Abaaoud. 8. November 2015: Series of suicide bombings and multiple shootings; Paris. Cell-based well-coordinated multiple attacks carried out by personnel trained in Syria by ISIS.

In reviewing the nature of these attacks there are clear indications that ISIS has slowly shifted from a strategy of supporting lone-wolf attacks by self-radicalised individuals, to lone- wolf attacks directly motivated and trained by ISIS to (finally) well-coordinated cell-based attacks across multiple targets. This is a clear evolution and indeed major escalation of the ISIS‟ modus operandi, clearly indicating that ISIS now has the capability to execute attacks in western nations while authorising the same from Syria.

We believe that we will continue to see „lone wolves‟ being inspired to carry out attacks, but now the paradigm has shifted to where we are going to begin seeing more from veteran terrorists who have returned from Syria and who are charged with (re-)forming cells made up of fellow combat veterans they fought with in Syria. The transition from lone-wolf to cell- based attacks is a major achievement for ISIS and demonstrates their abilities way beyond their strongholds in Iraq, Libya and Syria. In fact, in parallel with the significant attacks in Paris, the twin suicide bombing in Beirut on 12 November were a further example of how ISIS‟ capabilities in executing major attacks outside its strongholds have developed.

The relevance of the combat indicators from Paris and the unfolding situation in Molenbeek and Belgium

Molenbeek district in Brussels has attained much notoriety after several perpetrators of the Paris attacks were found to have lived in this district, with the international media describing it as the „jihadi capital of Europe‟. Two days after the Paris attacks, Belgian Interior Minister Jan Jambon said that the situation in Molenbeek was not under control and the authorities

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis would have to step up efforts there as the next task. But this was not the first time that Molenbeek has been linked with jihadis. From the pre-9/11 assassination of anti-Taliban commander Ahmed Shah Massoud, to the Madrid train bombings in 2004, to the killings in the Brussels Jewish museum in 2014 and the foiled shooting attempt in a Paris bound high- speed train in August 2015, the investigations for each of these incidents have commonly led to Molenbeek.

Finding the reasons for this are fairly academic at this moment; simply put forward, the district has proven a very fertile ground for the recruitment of Islamic extremists. According to Flemish researcher and expert on Belgian jihadism, Pieter Van Ostaeyen, in October 2015 there were approximately 190 Belgian fighters in Syria, mainly with ISIS, with a further 120 Belgian fighters having returned back to Belgium from the war. Statistically speaking, Belgium, with a Muslim population of circa 640,000, suffers roughly 1 jihadi being involved in Syria or Iraq for every 1,260 of its Muslim nationals. On a per capita basis, this makes Belgium the top European nation in terms of contributing foreign fighters to the Syrian war. According to Van Ostaeyen, of the 190 Belgians in Syria, 101 were from Brussels and Molenbeek would have supplied a significant number of them.

A significant weapons cache was discovered in Molenbeek in the wake of the security operation there on 18 November. Brussels was under security lockdown for four days because of a „serious and imminent threat‟, during which schools and public transport systems were shut down. Several police raids were conducted in Brussels and southern Belgium, while a manhunt was undertaken to apprehend Salah Abdeslam and other accomplices of the Paris attacks. At least 16 suspects were arrested during the raids, although many of those arrested were released later. Brussels still remains at the second highest possible security alert level.

The threat of further cells is clearly spurring these developments - and rightly so. If assessments and intelligence are close to being accurate regarding the training of external resources in Syria and subsequent deployment to Europe, then essentially only one cell has been potentially neutralised. That leaves a potentially large and significant pool of commanders and / or coordinators having been deployed to predetermined and selected targets who can initiate attacks at will in their designated region of operations. They hold the strategic advantage at the moment and will seek to maintain the momentum. The increasing sophistication of these domestic attacks is a genuine concern - as we discussed above the strategy is evolving from singular lone wolf domestic attacks to well-coordinated attacks.

The potential number of attacks is the discerning aspect of this; we live in extremely target rich environments, the security services cannot be everywhere at all times. The likelihood of

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis a diverging strategy of launching attacks on principal targets and cities then switching to smaller cities or towns, transportation hubs and back again to major targets will become the reality unfortunately. We will move from this type of cellular structure in diagram A below to diagram to B over time. It is in fact already in play.

Diagram A – Diametric example of localised Cell structure

Diagram B – Diametric example of transnational Cell structure

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

The strategy behind the ISIS escalation

The escalation in the ISIS strategy essentially became apparent to the world with the downing of the Russian passenger plane over the Sinai desert, followed by the Beirut twin suicide bombings in 2015. Then came the assault on Paris, and with the shock of Paris still raw, came the Mali hotel attack – albeit claimed by an al-Qaeda off shoot (this attack differs from the ISIS campaign in terms of motivations, along the lines of a „Jihadists Who‟s got talent‟ play off), this attack requires analysis within the context of the broader Jihadist campaign now savaging many regions. But, aside from the shock and awe of the scale of the Paris attacks should we be surprised by these developments? The foresight and strategic planning for this escalation did not merely happen in the past few months, or in the midst of the refugee crisis. This has been a long thought out strategic escalation, and what we are now seeing is just the beginning. The downing of the Russian plane was patently a message to Russia, and a veritable poking of the hornets‟ nest for a predictable response. Similarly Beirut was about escalating the internecine Shia and Sunni conflict and showing capabilities. Paris was an unambiguous message to the world from ISIS that „we‟re going global‟.

It is important to realise that every decision taken by ISIS is part of a larger strategy to ensure the survival and expansion of their Caliphate. So if western political leaders claim that the attacks were carried out because ISIS did not like the freedoms of the west or the western way of life, then they are nothing but politically correct statements that fail to give due importance to the realities behind these attacks.

The survival of ISIS as an organisation depends on the continuous support of its followers across the world, and the flow of foreign fighters such support generates. To maintain that, it needs to at least appear to be winning or gaining grounds in the battlefield. An ability to strike in the centre of western „infidel‟ heartlands immediately raises the popularity of the group in the eyes of its global followers and also makes it appear to be gaining momentum. However, there is also a secondary and more sinister objective behind attacking these locations.

Groups like ISIS survive by claiming that Islam is under attack and also by spreading hatred between Muslims and non-Muslims. The ideology of global jihad is nothing but the belief in the existence of a perpetual conflict between Muslims and non-Muslims, between two mutually exclusive universes of cognition – a clash of civilisations so to speak. To propagate that ideology, it becomes important that there be real or imaginary acts of atrocities

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis committed against Muslims by non-Muslims from time to time. It is the hatred that such incidents generate which ISIS or its likes use as their biggest recruiting tool.

The latest reports indicate there has been a spike in Islamophobic incidents in France since the Paris attacks, with mosques being vandalised and Muslims getting publicly humiliated for their faith. A similar spike in hate crimes were evident following the Charlie Hebdo attacks in January, with the first six months of 2015 witnessing a 284% increase in such incidents as compared to the previous year.

Additionally, the attacks have and are also having an impact on the political discourse in Europe and have emboldened the right-wing political parties to condemn Islam and vilify the refugees entering Europe. From the UK Independence Party (UKIP) and Britain First, to France‟s National Front and Germany‟s Pegida, right-wing groups across Europe have used the Paris terror attacks to aid their anti-Islam, anti-immigration agendas. In doing so, several groups have characterised recent events as an ongoing conflict between the West and Islam.

France has declared a state of emergency for three months, which has already allowed for more than 1,000 warrantless police searches, 165 warrantless arrests, and placement under house arrest of more than 250 people. There are also calls of expelling radical imams from the country, closing mosques suspected of preaching religious hatred and stripping French citizenship to individuals engaged in anti-French activities. There have been serious calls for the internment of the thousands of people listed by the intelligence services as possible national security threats; French Prime Minister Manuel Valls has declared himself open to the possibility. In Belgium, the authorities have announced security crackdown, with an addition € 400 million to be spent on security, the conducting of night searches as well as the banning, conviction or expulsion of „hate preachers‟.

This is precisely what ISIS wants to see happen. Such draconian responses from France in particular and Europe in general will beget a fresh cohort of alienated, angry European terrorists; at best, they will be propaganda fodder for ISIS's recruiters, who will present them as further evidence of Europe‟s hypocrisy, its willingness to apply its fundamental values variably, and its alleged oppression of Muslims. ISIS wants to provoke the West into what they will call a crusade, so that they could count on growing support from marginalised Muslims both in MENA and in European countries such as Britain and France and draw on growing support bases further afield into Central Asia and Southeast Asia. Thus far the right wing and reactionary politicians are giving them exactly what they desire.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Future plans of ISIS for Europe and further afield

Although ISIS will continue to export trained terrorists to Europe and mixing them with refugees it is now a largely academic consideration, the horse has well and truly bolted on this element of their planning. ISIS has been far ahead of the western security services on this one. The network of commanders and trainers has long since been established, shutting the borders although necessary to stem further infiltrations is reactionary and will only mitigate enhancement of the threat in a limited fashion.

The western world is facing the very real and present danger of a downward spiral into asymmetrical warfare from within. The question is where else has ISIS set their sights? What other countries and regions have ISIS already been dispatching commanders and trainers to? The world watched the Arab Spring unfold during the beginning of this decade; we are now bearing witness to the birth of a globalised ISIS, the consequences of which will be with us for a long time to come as the organisation‟s tentacles emerge in unexpected locations in the coming months and years.

Further to this point, there are reports that IS has also invested heavily in Libya to establish an official affiliate, which would serve as a launching pad for conducting facilitation operations in support of other ISIS aligned entities throughout Sudan, Tunisia, Algeria, Nigeria and Egypt. The Libyan ISIS Emir Abu Nabil is a senior member of the ISIS external operations division and was dispatched to Libya to establish and lead the affiliate in-country. One of his other principal assignments was to open up a second pathway from which attacks against Europe could be conducted. Still, ISIS won't be abandoning the use of lone-wolves. Instead, they'll likely opt to use a combination of lone-wolves and attack cells to „reach out and touch‟ the West.

In the meantime, ISIS propaganda department will flood social media and law-enforcement hotlines with false tips and threats to overwhelm western security forces and stretch their resources. On 18 November, a soccer match between Germany and Netherlands was cancelled due to a bomb threat. This came in the form of an ambulance that had what appeared to be explosive material placed on-board. The German government would later deny that the vehicle contained any explosive materials however, the ambulance did in fact contain an explosive material albeit not wired to detonate. In other words, it was a very effective hoax. We suspect actual explosives were used to trigger a response from bomb- sniffing dogs. Other hoax incidents have seen a small number of flights diverted due to threats being called in.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

But Europe is not the only place where ISIS wishes to spread its tentacles; its objectives are much more ambitious and ISIS wants nothing short of global domination. While in Europe, ISIS‟ primary objective at the moment seems to be carrying out mass-casualty attacks; for other Muslim majority parts of the world like South Asia and Southeast Asia, ISIS has long been trying to setup local chapters of its caliphate by using its cadres from these respective regions.

As mentioned earlier, the external operations unit of ISIS had formed the Anwar al-Awlaki Batallion (AAB) in January 2015 for carrying out operations in Europe. At the same time, it formed another sister unit of AAB, named „Katibah Nusantara Lid Daulah Islamiyah‟ (KNLDI) or the „Malay Archipelago Unit of the Islamic State‟, consisting solely of Southeast Asian foreign fighters in ISIS. The purpose behind KNLDI was to setup an organisational structure for the mobilisation of Southeast Asian jihadis for the religious and military cause of ISIS – one that would eventually establish a chapter of ISIS‟ caliphate in the region. KNLDI also serves as a direct link between ISIS and several local or regional jihadist organisations in the region who have either pledged allegiance or support ISIS. As recently as 26 November, Indonesian security forces had a four-hour long gun battle with ISIS affiliate Ansar Khalifah Philippines in Sultan Kudarat province of Philippines, during which 8 jihadists were killed. Earlier on 19 November, an internal classified memo of the Malaysian Police forces was leaked to the media which detailed 18 Syria trained ISIS suicide bombers as having entered Malaysia, with 10 being present in Kuala Lumpur itself. The memo also mentioned that the suicide bombers were awaiting instructions from their leaders to launch attacks.

In the case of Pakistan, there are confirmed reports that ISIS has established several training camps in its Baluchistan province and has allied with several local and sectarian terrorist organisations to establish its operational presence in the region. ISIS has also declared jihad against the Afghan Taliban and has already carried out several attacks against Taliban strongholds inside Afghanistan.

Even for a nation like Bangladesh, which despite being a Muslim majority nation had so far largely stayed away from global jihadist activities; ISIS seems to be making significant progress. It began in September 2015, when US officials informed Bangladeshi authorities that ISIS linked jihadists were planning to ramp up activities inside the nation. In the days that followed, a series of unusual attacks seemed to substantiate the warning. An Italian and a Japanese national were shot dead within days, followed by a bombing inside a Shia mosque and recently, on 26 November, gunmen opening fire inside another Shia mosque. While all these incidents were unprecedented in Bangladesh; ISIS claimed responsibilities for each of these attacks.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

Was there an intelligence failure?

The European intelligence agencies had received several warnings prior to 13 November that an attack on France was imminent. French authorities were aware in August 2015 that a French jihadist who went to Syria was asked by ISIS to carry out an attack on a concert venue in France. Similarly German authorities had detained an Algerian man from a refugee centre in Arnsberg who was telling other Syrian refugees that an attack was imminent in the French capital.

Most importantly, at least five of the individuals involved with the Paris attacks were known to the French or Belgian authorities as potential/actual jihadist elements, with a few having international arrest warrants against them.

In January 2015, Ibrahim Abdeslam was detained by Turkish authorities and deported back to Belgium. Turkish authorities at that time mentioned that Ibrahim had been radicalised and was waiting to join ISIS in Syria. But Belgian authorities later set him free. The same Ibrahim later blew himself up at the Comptoir Voltaire bar in Paris on 13 November.

Ismail Omar Mostefai had been in the French S-list since 2010. Turkish police considered him an ISIS member and had reportedly warned Paris about Mostefai twice – once in December 2014 and later again in June 2015. There was no response from the French authorities while Mostefai freely travelled between Europe and Syria. He later blew himself up at the Bataclan concert hall.

Bilal Hadfi had been under surveillance from the Belgian authorities for possible links to jihadi activities and yet he was able to evade them and participate in the Paris attacks.

The French authorities had launched an investigation on Sami Aminour in 2012 for terrorism related activities and at that time he was suspected of planning to join militants in Yemen. He missed four weekly police checks in 2013 and the authorities later lost track of him. An international arrest warrant was issued against him and yet he managed to sneak into France.

Last but not the least, the ringleader Abdelhamid Abaaoud was a high-profile ISIS recruiter for Europe and was known to have links with several executed and foiled terrorist attacks in France during the last one year. In July 2015, Abaaoud was sentenced in absentia to 20 years in prison for recruiting ISIS fighters to Syria. He was a most-wanted man, with several European security agencies aware of his activities. And yet, he successfully organised the Paris attacks by being personally present in the city.

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis

The patent failure of domestic French intelligence services combined with the lack of intelligence coordination with neighbouring European countries is a significant concern. The fact that several known or suspected radical jihadists were able to conduct such an ambitious attack under the agencies noses without detection does not auger well for the security situation in the short term, as in the next 3-6 months, or perhaps longer.

Source comments from European intelligence agencies

Our sources within the European intelligence community have indicated that there is no point in blindly blaming the French or Belgian intelligence services, as there just has not been enough time to maximise intelligence sharing across countries where the refugees have been walking through. Common feedback is that a Paris like incident was being anticipated for some time. Both Italian and Greek authorities had already warned Europol and other European security services that they could not provide any early warnings. Additionally, the G20 meeting in Turkey was an important event which ISIS was well aware of and was likely to capitulate on.

The main focus of the intelligence agencies now is how Abaaoud made his journey to Paris without getting caught and coordinated the link up with the Molenbeek Cell. There were also some unconfirmed reports about similar cells in Marseille and Rotterdam cells being investigated.

The sources believe ISIS-Europe is taking their time in selecting targets and when that is done, they will import personnel from Syria with the right training, who would also carry orders from ISIS leadership to the locally converted recruits. One critique levelled against the French intelligence was why they were not pushing their informants in the jihadist landing pads of the Parisian suburbs earlier this year after Charlie Hebdo attacks?

It seems, in reality, these cells are well organised and insulated, and have impeccable motivation. Something similar to family based units which were frequently found in Iraq.

Our sources also mentioned that French and Spanish intelligence agencies, which had Algerian or Moroccan problems for years, have planted a few of their informants in the camps and on the „Europe-bound refugee highways‟. They are relying on embedding these assets now to see when the next active cell will arrive. The expectation is that these agents will spot Algerians, Tunisians, or Moroccans who do not fit the Syrian refugee profile, and once identified, follow them and see what their operational objectives and structures are. British intelligence is convinced that the 'flight of the Syria veterans' is already upon Europe

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis and that the refugee crisis is the perfect vehicle for them to penetrate past European border protocols.

Our sources firmly believe that ISIS is not done with European capitals yet and they are likely to hit France again simply to demonstrate they can act with impunity. Christmas and New Year‟s Eve are likely to be the two dates to watch for.

Another source from the intelligence community within Europe mentioned that the Paris attack in particular was a wakeup call and that it is actually the beginning of a campaign, and France with such a large Middle Eastern and North African population is an easy target. The potential attackers have the option of striking at will and lying low afterwards within the local population. The same source also reported that Belgium is rushing through new laws on refugees and immigration, which in the source‟s opinion indicate that the Belgian authorities are feeling especially vulnerable.

Are the attacks over?

We have identified the following key factors behind the successful execution of the Paris attacks:

1. ISIS senior leadership felt carrying out attack in Europe was in their strategic interest 2. ISIS had access to large number of European Muslims, who had travelled to Syria and who were sent back to their respective nations to organise the attacks 3. The refugee crisis in Europe helped the perpetrators to infiltrate into the continent without being caught, while some perpetrators had used their European passports to legitimately enter the continent 4. The perpetrators had the technical skills and contacts to clandestinely procure weapons from inside Europe 5. Under-funded European intelligence and law enforcement agencies are overwhelmed by the scale of threat and simply lack the resources to properly monitor all potential suspects 6. There exists large number of fanatics who are willing to give up their lives for their beliefs

None of the six points as mentioned above has changed since the attacks of 13 November. To the contrary the circumstances and conditions have worsened in the past few weeks. The realistic prospect of further sleeper coordinators and support networks in existence across Europe should give rise to significant concerns. However, although the numbers of

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis potentially trained and motivated jihadist planners and coordinators is nearly impossible to quantify the risks must be addressed as soon as possible.

This particular problem could stretch well beyond Europe. There is a very real prospect that these coordinators are now in place in other regions as well. With the French declaration of war against ISIS in the wake of this incident, the British now launching air strikes, Germany offering support for the efforts in the form of 1,500 support element troops presents the case for a rapid expansion of ISIS tactics across Europe. Russia has a broad set of considerations to be cognizant of, ranging from strategic interests in the Middle East to Central Asia and societal and commercial interests across South East Asia.

The target pool for ISIS has suddenly exponentially grown in the past 6 weeks alone. Therefore, the risks of ISIS carrying out further attacks in Europe are a very real prospect – at least in the near term. The risks of ISIS popping up in random places, or ISIS ideologically inspired lone wolves continue to rise alongside the more structured attack scenario. San Bernardino in California is sadly the latest possible example of „radicalisation inspired incidents‟.

Conclusion

As our analysis said some time ago the morphing of ISIS to a global network will continue to be demonstrated through their ability to launch seemingly unpredictable attacks in vulnerable European and other capital cities and divergence to lessor targets and back again to primary targets. The evidence of this is now emerging in the form of both coordinated attacks and „lone wolf‟ or „self-radicalised‟ attacks in different locations, continents apart in cases. It is a stark reminder to the security services in many differing countries that they (ISIS) have the strategic and tactical advantage and momentum. The continuous scaling up of police and security services presence is unsustainable at the levels required as deterrents to ISIS or radically inspired lone actors. They simply cannot be everywhere all of the time. This is part of ISIS strategy, bring the war to Syria and Iraq and we bring it to your bustling cities and sleepy towns and hamlets.

Intelligent Security Solutions Risk has been for some time indicating a geographically enhanced capability of ISIS across different regions as being a growing risk. The evidence to support this position is sadly mounting by the week. The threat trajectory is on a seemingly steep upward spiral, and whether they act or not, the mere threat of acting is sufficient to raise security concerns, deployments, reactions, heightened alert levels which can be in place for lengthy periods, sapping the capabilities and reach of security services in the process. Such sustained heightened levels of awareness and alerts also eventually over

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis time reduce the general public‟s sense of awareness. Ultimately this produces the situation whereby complacency eventually replaces alertness, thus the cycle of over stretching and sustainability of general awareness is eroded and vulnerability then returns.

The situation unfolding in Thailand in the past few days is both indicative of this strategy and also troublesome in terms of the misinterpretation of the risks. Claims of up to 10 ISIS operatives of Syrian extraction having entered Thailand with a view to striking Russian associated targets are now being touted by multiple news agencies. Sources have indicated that the original threat warning from the Russian Intelligence agencies indicated ‟perhaps 10 individuals from Syria have been dispatched to Thailand in October‟, it did not state they were all of Syrian extraction. This perhaps explains the Thai police response that they „have not been able to confirm the presence of these Syrians and called for calm‟. The specifics of the dispersal of the suspects, four to Pattaya, two to Phuket, two to Bangkok and two to an unknown location requires cautious examination. If such precise numbers and exact locations are known or suspected then why not exact nationalities? Are the Thai authorities out across the country looking for 10 unidentified „Syrians‟ or should they be throwing a drag net across the localities looking for 10 unspecified nationalities arriving between the 15th to the 30th of October? If such closed dates are proffered from where did the suspects hail? Where was their port of arrival in Thailand? The process of elimination on such specific intelligence, a narrow corridor of dates of arrival, and locations in Thailand believed or otherwise to where the targets went, the port of departure and port of arrival would narrow down search and identification parameters significantly. None of this has yet been explained.

Returning to the assessment that specific ISIS camps in Syria have been training an unknown number of international recruits for deployment to other countries, such as those behind the Paris attacks, the potential numbers of jihadists possibly trained and dispatched from these camps remains totally unqualified in a quantifiable and verifiable manner. In actuality, even the number of camps may not be really known. In short the world‟s intelligence agencies essentially simply do not know the real or imagined numbers involved nor their nationalities or their present locations. It presents a rather disturbing picture in terms of where and when they can strike next.

Consequently, is Thailand now in the high risk category? Yes, it is and will remain so for the foreseeable future. The August incident at the Erawan Shrine should be seriously reviewed in light of recent events. The cell behind the attack has been presented in a very different light by the Thai security services and the ruling Military government. The timeline for the planning of the attack, the modus operandi of the attack, the mass casualty nature of it, the cross regional make up of those behind the planning and execution, even down to the type

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis of explosives used all need to be re-examined. Certain elements bear similarities to the ISIS modus operandi and the attacks in Paris, the timeline, the explosives the cell structure and other similarities. However, given a large amount of physical forensic evidence was lost due to the overzealous handling of the blast scene, to restore the impression of normality, the comparative analysis on the composition and importantly – construction of the device, is likely lost forever. That could have been contrasted to subsequent similar devices used elsewhere. Bomb making techniques carry similarities and can tell a lot on origins. Perhaps the strategy of denial of who was actually behind the incident and their motivations may now be coming back to haunt the Thai security services and the Military government. (For our clients in Thailand more detailed specific analysis of questions already asked of the agencies will be available inside the next 48 hours pertaining to the direct nature of unfolding risks.)

The scale of ISIS aspirations across Europe, Middle East, North Africa, East Africa, Central Asia, South Asia and South East Asia are really yet to present themselves. In the interim period the world‟s leaders and governments will respond as per the script written by the ISIS strategists.