EUROPEAN UNION TERRORISM SITUATION AND TREND REPORT 2018

© European Union Agency for Law Enforcement Cooperation 2018. Reproduction is authorised provided the source is acknowledged. For any use or reproduction of individual photos, permission must be sought directly from the copyright holders. This publication and more information on Europol are available on the Internet. ISBN 978-92-95200-91-3 www.europol.europa.eu DOI 10.2813/00041 QL-AJ-18-001-EN-N 04 05 FOREWORD TRENDS 08 21 GENERAL OVERVIEW JIHADIST TERRORISM

Terrorist attacks and suspects arrested Terrorist attacks and suspects arrested Terrorist and violent extremist activities in the EU

The convergence of cyber and terrorism Terrorist situation outside the EU

Convictions and Penalties Kidnappings CONTENTS 45 48 ETHNO-NATIONALIST AND LEFT-WING AND SEPARATIST TERRORISM ANARCHIST TERRORISM 51 53 RIGHT-WING TERRORISM SINGLE-ISSUE TERRORISM

Overview of the failed, foiled and completed attacks in 2017 per EU A1 54 Member State and per affiliation

A2 Arrests in 2017 per EU Member State and per affiliation 55

A3 Convictions and penalties (Eurojust) 57 annexes A4 Europol activities in counter-terrorism 60

A5 Methodology 63

A6 Acronyms 65

A7 Amendments in national legislation on terrorism in 2017 66 TESAT 2018 4

FOREWORD

In 2017 European countries were ten-year period comprised the largest and volume of terrorism that the EU again hit by terrorist attacks and there proportion of attacks reported by faced in 2017. Although the majority were many innocent victims of this Member States. In contrast, the of Member States reported that they indiscriminate violence. It therefore threat of jihadist terror has increased did not experience any terrorist attacks goes without saying that combatting considerably since 2006, culminating during the reporting period, the human terrorism remains a top priority for in large-scale attacks such as those suffering and the threat of attacks Europol. in Paris in 2015 and in Brussels, Nice remains high. In this report you will To fight terrorism, it is essential to and Berlin in 2016. Attacks committed not only find information about how have optimal information exchange by right-wing extremists have rarely many terrorist attacks took place in and accurate data. That is why the EU been reported by Member States over 2017, but also the number of arrests Terrorism Situation and Trend Report the years and were therefore never and convictions for terrorist crimes. A (TE-SAT) was created in 2007 so that the prominently covered in the TE-SAT. brief overview of the terrorist situation European Parliament and all national The same applies to acts of single- outside the EU is also included. issue terrorism, whereas left-wing governments and police forces have an I would like to thank all EU Member extremist terrorism appears to be a overview of the European situation on States, Eurojust and our cooperation constant in some Member States, as an annual basis. Since the first report, partners outside the EU for their reflected in the TE-SAT reports over the which gave an overview of the situation contributions to the TE-SAT 2018. years. However, none of the reported in 2006, many things have changed. Finally, I would like to acknowledge activities in any terrorist category have Although it already appeared that the the work of the members of the been as lethal and have had such an internet played an important role in the Advisory Board, consisting of the impact on society as a whole as those radicalisation of some perpetrators, ‘troika’ (Presidencies of the Council committed by jihadist terrorists – such and terrorists showed a preference of the EU, namely Estonia, Bulgaria as those also committed in 2017 and for improvised explosive devices, and Austria), France, Spain, Eurojust, since the beginning of 2018. the terrorist landscape has further the EU Intelligence and Situation diversified and the threat has increased. This 2018 edition of the annual TE-SAT Centre (INTCEN) and the Office of the In the years following the first edition provides an overview of the nature EU Counter-Terrorism Coordinator. of the TE-SAT, the overall number Their valuable contributions were of terrorist attacks in the European indispensable for the production of this Union (EU) decreased, largely owing 2018 edition of the TE-SAT. to a substantial drop in the number The numbers in this report are not of separatist attacks, which over a just statistics. Behind every number is human suffering. I therefore want to close this foreword with a thought for the victims of terrorist violence. “We must never forget that behind every number there is an innocent victim.”

Catherine de Bolle Executive Director of Europol TESAT 2018 5

TRENDS

In recent years there has been an increase in the frequency of jihadist attacks, but a decrease in the #1 sophistication of their preparation and execution. Jihadist attacks, however, cause more deaths and casualties than any other terrorist attacks.

Recent attacks by jihadist terrorists have followed three patterns: indiscriminate killings (London, #2 March and June 2017; and Barcelona, August 2017); attacks on symbols of Western lifestyle (Manchester, May 2017); and attacks on symbols of authority (Paris, February, June and August 2017). New attacks in the EU by jihadist terrorists following one of these patterns or a combination thereof are highly likely.

Jihadist attacks are committed primarily by home- grown terrorists, radicalised in their country of #3 residence without having travelled to join a terrorist group abroad. This group of home-grown actors is highly diverse, consisting of individuals who have been born in the EU or have lived in the EU most of their lives, may have been known to the police but not for terrorist activities and often do not have direct links to the Islamic State (IS) or any other jihadist organisation.

Recent attacks prove jihadist terrorists’ preference for attacking people rather than other targets #4 provoking less of an emotional response from the general public, such as damage to premises or loss of capital. TESAT 2018 6

Jihadist terrorists may operate in groups, but have often found to be lone actors. They may have #5 managed to keep their environment completely in the dark about their intentions prior to the attack. However they may have friends and relatives in their environment who know of, sympathise with, facilitate or even assist in the preparation of an attack.

The number of individuals travelling to the conflict zones in Iraq or Syria to join jihadist terrorist groups #6 as foreign terrorist fighters has dropped significantly since 2015. The number of returnees was low in 2017.

Online propaganda and networking via social media are still essential to terrorist attempts to reach out #7 to EU audiences for recruitment, radicalisation and fundraising. As IS’s capacities to produce new propaganda material are severely affected by losses of both operatives and infrastructure, the group continues to spread its message to wide audiences, by increasingly redistributing older material by new means.

The often rudimentary and fragmented knowledge of Islam of (aspiring) jihadist terrorists makes them #8 vulnerable to being influenced and manipulated by those who selectively use religious texts to fit a violent ideology. TRENDS 7

The degradation of IS organisational structures may reduce the attractiveness of the group. However, #9 this may not affect the threat of jihadist terrorism, as disaffected IS members and sympathisers – including those residing in EU Member States – will likely continue to adhere to jihadist beliefs and might be drawn to join other groups, such as al-Qaeda. Al-Qaeda is still a powerful player and actively encourages terrorist attacks in the EU. Near-future terrorist activities in the EU ordered, guided or inspired by al-Qaeda or other jihadist organisations remain a realistic possibility.

Ethno-nationalist and separatist terrorist attacks continue to far outnumber attacks carried out by #10 violent extremists inspired by any other ideologies or motivations.

The violent right-wing extremist spectrum is expanding, partly fuelled by fears of a perceived #11 Islamisation of society and anxiety over migration.

There is no evidence of chemical, biological, radiological or nuclear (CBRN) weaponry being used #12 by terrorists in the EU, despite indications of jihadist terrorists taking an active interest in its possibilities. Improvised explosive devices, firearms and improvised weapon, such as knives and vehicles, are the weapons of choice with which recent attacks were carried out. These weapons, except for explosive devices, do not require much preparation or special skills to be employed in terrorist attacks, which are either carefully prepared or carried out spontaneously. TESAT 2018 8

1/ GENERAL OVERVIEW GENERAL OVERVIEW 9 terrorist attacks and suspects arrested

(police and military forces). In terms Attacks figure 1 of weaponry, the use of firearms and Number of failed, foiled or completed explosives were the most prevalent4. In 2017 a total of 205 foiled, failed attacks from 2014 to 2017. However, compared to previous year, and completed terrorist attacks were the use of explosives decreased from reported by nine EU Member States. 40% to 30%. Firearms were used in 226 The United Kingdom (UK) experienced 41% of all attacks, a slight increase the highest number of attacks (1071), compared to 2016 (38%). Hungary followed by France (54), Spain (16), 205 mentions that because of the past Italy (14), and Greece (8). Belgium and 193 conflicts between Western Balkan Germany reported 2 attacks each; countries and the ongoing unrest in Finland and Sweden noted 1 attack Ukraine, large amounts of small arms each. Spain, Finland and Sweden are available on the market. reported on jihadist terrorist attacks after a long period of having been 142 unaffected by this phenomenon. In 2017 68 victims died as a result of terrorist attacks and 844 people were injured2. Similarly to 2016, nearly all figure 2 reported fatalities and casualties were Failed, foiled or completed attacks by the result of jihadist terrorist attacks3. affiliation in 2017.

The total number of attacks (205) is 2014 2015 2016 2017 a deviation of the downward trend that started in 2014 owing to a 45 % 67 increase in the number of attacks in compared to 2016 (99). The countries Separatist 2017 compared to 2016 (142). reporting terrorist attacks linked to separatist terrorism are the UK Overall, attacks specifically classified (88), France (42) and Spain (7). The as ethno-nationalist and separatist number of jihadist terrorist attacks accounted for the largest proportion more than doubled, from 13 in 2016 (137) and represent an increase to 33 in 2017. Attacks carried out by 2 left-wing terrorists reached a total 16 12 NS of 24, of which most were reported Jihadist Left-wing 1 88 attacks reported by the UK were acts of 3 security-related incidents in Northern Ireland. Of by Greece (8) or performed by Greek Right- these, five involved attacks on national security perpetrators in other countries (2). wing targets. 2 Data sourced from media reports and Terrorist attacks primarily targeted contributions of EU Member States. Figures exclude casualties of Northern Ireland security-related civilians and private enterprises, incidents. followed by public institutions and 3 62 people died and 819 were injured in jihadist representatives of law enforcement 4 88 security-related incidents in Northern Ireland attacks in 2017. included 58 shooting incidents and 30 bombings. TESAT 2018 10

Arrests

In 2017 a total of 1219 individuals 2015; 84 in 2016 and 30 in 2017). figure 3 were arrested in the EU for terrorism- In 2017 most arrests (660) were Number of arrested suspects from 2014 related offences. 18 EU Member States performed on suspicion of to 2017. reported arrests of suspects. Similarly participating in activities of a terrorist 1219 to 2016, the overall number of arrested group; planning; and preparing attacks. persons remained highest in the UK 73 persons were arrested on suspicion 1077 (4125), France (411), and Spain (91). of facilitating terrorism (dissemination 1002 Most arrests (705 out of 7916) were of propaganda, recruitment and related to jihadist terrorism. This financing of terrorism). Arrests for 774 number does not follow the trend of a travelling to conflict zones for terrorist continuous increase in jihadist arrests purposes continued to decrease for the prevalent over the past three years third year in a row (141 in 2015; 77 in (395 in 2014; 687 in 2015; and 718 in 2016 and 28 in 2017). 2016). Similar to 2016 the number of The average age of those arrested was arrests for left-wing and right-wing 30, with 45% of the suspects falling terrorism remained low (36 and 20 in the range of 20-30 years old; 25% arrested persons in 2017 respectively; in the range 30-40 years old. More 31 and 12 – in 2016). The number of than 80% of the arrestees were male. arrests for separatist terrorist offences The number of EU citizens among continued to decrease sharply (168 in the arrestees comprises 50% and is between the proportions of previous 2014 2015 2016 2017 5 Since the 2018 edition, the TE-SAT now includes all years (58% in 2015; 43% in 2016). UK arrests (except 173 arrests relating to Northern Ireland terrorism) and not only the arrests that have resulted in a charge. 6 428 terrorism-related arrests for 2017 were reported without differentiating between types of terrorism, therefore they are not included in the ranking.

1 9

figure 4 Attacks and arrests by EU Member State 1 1 in 2017.

17

11

2 107 412 35 2 58 2 50 1

48 2 54 411 2

14

1 16 91 14 39 8 15 GENERAL OVERVIEW 11 terrorist and violent extremist activities

ascertaining the origin and destination of Financing of terrorism financial transactions. Value transfer systems such as hawala are highly adaptable to conditions such as war, economic sanctions In 2017 Member States carried out several and blockades, and are reliable alternative investigations into financing of terrorism. outside of the conventional banking system. One major investigation focused on a large They offer possibility to transfer money network of Lebanese nationals offering without direct money/value flows between money laundering services to organised sender and receiver thus tracing the money/ crime groups in the EU and using a share value flow in a hawala network is virtually of the profits to finance terrorism-related impossible. Many prominent hawala activities of the Lebanese Hezbollah’s military operators are based in the United Arab wing. The cooperation of these money Emirates (UAE), which frequently serves as launderers and Hezbollah’s military wing the international platform for illicit finance was a clear example of a nexus between activities. organised crime and terrorism. Another such investigation dealt with the financial Money being transferred via the hawala support of foreign terrorist fighters (FTFs) system generally moves from – and not to in the conflict zones in the Middle East (Iraq – the EU. It is probable that hawala is used and Syria) and North Africa (Libya). This more often by support networks that send investigation uncovered the mechanism used money to terrorist organisations abroad than by FTFs to obtain financial support from for plotting attacks within the EU. their families in Europe through a network Diaspora communities living in the EU of facilitators and money collectors. The play a significant role in financing and monitoring of around 5 000 money transfers procurement activities for conflicts in their from around 2 000 senders to around 1 000 countries of origin. There is a high potential recipients, for a total amount of more than for mobilisation with regard to fundraising EUR 2 million, provided proof of life of among jihadist sympathisers. In most cases, known FTFs and, interestingly, also identified the calls for donations are made in mosques, previously unknown FTFs and sympathisers via websites and web fora. Non-profit of IS. organisations (NPO) may be used for money The above investigations and other cases laundering and terrorism financing under the of financing of terrorism together illustrate umbrella of humanitarian activities. the diverse methods that the financing The Partiya Karkeren Kurdistan (PKK, of terrorism may employ, from very basic Kurdistan Workers’ Party) is known to to highly complex schemes. In terrorism systematically and, if need be, forcibly collect financing, cash transactions, in which funds in the EU to finance its activities. The couriers may be used, and unregulated and organisation also uses front organisations illegal financial networks take a prominent and charities in the EU for this purpose and role. The use of informal value transfer is suspected of being involved in criminal services6 adds significant complexities to activities to supplement its income to cover expenses in Turkey, the Middle East and 6 Hawala is an informal method of money transfer based on Europe. trust and honour, operating outside the traditional banking system, whereby money is paid to a network of brokers (known as a hawaldars). TESAT 2018 12

Kidnapping remains a high-profile form of jihadist terrorism impacting on foreign nationals overseas. The prospect of large ransom payments, apart from prisoner exchanges or increased notoriety via propaganda, ensures terrorist groups continue to view foreign hostages as valuable commodities. Most terrorist activities with which the EU was confronted in recent years, irrespective of affiliation, were inexpensive and did not require external sources of funding, in particular attacks committed by lone actors using weapons such as cars and knives. For instance, micro- financing of jihadist groups operating in the EU usually works via the private financial means of group members. In addition to licit employment incomes, state subsidies and social benefits, funds provided from like-minded individuals within the community are the main sources of income. Dissident Republicans in Northern Ireland are associated with both minor and serious criminality, including drug dealing, extortion and fuel laundering7. Anarchist and right-wing extremist groups are mainly financed by their members through contributions and fundraising events (parties, concerts). Members of the anarchist and left-wing extremist milieus have been found to sometimes revert to crime (robberies of interest; economic structures, such banks and supermarkets). Explosives as banks, branches of multinational Virtual currencies, among which companies; and law enforcement Bitcoin is the most well-known, have targets. These anarchist groups either Although the majority of attacks in gained popularity due to their key sent parcels with explosive contents 2017 were committed using simple characteristics that include ease of to their targets by postal services, left means, the use of explosives remains access, anonymity, safe transactions, improvised explosive devices (IEDs), a preferred modus operandi for low cost and high speed for improvised incendiary devices (IIDs) at terrorists, because of their proven international transfers. Their expansion their target locations, or carried out effectiveness and, for jihadist terrorists among terrorist organisations, however, attacks by throwing IEDs or IIDs while in particular, their ability to create mass seems to be slow and has not yet passing their targets. casualties and high media impact. In matched the use made of them by a number of jihadist attacks in 2017, However, lacking the ability to acquire organised crime groups, especially the perpetrators wore person-borne military-grade explosives and firearms, those involved in cybercrime. The improvised explosive devices (PBIEDs) or having no wish to do so (possibly number of known cases of virtual in suicide vests or belts, although these to evade the higher risk of detection) currencies related to terrorism mostly proved to be fake. has led terrorists to primarily use financing remains very low. rudimentary IEDs made of home-made Anarchist groups have used explosives explosives (HMEs). The HME production 7 Fuel laundering is removing the dye from low-price against state structures, including undertaken by the cell responsible for dyed fuel and selling it illegally at the higher price of public services and services of general the August 2017 attacks in Barcelona undyed fuel. GENERAL OVERVIEW 13

special knowledge was required. The attack methodologies and capabilities used by Dissident Republican (DR) groups in Northern Ireland vary. In many attacks, firearms or small IEDs such as pipe bombs were used, but they also deployed larger and/or potentially more destructive devices such as vehicle-borne IEDs (VBIEDs) and explosively formed projectiles (EFPs). All groups retain access to a range of firearms and explosives and there is an ever-present threat of under-vehicle IED attacks. Explosive remnants of war (ERW) and illicit trafficking of explosives from former conflict areas still present a significant threat to the EU. Hand grenades, rocket launchers, high-grade explosives and detonators are mostly used by various organised crime groups. However, some terrorist groups, such as Northern Irish DR groups, are known to have acquired and used these weapons as well. Some of the military explosive ordnance is sourced via thefts from military explosive storage facilities and the illegal collection of ERW and unexploded ordnance (UXO). The use of pyrotechnics in constructing IEDs is mostly employed by left-wing extremist and separatist groups. However, there have also been cases and Cambrils, for example, has shown conducting legitimate business. in which jihadists have misused that jihadist individuals and groups may With regard to HMEs used by jihadist pyrotechnic articles (alone or in have the ambition to execute complex terrorists, triacetone triperoxide (TATP) combination with HMEs) in preparing plans and conduct large-scale IED continued to be predominant. It was IED attacks. This development might attacks. The acquisition of HME-making noted however, that in some cases, be explained, at least partially, by knowledge has mostly been facilitated terrorists used TATP in combination the lack of success by some terrorists by the internet and encrypted social with other types of explosive materials, with regard to producing and using networks, such as Telegram, WhatsApp in order to enhance the IED’s power TATP. In addition to legal pyrotechnics and Facebook. Even though content and aggravate their lethal effects. In shops and illegal street markets, online such as bomb-making instructions those instances TATP has mostly been shops and vendors on various social is continually removed from the used as a booster, while the terrorists networks have become the main internet, various sites persist where used ammonium nitrate (AN)-based sources of illegal pyrotechnic articles. such information can be retrieved. explosives and/or gas cylinders/ Their characteristics and availability The internet is also increasingly used cartridges as a main or additional make pyrotechnics a viable alternative for online procurement of explosives charge. to TATP and their use in IEDs has been precursors through web shops located widely promoted in various online in various EU Member States. The In 2017 IEDs used in anarchist attacks jihadist bomb-making instructions. procurement of explosives precursors were made from an array of readily Using gas cylinders to cause explosions from outside the EU is also facilitated available shop-bought materials. They in attacks is also promoted through by legal companies apparently were simple devices for which no these media. TESAT 2018 14

Threats to contaminate food by anarchists

On 19 December 2017 anarchists published threats on the internet to contaminate food products in Athens and Thessaloniki in Greece. An activist group claimed to have deliberately introduced hydrochloric acid in soft drinks, milk, sausages and sauces. A of Lone Jihad” series8, released by post by user Green-Black Commando CBRN Furat Wilayah Channel in English in titled “Green Nemesis Act 3” on the 2017, specifically suggested CBRN Athens Indymedia website warned that scenarios involving food and water the group had poisoned several drink As in previous years, no terrorist contamination as possible terrorist products of multinational companies attacks using chemical, biological, tactics for lone actors. The proposed with hydrochloric acid and that they radiological or nuclear (CBRN) simple methods with use of available would be replacing the items on substances were recorded in the EU in means allow untrained individuals, supermarket shelves shortly after. They 2017. No EU Member States reported even lone actors, to put in practice also posted online photos showing the that any of their investigations involved attacks with CBRN materials. By poison being injected into the products. planning or preparations for terrorist suggesting simple methodologies, Similar threats of food contamination attacks with a CBRN component, such terrorist organisations make CBRN in Greece were published by anarchists as recruitment of skilled individuals, attacks more accessible with the in previous years, in 20169 and 201310. attempts to access CBRN facilities or to intention of increasing the number These plans usually involve targeting acquire CBRN materials. of attempts in the hope of carrying major multinational corporations in CBRN-related topics recurrently out a successful attack regardless order to force them to withdraw their appeared in the terrorist propaganda of the initial scientific knowledge or products, thereby generating significant online. The number of online experience of the actor. loss of revenue, in particular during jihadist propaganda messages and busy periods of the year. A plot to create an improvised tutorials addressed to lone actors dispersal device to release toxic and proposing easy-to-implement hydrogen sulphide gas, which was scenarios for small scale CBRN attacks disrupted in Australia when the increased compared to previous years. suspects were arrested on 29 July 9 In particular, several jihadist media In December 2016 Greek anarchists published a 2017, illustrates the intent of jihadist warning claiming they contaminated several food outlets used social media channels terrorists to use chemical weapons and drink products produced by multinational to release knowledge about chemical companies. The operation called Green Nemesis #2 in a terrorist attack in the West. In weapons and related terror tactics in was planned to take place during the Christmas and this CBRN terrorist-related case, New Year period in the Attica region of Greece. The 2017. warning message posted on the anarchist website the perpetrators had reached the explained how to introduce chlorine and hydrochloric CBRN materials recommended as preparation phase, including procuring acid to products while leaving packaging intact. terrorist weapons are usually toxic components and precursors, designing, 10 Similar threats to contaminate beverages produced by the same multinational company were also industrial chemicals accessible within and testing a device. expressed in December 2013. the EU due to their dual use nature and use in many peaceful applications.

Several documents from the “Knights 8 Series of articles published on social media. GENERAL OVERVIEW 15 the convergence of cyber and terrorism

accounts on Facebook and Twitter. Recruitment and Cyber-attacks More recently, in December 2017, the propaganda Electronic Ghosts of the Caliphate (EGC) threatened to conduct a global cyber- While terrorist groups use the internet attack. However no attack materialised. to reach their followers and spread By 2017 over 150 social media their message, their capability to launch Some studies12 suggest that, rather than platforms were identified as being attacks via the internet appears to trying to develop their own capability abused by terrorists for propaganda remain extremely limited. The absence and tools, some terrorist groups now dissemination11. Additionally file sharing of any major cyber-attacks by terrorist turn to online criminal markets, using sites are used to store and disseminate organisations can be interpreted as the the crime-as-a-service industry to buy terrorist content, messaging and bot result of a lack of appropriate technical access to the capabilities that they services advertise links to such content skills within the groups. A number of themselves are lacking. If this is true, and social media aggregators store cyber-terrorist groups have come to it is likely that the effectiveness of and stream content to other social light over the past few years. However cyber-terrorist groups will increase, media platforms. Industry and law the overall threat from a cyber-attack of perhaps with short delay. Such attacks enforcement action however have terrorist origin appears to remain low. are unlikely to create as much public resulted in a reduction of the terrorist attention as a real-world attack. The Islamic State Hacking Division, abuse of mainstream platforms such However a cyber-attack may amplify also known as the United Cyber as Facebook, Twitter and YouTube, the impact of a real-world attack, if Caliphate, incorporates any online but similar progress has yet to be carried out in conjunction with the group identifying itself as the digital made with start-up social media and latter, in what may be called a hybrid army for IS. To date, this has included companies with limited resources. attack, for example, by disrupting the Caliphate Cyber Army, which was emergency or other essential public Most terrorist activity concerns the largely responsible for a number of services. surface web. Some terrorist activity website defacements; the Islamic Cyber however can also be found on the Army, which is believed to be focused Darknet. This mostly relates to on gathering intelligence related to fundraising campaigns, the use of illicit the energy industry and power grids, markets and further advertisement purportedly in preparation of an attack; of propaganda hosted on mainstream and the Sons of the Caliphate Army, social media. 12 Wolf, K., Cyber jihadists dabble in DDOS: Assessing which focuses on hacking social media the threat, 2017, https://www.flashpoint-intel.com/ blog/cyber-jihadists-ddos

11 Europol, Internet Organised Crime Threat Assessment (IOCTA) 2017, 2017, p. 53. TESAT 2018 16 convictions and penalties

In 2017 17 Member States reported (125), followed by France (120) and respect to defendants who were a total of 565 individuals who were Belgium (85)15. In France and Spain believed to be in conflict zones or convicted or acquitted of terrorist four individuals were tried twice were claimed to have died but were offences13. This number is similar to during the year in different terrorism not officially declared dead. Some the numbers submitted over the past proceedings. As a result, the total individuals sentenced for terrorist two years14. number of verdicts pronounced for offences in 2017 had previously been terrorism-related offences in 2017 was convicted of terrorism in the same In 2017 the UK was the Member State 569. Member State or abroad. that reported the highest number of individuals in concluded court Some of the defendants who appeared The majority of the verdicts reported proceedings for terrorist offences before courts in the EU Member in 2017 are final, while others are States were minor of age at the time pending judicial remedy, as appeals of trial and/or when the offences have been submitted16. 13 Eurojust received contributions containing information on terrorism-related court decisions were committed. The number of in 2017 from the following Member States: Austria, female defendants judged in 2017 (66) Belgium, Czech Republic, Denmark, Estonia, Finland, increased compared to 2016 (53). The 16 France, Germany, Greece, Italy, Lithuania, the According to Council Decision 2005/671/JHA, Netherlands, Poland, Portugal, Spain, Sweden and practice in some countries to render the information to be submitted to Eurojust is in the UK. relation to final convictions. Due to the specifics of sentences in absentia continued with reporting, some Member States submit information If a verdict pronounced in 2017 was appealed and on final decisions only, while other Member the appeal was concluded before the end of the States report also on not final decisions. The data year, Eurojust reported only on the latest/final 15 The UK contribution includes proceedings on provided by the UK did not distinguish between final verdict. offences under anti-terrorism legislation, as well decisions and decisions pending judicial remedy. 14 Please refer to Annex I for additional information as other offences assessed to be terrorism related. As reported, all convictions in the UK are effective and clarification on the numbers mentioned in this Similar to previous years, the UK data for 2017 from the moment of their being pronounced, even if section. refers only to convictions. an appeal is made.

figure 5 580 Number of individuals in concluded court proceedings for terrorist offences in 2015, 565 2016 and 2017, as reported to Eurojust*. 513

* The data for the previous years corresponds to the data reported in the respective TE-SAT reports.

2015 2016 2017 GENERAL OVERVIEW 17

Type of terrorism

In 2017 the vast majority of verdicts (352) in the Member States concerned jihadist terrorism confirming a trend that started in 201517. Similar to the recent years, the largest part of the verdicts for jihadist terrorism concerned offences related to the conflict in Syria and Iraq; however of Antwerp in July 2017. The court four-year sentences given to the other persons who had engaged with Al found them guilty of (attempted) three. Qaeda, the Taliban or Al-Shabaab were participation in the activities of a In Spain six men were sentenced also tried in 2017. In one case in Austria terrorist group (ISIL). The court found to six years in prison each after a member of Hamas was imprisoned that three of the defendants had the National Court found them for life after the Supreme Court found formed the core of Way of Life – the guilty of membership in a terrorist him guilty of membership in a terrorist new jihadist group that adopted the organisation. The six had supported organisation and attempted incitement ideology of the banned Sharia4Belgium Muslim radical extremism, aiming to to murder as terrorist crime. – and had tried to recruit young men recruit fighters for Al Qaeda in order via a non-profit organisation. Four of The highest number of verdicts for to carry out attacks in the Maghreb the defendants had unsuccessfully jihadist terrorism in 2017 (114) were or in the West. They had used several tried to reach Syria, while two others rendered in France. Austria, Denmark, networks, such as Blogger, Contactime, had succeeded and one already Estonia, Finland, Italy, Poland, Portugal Facebook, Flickr, Google+, Issuu, returned. Some of the verdicts were and Sweden reported only verdicts Paltalk, Scribd, Twitter and YouTube, appealed and upheld by the Court of for jihadist terrorism in 2017. The vast to spread propaganda, share their Appeal of Antwerp in December 2017. majority of jihadist terrorism verdicts strong disapproval of Western society, rendered in 2017 was in relation to ISIL In Italy the Court of Appeal of Trento distribute combat manuals to train or its affiliated groups. confirmed a sentence issued by a their followers for potential missions, In Belgium, for example, seven lower court against four members and organise meetings. One of the members of the Salafist group Way of of the Merano cell of the terrorist men had established Sharia4Spain, Life were sentenced to prison terms of group Rawti Shax. Rawti Shax had cells the Spanish branch of the global up to five years by the Criminal Court in Europe and the Middle East that Sharia4 movement. The group had also communicated and operated via the established an independent system for internet and had provided logistical financing its activities and had shown a 17 The data provided by the UK was not broken down and financial support to recruiting particular interest in the development by type of terrorism and is therefore not included in foreign terrorist fighters to be sent of biological or chemical weapons. the numbers that follow. to Iraq and Syria. Their stated aim In 2017 courts in the EU Member was to establish a theocratic state States continued to refer to the and to overthrow the government of so-called ISIL registration forms Kurdistan. The Merano cell members filled in upon entry into the terrorist had been arrested as part of a big organisation. In the Netherlands, for multinational operation coordinated by example, the authorities launched an Eurojust in November 2015. The court investigation into alleged participation ruled that they were theoretically in a terrorist organisation triggered capable of carrying out attacks and by information on such a registration confirmed the six-year sentence given form provided to the Dutch Military to one of the group members and the Intelligence and Security Service TESAT 2018 18

by the US Department of Defense. Dutch criminal law. In Lithuania a man A smaller number of the defendants Corroborating it with other evidence, who had attempted to support and in 2017 were tried for glorification the District Court of Rotterdam held finance the Real IRA was imprisoned by of terrorism, recruitment and (self- that the registration form attributed to the Court of Appeal. ) training for terrorist purposes, the defendant was authentic. Owing financing of terrorism, instigation In 2017 courts in the Czech Republic, to the nature of the information that to commit terrorist acts, or for Greece and Spain heard left-wing would have been primarily known to attempting to commit such crimes. In terrorism cases, marking an increase the defendant, the court considered some cases, terrorism charges were in such cases compared to last year. it proven that he had provided the filed in parallel with charges for other Germany was the only Member State information stated in the registration offences, e.g. murder, possession of that reported verdicts for right-wing form. The ISIL registration forms were weapons and explosives, war crimes, terrorist offences. The majority of the also introduced in evidence in two or forgery of official documents. female defendants (42) were tried for cases in Denmark. jihadist terrorist offences confirming In Spain a 38-year old man was As in previous years, Spanish courts an upward trend from the past couple sentenced to five years in prison for tried the largest number of individuals of years. having used social platforms to spread charged with separatist terrorism the word and symbols of ISIL and to offences in the EU in 2017. One Type of offences recruit female minors to travel to the of them belonged to the terrorist ISIL-controlled areas in Iraq and Syria group Resistência Galega (RG, and marry fighters there. He contacted Galician Resistance), while all others In a large number of cases concluded the girls at an Islamic cultural centre belonged to or were affiliated with in 2017 the defendants were brought with the intention of indoctrinating Euskadi ta Askatasuna (ETA, Basque to court on charges of participation in them and offering them the possibility Fatherland and Liberty). In France, (the activities of) a terrorist group. In to travel to Syria. Germany and the Netherlands, PKK May 2017 in Germany, for example, In a case that had no precedent members were convicted of offences, the Higher Regional Court of Berlin in Sweden, the Court of Appeal of including participation in a terrorist convicted a 20-year old Syrian man of Malmö confirmed the six month organisation, financing of terrorism, membership in a terrorist organisation sentence issued earlier in 2017 by the complicity in money laundering, and sentenced him to a five-year Malmö District Court against a man recruitment and/or training of its juvenile sentence. Before moving to who had urged others to finance ISIL members, while in Belgium four Germany in August 2015 and being via Facebook. The court admitted people were acquitted for alleged fund recognised as a refugee, the defendant in evidence that he had posted a raising for the PKK. In the Netherlands had been a member of ISIL in Syria. In message asking for help to supply also five members of the Liberation 2013 he participated in the siege of weapons to those fighting “at the Tigers of Tamil Eelam (LTTE) were an airport and in the spring of 2014 front”. The message also contained sentenced by the Supreme Court to in a city siege eastern Syria. After the names of two people who could serve prison terms for their role in the arriving in Germany, he became a be contacted in order to transfer the terrorist group, after the court ruled contact person for ISIL in Germany. He money; one of them is on the United that the claim that LTTE fighters could provided them with information about Nations (UN) and EU lists of terrorist be defined as “combatants” cannot soft targets in Berlin, well aware that financiers. The court heard that the be supported under international such information could be used to plan post could be accessed by anyone, humanitarian law and they can be terrorist attacks. even without a Facebook account. prosecuted and sentenced under GENERAL OVERVIEW 19

In the Netherlands the brother of a 15 years old when she committed the conviction rate registered in 2016 Dutch fighter in Syria was found guilty offence. (89%) continued in 2017. In some of financing of terrorism, among cases defendants were acquitted of In Spain the National Court sentenced others, and given a two-year prison terrorist offences but convicted of a 20-year-old Moroccan woman to five sentence for sending approximately other offences, such as an attack on air years in prison. The court found that EUR 17 000 to his brother via a transport, drug trafficking, burglary, she became radicalised since 2015 and middleman in Turkey. The court held attempted extortion, preparation of an shared her religious and political views that the man was well aware of the explosion, theft, firearms offences, and on social media. She posted messages actions of his brother and those of ISIL abduction of a minor19. supporting ISIL and the jihad and in Syria. By providing financial support planned to travel to the conflict zone All prosecutions for right-wing terrorist to a person whose involvement in controlled by ISIL and wished to marry offences resulted in convictions in terrorism was known to him, the man a mujahid. She posted photos and 2017. The concluded jihadist terrorism consciously accepted the significant videos of ISIL fighters and executions cases continued to have a very high possibility that these funds be used for via Facebook, Twitter and YouTube. conviction rate (89%), similar to 2016 the purpose of committing terrorist She also accessed chat rooms used and (92%) and 2015 (94%). The acquittal offences. managed by ISIL members. The court rate among the verdicts related to The female defendants in 2017 were found her guilty of collaboration with a separatist and left-wing terrorism was tried for preparing to commit terrorist terrorist organisation. higher (29% and 28% respectively)20. acts, participation in or collaboration In Spain, for example, the National In the Netherlands the first female with a terrorist organisation, financing Court acquitted an ETA member for returnee to be sentenced for terrorist of terrorism, glorification of terrorism, his alleged role in an attack on a local offence was given a two-year prison spreading messages inciting to commit government building in Guipuzcoa term, of which one year on probation. a terrorist offence. in July 1995. The attack had been She was convicted for having helped carried out by ETA’s Donosti command In Denmark a teenage girl was found her husband travel to Syria and in 1995, using a grenade launcher guilty of attempted terrorism for participate in the fighting there. and two grenades. The court ruled having tried to make bombs to be that the defendant was no longer used in terrorist attacks against her Convictions and criminally liable for the alleged acts, own former local school and against a due to the application of the statute Jewish school in Copenhagen. The first acquittals of limitations. In Greece the criminal attack was not carried out because prosecution of some acts in a left-wing she did not receive an order from ISIL/ terrorism case was definitively ended jihadists with whom she corresponded In 2017 Denmark and Estonia were due to the statute of limitations. via the internet. The second attack the only two Member States that was prevented as she was arrested had convictions and no acquittals for by the police. The girl, who lived in terrorist offences18. Austria, Belgium, 19 a village in the countryside, became Eurojust considers it as one verdict if an individual France, Germany, Italy and Spain also is convicted of more than one terrorist offence radicalised via the internet and chat witnessed a vast majority of successful within the same proceeding, or convicted of a contacts in just a few months after prosecutions resulting in convictions terrorist offence and acquitted of another offence. If an individual is acquitted of a terrorist offence and having converted to Islam. She bought for terrorist offences. The record high convicted of another offence, the verdict is included chemicals to produce TATP and started in the overview as acquittal of terrorism. experiments with the substance in 20 The data provided by the UK was not broken 18 The UK data for 2017 refers only to convictions down by type of terrorism and is therefore not used the basement of her house. She was and is not included in the numbers in this section. to calculate the conviction rate. TESAT 2018 20

Penalties figure 6 Average sentences (excluding non-prison penalties) per Member State in 2017, as The average prison sentence for terrorist offences in the reported to Eurojust. EU in 2017 was five years21, similar to that of 2016. The lowest prison sentence ordered by courts in the EU Member States in 2017 was 45 days. Sentences of up to five years of Average sentence in years imprisonment remained the majority of the penalties handed down with the guilty verdicts in 2017 (61%); sentences of ten or more years of imprisonment remained similar to 2016 (12%). 6 The most severe penalty – imprisonment of 158 years – was handed to an ETA member in Spain convicted of 11 counts of attempted assassination. As mentioned above, in Austria 5 a 27-year-old member of Hamas was sentenced to life-long imprisonment for having used social media to call on others to kill Jews in Jerusalem. The same sentence was pronounced in Germany against a man who had attempted to attack Bonn 3 train station in December 2012 and planned the murder of a political party leader. Courts in the UK also gave life sentences to persons found guilty of preparing to commit 6 acts of terrorism. It should, however, be taken into consideration that the severity of the penalty in each case would depend on the 3 respective offence and cannot serve any comparative purposes. Additionally, in some Member States the average sentence is calculated on the basis of one conviction, while 6 in others it is based on a considerably higher number of convictions. Left-wing terrorist offences continued to bear the highest 6 average prison sentence (ten years). The average prison sentence for jihadist terrorist offences remained five years and four years for separatist and right-wing terrorist 17 offences22. In addition to prison terms, several courts imposed fines, restrictions on civil rights, travel bans and expulsion from the 5 national territory. In France some of the convicted persons were written in the national judicial database for terrorist * offenders. In some cases youth penalties were given or the sentence was partially or fully suspended. In other cases 6 the sentencing or the execution of the prison sentence was postponed upon certain conditions, or no penalty was yet ordered at the time of reporting. 3 In the cases in which the guilty verdicts did not result in prison sentences, the courts ruled on fines, community service, rehabilitation, or community orders. Treatment 2 in a mental health institution was ordered in some cases, in addition to or as an alternative to imprisonment. In one occasion it was also ordered for a person declared insane and 5 acquitted of terrorist offences. * 1

21 For the purpose of the calculation of the average prison sentence, penalties exceeding 40 years of imprisonment and life sentences were counted as 40 years. In the cases where the court ordered a minimum number of years of the 5 life sentence to be served, the sentence was included in the overview with the minimum number of years indicated. *The average sentence is based on one convic�on. 22 The data provided by the UK was not broken down by type of terrorism and is therefore not included in the overview. JIHADIST TERRORISM 21

2/ JIHADIST TERRORISM 718 687 705

395 216 2013 2014 2015 2016 2017 TESAT 2018 22

9 figure 7 Number of suspects arrested for religiously inspired/jihadist terrorism in EU Member States in 2017. 1 14 28 3 2 50 52 1

46 2 373 2 14

26 1 78 3

figure 8 Number of suspects arrested for religiously inspired/jihadist terrorism from 2013 to 2017.

718 687 705

395 216 2013 2014 2015 2016 2017

9

1 14 28 3 2 50 52 1

46 2 373 2 14

26 1 78 3 JIHADIST TERRORISM 23 terrorist attacks and suspects arrested in the EU

EU Member States reported 33 foiled, Targets included the military, civilians driver’s cabin. The attacker ran from failed and completed jihadist terrorist and the police. Among the deadliest the scene, but was later arrested. The attacks in 2017, more than double attacks were when vehicles were used attack remained unclaimed; however the figure of 2016 (13). Ten of the as weapons. the perpetrator had recorded and sent 33 attacks were assessed as having a video in which he pledged allegiance been completed, i.e. perceived by EU to IS. Member States as having reached the The ten attacks with fatalities24 in 2017 On 20 April a 39-year-old male opened goals that the perpetrators may have were the following25: fire on a police vehicle parked on the had in mind, which invariably seems to MARCH Champs Elysées in Paris (France) killing be the killing of what the perpetrators one police officer. Two other police perceived as “enemies of Islam”, as On 22 March a 52-year-old male officers and a tourist were seriously legitimised by jihadist ideology. 12 drove his car into pedestrians walking wounded. The attack was claimed by attacks were assessed to have failed across Westminster Bridge in London IS through a breaking news message to reach their objectives in full, and 11 (UK). He subsequently stabbed a issued by A’maq News. It was reported were foiled – mostly in France and the policeman guarding the nearby Houses in al-Naba’ and Rumiyah. UK. of Parliament, before being shot dead by police. Five people were killed and MAY A total of 62 people were killed in at least 50 injured. The attack was ten of the 33 attacks. Reportedly On 22 May a 22-year-old suicide claimed by the so-called IS (IS) through most fatalities were in the UK (3523), bomber, born in the UK to Libyan a breaking news message issued by followed by Spain (16), Sweden (5), parents, killed 22 people and injured A’maq News. It was reported in IS’s France (3), Finland (2) and Germany (1). 512, including children, in an attack Arabic weekly newsletter al-Naba’ In addition a total of 819 people were on a concert hall in Manchester (UK). and in the monthly multi-language injured in 14 attacks. The attack was claimed by IS through magazine Rumiyah. a breaking news message issued by A total of 705 people were arrested APRIL A’maq News. In addition IS issued a in 18 EU Member States (373 of statement from its central leadership; those arrests took place in France) on On 7 April a 39-year-old male hijacked it was also reported in al-Naba’ and suspicion of involvement in jihadist a lorry transporting beer and drove Rumiyah. terrorist activities, roughly the same it into a busy pedestrian street in number as in 2016. Most arrests (354) Stockholm (Sweden), killing five JUNE were on suspicion of membership of people and injuring 14. He crashed On 3 June eight people were killed a terrorist organisation, followed by the vehicle into a department store. and 48 injured in central London (UK), arrests on suspicion of planning (120) A rudimentary improvised explosive when three attackers drove a van into or preparing (112) an attack. device (IED) was also found in the pedestrians on London Bridge and launched a knife attack after exiting 24 23 This figure is from open sources and does not Excluding perpetrators. the vehicle. The attack was claimed by contain casualties of Northern Ireland security- 25 Details about attacks in the UK are derived from IS through a breaking news message related incidents. both Europol and open sources. TESAT 2018 24

issued by A’maq News. It was reported OCTOBER On 25 August one soldier was lightly in al-Naba’ and Rumiyah. wounded, after a machete-wielding On 1 October two women, aged man attacked them in Brussels JULY 17 and 20, were stabbed to death (Belgium). The perpetrator was shot at Marseille’s main railway station On 28 July a 26-year-old unsuccessful dead at the scene. The attack was (France). The attacker was shot dead asylum seeker in Hamburg claimed by IS through a breaking news by a soldier from a military patrol as (Germany) attacked several people statement issued by A’maq News and part of the Sentinel Operation. The in a supermarket with a knife that later reported in al-Naba’. he had taken from a shelf, killing one attack was claimed by IS through a SEPTEMBER and injuring six. The attack was not breaking news message issued by A’maq News al-Naba’ immediately claimed by IS. However and reported in . On 15 September an improvised an article in al-Naba’, published on 4 explosive device (IED) was detonated August, reported on the incident citing on a tube train at Parsons Green In addition people were injured in the Western media reports. While the station in south-west London (UK) following attacks28 in 2017: victims of the attack were identified during the morning rush hour. Thirty as “crusaders”, the perpetrator, by JUNE people, including a young boy, were contrast, was not described as an “IS injured, when the bomb partially On 6 June a French soldier was soldier”26. detonated and sent a fireball along attacked and injured by a hammer- a carriage. The attack was claimed AUGUST wielding man while patrolling in front by IS through a breaking news of Notre-Dame Cathedral in Paris On 17 August fifteen people were item by A’maq News, and the IS (France). killed and 131 injured, when a van sped leadership issued a separate claim of into La Rambla promenade, a busy AUGUST responsibility. It was also reported in downtown street in central Barcelona al-Naba’29. On 9 August six French soldiers, (Spain) packed with tourists. patrolling as part of the Sentinel Some eight hours later in Cambrils, Operation, were wounded, three a city 120 km south of Barcelona, a of them seriously, when a driver car drove into pedestrians, killing one deliberately drove into the patrol as and injuring six civilians and a police they left their barracks in the western officer. The attack in Barcelona was suburbs of Paris (France). The attack immediately claimed by IS through was not immediately claimed by a breaking news message issued IS, however, an article in al-Naba’, by A’maq News. Both attacks were published on 11 August, reported on subsequently claimed in a statement the incident, citing Western media from the IS central leadership. The reports. While the victims of the attacks were also reported in al-Naba’ attack were identified as “crusaders”, and praised in Rumiyah. the perpetrator, by contrast, was not described as an “IS soldier”. On 18 August two people were killed and eight injured in a knife attack in On 25 August three police officers Turku (Finland). The main suspect is an suffered injuries, while arresting a 18-year-old male, who was arrested 26-year-old man in possession of a just after the attack. The attack was sword in a car outside Buckingham not immediately claimed by IS27. Palace in central London (UK), reportedly shouting “Allahu Akbar”.

26 Alongside this incident, the article also referred The attack remains unclaimed. to a shooting incident at a nightclub in Constance (Germany), which was not related to terrorism. 27 In an article in al-Naba’, published on 8 February 29 In the same article in al-Naba’, IS also claimed 2018 IS reports on the trial of the perpetrator, responsibility for an evacuation of Paris Charles de including his statement that he was a “soldier of the 28 Details about attacks in the UK are derived from Gaulle airport on 17 September, alleging that its caliphate”. both Europol and open sources. “soldiers” had planted several IEDs. JIHADIST TERRORISM 25

Eleven attacks were foiled and seven London (Parsons Green) in the UK. In was shot dead by soldiers guarding attacks did not result in fatalities or Barcelona, the driver of the van who the station. The Parsons Green casualties. In these attacks the military drove into pedestrians was believed incident is another example of a failed or police were targeted, mostly using to be part of a group that had planned detonation of an explosive device that simple weapons, such as knives or a much larger operation that was could have caused mass casualties, if hammers, without causing major thwarted by a massive explosion the manufactured and handled properly, injuries. Two failed attacks were day before in the house occupied by which fortunately it was not. claimed by IS. On 19 June a 31-year-old the group in Alcanar. Two members of The attacks that were committed perpetrator drove his car loaded with the cell were killed in the explosion, in 2017 reflect the preferences of gas canisters into a police van on the including a 40-year-old imam thought terrorists driven by jihadist ideology Champs Elysées in Paris. He was killed to be the cell’s mastermind. The in selecting their targets and the in his car by toxic fumes. The next explosives destroyed in the incident goals they want to pursue, as seen day a 36-year-old individual failed to were allegedly prepared for one or also in attacks committed in previous detonate an IED hidden in his luggage more other attacks using large vehicle- years. They aim at indiscriminate trolley at Brussels Central train station. borne IEDs (VBIEDs). killings as well as on eliminating Both attacks were not immediately The Manchester attack was an symbols of Western “hedonistic” claimed by IS, but were mentioned exception because it was carried lifestyle and symbols of authority. in an issue of Rumiyah (a multilingual out successfully with an improvised These perpetrators attack people magazine whose name referred to explosive device (IED), requiring a rather than targets that provoke less the city of Rome, which was to be certain level of sophistication and of an emotional response from the conquered by Muslims) published on preparation to complete as intended. general public, such as damage to 13 July, where the perpetrators were A total of 22 people were killed, which premises or loss of capital. The intent described as “caliphate soldiers”. made it the deadliest attack in the of indiscriminate killings was illustrated Jihadists who carried out terrorist UK since the suicide bombings on – among others – by the attacks in attacks in the EU in 2017 were mainly London’s transport system in 2005. London, Stockholm, Manchester, home-grown, meaning that they Ostensibly the perpetrator acted Barcelona and Cambrils. The were radicalised in their country of alone. However he had travelled back detonation of an explosive device in a residence without having travelled to the UK from Libya shortly before concert hall in Manchester doubled as to join a terrorist group abroad. A carrying out the attack. He may have both an attack on a symbol of Western substantial number had a criminal received IED construction training lifestyle and as an attack to cause past or had previously been known to while in Libya. indiscriminate mass casualties. In 2017 authorities, but were not considered a the police and military once again In general however, the increase in the major terrorist threat. remained a focus of attacks. number of jihadist terrorist attacks For attacks in the EU in 2017, no direct in 2017 ran in parallel to a decrease Not all EU Member States were links to a terrorist group or previous in sophistication in their preparation affected equally by jihadist terrorism, terrorism offences by the perpetrators and execution. In cases in which with a number reporting no such were identified at the time of writing. more sophisticated methods were attacks over the course of 2017, Most carried out their attacks alone or required, a lack of expertise led to despite some of them having been in some cases with one or two others. failure in some cases. On 20 June a threatened in IS propaganda. Jihadists However a number of people in their 36-year-old male tried to detonate a have proven to be able to radicalise environment may have been aware of bomb in a luggage trolley in Brussels without raising suspicion and to their plans and tolerated and possibly Central train station, but only the prepare attacks, while remaining even facilitated or supported them. trolley caught fire, after which the undetected by law enforcement. These lone actors’ use low-tech means suitcase exploded due to the gas Therefore, the threat of jihadist to carry out an attack. bottles it contained. It is assumed attacks in the EU remains acute, as that the device failed to function as demonstrated by the attacks which This applies to all of the above-listed intended, probably because of poor took place in 2017 and those that were jihadist terrorist attacks, except for manufacturing. No one was hurt in this prevented in time. the attacks in Barcelona and Cambrils incident except for the attacker, who in Spain, and Manchester and TESAT 2018 26

Asia), potentially increasing the risk Travel for terrorist of more organised spectacular-type purposes attacks in Europe in the medium to long term. Austria reported that the number of FTFs started decreasing at Around 5 000 individuals from the the beginning of 2015. Switzerland has EU were believed to have travelled to not recorded any new departures to conflict areas in Iraq and Iraq and Syria. conflict zones since 2016. The number By late 2017 the number of people of departures from Belgium in 2017 from Europe fighting in IS may have was described as “limited or non- been as low as 2 500. It was thought existent”. that about 1 500 foreign terrorist The Netherlands reported that the fighters (FTFs) returned home and decline in successful travellers was 1 000 were killed. Belgium, Germany, evident and steady. However in France and the UK were the major June 2017 a Dutch man succeeded source countries. Hungary asserts that in travelling to Syria to join IS (the around 1 000 individuals from the first time since November 2016 that Balkan states joined IS between 2014 someone was able to reach the conflict and 2016 and expects a significant zone). Before his journey, there number of them to return to their were no apparent indications of his former home countries, facilitated by radicalisation. Spain also reported that organised crime groups engaged in the flow of travellers had decreased illegal migration. significantly. Over 2017 Poland did In 2017 there were considerably fewer not note any departures or returns EU-based FTFs travelling to conflict of Polish FTFs (however an FTF of zones and a diminishing number of Chechen origin with refugee status in returnees. Due to the military situation Poland was detained in 2017, charged in Iraq and Syria, it appeared to have with participation in a foreign military become even more difficult to leave organisation and illegal possession of IS territory. After losing control of weapons and ammunition). significant terrain, some IS members Despite this apparent reduction in were however seeking to leave the travellers, it should be underlined that combat zone, either to return home, IS, al-Qaeda and other jihadist groups, or to travel to other conflict areas continue to pose a major threat. They (for example to Afghanistan; within have the ongoing intent and capability the Middle East and North and West to conduct terrorist attacks against the Africa; Central, South or Southeast West. JIHADIST TERRORISM 27

RETURNEES Although no concrete examples to action – including via propaganda were available, Bulgaria reported its outlets – have comprised specifying EU Member States reported that concerns of being used as a transit attacks on civilian targets by means of returnees to Europe may have a route, i.e. the possibility of FTFs or new methods, including those tested certain amount of combat and linked individuals passing through in the conflict zones. This poses a operational experience; gained an Bulgaria on their way to and from significant challenge to the authorities enhanced capability to commit acts Syria, but due to entry bans for Turkey, in terms of setting up counter- of terrorism; and be particularly they were returned back to Bulgaria. measures. Moreover, IS sympathisers dehumanised and prone to violence Hungary reported that up to 2017, FTFs in Europe, in contact with individuals upon their return. They also serve as used their country mainly for transit in abroad who have the required skills role models and might be involved order to reach the conflict zones or to and mind-set to commit acts of in recruiting and radicalising others. travel back using the Balkan route to terrorism, may become involved in Furthermore, returnees and other their Western Europe-based contacts. planning or support activities. One extremists in prison may encourage They also stated that based on 2017 of the most significant threats posed inmates to ultimately travel overseas data, it was apparent that several by those who have travelled to the to fight or conduct other terrorist of these individuals or groups spent Syrian conflict zone comes from activities. considerable periods in Hungary. From jihadists in conflict zones that engage Belgium, for example, reported that time to time Romania has been used in planning attacks against Europe or the number of returnees was very as a transit area or secondary route incite others to do so. However, the limited in 2017 (amounting to only five for FTFs travelling to and from Iraq ability of such individuals to continue fighters, some of whom had already and Syria (albeit that they noted the this kind of activity in theatre is likely been detained in prison in Turkey since descending trend as with the rest of to be reduced due to the impact of 2016). However, Belgium also reported Europe). Between January 2013 and increased military pressure, loss of that currently the phenomenon of November 2017 Portugal asserted cohesion, lack of infrastructure and home-grown terrorist fighters seemed that their territory was used as a reduced access to resources. to be a greater threat than that transit platform by a total of 12 (non- As noted above, recent attacks in emanating from returnees. Denmark Portuguese) FTFs on their way to the Europe have, for the main part, been expected that only a limited number conflict areas (including nationals from committed by lone individuals who of its FTFs would return. Although in France, Morocco, Poland, Russia and have not been to a conflict zone – total Denmark observed approximately the UK). In addition Poland indicated but who may have been inspired 50 returnees from Iraq and Syria, that in 2017 militants involved in by terrorist propaganda and/or the the number continued to decline in the conflict in the Middle East were extremist narrative, as well as by other 2017. Denmark also reported that a examining the possibility of crossing successful attacks worldwide. This was number of travellers no longer had the Polish-Ukrainian border to reach evidenced by several successful attacks their passport or residence permit, other EU countries. Border pressure in the UK during 2017, for example, the and returning to Denmark became and logistical considerations have also attack on Westminster Bridge, London, less attractive given the prospect of made it more difficult for aspirant in March. Furthermore, the attacks criminal prosecution. Switzerland attack operatives to travel from Syria in Barcelona and Cambrils in Spain in reported only three returnees over via Turkey into Europe. August 2017 – although not committed the reporting period. Overall, the by FTFs – were reported as being Netherlands reported some 46 ideologically linked to IS. In addition, returnees from 2012, but only four ACTIVITIES ON RETURN TO Spain also reported that in June 2017 in 2017, but also that returning from EUROPE a Danish citizen – who had been in the the conflict zones had become very As IS gets weaker, it has been urging its conflict zone between 2012 and 2015 – difficult, and that they were aware of followers to carry out lone actor type was arrested in Spain, having travelled Dutch men and women who had the attacks in their home countries, rather from Denmark, possibly in order to intention to leave Syria, but who were than guiding them to attempt to travel purchase a weapon (presumably to not actually able to do so. to the so-called caliphate. Exhortations carry out an attack). Italy, for example, TESAT 2018 28

stated that one of the main sources TRAVEL OF WOMEN AND of terrorist threat to them included CHILDREN potential sleeper cells from the external Austria noted that a number of women operations units of IS or al-Qaeda and (including minors), left or wanted to “affiliated” organisations inspired by leave for the war zone. They reported jihadist ideology. In 2017, investigations that contacts were established via in Italy led to 26 arrests for terrorist the internet and by friends and offences: including for recruitment (on acquaintances. Some of the women behalf of IS), sharing IS propaganda, married foreign terrorist fighters under providing logistic support to a terrorist Islamic law, sometimes via social media. organisation, and facilitating the The UK also reiterated that there was movement of FTFs to jihadist combat an increase in the number of women, zones. families and minors engaging in the Germany reported that on 12 April conflict, although they remained a small police officers arrested a 31-year-old proportion of overall travellers. Syrian member of IS. It was alleged The Netherlands reported that there that he travelled to Germany with the were indications that Dutch jihadists aim of recruiting members, as well in Iraq or Syria – mainly women and as coordinating terrorist cells already minors – were in refugee camps or in active in Europe to carry out attacks on the hands of non-jihadist combatants. unspecified targets. The Netherlands assessed that in the Furthermore, between February and near future a number of men, but November 2017, the Swiss authorities mainly women and/or minors, would arrested individuals on terrorism probably attempt to reach to the charges for preparing and facilitating Netherlands (potentially also posing as jihadist travel to the Iraqi-Syrian conflict victims in order to deflect authorities’ zone; for providing financial support to attention). Moreover, Belgium asserted to assess whether potential terrorists IS; for the radicalisation of a number that the returning wives (and children) have been smuggled in systematically of persons from Italy and Switzerland; of jihadists also caused concern, due via these flows. They did, however, for travelling to the Iraqi-Syrian conflict to the reported involvement of female state that in several cases the zone; as well as for association and activists in preparing attacks. suspicion that certain individuals were support of terrorist organisations. members of a terrorist organisation Consequently, the presence of both was substantiated, and that some In 2017 various Dutch or Dutch returnee men and women, and to an individuals who came to Austria along speaking jihadists, including members extent minors (who together with their with the migrant flows were arrested of both al-Qaeda and IS, threatened to parents have stayed with FTFs/jihadists for suspicion of supporting, or being a commit attacks against the Netherlands in the conflict zone, or have themselves member of, IS. or called upon others to do so, both undergone indoctrination and military online and offline. In a number of cases, training) are believed to comprise a Investigations in Greece and Italy also the threats seem to have originated continuous threat to security. did not support the suggestion that from Syria. The Netherlands reported terrorists were systematically using the that IS in particular continued to make migrant flow in 2017 – but they could full use of the network that foreign USE OF IRREGULAR not rule out the possibility that these jihadists in Iraq and Syria had access to, MIGRANT FLOW flows and/or posing as refugees might in their home countries. be used as a method in the future to As previously reported, terrorist use of enter Europe. Romania reported that Finally also of note, is that jihadists the migrant flow has been observed, the activities which facilitate (illegal) located in different (non-European) but it is not deemed systematic. migration from the conflict areas do locations may increasingly focus on Austria reported that it was particularly not appear to have ties to terrorist attacking local Western targets, as it affected by migrant flows emanating organisations, and are mainly financially becomes increasingly difficult to travel from the conflict areas of Africa and motivated. to conflict zones such as Iraq and Syria. Asia, but there is not enough evidence JIHADIST TERRORISM 29

Numerous IS videos produced during 2017 reiterated the urgency of carrying out retaliatory attacks against the West, and their publications emphasised the atmosphere of terror and panic in the aftermath of attacks carried out in Western countries. IS continued to encourage individuals to carry out terrorist attacks in countries of the anti-IS coalition, with whatever means they have at their disposal, including bladed weapons, vehicles and arson, which, were explicitly suggested in IS propaganda, among other things. For much of 2017 IS was quick to claim that attacks had been committed in its name and to take responsibility, despite a lack of substantiating evidence. In several cases the subsequent investigations did not bring to light a link to the group, such as with regard to the mass shooting on 1 October targeting an open air concert in Las Vegas, USA, which killed 58 people and injured several hundred. IS was quick to describe the perpetrator as a “soldier of Finally it has been assessed to be more as a natural reaction to the perceived the caliphate” in an official statement difficult now for terrorists to exploit injustice suffered by Muslims. For and as an “IS soldier” in A’maq News the migrant flow, owing to increased example, in an audio speech published releases, alleging that he converted security measures, such as intensified on 7 May, Qasim al-Raymi, the leader to Islam several months before the control of EU borders. Nonetheless, of al-Qaeda in the Arabian Peninsula attack. By the time of writing, however, travel to Europe may still be possible, (AQAP), called for lone actor attacks no evidence of a jihadist motivation for instance via third countries using in the West in retaliation to tragedies of the perpetrator or links to IS have stolen or forged travel documents. suffered by Muslims around the world. come to light. IS also claimed an attack Such attacks, he explained, would have on a casino in Manila, the Philippines, a deterring effect on the West’s actions on 2 June 2017 which killed at least 36 INCITEMENT OF LONE ACTOR in Iraq, Syria, the Arabian Peninsula people. The Philippine National Police, ATTACKS IN THE WEST (i.e. Saudi Arabia and Yemen) or Asia. however, stated that the attack more The group also published a new issue likely had a criminal background. A continuing point of similarity between of its English-language electronic al-Qaeda and IS is the explicit call for magazine Inspire in August, in which it lone offenders to target civilians in the praised lone actor attacks in the USA West. Over 2017, the two major jihadist and suggested modus operandi for the organisations disseminated operational perpetration of attacks. manuals with instructions on how to carry out these attacks. The differences IS considerably more ruthless rhetoric lie in the way in which they convey the purports to be embedded in Islamic message and the justifications provided. eschatological tradition, the idea Al-Qaeda bases its propaganda on that the final confrontation between political grievances, uses a softer tone good and evil is approaching and and justifies the lone actors’ attacks every individual must choose sides. TESAT 2018 30

TERRORIST USE OF THE INTERNET AND SOCIAL MEDIA Online propaganda continues to be an essential part of jihadist terrorist attempts to reach out to EU audiences for recruitment, radicalisation and fundraising. The often rudimentary and fragmented knowledge of Islam of aspiring jihadist terrorists, derived from religious texts selected to fit a violent ideology, makes them vulnerable to being influenced and used by those who misuse religion to incite violence. The serious losses that IS sustained in territory and human and material resources in 2017 had a significant impact on the organisation’s media production capabilities. The IS media department was forced to relocate and restructure. The increased military pressure resulted in a noticeable disruption of its media activities and a marked decline in the quality and quantity of content production, especially in the second half of 2017. By December however, the IS media Since its creation in 2014, A’maq News 2017. Al-Naba’ and Rumiyah, although network began showing signs of had acted as an independent news addressing different audiences, had recovery and increased its content outlet, pretending to be a journalistic the similar goal of setting and adjusting output slightly. organ. By 2016 it had become one of the organisation’s political discourse the main tools for IS to claim attacks, and highlighting significant ideological Nevertheless, IS media appeared to including lone actor attacks in western developments. Additionally, al- have remained centralised in 2017 countries30. IS officially endorsed A’maq Naba’ provided in-depth information despite the evident damage caused to News in July 2017. The Nashir Agency on military advances and practical its media infrastructure. The weekly is also suspected of belonging to the IS guidance on how to carry out terrorist al-Naba’ newsletter, for example, media apparatus, although it has not attacks. With the interruption of continued to state on its front page been formally or publically endorsed by Rumiyah, the organisation’s ability that it was produced by IS’s “media the IS. to reach out to non-Arabic speaking Diwan [ministry]”. IS provincial media audiences outside and inside Iraq and outlets that generated higher media By the end of 2017, IS’s main publication Syria significantly decreased. output in 2017 appeared to match remained the weekly Arabic newsletter with regions witnessing heightened IS al-Naba’ (“the news”). Starting in 2016 In addition to the decrease in military activity. In these areas local IS the organisation launched Rumiyah). propaganda production, IS online media staff likely maintained smoother In 2017, Rumiyah was published in dissemination capabilities were heavily communication means with the various Bosnian, English, French, German, curtailed by the increasing disruption central media mouthpieces. Apart Indonesian, Kurdish, Pashto, Russian, efforts led by social media companies from al-Naba’, in 2017, IS officially Turkish, Urdu and Uyghur on a near working jointly with law enforcement endorsed propaganda outlets were monthly basis. However, the publication agencies and government bodies. This the A’maq News Agency, the al-Hayat however ceased after its 13th issue, clampdown resulted in further and Media Centre, the al-Furqan Media which was released on 9 September more extensive disruption of IS activity Production Company, the al-Ajnad on a number of major social media Media Production Company, the al- platforms. 30 Europol, EU Terrorism Situation and Trend Report Himma Library and al-Bayan Radio. (TE-SAT) 2017, 2017, pp. 26-30. JIHADIST TERRORISM 31

In 2016 a large proportion of IS tools which ensure anonymisation of sympathisers had already migrated communication (e.g. TOR Browser, from their main hubs on Facebook TAILS OS) on specific IS propaganda and Twitter to Telegram, an encrypted sites and some Darknet sites in order messaging application perceived as to safeguard the interests of their more secure and less law-enforcement sympathisers when accessing online friendly. 2017 saw them move further terrorist propaganda. The need for from public Telegram channels to increased secrecy also led online private and closed chat groups, for sympathisers to revert to blogs and which a link key – available for a traditional web forums, more adapted short period of time and shared on for peer-to-peer mentoring, as well as associated channels – is needed to to smaller platforms with less capacity gain access. Due to this mechanism, for – or focus on – carrying out combined with the fact that disruptive procedures. information on Telegram can neither At the same time, sympathisers of be searched (without prior access to terrorist organisations (IS and al- the given channel) nor indexed by Qaeda) continued to take advantage search engines, Telegram remained of cryptocurrency adoption. IS, for a relatively safe haven, albeit with example, triggered cryptocurrency limited outreach and recruitment donation campaigns (e.g. Bitcoin potential. As a result Telegram is donations) in IS-affiliated websites, largely used for community-building, as well as in chat environments (e.g. discussing targets and methods of Telegram), in order to raise funds. attacks, advertising links to material posted on more accessible platforms The decrease in official IS propaganda and coordination of so-called media in the last quarter of 2017 spurred raids (ghazawat i’lamiyya) to be IS supporters into producing more launched on Twitter and other social user-generated – and translating media platforms. For example, the pro- older – content (UGC), thereby IS Nashir Telegram channel, stressing blurring the distinction between the need to reach out to wider official and unofficial activism. audiences, increased its calls to IS Indeed, despite retaining a close supporters, starting in late March 2017, group of core sympathisers for to occupy popular platforms such as reasons of authentication, IS has Facebook, Instagram and Twitter and gone to great lengths to glorify has itself repeatedly attempted to set information warfare and repeatedly up accounts on these platforms. encourages sympathisers to become more active online. The IS’s supple In order to counter the large-scale definition of media operatives – which closure of IS supporter accounts encompasses the organisation’s “war on various platforms, dedicated correspondents” as much as online volunteers have been working for propagandists – and the possibility of the past few years on building a pool taking part in active, yet lower-risk, of accounts (Al-Ansar Bank or “bank activism has encouraged many to join of supporters”) on Facebook, Gmail, the circle of these “martyrdom-seekers Instagram and Twitter. These accounts without a belt”. This strategy seems enable IS sympathisers to bypass to have been designed to bolster the the registration process, thereby resilience of IS’s online media model. ensuring their anonymity, and to Most of this UGC focuses on praising retain an online presence when their the attacks perpetrated by IS affiliates, accounts are shut down. Similarly, or on inciting Muslims in Western IS sympathisers continued to invest countries to take part in the struggle. resources into promoting open source TESAT 2018 32

Other sympathisers focus on archiving historical content (including on the Darknet) and creating clearinghouses and libraries, with some providing bespoke services. The importance of these archivists has grown as the organisation lost the ability to dominate the online space with large quantities of new material. As a result, IS retains an extensive archive of material across a variety of online platforms. In 2017 it became increasingly difficult to locate terrorist content in English on major social media platforms, such as Facebook and Instagram. This is both because English content was taken down more quickly and less material was produced in the English language. Arabic content, by contrast, as well as emotive chants anashid( ) and non- visual content, was still widely available and accessible on Facebook and YouTube. This may be because social media companies have, in general, been is an integral part of the propaganda It is safe to say that the IS core quicker to respond to videos containing message and is in many ways more narrative, namely the establishment extreme violence than to speeches insidious. Indeed jihadist organisations of a functioning caliphate, failed in or ideological treatises produced by have long realised the importance of 2017. Likewise its focus on apocalyptic terrorist groups but which feature no garnering more followers and appealing eschatology (and the Dabiq discourse31) explicit calls to violence. Similarly, social to those who would otherwise shy away lost much of its resonance. Instead media companies’ focus on removing from these groups’ brutality, but who of conceding defeat, however, the violent content produced mostly by are nevertheless moved by the idea of a organisation attempted to reframe IS has led to material produced by its global Muslim community (umma) and how it defined victory. It professed the rivals, such as al-Qaeda or Hay’at Tahrir caliphate. inconsequentiality of territorial control al-Sham, becoming more visible. For and emphasised the prophetic nature In terms of narrative, the discourse instance, al-Qaeda released several of the “trials and tribulations” that it promulgated by the major jihadist recordings of Hamza bin Laden, a son faced, stressing that these were proof groups (IS and al-Qaeda) remained of al-Qaeda founder Osama bin Laden, that the group was on the right path largely constant over 2017, although in 2017, including a speech in May in and that victory was imminent. In a a few changes were noted. IS which he called for lone actor attacks further show of denialism, IS focused propaganda, in particular, witnessed in the West. The organisation might on documenting raids carried out by a significant thematic shift since 2016. want to attempt to exploit his name its fighters on remote army outposts Idyllic depictions of governance and in order to regain prominence on the in Iraq and Syria in an attempt to prove civilian life in the caliphate dropped international stage. that it still held sway over strategic considerably. These were replaced by areas and that mainstream media was In this context, it is worth noting that a defensive and defiant discourse and merely peddling fake news to damage only a fraction of terrorist propaganda a stronger focus on victimhood and sympathisers’ morale. (both for al-Qaeda and IS) features resilience. Just as it does for al-Qaeda, ultraviolent videos. The larger portion IS ideology rests on a strong sense Whereas IS propaganda continued of propaganda material has focused of injustice. More than in previous to present the group’s choices as the on community projects, religious years, propaganda released in 2017 only true interpretation of Islam, a preaching or even poetry recitals. The told a story of existential conflict, in promise is that of a culturally engaging which Sunni Muslims are portrayed as 31 environment where redemption is the primary victims of a coalition of Including the final battle between good and evil which according to Islamic tradition will take place possible. As such, non-violent material Christians, Jews and Shi’i Muslims. in Dabiq in northern Syria. IS lost Dabiq to Turkish troops in 2016. JIHADIST TERRORISM 33

In contrast to al-Qaeda, which conceded that women were allowed to fight but never encouraged them to do so, IS appeared to be openly calling on women to take up arms. An article published in al-Naba’ on 5 October, entitled “The duty of women fragmentation on ideological grounds in [waging] jihad against the enemies”, within IS also came to the fore in 2017. encouraged women to take part in In May, the Delegated Committee32 armed action. This followed on from issued a circular which attempted an article published in Rumiyah in July, to set out the group’s approach to in which the “courage and sacrifice” of takfir, the act of declaring other women who fought alongside Prophet Muslims unbelievers, which for IS is a Muhammad are given as examples justification for their killing. In addition, for today’s mujahidat to emulate. The several doctrinal IS publications were 2011 and due to a failed experience call to take up arms came as IS was declared void. The May circular argued in Yemen – not to alienate local haemorrhaging territory and marked that takfir was a foundation and an populations and instead to embed a shift away from its earlier discourse obligation of the Islamic faith and itself into local insurgencies in order to where women were described as held the opinion that ignorance in this court local appeal and establish robust essential but in which their supportive matter was not excusable (a principle support bases. Al-Qaeda leader Ayman role was emphasised (mainly providing roughly equivalent to ignorantia al-Zawahiri in particular appeared to be financial support to jihad, taking care of juris non excusat). In practice this conscious of the importance of popular their husbands and producing children). interpretation means that anyone support and continuously advised Nevertheless, as is evident in Rumiyah doubting the judgements of IS with against actions that would antagonise Issue 12, a woman’s default role is still regard to the definition of the enemy Muslim masses. This was made obvious that of a home-maker and caretaker of would himself be liable to be killed. in the code of conduct issued by her family. al-Qaeda in the Indian Subcontinent A number of indications, including an Moreover, IS promotes the idea that al-Naba’ (AQIS) in June 2017 – and drafted in article published in in mid- every Muslim, regardless of his/her consultation with al-Zawahiri – which June, which hinted at the apostasy of IS physical condition, can play a role in forbade carrying out operations that leader Abu Bakr al-Baghdadi, suggest jihad. It has issued at least three videos have the potential to alienate the that the memo exacerbated simmering in recent months featuring disabled masses. As such, it sees itself more as conflicts within IS, which ultimately fighters to reinforce this argument. led to its repeal. A circular published a spiritual spearhead and recognises in October 2017, supposedly after a advantages in letting locals take IS propaganda also continued to shift in personnel within the Delegated command over issues of security and showcase minors and children, Committee, revoked the earlier governance. thereby stressing the importance of handing down the message to future previous memo and reinstated the Another interesting element to note generations. Videos featured children earlier IS ideological guidelines. is the evident development in the taking part in religious and military way terrorist movements reach out A major contrast in narratives between training. On a few occasions, they were to – and attempt to engage and recruit al-Qaeda and IS lies in the fact that the also filmed carrying out extra-judicial – women. IS female sympathisers in former has taken great pains – since executions of prisoners. IS teaches particular have successfully made use these children IS ideology to prepare of the internet to mentor and mobilise 32 The al-Lajna al-Mufawwada (“Delegated them for their role on the battlefield Committee”) is the highest decision making body other women. within IS after the caliph. and to reinforce their determination. TESAT 2018 34

Terrorist situation outside the EU33

33 This section is largely based on open sources.

Members of Albanian, Bosnian and regarded a viable terrorist threat. Roma minority communities are The same applies to jihadist groups predominant in jihadist groups in in the country, although some of Serbia. The country also reported their members, in particular returned propaganda activities being recorded FTFs, possess knowledge and skills in 2017, both through personal that could be used for terrorist contacts in informal religious groups, purposes. Moderate groups oppose from some informal religious venues violent methods and seek to distance as well as via the internet and social themselves from radical elements in networks. These propaganda activities their midst. were aimed at the radicalisation and Bosnia and Herzegovina asserts that recruitment of new members for up to December 2017 approximately terrorist organisations. Increasingly Western Balkan 300 persons had travelled from the women are being approached, as well country to Iraq and Syria. As per 31 as members of the Roma population. countries December 2017 an estimated 107 were Spouses of radical Islamists are found still in Syria, of whom 61 men and to be very active in recruiting other 46 women. It is believed that by that None of the Western Balkan countries women. date 41 FTFs had returned to Bosnia have reported acts of jihadist terrorism However, in 2017 there was a and Herzegovina and that 71 FTFs having taken place in their territories significant decline in activities aimed had lost their lives. In 2017 only one in 2017. Kosovo34 reported a decline at recruiting persons for terrorist (failed) attempt has been recorded of in jihadist propaganda activities and organisations in Iraq and Syria. This an individual attempting to travel from no apparent cases of financial or decline was – apart from the military Bosnia and Herzegovina to the conflict logistical support of terrorist groups. defeats and territorial losses of areas. In Bosnia and Herzegovina The country shares its concerns IS – at least in part caused by the there is little reporting to indicate about the possibility of returning FTFs arrest of a group of people in 2014 that extremist groups susceptible from the conflict areas with EU and who participated in the recruitment to violence have an organised and non-EU countries. In 2017 Kosovar and dispatching FTFs to the Syrian systematic network structure. Indeed, authorities initiated a total of 54 battlefield. No new cases of foreign there is evidence that within the cases on suspicion of participation in terrorist fighters were recorded in extremist groups there are factions terrorist activities in Iraq and Syria. 2017. with different religious and ideological These include cases in which there beliefs, creating opportunities for was no evidence of involvement of Montenegro reports the presence internal disagreement and disputes. its nationals in fighting in the conflict of several radical groups in its areas. Arrests made in Kosovo were jurisdiction, of which two groups are primarily based upon suspicion of most exposed: takfiris and jihadists. engagement in propaganda activities. Takfiris are seen as being very rigid in the interpretation of the basic Islamic postulates and perform 34 This designation is without prejudice to positions religious rituals by strict Sharia rules. on status, and is in line with UNSCR 1244 and They distribute various propaganda the ICI Opinion on the Kosovo Declaration of independence. materials via the internet but are not JIHADIST TERRORISM 35

statement by the IS leadership claiming a woman hostage in an apartment responsibility for the attack was issued. building near Melbourne, after having killed another person at the building On 11 December a 27-year-old entrance. The perpetrator was shot Bangladeshi man legally residing in the and killed by police. He reportedly USA detonated, probably prematurely, shouted “This is for IS. This is for al- a person-borne IED (PBIED) in an Qaeda”. IS claimed responsibility for underground passage in Manhattan. the attack through a message issued The blast injured three people. The by A’maq News, which described the perpetrator was arrested and admitted perpetrator as an “IS soldier”. In an to carrying out the attack in support article in al-Naba’, the group claimed of IS and in protest against United that the “caliphate soldier” killed one States (US) policies, including in the “crusader” and engaged in a fight Middle East. He began his radicalisation with police officers, injuring three of North America and process in 2014 and appeared to them before being killed. The attack have been influenced by IS calls on its was also praised in Rumiyah. The Australia supporters to perpetrate attacks in perpetrator had been charged in 2010 their countries of residence, should over an alleged terrorist plot but was they be prevented from travelling to acquitted. At the time of his death, he In 2017 the USA suffered a number join IS. The attack was mentioned by was on parole for offences unrelated to of attacks for which IS claimed IS in al-Naba’, but only by reference to terrorism. responsibility, without providing Western media reports according to evidence of its direct involvement. Two which the perpetrator stated that he On 29 July 2017 two brothers of attacks in New York City were clearly was an “IS soldier”. However, IS failed Lebanese origin were arrested on inspired by IS. On 31 October a 29-year- to officially confirm this in any other suspicion of plotting a major attack. old Uzbek citizen legally residing in way. They had planned to detonate an IED the USA, drove a rented truck into a aboard an airliner flying from Sydney In Canada, a 30-year-old refugee from walkway in Manhattan, killing eight to Abu Dhabi in mid-July. The plot Somalia deliberately struck a police people and injuring 12 others. After failed because they failed to check in officer on traffic duty in Edmonton, crashing into a school bus, he exited a bag containing an explosive device Alberta, with a van on 1 October, the vehicle brandishing imitation for the targeted flight, on which a third before trying to stab him with a knife. firearms, before being shot and brother travelled. They had received The perpetrator initially fled on foot, arrested. A note claiming the attack the explosive device from an IS then acquired another vehicle, with on behalf of IS was found in the truck. contact via mail from Turkey. After the which he subsequently injured another The perpetrator, who was known for failure, the brothers started planning four people, before being arrested. minor offences, but not for terrorism, an attack using a chemical dispersal The attack was not referred to in IS deliberately chose the date in order device, which was disrupted by their propaganda. However, reportedly, an to target civilians during Halloween arrest. The brothers in Australia were IS flag was found in the car used for the celebrations. In its weekly newsletter in contact with a fourth brother, who al-Naba’ attack on the police officer. , IS described the perpetrator allegedly was an IS commander in Syria. as an “IS soldier”, however no separate In Australia, on 5 June, a man took

the perpetrator followed guidelines Russia given by al-Qaeda leader Ayman al- Zawahiri. The claim was denied by a media outlet of the al-Qaeda-linked On 3 April 2017 a suicide attacker Caucasus Emirate. detonated a bomb on a train in Saint Petersburg killing 14 people. The On 19 August a man stabbed several suicide bomber was identified as a passers-by in the Russian city of 22-year-old naturalised Russian citizen Surgut. In an A’maq News statement, born in Kyrgyzstan. The bomb was IS described the perpetrator as an “IS reportedly an improvised explosive soldier”. A video published three days device using commercially available after the attack by IS media outlet to have had ties with radical Islamists. Furat showed the perpetrator pledging explosives. Another device, planted The attack was claimed by a hitherto at another metro station, allegedly allegiance to IS, stating that he was unknown group using the name Imam happy to die as a martyr and calling for by the same perpetrator, was found Shamil Battallion, which alleged that and defused. The perpetrator is said more knife attacks. TESAT 2018 36

the man suspected of preparing a Turkey bomb attack had been detained in a counter-terrorism operation. During his transfer to the police headquarters After a series of attacks in Turkey he was able to attack and kill the claimed by or attributed to IS in 2015 officer with a knife, before being shot and 2016, which culminated in the 31 dead by a fellow policeman. December 2016 attack on a nightclub in Istanbul that killed 39 people, no IS propaganda in 2017 continued major terrorist attack was carried out calling for the killing of members of by IS in Turkey in 2017, although the the Turkish government, including threat of lone actor attacks persists. Turkish President Receb Tayyip Turkish security forces arrested Erdoğan, Turkish religious institutions hundreds of suspected IS members in and Muslim groups which IS consider Turkey, partly on suspicion of planning apostates. In addition IS accused terrorist attacks throughout the year, Turkey of killing Muslim civilians, including prior to the 2018 New Year including children, and of collaborating celebrations. On 13 August 2017 a with the “enemies of Islam” in Syria. Turkish policeman was stabbed to Official IS publications featured death in Istanbul by an alleged IS pictures of Turkish soldiers killed in member. According to Turkish media, Syria.

These included European nationals. carried out with unmanned aerial Iraq and Syria They were said to have surrendered vehicles (UAV) commonly known as with their husbands to Kurdish forces, drones. Footage allegedly taken by who then handed over the women and these UAVs showed the apparently Two years after it reached the limits of children to Iraqi authorities. Male IS successful dropping of explosive its expansion in mid-2015, IS lost most fighters were said to have remained in devices on enemy targets. of the territories that it controlled in captivity with the Kurdish forces. Iraq and Syria. In Syria IS also lost most of its territory In reaction to the offensive on Mosul, in the course of 2017. Control of IS’s In Iraq, after a military campaign that IS increased the number of large scale main stronghold in Syria, al-Raqqa, started in October 2016, Iraqi armed was achieved by the Syrian Democratic forces and allied militias took full Forces (SDF)35 by October 2017. Prior control of Mosul in July 2017. More to the conquest, hundreds of Syrian than 800 000 inhabitants fled the IS fighters left the city according to fighting, and it was reported that IS human rights activists, while foreign was deliberately targeting civilians. fighters remained. Following an Tal’afar, located between Mosul and agreement with the SDF, IS fighters the Syrian border, was recaptured and their families left the city on 15 in late August 2017. Hawija, the last October, retreating south along the significant town under IS control in Euphrates River. Between 200 and Iraq, fell in early October. In December 300 IS fighters reportedly remained 2017 the Iraqi government declared in the city. On 17 November, the SDF that it had achieved victory over IS in declared that they had complete Iraq. terrorist attacks in Iraq, targeting in control of the city. particular the Shi’i majority population Several hundred foreign IS members, In early November the Syrian army and Iraqi security forces and militias including large numbers of women and its allies with Russian air support allied with it. The attacks aimed to and children, were captured after the reportedly expelled IS completely increase the tensions between Sunnis fall of IS-held territory in Iraq. Some from the Dayr al-Zawr province. On 9 and Shi’is in Iraq and to destabilise the foreign nationals were sentenced to November, the city of Al-Bukamal on fragile security situation in the country. death or imprisonment by Iraqi courts. the Iraqi border was taken by Syrian By summer 2017 the rate of attacks in By September 2017 1 400 foreign regime troops. IS fighters evacuated women and children of presumed IS Iraq seemed to have diminished, but fighters were held in a camp south of large-scale attacks continued to occur. 35 The SDF is an alliance of Arab and Kurdish militias Mosul, according to media reports In late January 2017 IS propaganda dominated by the Kurdish Yekineyen Parastina Gel relying on sources in Iraqi intelligence. started showing attacks allegedly (YPG – People’s Protection Units) supported by the USA and other Western countries. JIHADIST TERRORISM 37

the city. By the end of 2017 IS territory Levant Free Men Movement) for this integration within the Syrian armed was reduced to a stretch of the purpose. Concurrently, other jihadist opposition. However, a significant Euphrates valley and the adjacent groups opposing the merger rallied faction of al-Qaeda loyalists rejected desert. around Harakat Ahrar al-Sham. This the break of relations with the mother rearrangement led to the formation organisation. On the Lebanese-Syrian border, the of two competing jihadist coalitions in Lebanese army launched an offensive In 2017, rumours continued to spread northern Syria. against an IS enclave in late August that al-Qaeda leader Ayman al-Zawahiri 2017, while Syrian army and Hezbollah Hay’at Tahrir al-Sham also experienced never gave his agreement to Jabhat al- forces attacked IS from the east. As splits in the course of 2017. Several Nusra’s severing of ties with al-Qaeda. part of the ceasefire agreement with factions declared that they left Apparently, the al-Qaeda loyalist the Syrian regime and Hezbollah, on Hay’at Tahrir al-Sham in protest faction was planning to establish a 30 August 2017, a convoy of IS fighters at its aggressive attitudes towards new al-Qaeda affiliate in Syria since the declaration of Jabhat Fateh al- left the Lebanese-Syrian border area other forces within the Syrian armed Sham. The tensions escalated after in direction of al-Bukamal. The convoy, opposition. One of the most prominent the deployment of Turkish military in which was escorted by the Syrian army was Harakat Nour al-Din al-Zinki Idlib province in mid-October 2017, and Hezbollah, was stranded in the (Nuruddin al-Zinki Movement), which to which Hay’at Tahrir al-Sham had Syrian Desert after anti-IS coalition broke away in late July in opposition to agreed. On 26 November 2017, Hay’at airstrikes attempted to prevent it from what it saw as unacceptable aggression Tahrir al-Sham launched a large-scale 36 against Harakat Ahrar al-Sham . In detention campaign against al-Qaeda early October former Jabhat al-Nusra loyalists in areas controlled by it in and Jabhat Fateh al-Sham leader Abu the Idlib province, Syria. In an audio Muhammad al-Jawlani succeeded Abu message published on 28 November Jabir Hashim al-Shaykh as leader of 2017 in the context of the detentions, Hay’at Tahrir al-Sham, showing Jabhat Ayman al-Zawahiri confirmed the Fateh al-Sham’s predominant position rumours that he had not agreed to within Hay’at Tahrir al-Sham. Jabhat Fateh al-Sham’s defection from al-Qaeda and asked Jabhat al-Nusra to Among jihadist ideologues, however, renew its pledge of allegiance to him. opposition to Hay’at Tahrir al-Sham He emphasised that this “breaking of also grew. Certain decisions taken by the pledge of allegiance” did not lead Hay’at Tahrir al-Sham were deemed to the aspired unity of the “mujahidin” to contradict jihadist principles. in Syria and did not stop the USA from reaching its destination. Abu Muhammad al-Maqdisi, a putting the new organisation on the In speeches published on the internet, leading Jordanian jihadist ideologue, terrorist list. Finally, Hay’at Tahrir the IS leadership called for supporters vehemently accused Hay’at Tahrir al-Sham had to stop its campaign in Australia, Europe, Russia and the al-Sham of “diluting” jihad by against the al-Qaeda loyalists due to USA and elsewhere to perpetrate compromising jihadist convictions, for heavy internal and external pressure, attacks in order to deviate its enemies’ example, by collaborating with Turkey. with several factions suspending its attention from the “caliphate lands”. activities within Hay’at Tahrir al-Sham The relation between Hay’at Tahrir They also praised the achievements and threatening secession. The events al-Sham and al-Qaeda has been of IS affiliates in countries beyond Iraq show the difficulty in accommodating ambivalent since the beginning. and Syria, in particular the Philippines. global jihadist factions within a broader Jabhat Fath al-Sham is the successor framework, which would entail the In Syria, relationships between organisation of Jabhat al-Nusra, which acceptance of compromise in rhetoric al-Qaeda-linked factions and the publicly broke its ties with al-Qaeda and deed. The events also show the rest of the Syrian armed opposition in late July 2016, declaring that it was continued influence of al-Qaeda leader remained complex and, at times, an organisation without ties to any Ayman al-Zawahiri through trusted tensions escalated into violence. In late external organisation. This public middlemen on the ground. January 2017 several fighting factions, disassociation from al-Qaeda appears including Jabhat Fateh al-Sham (the to have been accepted at the time by Levant Conquest Front), merged to the al-Qaeda leadership under the form Hay’at Tahrir al-Sham (the Levant promise that the relationship would Liberation Committee). The merger be continued in secret. This was likely was an attempt to unite al-Qaeda- done to eschew being labelled as a linked factions and local groups of proscribed terrorist organisation and jihadist orientation. Hay’at Tahrir facilitate the group’s cooperation and al-Sham was initially headed by Abu Jabir Hashim al-Shaykh, who defected 36 On 18 February 2018 Harakat Ahrar al-Sham from his position as senior commander and Harakat Nour al-Din al-Zinki announced their in Harakat Ahrar al-Sham (the merger under the name Jabhat Tahrir Suriya (Syrian Liberation Front). TESAT 2018 38

targeted Egyptian military forces, Egypt Christians and Sufi mosques. A series of assassinations of Coptic Christians in the northern Sinai led hundreds In Egypt, two German female tourists of families to flee the peninsula. The were stabbed to death and four other assassinations were not claimed, people, including a Czech woman, but in propaganda messages IS Sinai wounded in a hotel in Hurghada on 14 province had previously threatened July. The Czech woman later died as to kill Christians. In addition, one a result of her injuries. According to policeman was killed and three media reports the attacker, a 28-year- others wounded in a shooting on St old student from northern Egypt, was Catherine’s monastery in the Sinai the Coptic cathedral in Alexandria, tasked to attack foreigners by online on 18 April, which was claimed by IS. where the service was led by the contacts that claimed to belong to IS. In an attack on a Sufi mosque in the Coptic Pope who remained unharmed. He swam to the hotel beach, sat with northern Sinai on 24 November, 305 the women and had a conversation people, including many children and The security situation in Egypt’s in German, prior to the attack. He elderly people, were killed, according western desert remained of concern then swam to an adjacent hotel, to the official count. The assailants to Egyptian authorities, due to its where he also wounded two people, reportedly carried IS flags, but no claim proximity to Libya. For example, on before being apprehended. According of responsibility was issued by the 26 May an attack claimed by IS on a to German authorities, based upon group. bus carrying Coptic Christians near information from the appropriate Minya caused the death of at least Egyptian counterparts, there was no Christians were also targeted in 19 people. In response, Egypt carried evidence for a religiously motivated several attacks claimed by IS in 2017 out airstrikes on targets in Libya, from terrorist attack. in different parts of Egypt outside the where the attackers were said to have Sinai. For example, in Tanta, a city come. On 20 October according to an On the Sinai peninsula, the fight in the Nile Delta, a suicide attacker official statement, 16 policemen were against the local IS affiliate, the IS detonated his IED in a Coptic church killed in a shootout following a raid Sinai province, escalated in 2017, during Palm Sunday service on 9 April, on a supposed terrorist hideout in the with terrorist attacks followed by killing 27 people. Hours later a second Bahariya Oasis. violent repression. Numerous attacks attack which killed 17 people targeted

In particular the Libyan National Army North Africa (LNA), led by Khalifa Haftar and linked to the Bayda government, continued to expand in 2017 its control over In Libya the competition between rival territory to the south of Benghazi. After governments continued in 2017 despite seizing much of the oil-rich Gulf of Sirte the formation of the Government of in September 2016, it continued south National Accord (GNA) in March 2016, taking control of the Jufra district in based on a Libyan Political Agreement early June 2017. In addition, in July signed in December 2015 in the 2017 the LNA announced that it had Moroccan coastal town of Skhirat. achieved victory over the factions The GNA, which is led by a Presidency controlling parts of Benghazi city. Council and is the internationally recognised government of Libya, Despite several attempts to struggled to consolidate its position. international mediation to achieve Powerful militias and local warlords a ceasefire between the parties, the siding with either of the two other military confrontations between the Libyan governments – the officially rival blocks increased in 2017 and were dissolved Government of National accompanied by accusations of war Salvation (GNS), mainly supported crimes committed by different parties. by Islamist factions, in Tripoli in the The chaotic situation in Libya severely west of the country, and the House of hampered counter-terrorism efforts. Representatives and its government After the expulsion of IS from the in Bayda in eastern Libya – continued coastal town of Sirte in December competing for control of territory and 2016, which it had seized in early resources. JIHADIST TERRORISM 39

2015 by forces linked to the GNA, In late May 2017 Ansar al-Shari’a in remaining IS fighters retreated to Libya, a local ally of al-Qaeda, declared desert areas. From there the group its dissolution, stating that others continued perpetrating attacks in areas would need to continue the fight. The south of Sirte and the Jurfa district. group’s decline, which had started By late August IS had become more in 2015, was probably linked to the assertive again, staging checkpoints growing influence of IS in the country. in the LNA-controlled Jufra district It is likely that former members of and perpetrating terrorist attacks in Ansar al-Shari’a joined jihadist factions populated areas along the coast. These in western Libya. The low profile terrorist activities continued for the adopted by al-Qaeda in Libya is in line remainder of the year. with its official strategy of creating alliances with local groups.

by the leader of Ansar al-Din, Iyyad Agh (MINUSMA) troops. These included two Sahel and Nigeria Ghali, who in the foundational video attacks on UN camps in Douentza and pledged allegiance to the leaders of Timbuktu on 14 August which killed at The security situation in Mali remained AQIM, the al-Qaeda central leadership least 19 people. and the leadership of the Taliban. The precarious in 2017, with frequent Foreigners continued to be targets merger was subsequently endorsed attacks by jihadist groups targeting of attacks or hostage taking. On 18 in public statements by AQIM and Malian and foreign military forces June JNIM attacked a tourist resort the al-Qaeda central leadership. In its present in the country. For example, on in Kangaba near the Malian capital statement, AQIM linked the approval of 18 January 2017 77 people were killed Bamako, which was popular with the merger with hopes for new attacks in a suicide attack using a vehicle-borne Western citizens. Five people were in France. improvised explosive device (VBIED) on killed, including two French citizens and a military camp in Gao during morning a Portuguese soldier working for the EU assembly. The camp housed Malian Training Mission Mali. government soldiers and former rebel forces conducting mixed patrols under In a video published on 1 July albeit not the Joint Operational Mechanism, a under the al-Zallaqa Media label, JNIM UN-brokered peace agreement. On declared that at that moment in time it the same day, a statement was issued held hostage six foreign nationals from by the al-Andalus Media Production Australia, Colombia, France, Romania, Company, the official media outlet South Africa and Switzerland. These of al-Qaeda in the Islamic Maghreb included a Colombian nun, kidnapped (AQIM), which specified that the on 7 February in southern Mali close attack was conducted by a member to the border with Burkina Faso. She of the al-Murabitun brigade of AQIM. To mark its autonomy and remained in captivity throughout the Al-Murabitun (those who are lined up programmatic orientation, JNIM year. [against the enemy]) had split in 2015 created a new online brand with a In addition, the faction of al-Murabitun into a faction pledging allegiance to IS centralised media outlet, the al-Zallaqa that pledged allegiance to IS, now and another one that remained loyal to Media Production Company, named commonly known as the Islamic State AQIM. after the Battle of Sagrajasal-Zallaqa ( in the Greater Sahara, continued to be in Arabic) in Spain in 1086, in which In early March 2017 Ansar al-Din (also active in the border region between Christian forces were defeated by a known as Ansar Dine, “supporters of Burkina Faso, Mali and Niger. On 4 Muslim army. the religion”), al-Murabitun and AQIM’s October 2017 it attacked a unit of Sahara division merged under the The merger led to improved Nigerien and US Army Special Forces, name Jama’at Nusrat al-Islam wal- operational capacities and an increase killing five Nigerien and four US 38 Muslimin (JNIM, “group in support of in the number of casualties owing to soldiers . Islam and Muslims”). In addition, the terrorist attacks in the region. JNIM Fulani-dominated Macina Liberation continued the violent activities of Front joined the umbrella organisation. its predecessor organisations with The main groups forming the alliance several attacks on military targets, 38 The attack was among a number of incidents had already cooperated closely in the including the forces of French claimed in a statement signed by the group’s leader, past37. The new formation was to be led military in Operation Barkhane and Abu al-Walid al-Sahrawi, which was sent to local news outlets on 12 January 2018. In a video released United Nations Multidimensional in early March 2018, the group presented footage 37 Europol, EU Terrorism Situation and Trend Report Integrated Stabilisation Mission in Mali taken from a camera on one of the US soldiers’ (TE-SAT) 2017, 2017, p. 36. helmets. TESAT 2018 40

In Nigeria, despite repeated army fatalities caused by terrorism in 2017. Sambisa Forest in southern Borno claims to have defeated it militarily, Most attacks remained unclaimed. State and adjacent areas. Many the different factions of the jihadist suicide attacks targeting mosques and In August 2016 Boko Haram split militia known as Boko Haram crowded places are attributed to this into two main factions, one led by (“Western education is unlawful [in faction. Abubakar Shekau, who had pledged Islam]”) continued to conduct large- allegiance to IS in 2015, and another scale violence and abductions in 2017. one led by the son of Boko Haram Numerous attacks across north-east founder Muhammad Yusuf, using the Nigeria and neighbouring countries nom de guerre Abu Mus’ab al-Barnawi Niger, Chad and Cameroon targeted (“Abu Mus’ab from Borno”), who was military and police forces, mosques, recognised by the IS leadership as markets and internally displaced the head of its West Africa province persons (IDP) fleeing Boko Haram. in August 2016. In 2017 the two In 2017 an increased use of women factions operated in largely separate and children in suicide attacks using geographical areas. The IS West Africa person-borne improvised explosive province under al-Barnawi was based devices (PBIEDs) was noted. Many of in the Lake Chad region. It acquired the women had been abducted by capabilities to conduct highly Boko Haram in previous years. These organised attacks. Abubakar Shekau’s attacks led to a significant increase of faction was mainly active around the

The turmoil in Yemen allowed Arabian Peninsula al-Qaeda in the Arabian Peninsula (AQAP) to continue building and expanding its popular support base, In Yemen, the civil war between the after being forced to withdraw from Houthi rebels, who refer to themselves Mukalla in April 2016, by creating as Ansar Allah (“servants of God”), strong links with Sunni tribes, in and the internationally recognised particular in the eastern Hadramawt government under President Abd- governorate, without attracting public Rabbu Mansour Hadi continued attention. AQAP profited from the unabated. The Hadi government smuggling trade fuelled by the war continued to receive support from an economy. alliance of Arab Sunni countries led by Saudi Arabia, backed by Western Militarily, AQAP focussed its attacks states, which started conducting on Houthi rebels and the Yemeni airstrikes in the country in 2015. The military. In its propaganda, AQAP conflict created one of the greatest portrayed its fight against the Yemeni humanitarian catastrophes in Yemen’s army as an attempt to protect Sunni history. tribes in Yemen against their enemies, who in the group’s ideology comprise The Houthi militias, whose members Western countries, in particular the belong to the Zaydi branch of Shi’i USA, Arab countries involved in the Islam, were allied with forces loyal to war in Yemen, the Hadi government as former Yemeni president Ali Abdullah well as the Houthi rebels. For example, Salih, who had been ousted in 2012 after a USA raid on an alleged AQAP in the wake of popular protests. After stronghold in Yemen’s Bayda province Salih declared that he had withdrawn on 31 January, AQAP’s leader Qasim from the alliance with the Houthis, he al-Raymi denounced the death of was assassinated by Houthi fighters women and children in the raid, on 7 December 2017 when he tried to including a daughter of late jihadist flee the formal Yemeni capital Sana’a, propagandist Anwar al-Awlaqi, and which had been under Houthi control expressed his sympathy with the Sunni since 2014. The Houthis declared tribe on whose territory the incident that he was killed on account of his had occurred. He alleged that the treason. USA was conspiring with the Houthi JIHADIST TERRORISM 41

rebels to fight the Sunnis in Yemen. On Contrary to AQAP, from late 2014 Saudi Arabia, which was among several occasions in 2017 AQAP also armed factions in Yemen which pledged countries singled out in IS calls for lone denounced Saudi Arabia and the United loyalty to IS sought integration into actor attacks, continued to witness Arab Emirates (UAE) as deviating from the local tribal structure to a far lesser sporadic terrorist plots. For example, Islam and collaborating with the USA degree and instead adopted a rhetoric two men blew themselves up on in its alleged war on Muslims. The two aimed to deepen sectarian divisions 21 January 2017 when confronted Arab countries were accused of trying in Yemen. Several bomb attacks by security forces in Jeddah. Their to corrupt the Yemeni tribes by inciting and assassinations in Yemen were affiliation was not disclosed. On them to fight one another. The high claimed by IS, mainly in the al-Bayda’ 23 June, according to authorities, civilian death toll inflicted by the Saudi- governorate and Aden. Videos showed a terrorist plot allegedly targeting led coalition and accusations of human training of fighters and idyllic scenes on security, pilgrims and worshippers at rights violations perpetrated by both life with IS. In mid-October 2017, a US the Grand Mosque in Mecca was foiled. the Houthi rebels and forces linked to airstrike targeted two IS training camps One of the suspects blew himself the Saudi-led coalition, in particular in al-Bayda’ province, killing dozens of up when engaged in a fire fight with the UAE, are likely to increase the IS members, according to the US army. security forces at a hideout. Saudi effectiveness of such arguments. AQAP The camps were allegedly used to train authorities did not attribute the plot to warned local populations that, in case fighters in the use of different weapons a specific group. they joined the coalition side, they and rocket launchers. In November would become attack targets. 2017 AQAP celebrated the defection of IS members in Yemen.

landmine targeted the WFP convoy and Somalia its escorting soldiers. In 2017 HSM in particular targeted Somalia witnessed continued conflict the capital Mogadishu, which suffered and severe drought in 2017, the multiple attacks. These attacks were effects of which compounded to carried out mainly by remotely create the most severe famine in detonated VBIEDs, suicide attacks the country since 2011 affecting half using VBIEDs or suicide assaults. the population. Harakat al-Shabab They targeted military and police, al-Mujahidin (HSM – “mujahid youth populated areas and hotels. In movement”), which still controlled addition, numerous attempts on the rural areas in southern Somalia, lives of Somali military, intelligence continued launching assaults on troops and government personnel as well as of the African Union Mission in Somalia Somali journalists occurred. (AMISOM) and Somali forces. For Most but not all of these were claimed example, on 27 January HSM fighters by HSM. In one of the deadliest attacks attacked Kenyan AMISOM troops at in Somalia in decades, VBIEDs hidden in Kulbiyow in Somalia near the Kenyan two lorries exploded on a busy junction border. The attack started with two in central Mogadishu on 14 October. VBIEDs driven into the military base, More than 350 people were killed. The followed by a large number of HSM attack was attributed to HSM but no fighters attacking it. HSM claimed claim of responsibility was published. that they killed more than 50 Kenyan The group may have hesitated to claim soldiers, a number denied by the the attack due to the risk of the high Kenyan army. civilian death toll alienating Somali Through such attacks and roadblocks citizens. Two weeks later, by contrast, on major routes, HSM constituted the HSM claimed responsibility for an greatest impediment to the delivery of attack in Mogadishu on 28 October relief to drought victims, in particular in which 23 people were killed. The in areas under its control in the target was a hotel scheduled to host a country’s south. In April a roadside meeting between the Somali Federal bomb exploded 100m behind a moving President and his five regional peers. World Food Programme (WFP) convoy After two VBIEDs detonated nearby, in the outskirts of Mogadishu. HSM armed fighters assaulted the hotel. stated that the remotely controlled The attackers were reportedly killed TESAT 2018 42

during the ensuing siege. These and active in 2017. In October 2016 the when a PBIED detonated at a police other attacks may have aimed to group had taken over the town of checkpoint near a hotel in Bosaso. disprove speculations about the group Qandala in Puntland’s Bari region, In November the US military started being weakened by the killing of an declaring it the seat of an “Islamic conducting airstrikes targeting the IS HSM commander in a US drone strike caliphate in Somalia”, but was faction in Somalia. in the Lower Shabelle region in early driven out in early December 2016. In Kenya in 2017 HSM concentrated August, who was believed to have Its recruitment efforts reportedly its violent activities on the regions been responsible for leading HSM targeted disaffected HSM members bordering Somalia, conducting several forces operating in the Mogadishu and in southern Somalia. Despite its more attacks on Kenyan security forces and Banaadir regions and planning and international orientation compared local inhabitants. executing attacks in Mogadishu. to HSM, the group has been able to attract only a limited number of An armed faction in Puntland which foreign fighters. On 8 February 2017 split from HSM in October 2015 and the group’s fighters stormed a hotel pledged allegiance to IS39 remained in Bosaso, the economic capital of Puntland. On 23 May it carried out its 39 Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, 2016, p. 33. first suicide attack, killing five people

filled with explosives detonated at the The Pakistan-based Taliban offshoot entrance of the diplomatic quarter Jamaat-ul-Ahrar (“Group Of Free in Kabul after being denied access; Men”) claimed responsibility for more than 100 people died. The several attacks in in February 2017. explosion took place near the German IS claimed several bomb attacks embassy, which was severely damaged killing more than a hundred people and had to be evacuated. IS claimed in Pakistan in 2017, targeting Sufi responsibility for the attack, but shrines, Christians, politicians. On 16 Afghan authorities tended to attribute February an attacker detonated his it to the Haqqani Network (HQN), PBIED at a Sufi shrine in Sehwan in which is linked to the Taliban. southern Pakistan. According to the authorities, 83 people died. IS claimed IS targeted the Shi’i minority in responsibility. South Asia Afghanistan in several attacks. Among other incidents, the group claimed A series of attacks on 23 June in suicide attacks on Shi’i mosques in different regions of Pakistan, which Afghanistan witnessed continued Herat on 1 August, which killed at least killed at least 42 people in Quetta, violence throughout 2017 from both 29 people, and in Kabul on 25 August, Parachinar and Karachi, was claimed the Taliban movement and IS Khorasan which killed some 40 people. by both Jamaat-ul-Ahrar and IS. Other attacks remained unclaimed. province. The Taliban claimed Presumed IS members killed six responsibility mainly for attacks Afghan employees of the International targeting security forces, including Committee of the Red Cross in NATO troops. IS claimed a high number northern Afghanistan on 8 February. of suicide attacks, often using PBIEDs in combination with firearms, on Several attacks were claimed by both religious and civilian targets, including the Taliban and IS, including an attack foreign embassies. On 10 January with nearly 50 rockets fired on Kabul’s a twin bomb attack targeting the main airport during a visit by the US provincial governor’s office in Kabul Secretary of Defense and the NATO killed 11 people, including five UAE Secretary General on 27 September. diplomats, who were member of a On 26 July, al-Qaeda announced the visiting delegation. The governor and creation of Ansar Ghazwat al-Hind as the UAE ambassador to Afghanistan a new affiliate operating in the region were among those injured. On the of Kashmir, which is disputed between same day, a twin bomb attack targeted India and Pakistan. The new entity was the Afghan parliament. Both attacks to be headed by a 23-year-old former were claimed by the Taliban. Hizb al-Mujahidin (“Mujahidin Party”) On 31 May 2017 a large water tanker member. JIHADIST TERRORISM 43

to consist of Abu Sayyaf and Maute threatened that “we will be in Rome, members. According to a military God willing”. Muslims in East Asia, spokesman, they were supported by especially in Brunei, Indonesia, fighters from other Asian countries, Malaysia, Singapore and Thailand were including Indonesia, Malaysia and asked to come to Marawi and join jihad Singapore. there. IS used the success in the Philippines In mid-October the Philippine army to project an image of invincibility. announced that it had killed Isnilon For example, in a comment on the Hapilon and another IS leader, 22 May bomb attack on a concert in Omarkhayam Maute, in Marawi. On Manchester, an article in Rumiyah in 23 October the Philippine government early June stressed that the loss of declared that the battle against the Southeast Asia territory would only result in future terrorists in Marawi had ended. expansion, citing as an example the takeover of Marawi. In an IS video In the Philippines in late May 2017 featuring the events in Marawi, which at least 100 Islamist rebels attacked was published on 20 August, the group Marawi, a city of 200 000 inhabitants stated that the city was “liberated” Mindanao Island. The clashes on 23 May, almost two years after reportedly started when soldiers the mujahidin in Indonesia pledged tried in vain to arrest Isnilon Hapilon, allegiance to Abubakr al-Baghdadi. The the leader of Abu Sayyaf, which had video showed armed men storming pledged allegiance to IS in 2014 and a church and destroying statues and intended to unite all IS factions in pictures of Pope Francis. A fighter the region. The attackers were said

against Western targets in both in April 2015 in the border area of Kidnappings Afghanistan and Pakistan. The arrest Burkina Faso, Niger and Mali remained of the HQN leader’s brother in 2014, captive at the time of writing. He was and his subsequent death sentence abducted by an IS-affiliated branch of In 2017 Western citizens continued in Afghanistan, led to the HQN al-Murabitun and his last appearance to become victims of terrorist attacks making considerable efforts to kidnap was in a video posted online by AQIM and kidnappings, mainly in and around westerners for use in negotiations. in July 2017. Furthermore, a Swiss conflict zones. During the reporting The rescue of an American-Canadian missionary has been held by AQIM period, attacks and kidnap operations family in Pakistan in October, deprived since January 2016 when she was against westerners occurred in the HQN of the opportunity to use abducted from her home in Timbuktu. Afghanistan, Burkina Faso, Egypt, Mali, them in a prisoner exchange. The HQN This hostage has featured in a number Nigeria and the Philippines. No such currently holds two Western hostages, of AQIM videos in which the terrorist incidents were reported in Iraq, Libya, an American and an Australian, group demanded the release of its Syria and Yemen but the risk of EU professors at the University of Kabul, imprisoned fighters in Mali and of a citizens being attacked or kidnapped who were kidnapped in Kabul in August member of Ansar Dine that was facing remained high. Moreover, a number of 2016. In October 2017, HQN released a trial at the International Criminal Court. western citizens who were abducted in statement that the American hostage Her most recent appearance in one of previous years by criminal or terrorist was in poor health and urged for a these videos was in June 2017. groups remained in captivity. Hostages prisoner swap. In May 2017, an incident During the reporting period, two have been used by their captors for occurred in Kabul, in which unidentified attacks targeting westerners also propaganda and political pressure on militants attacked a guesthouse of occurred in the same region. On 18 local and foreign governments; financial Operation Mercy (a Swedish NGO) and June in a terror attack on a luxury gains via ransom payments; and killed a German woman and an Afghan resort in Bamako (Mali), a Portuguese prisoner exchanges. guard and kidnapped a Finnish aid soldier and two civilians with dual worker, who was later released. In Afghanistan, terrorist and criminal nationality (French-Malian and French- groups continued to pose a grave In the Sahel region, militants of Gabonese) were killed. AQIM claimed kidnapping threat for both locals and al-Qaeda in the Islamic Maghreb responsibility and its intention to target foreigners. The Haqqani Network (AQIM) and IS continued their terrorist members of an EU military training (HQN) maintained the intent and activities. A Romanian citizen kidnapped delegation in Mali. On 14 August one capability to conduct kidnap operations TESAT 2018 44

French national was killed during an concerning the death of one Austrian, members in Bohol, a major tourist attack at a Turkish restaurant popular one Czech, one Ghanaian and four destination. The provinces of Cebu and with expatriates in Burkina Faso. Filipino hostages abducted by IS Palawan were also considered to be militants at al-Ghani oil field in March within the reach of terrorists based in A Swedish citizen and a British- 2015. the south of the country. South African citizen held by AQIM were released in June and July 2017 No kidnapping of EU citizens was Three EU citizens remained hostages respectively. They had been abducted reported in the Philippines in 2017. in Syria in 2017: an Italian Jesuit priest from a restaurant in Timbuktu in Nonetheless, in February the Abu kidnapped in July 2013 in Raqqa; an November 2011 along with a Dutch Sayyaf Group (ASG) posted a video Italian businessman kidnapped in citizen who was freed in 2015, and online showing the execution of May 2016, who appeared in a video were held in different locations. In a German hostage that they had in November of the same year; and October an Italian catholic priest who abducted in November 2016. Western a British journalist held by IS since was kidnapped in Benin City (Nigeria) tourists in the Philippines continued to November 2012, who has featured by a criminal group demanding a be an attractive target for kidnapping in numerous IS propaganda releases. ransom was released having been held by local terrorist organisations, Their whereabouts and fate remain for five days. especially the ASG. In 2017 militants unknown at the time of writing. expanded their area of operation Libya experienced no kidnapping beyond the Mindanao province and of EU citizens in 2017, but the the Sulu Archipelago. In April Filipino security situation in the country security forces thwarted an attack, has not changed; political instability probably aiming at kidnapping tourists, and violent conflicts continued. In by a group of heavily armed ASG September 2017, there were reports TESAT 2018 45 3/ ETHNO-NATIONALIST AND SEPARATIST TERRORISM

Most terrorist attacks carried out with many attacks involving firearms in the EU in 2017 were specified as UK / Dissident or small improvised explosive devices separatist attacks (137 out of 205). Republican groups such as pipe bombs. They have, France counted 42 attacks, Spain however, also deployed larger and/or experienced 7 attacks. There were 88 potentially more destructive devices security-related incidents in Northern In 2017, included in the 88 security such as vehicle borne improvised Ireland, of which 58 were shooting and incidents mentioned above, there were explosive devices (VBIED) and 30 were bombing incidents. five Dissident Republican (DR) attacks explosively formed projectiles. The completed separatist attacks against national security targets41, Apart from attacks on the security were aimed at businesses and critical including one in January in which a services, many dissident republicans infrastructure, but also at civilians and police officer was seriously injured in a are also heavily involved in criminal the military. A total of 30 individuals shooting in Belfast. activities for personal gain, including were arrested in Germany, Spain, DR terrorist groups opposed to the smuggling and extortion. Their 40 France, the Netherlands and Austria . peace process remain the most activities range from minor to serious significant threat to national security criminality, including drug dealing, in Northern Ireland. The UK lists four extortion, fuel laundering and murder. DR groups: the new IRA; Óglaigh na hÉireann (ONH); the Continuity IRA Spain / Euskadi ta (CIRA); and Arm Na Poblachta (ANP), who continue to consider violence a Askatasuna legitimate means of achieving their goal of a united Ireland. These groups consider police, prison officers and No terrorist attacks were perpetrated members of the armed forces in by the Basque nationalist and Northern Ireland as their primary separatist organisation – Euskadi ta targets. Askatasuna (ETA) during 2017. Indeed, it has not carried out any attack since Attack methodologies and capabilities announcing a ceasefire in October used by DRs vary across the groups 2011. ETA’s activities have been focused on “partial disarmament” and on issuing communiqués aligned 41 Attacks on national security targets is a measure used by the security service and includes those with the separatist strategy of the targeted principally (but not exclusively) against left-wing Abertzale movement. Their 40 The arrests contributed by the UK were not the security forces, those who support them and included in the ranking as not specified by type of premises and institutions associated with policing main demand is for the complete terrorism. justice and security. TESAT 2018 46

amnesty for the ETA militants serving Kurdistan / Partiya fuel and cigarette smuggling, prison who have been convicted and extortion, kidnapping and money are currently in jail. In 2017 a series Karkeren Kurdistane laundering42. Austria, France, Romania of criminal damages against bank and Switzerland reported activities of offices and public transportation the annual kampanya to finance PKK infrastructure were perpetrated by Prior to the constitutional referendum, and its armed branch Hêzên Parastina members of the left-wing Abertzale held throughout Turkey on 16 April, Gel (HPG – People’s Defence Force)43. movement. The senior members of the Belgium reported incidents between Most funds appear to come from group reside in France; other militants Kurdish and Turkish militants. voluntary donations obtained, in some have moved to different EU countries, France also reported attacks against cases, under intimidation. France including Germany. Two members Turkish consulates, institutions and reports an estimate of EUR 6 million of the group were arrested in Berlin, associations. In February the premises proceeds. In November 2017 eight PKK Germany, in October 2017. of the Turkish newspaper Zaman militants were convicted of terrorist in Seine-St-Denis, and the cultural financing. association Millennium, in Marseille, The PKK is believed to use Europe as both France, were also targeted. a base for logistics and procurement During 2017 French counter terrorist of weapons and recruitment44, and units arrested several militants, transporting the conflict into the accused of criminal damages using at Kurdish diaspora. France reported the times, incendiary improvised devices process of recruitment of militants in 2016. through the organisation Komalen Turkish authorities assess that the Ciwan (Kurdish Youth Organisation). Partiya Karkeren Kurdistane (PKK – Kurdish youngsters residing in France Kurdistan Workers’ Party) generates are lured to join the organisation. income from many different types Subsequently, they are sent to of crimes including drug trafficking, indoctrination camps scattered in migrant smuggling, human trafficking, Europe, far from their families and under the influence of PKK senior ranks. Finally they are trained in combat techniques in military camps in Armenia, Iran and Iraq. However, France estimates that only dozens of Kurdish fighters are recruited annually in Europe.

42 Based on figures provided by Turkey. 43 Belgium does not confirm direct financing of HPG. 44 Based on figures provided by Turkey. ETHNO-NATIONALIST AND SEPARATIST TERRORISM 47

figure 7 Number of failed, foiled, or completed attacks and number of arrests for ethno- nationalist and separatist terrorism 2013-2017. 180 168 154

137

99 84 84 67 65 30

2013 2014 2015 2016 2017

figure 8 Number of failed, foiled, or completed attacks and number of suspects arrested for ethno-nationalist and separatist terrorism in EU Member States in 2017

UK rance pain

88 Not 42 13 7 10 specified

ermany ustria etherlands

3 2 2 TESAT 2018 48 4/ LEFT-WING AND ANARCHIST TERRORISM

be no operational cooperation or Fund (IMF) in Paris and exploded in Terrorist attacks coordination other than the exchange the hands of an employee causing and suspects of solidarity messages via a number of light injury. Greek law enforcement anarchist websites. discovered eight more parcel bombs at the sorting centre of the Hellenic Post arrested On 1 January a bomb exploded in Office in Athens. Synomosia Pyrinon front of a bookshop with links to the tis Fotias(Conspiracy of Cells of Fire) neo-fascist activist group Casa Pound The number of attacks carried out claimed responsibility merely for the in Florence (Italy), seriously wounding by left-wing and anarchist terrorist VOIED sent to Germany. In a similar a bomb-squad officer. Open source groups and individuals (24) decreased attack in May, a parcel bomb exploded media reported the arrest by police slightly in 2017 (27 in 2016). Left-wing in the car of a former prime minister of five anarchists for “attempted and anarchist terrorist activity occurs of Greece injuring him and two police manslaughter”. almost exclusively in Greece, Italy and officers. Spain. Attacks reported by Germany In Greece left-wing and anarchist Militants of Organosi Epanastatikis and France were both related to terrorist groups and individuals Aftoamynas (Revolutionary Self- terrorists active in Greece. A slight continued to have enhanced Defence Organisation) carried out increase was observed in the number operational capabilities and access two identical attacks against police of arrested people over 2017 with a to military-grade weapons. In 2017 officers guarding the headquarters of total of 36 arrests, compared to 31 in eight attacks were carried out: six with a Greek political party in the centre 2016. the use of IEDs and two with the use of Athens. On both occasions the of firearms. Furthermore, a total of Consistently with previous years, perpetrators shot at the police using 12 people were arrested on charges modi operandi employed by left- an assault rifle. The first took place on related to left-wing and anarchist wing and anarchist terrorist groups 10 January and resulted in the injury of terrorism. included predominantly the use of one police officer and the second on 6 improvised explosive devices (IEDs). Terrorists from Greece were behind November without causing any injuries Attacks were principally targeted two attacks that occurred in Germany or damage. on government and police officials, and France. These were part of a Two terrorist attacks were claimed by property and infrastructure and were terrorist campaign involving the Omada Laikon Agoniston (Group of carried out exclusively by groups and sending of a total of ten victim- Popular Fighters) in 2017. On 19 April individuals of anarchist ideological operated improvised explosive devices an IED exploded outside the central background. Groups in Greece and (VOIEDs, specifically parcel bombs) offices of a bank and on 22 December Italy continued to claim they comprise occurred in March. One of the parcel another device detonated in front of an international network they call bombs was addressed to the German the building of the Athens appeals Federazione Anarchica Informale/ Minister of Finance and was discovered court. Both explosions were preceded Fronte Rivoluzionario Internazionale and dismantled by the authorities by a warning call to newspapers. (FAI/FRI, Informal Anarchist in Berlin. A second was sent to the Federation/International Revolutionary director of the International Monetary In Italy anarchist terrorist activity Front). However, there appears to LEFT-WING AND ANARCHIST TERRORISM 49

figure 9 Number of failed, foiled, or completed attacks and number of arrests for left-wing and anarchist terrorism from 2013 to 2017. 67

54 49

36

31 27 24 24

13 13

2013 2014 2015 2016 2017

declined in comparison with the 26 January in Milan and on 7 June terrorist attacks outside Turkey, its previous year. A total of seven attacks in Rovereto; and an attack using members maintained a fixed structure occurred in 2017, most of which Molotov cocktails against the offices on EU soil that provides logistical were in expression of solidarity with of the Trans Adriatic Pipeline (TAP) in and financial support for terrorist incarcerated members of anarchist Meledugno. activities in Turkey, under the guise terrorist groups. For yet another year, of legally established associations. An In Spain left-wing and anarchist anarchist terrorists in Italy used IEDs, indication of this structure was the terrorist activity continued its VOIEDs and improvised incendiary arrested of nine DHKP/C operatives on qualitative and quantitative decline of devices (IIDs) in their attacks. Italian 28 November in Greece on terrorism- the past three years. Seven anarchist law enforcement arrested 11 people in related charges and the discovery terrorist attacks were reported for relation to anarchist terrorist activity. of weapons, explosives and forged 2017 out of which two were carried documents in their possession. The FAI/FRI was responsible for three out with the use of crude IIDs in a attacks. On 7 June parcel bombs were parking lot of the Spanish National sent to two Turin-based prosecutors Police on 25 May and a bank branch Violent extremist in charge of several cases against on 7 June respectively and five anarchist terrorists. The two devices were foiled. Spanish authorities also activities were detected and dismantled at the arrested three people on charges Turin Courthouse. A similar VOIED related to anarchist terrorism. Several EU Member States reported was detected at the headquarters of In 2017 the Turkish Marxist-Leninist that in 2017 left-wing and anarchist the prison department in Rome on 12 terrorist group Devrimci Halk extremism remained a threat to June. The Santiago Malnonado Cell of Kutrulus Partisi/Cephesi (DHKP/C, the public order. It predominately the FAI/FRI also claimed responsibility Revolutionary People’s Liberation derived from anarchist groups and for the explosion of an IED outside the Party/Front) remained active in both individuals that form loose collectives Carabinieri Roma San Giovanni police Turkey and the EU. On 20 January in without hierarchical structure and station that caused moderate damage Turkey, it carried out an attack against organized their actions largely in to the building. a police station and the provincial squatted buildings and “social centres”. Anarchist terrorists in Italy were administration building of the Justice Marxist-Leninist groups and individuals behind three arson attacks in the and Development Party in Istanbul appeared to be less violent in the first half of 2017: two arsons of using a rocket launcher. Although the reporting period, although there telecommunication transmitters, on organisation has never carried out appeared to be no change in their rhetoric. TESAT 2018 50

figure 10 Number of failed, foiled, or completed rance ermany attacks and number of suspects arrested for left-wing and anarchist terrorism in EU Member States in 2017 1 10 1

reece taly pain

8 10 12 7 11 7 3

In most of the EU Member States, attention (e.g. corruption scandals) and via solidarity events. Further anarchist extremist activity remained continued to appear in the anarchist synergy was observed during large- low in intensity. In Greece and Italy, rhetoric. scale international events with much however, the anarchist extremist media attention. The Hamburg G20 Like in previous years, anarchist milieu is considered to be an Summit, for example, attracted extremist violence largely targeted antechamber to terrorism, in the numerous extremists from around police personnel and infrastructure, sense that it provides fertile ground Europe: police arrested anarchists government property, banks, for radicalisation and recruitment. from the Czech Republic, the migration-related private businesses In addition, the anarchist movement Netherlands, Switzerland and the UK and right-wing extremists. Modi supports imprisoned anarchist and identified protesters from Italy operandi included launching attacks terrorists with solidarity and and Spain. Extremists in the EU also during demonstrations, arson attacks, fundraising activities. followed and reacted to developments and vandalisms. Acts of arson were on the international political stage. The issue of migration remained carried out with the use of improvised On two such occasions, anarchist central in the anarchist extremist incendiary devices (IIDs) or with the extremists in Greece vandalised the agenda. Anarchists focused their throwing of Molotov cocktails in Embassy of Israel and the Embassy of activities on government migration hit-and-run operations. Such attacks Saudi Arabia at the end of the year, in policies and on the expression of were reported by Belgium, France, reaction to the two countries’ policies solidarity with migrants. The core Germany, Greece and Italy. Vandalism on Palestine and Yemen respectively. of their mobilisation, however, was occurred mainly during protests but against right-wing political parties and also in surprise attacks by small groups right-wing extremist groups. Other of extremists against police stations or central issues were the support to other targets. arrested or imprisoned terrorists and In 2017 anarchist extremists in the extremists; the eviction of squatted EU maintained contacts with and properties; and generic themes, such continued to express their support as the economy and the criminal to each other. This was achieved via justice system. Furthermore, emerging references on their online propaganda issues that attract the public’s TESAT 2018 51

5/ RIGHT-WING TERRORISM

Five foiled, failed or completed There are RWE groups that are of RWE groups have targeted anarchist terrorist attacks attributed to right- prepared to use violence to advance groups. wing extremists (RWE) were reported their political agenda. In March 2017 Neo-Nazi groups reported by EU for 2017: all of them by the UK. On EU Security Commissioner Sir Julian Member States include the Generace 19 June one person died and 10 King highlighted the growing menace Identity (Generation of Identity) were injured after a van was driven of RWE. Sir King said that he was not movement and the Pro-Vlast deliberately into a crowd of Muslim aware of a single EU Member State movement in the Czech Republic, the worshippers in North London by a that is not affected in some way by the group Soldiers of Odin in Belgium man who had previously expressed phenomenon. However, he also noted and the Blood & Honour organisation hatred of Muslims. Four days later, that it tended to receive less media in Portugal. Other RWE groups try on 23 June, a known supporter of the coverage46. This may contribute to to present themselves in a more far-right party Britain First drove a underreporting on the subject. widely accepted fashion. These vehicle into an Indian restaurant in The RWE scene is fragmented and groups sometimes publicly advertise London, injuring several people. Prior manifests itself in a variety of forms. populist views in a way to make them to the attacks, he was caught on CCTV In EU Member States, a myriad of socially acceptable within segments making Nazi salutes. often small RWE groups, including of the population, as reflected in the In addition to attacks classified as National Socialist-oriented and existence and electoral successes of terrorism, other violent incidents took neo-Nazi groups, exist. Germany legally constituted political parties in place in 2017 motivated by RWE, for reported New Right factions, such as EU Member States that have adopted example on 15 April two men with a the Identitäre Bewegung Deutschland elements of RWE agendas. proven affinity with National Socialism (IBD, Identitarian Movement An important trigger for the current threw incendiary devices at an asylum Germany) and supporters of the expansion of the RWE scene is the hostel in Germany. Reich Citizen ideology, to be gaining fear of an assumed Islamisation of visibility. These RWE groups adopt a The number of individuals arrested the Western world. A major and variety of ideologies, ranging from in relation to RWE offences almost active representative of the RWE the condemnation of the political doubled in 2017 (11 in 2015; 12 in scene motivated by fear of Muslim establishment and the membership of 2016; 20 in 2017). The vast majority domination and the introduction of international organisations (e.g. NATO (15) were reported by France. Of Islamic law (shari’a) is the Identitäre and the EU), to the rejection of asylum the 20 people arrested45, 16 were Bewegung, which originated in policies, migrants and individuals and arrested for preparing an attack, 3 Germany and currently has branches groups associated with a different for committing an attack and one for in other EU Member States including racial, ethnic (e.g. Roma), religious inciting and/or praising terrorism. Austria (Identitäre Bewegung (e.g. Jews and Muslims) or political Österreich, Identitarian Movement background. Furthermore, members Austria) and the Netherlands (Identitair Verzet, Identitarian Resistance). On

46 Tempest, M., “Commissioner warns of ‘growing its Facebook page the IBD has taken menace’ of right-wing terrorism in EU”, Euractiv. up a video of the French Génération com, accessed 31 January 2018, https://www. Identitaire and the intentions and 45 The arrests contributed by the UK were not euractiv.com/section/politics/news/commissioner- included in the ranking as not specified by type of warns-of-growing-menace-of-right-wing-terrorism- aims formulated therein, and has terrorism. in-eu/ TESAT 2018 52

obviously taken this as a reference and and hate speeches against migrants. role model for its founding. In Belgium, Activities sometimes included training the group La Meute Belgique (Belgian in self-defence, shooting and other Pack), with an anti-Islam agenda, had its combat skills. An example of such first meeting in 2017 to commemorate a group is the Slovenskí Branci in the March 2016 attacks in Brussels on Slovakia. This group believes that the the airport and the Maelbeek metro Slovak armed forces are insufficiently station. The Dutch group Identitair able to resist potential “outside Verzet temporarily occupied buildings threats”. In the UK, following the associated with Islam, including a proscription of National Action in Salafist school and a mosque under December 2016, two groups, Scottish construction. The UK assessed that Dawn and NS131, emerged and were protest activity by RWE groups will assessed to hold the same ideology continue to target predominantly and membership as National Action. In Muslim areas, provoking racial hatred September 2017, both groups were also and harassment. Triggers cited for such proscribed, it having been recognised activities included new or expanded that these groups were alternative Muslim places of worship, media names for National Action. Arrests coverage of sex offences by refugees against this group in October 2017 and (jihadist) terrorist incidents in the included individuals that were serving UK. in the British army. National Action In August 2017 two 36-year-old encourages its member to prepare for German nationals were arrested for a “race war” in the UK. The group has suspected preparation of a serious act held training camps in 2017, where of violence endangering state security. fighting and weapon training was Both suspects considered the German provided. Members also sought to join refugee policy misguided and worried the army or develop links with serving about a breakdown of state order. To personnel to give them the opportunity this end, they were believed to stock of gaining military training and enhance up on food and ammunition for their their individual capability. Other weapons legally obtained before. In instances of RWE attack planning in the their opinion, a crisis situation would UK, including the construction of viable provide the opportunity to capture IEDs and acquisition of firearms were and kill representatives of the left- identified and disrupted in 2017. wing political spectrum. In April 2017 a RWE groups have been found to foster serving German soldier was arrested. international contacts. Belgian RWE In December 2015, he had posed as a groups, for example, have developed Syrian refugee and applied for asylum in Germany. Demonstrations held in contacts with peer groups in Bulgaria, in Germany, allegedly with the intention Slovakia against the influx of migrants, Germany, Poland, Russia, the USA to assassinate high-ranking German also attended by non-extremist right- and Austria. The Identitäre Bewegung politicians and blame it on migrants or wing participants, attracted supporters Österreich participated in the “Save and refugees. from Belgium, the Czech Republic, Rescue” mission as part of the Defend Germany, Hungary, and Poland. The UK reported that the majority of Europe action in the Mediterranean The Portuguese Blood & Honour RWE activities were private meetings Sea to stop NGO ships from leaving organisation sends delegations to major and ticketed music events that can be Italian seaports to rescue migrants RWE events abroad. organised legally. This type of activity with Italian, French and German has also been observed in other EU representatives of the movement. The Additionally, links have been found Member States. In addition, protest Dutch branch of PEGIDA has contacts between some RWE groups and outlaw activities included demonstrations with far-right organisations abroad, motorcycle gangs (OMCG). The groups against temporary accommodation including Hooligans gegen Salafisten concerned are also associated with centres for asylum seekers and refugees (HoGeSa, Hooligans against Salafists) arms and drug (steroids) trafficking. TESAT 2018 53

6/ SINGLE-ISSUE TERRORISM

No attacks classified as single issue terrorism were reported by EU Member States for 2017. The influence of left-wing and anarchist extremists in protest movements related to environmental and animal rights issues and the opposition to the building of large infrastructure projects appeared to decline. Almost all EU Member States reported no or minimal activism related to animal rights. Nevertheless, the UK experienced a revival in the animal rights movement that covered a spectrum of activity from low level protest and direct action through to more serious forms of criminality. The Animal Liberation Front (ALF) was involved in over 66 violent actions including trespass, criminal damage and arson. TESAT 2018 54

ANNEX 1 Overview of the failed, foiled and completed attacks in 2017 per EU Member State and per affiliation

Member State Jihadist Left-wing Right-wing Separatist Single issue Not specified Total

Belgium 2 - - - - - 2

Finland 1 - - - - - 1

France 11 1 - 42 - - 54

Germany 1 1 - - - - 2

Greece - 8 - - - - 8

Italy 1 7 - - - 6 14

Spain 2 7 - 7 - - 16

Sweden 1 - - - - - 1

United Kingdom 14 - 5 88 - - 107

Total 33 24 5 137 0 6 205

›› The number of foiled, failed and completed attacks ›› Jihadist attackers targeted mostly civilians in public classified as jihadist terrorism (33) more than doubled, places and law enforcement personnel. However, the compared to 2016 (13). However, less than one third of vast majority of attacks on soldiers and officers were not the attacks (10) were completed. Nine jihadist attacks successful. were claimed by IS. Four attacks were attributed to IS. ›› In 2017 left-wing and anarchist terrorist groups or ›› The UK and France reported the highest number of individuals in the EU carried out 24 attacks. This was a jihadist attacks in total, together with the highest rate of downward movement after a sharp increase in 2016, foiled and failed attacks – of 11 attacks in France, only 2 when 27 left-wing attributed attacks occurred in EU were completed. The UK experienced 5 jihadist attacks Member States (13 attacks in 2015). and reported 9 disrupted plots. ›› Greece (8), Spain (7) and Italy (7) experienced the highest ›› The category of jihadist terrorism caused the most number of left-wing attacks; also in terms of completed casualties – 62 people dead (out of 68) and 819 injured acts (60%). Furthermore, 2 attacks that targeted France (out of 844). and Germany were caused by Greek extremists. Left-wing attacks resulted in five injuries and no fatalities. ›› In terms of weaponry, knives and other bladed weapons were used most frequently by jihadist attackers, often ›› Private enterprises and government institutions were combined with the use of vehicles. However, stabbing among the most frequent targets for left-wing attacks. In attacks also had the highest rate among foiled attacks, Italy, critical infrastructure was targeted in 3 attacks. followed by attempted bombings. ANNEXES 55

›› The majority of the left-wing attacks in 2017 were carried ›› Similarly to 2016, the countries reporting terrorist attacks out using unsophisticated improvised incendiary/explosive linked to separatism were the UK, France and Spain. The devices, parcel/letter bombs containing gunpowder and total number of separatist attacks increased by 40 % a crude ignition mechanism, and bottles with flammable (from 99 in 2016 to 137 in 2017), mainly due to increased liquids. frequency of attacks reported by France (18 in 2016, 42 in 2017). ›› Although the number of right-wing attacks remained low (1 in 2016; 5 in 2017), the attack attributed to right-wing extremism in the UK caused the death of a person in 2017.

ANNEX 2 Arrests in 2017 per EU Member State and per affiliation

Member State Jihadist Left-wing Separatist Right-wing Not specified Total France 373 10 13 15 - 411 Spain 78 3 10 - - 91 Germany 52 - 3 3 - 58 Belgium 50 - - - - 50 Austria 46 - 2 - - 48 Netherlands 28 - 2 - 5 35 Italy 26 11 - 2 - 39 Denmark 14 -- -- - 3 17 Greece 3 12 - - - 15 Bulgaria 14 - - - - 14 Ireland 3 - - - 8 11 Finland 9 - - - - 9 Hungary 2 - - - - 2 Poland 2 - - -- - 2 Romania 2 - - - - 2 Czech Republic 1 - - - - 1 Portugal 1 - - - - 1 Sweden 1 - - - - 1 United Kingdom 412* 412

Total 705 36 30 20 428 1219

* The number of the UK terrorism-related arrests does not include 173 arrests made in Northern Ireland. TESAT 2018 56

A total of 121948 persons were arrested on suspicion of being ›› EU Member State authorities arrested 36 people related involved in terrorism-related activities. Most arrestees (638) to left-wing and anarchist terrorism in 2017 (54 in 2014, were male, against 123 female49. The most frequent offences 67 in 2015, 31 in 2016), most of them in France, Greece were 1) membership of a terrorist group and 2) planning and/ and Italy. For the second consecutive year, the number or preparing a terrorist act. of arrests related to left-wing and anarchist terrorism continued to decrease. ›› A total number of 705 persons were arrested on suspicion of offences related to jihadist terrorism, similarly to 2016 ›› The number of individuals arrested in relation to right- (718) and 2015 (687). Most arrests occurred in France wing terrorist offences almost doubled in 2017 (from 11 (373), Spain (78) and Germany (52). in 2015 and 12 in 2016 to 20 in 2017). The vast majority of them (15) were reported by France. The individuals › Arrests for jihadist terrorism continued to represent the › arrested with right-wing affiliation were mostly suspected largest proportion of the total arrests for terrorism-related of preparing a terrorist act. offences in the EU. ›› The percentage of women arrested on suspicion of offences related to jihadist terrorism decreased from 26% in 2016 to 16%. The majority of arrested women (64%) held the citizenship of an EU Member State and were born in the EU. The average age of the suspects in jihadism- related arrests is 29 years, similar to 2016.

48 428 terrorism-related arrests for 2017 were reported without differentiating by type of terrorism, therefore have not been included in the ranking. 49 The gender of more than 400 arrestees was not reported. ANNEXES 57

ANNEX 3 Convictions and penalties (Eurojust)

This annex contains statistical information on the concluded court Member State 2015 2016 2017 proceedings for terrorist offences Austria 29 26 18 in 2017, as reported to Eurojust. It highlights some key figures and, where Belgium 120 136 85 relevant, compares those with the Czech Republic - - 8 figures for previous years. Denmark 1 8 4 Estonia - 2 2 Finland - 4 2 France 14 66 120 table / Number of individuals in Germany 17 30 34 concluded court proceedings for terrorist offences per EU Member Greece 38 3 19 49 50 State in 2015, 2016 and 2017 , as Hungary - 2 - reported to Eurojust. Italy - 11 23 Lithuania 1 1 2 49 The data for the previous years corresponds to the data reported in the respective TE-SAT reports. Netherlands 18 42 46 50 Eurojust received contributions containing Poland - - 4 information on terrorism-related court decisions in 2017 from the following Member States: Austria, Portugal - 1 1 Belgium, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Italy, Lithuania, The Slovenia 1 1 - Netherlands, Poland, Portugal, Spain, Sweden and the UK. Spain 166 154 69 If a verdict pronounced in 2017 was appealed and the appeal was concluded before the end of the year, Sweden 2 4 3 Eurojust reported only on the latest/final verdict. United Kingdom 106 89 125

Total 513 580 565

In 2017, 17 Member States reported a total of 565 individuals ›› In 2017 there were 66 female defendants in the concluded who were convicted or acquitted of terrorist offences. Four of court proceedings for terrorist offences. those individuals appeared twice before the court in 2017 in › The UK reported the highest number of individuals in the framework of different criminal proceedings51. As a result, › concluded court proceedings for terrorist offences (125), the total number of verdicts pronounced for terrorism- followed by France (120) and Belgium (85)52. related offences in 2017 was 569.

52 The UK contribution includes proceedings on offences under anti-terrorism 51 Two individuals in Spain and two others in France were each tried twice in 2017 legislation, as well as other offences assessed to be terrorism related. Similar to in different proceedings. previous years, the UK data for 2017 refers only to convictions. TESAT 2018 58

table / Number of verdicts in 2017 per EU Member State and per type of terrorism, as reported to Eurojust.

Member State Jihadist Separatist Left-wing Right-wing Not specified Total

Austria 18 - - - - 18 Belgium 81 4 - - - 85 Czech Republic 3 - 5 - - 8 Denmark 4 - - - - 4 Estonia 2 - - - - 2 Finland 2 - - - - 2 France 114 8 - - - 122 Germany 27 3 - 4 - 34 Greece 2 - 17 - - 19 Italy 23 - - - - 23 Lithuania - 1 - - 1 2 Netherlands 37 7 - - 2 46 Poland 4 - - - - 4 Portugal 1 - - - - 1 Spain 31 26 14 - - 71 Sweden 3 - - - - 3 United Kingdom* - - - - 125 125

Total 352 49 36 4 128 569

* The data provided by the United Kingdom was not broken down by type of terrorism and is therefore marked as ‘Not specified’ and not included in the numbers below.

›› In 2017 the vast majority of verdicts in the Member States ›› The majority of the female defendants (42) were tried (352) concerned jihadist terrorism confirming a trend that for jihadist terrorist offences confirming an upward trend started in 2015. from the past couple of years. ›› The highest number of verdicts concerning jihadist ›› Left-wing terrorist offences continued to bear the highest terrorism in 2017 (114) were rendered in France. Austria, average prison sentence (ten years). The average prison Denmark, Estonia, Finland, Italy, Poland, Portugal and sentence for jihadist terrorist offences remained five Sweden reported only verdicts for jihadist terrorism in years, and for separatist and right-wing terrorist offences 2017. it was four years. ›› As in previous years, Spanish courts tried the largest number of individuals charged with separatist terrorism offences in the EU in 2017. ›› In 2017 courts in the Czech Republic, Greece and Spain heard left-wing terrorism cases marking an increase in such cases compared to last year. Germany was the only Member State that reported verdicts for right-wing terrorist offences. ANNEXES 59

table / Number of verdicts, convictions and acquittals per EU Member State in 2017, as reported to Eurojust.

Member State Convictions Acquittals Total Acquittals In %

Austria 17 1 18 6%

Belgium 71 14 85 16%

Czech Republic 2 6 8 75%

Denmark 4 - 4 0%

Estonia 2 - 2 0%

Finland - 2 2 100%

France 117 5 122 4%

Germany 32 2 34 6%

Greece 15 4 19 21%

Italy 22 1 23 4%

Lithuania 1 1 2 50%

Netherlands 32 14 46 30%

Poland 3 1 4 25%

Portugal - 1 1 100%

Spain 60 11 71 15%

Sweden 1 2 3 67%

United Kingdom* 125 125

* The UK data for 2017 refers only to convictions and is not included in the calculations of percentages.

›› In 2017, Denmark and Estonia were the two Member ›› All prosecutions for right-wing terrorist offences resulted States that had only convictions and no acquittals in convictions in 2017. The concluded jihadist terrorism for terrorist offences. Also Austria, Belgium, France, cases continued to have a very high conviction rate (89%), Germany, Italy and Spain witnessed a vast majority similar to 2016 (92%) and 2015 (94%). The acquittal rate of successful prosecutions resulting in convictions for among the verdicts related to separatist and left-wing terrorist offences. terrorism was higher (29% and 28% respectively)54. ›› The record high conviction rate registered in 2016 across the EU (89%) continued also in 201753.

53 Eurojust considers it one verdict if an individual is convicted of more than one terrorist offence within the same proceeding, or convicted of a terrorist offence and acquitted of another offence. If an individual is acquitted of a terrorist offence and convicted of another offence, the verdict is included in the overview 54 The data provided by the UK was not broken down by type of terrorism and is as acquittal of terrorism. therefore not used to calculate the conviction rate. TESAT 2018 60

ANNEX 4 Europol activities in counter-terrorism

FIRST-LINE INVESTIGATIVE terrorism capabilities and at better network. If a major terrorist event SUPPORT: THE EUROPEAN facilitating information exchange were to occur, the ECTC can contribute COUNTER TERRORISM among counter terrorism authorities, to a coordinated response. Different CENTRE to bring cross-border cooperation in teams are available for this purpose, this field to a new level. often combined with counter terrorism Recent developments that include the experts temporarily seconded from terrorist attacks in Barcelona, and a The ECTC is designed as a central hub Member States, depending on the substantial number of failed and foiled in the EU in the fight against terrorism. nature of the event. attacks, combined with the existence In fact, it is the single point in the EU of large numbers of potentially violent where counter terrorism operational To provide direct operational support, jihadist extremists in the EU, indicate information from law enforcement and to also contribute to a coordinated that the terrorist threat towards the from all EU Member States, but also response if major terrorist attacks or EU is high. Despite the setback of IS in from third parties, is brought together threats were to occur, the ECTC applies Iraq and Syria the severity of the threat for analytical purposes. Specialised a scalable approach where other teams in the EU may even increase, in relation teams of counter terrorism analysts can be activated depending on the to returning foreign terrorist fighters and experts work on this information need. For example: Europol Emergency and their children and wives who to construct the wider EU perspective Response Team (EMRT): This team may all pose a danger to the security on counter terrorism phenomena comprises Europol experts and of Member States, but also as this for both operational and strategic analysts with relevant backgrounds setback could mean that IS will focus goals. To ensure efficient information and experience to support emerging even more on the West. Addressing exchange, the ECTC benefits from an investigations on a 24/7 basis. the challenges and making full use excellent network of counter terrorism of the available Counter Terrorism officers throughout the EU and opportunities is key to countering beyond. EUROPOL INFORMATION SYSTEM terrorism effectively. The principal task of the ECTC is to To ensure an effective response to the provide operational support upon One of Europol’s core databases is constantly changing developments Member States’ request for ongoing the Europol Information System (EIS). in terrorism, the European Counter investigations, such as those following Through this system, Member States Terrorism Centre (ECTC) was the attacks in Paris in 2015. The ECTC directly share and retrieve information, established at Europol, under the can assist by cross-checking live including on suspects, means of authority and direction of the operational data with the already communication, financial accounts and European Council. It builds further on available data at Europol, quickly firearms, etc. connected with serious the already existing tools and counter bringing financial leads to light, and and organised crime and terrorism. by analysing all available investigative terrorism networks of Europol, but The EIS offers first-line investigative details to assist in compiling a includes a number of new features. support, as this reference system structured picture of the terrorist These aim at enhancing the counter allows Member States to quickly ANNEXES 61

identify whether or not information of data on foreign terrorist fighters the possibility to send information relevant to them is available in one of within the AP Travellers increased directly to Europol or other counter the EU Member States or with non-EU substantially in 2017 as a result of the terrorism authorities. Until very countries or organisations. concerted efforts of Member States recently, countries could only use with the assistance of Europol. In SIENA to send their contributions on In cases of a positive hit, more December 2017 the ECTC opened a terrorism to Europol indirectly, through information may then be requested new AP on Core International Crimes the Europol National Unit and Liaison through the contributor’s Europol which is related to war crimes, crimes Bureau. The extended infrastructure National Unit. against humanity and genocide55. now also allows counter terrorism By the end of 2017 the EIS held authorities from different countries to The ECTC uses an integrated approach information on over 46 000 persons directly exchange information among meaning that data inserted in one linked to terrorism (the majority themselves, with optional involvement system is automatically cross-checked linked to the foreign terrorist fighter of Europol. Involvement of Europol against all other databases at Europol phenomenon), contributed by 37 is recommended to avoid possible to close intelligence gaps. In addition, countries. links to other Member States and regular manual checks are carried out. third partners to remain undiscovered as well as potential links between FURTHER IN-DEPTH INFORMATION EXCHANGE: organised crime and terrorism. ANALYSIS: THE COUNTER SIENA TERRORISM ANALYSIS In practice, this means that every counter terrorism officer in the WORK FILE AND THE In an organisation like Europol, with its Member States can check the EIS from ANALYSIS PROJECTS main focus on information exchange, their own computers, and directly secure and swift transmission of data For a more in-depth analysis, send information to, or receive is essential, especially when it comes the ECTC works with the counter information from, the APs. The to counter terrorism data. Information terrorism analysis work file (AWF). options described for sharing from a Member State must reach This file provides the framework for information are at the discretion of Europol and vice versa, without the operational analytical support with the the Member State. The dedicated risk of interception. To facilitate this Member States and non-EU partners. SIENA counter terrorism environment information exchange, the Secure As a result, the number of data is already operational with 95% of all Information Exchange Network categories that are permitted to be Member States and 46 counter Application (SIENA) was designed stored and processed is broader than terrorism authorities are now and has been in use for a number of in the EIS (within the counter terrorism connected to the system in total. years by Member States, Europol and AWF, there is focused analysis on third parties that have operational certain counter terrorism phenomena). cooperation agreements with Europol. Existing and emerging terrorist INTERNET REFERRAL UNIT phenomena are handled within A dedicated area has been created The Internet Referral Unit (IRU) has separate, so called Analysis Projects within SIENA especially for counter expanded its activities to counter (AP). In these highly secure terrorism authorities. This means that online radicalisation and recruitment environments the information is counter terrorism authorities now have by terrorists, by providing a core collected, cross-matched and analysed. internet investigation support This is done by dedicated teams of 55 The AP on Core International Crimes works capability and increasing partnerships counter terrorism analysts and counter together closely with the Genocide Network, also known as the European Union Network for (with the support of the European terrorism experts. Within counter Investigation and Prosecution of Genocide, Crimes Commission) towards online service terrorism a major AP is the topic of Against Humanity and War Crimes, hosted by companies (to promote self-regulation “travellers”, which deals with foreign Eurojust. activities). terrorist fighters. The amount TESAT 2018 62

By the end of 2017 it has assessed in groups continuous to be facilitated TEAM OF ROTATING GUEST total 51 805 pieces of content, which and actively supported by Europol. OFFICERS AT IMMIGRATION triggered 49 969 decisions for referral, This network is one of the main HOTSPOTS with a success rate of removal of achievements stemming from the EU The migration flows caused by the 84.8% since it was setup in July 2015. Action Plan on Enhancing the Security situation in conflict zones, mainly in of Explosives. the Middle East and North Africa, TERRORISM FINANCE A new platform for the European declined over 2017 but significant TRACKING PROGRAMME Explosives Ordnance Units Network on numbers of migrants and refugees the Europol Platform of Experts (EPE) continued to attempt to enter the The ECTC uses a number of tools to has become a main communication EU. The main entry points were the help detect the financing of terrorism, channel enabling already more than sea areas in Greece and Italy. Europol one of the best known being the 300 European bomb technicians and provided support to the two EU Terrorist Finance Tracking Programme CBRN experts to swiftly, efficiently Member States by deploying short- (TFTP). The TFTP has been established and directly share knowledge, best term Seconded National Experts following an EU-US agreement practices and technical information on (Guest Officers) at hotspots on the adopted by the European Parliament recent cases and incidents. eastern Aegean islands and in southern in 2010. The bomb-making process, potential Italy. Up to 50 of these Guest Officers Relevant information obtained recipes for the harmful use of are deployed on rotation in order to through the TFTP is provided by the explosives precursors, as well as strengthen the security checks on US Department of the Treasury to potential new threats using CBRN the inward migration flow, in order Europol, competent authorities of EU materials, are monitored daily and to identify suspected terrorists and Member States and Eurojust either cross-checked by Europol’s ECTC criminals, thus providing additional spontaneously by the US, or upon experts. Information is shared with security checks. request, pursuant to Article 9 or Article experts and relevant units within There is no concrete evidence that 10 of the Agreement respectively, with the EU Member States and non-EU terrorist travellers systematically the aim of combatting terrorism and countries. use those flows of refugees to enter terrorist financing. Europol assessments, strategic reports Europe unnoticed, but it is indisputable TFTP has proven to be a valuable tool and expertise are also timely in that some terrorists have entered the 56 in terrorism-related investigations, detecting security gaps and feeding EU posing as a refugee , as was seen it enhances the ability to map out the EU Policy Cycle through effective in the Paris attacks of 13 November terrorist networks, often by filling cooperation with the European 2015. in missing links in an investigative Commission. To counter this threat, Europol has chain. It is used to track terrorist In October 2017 the European recently approved the recruitment money flows, allowing authorities to Commission issued a new Action Plan of up to 200 counter terrorist and identify and locate operatives and to enhance preparedness against CBRN other investigators for deployment to their financiers, and assists in broader security risks, enhancing Europol’s role migration hotspots in Greece and Italy. efforts to uncover terrorist cells. as a key player in CBRN security. The ECTC – Strategy CBRN and EUROPEAN CYBERCRIME CHEMICAL, BIOLOGICAL, Explosives Team also assists EU CENTRE RADIOLOGICAL AND Member States operationally, both Launched in January 2013 the NUCLEAR AND EXPLOSIVES with counter terrorism and serious European Cybercrime Centre (EC3) and organised crime investigations. Europol is a key partner in the delivers high-level technical, analytical This includes having Europol staff Chemical, Biological, Radiological and and digital forensic expertise to appointed as court experts. Nuclear (CBRN) and Explosives field, support investigations by EU Member working together with the national States and non-EU countries in cases of competent authorities (from EU THE COUNTER TERRORISM convergence of cyber and terrorism. Member States and non-EU countries), JOINT LIAISON TEAM and liaising, assisting and jointly promoting activities and training with The EU Member States have 56 Europol, Changes in modus operandi of Islamic the European Commission and other established the Counter Terrorism Joint State (IS) revisited, 2016. relevant international organisations in Liaison Team (CT JLT) to work more these areas of expertise. closely on cross-border investigations, consisting of counter terrorism experts The European Explosive Ordnance and analysts from the Member States Disposal (EOD) Units Network, with and Europol counter terrorism experts its EOD and CBRN expert working and analysts. ANNEXES 63

ANNEX 5 Methodology

The EU Terrorism Situation and Trend representatives from France and Spain, terrorist offences are intentional acts Report (TE-SAT) was established in the EU Intelligence Analysis Centre which, given their nature or context, the aftermath of the 11 September (INTCEN), Eurojust, the office of the EU may seriously damage a country 2001 attacks in the USA, as a reporting Counter Terrorism Coordinator, and or an international organisation mechanism from the Terrorism Europol staff. when committed with the aim of: Working Party (TWP) of the Council of seriously intimidating a population, For the preparation of this report, the EU to the European Parliament. In or unduly compelling a government Europol collected qualitative and 2006 Europol replaced the TWP. The or international organisation to quantitative data on terrorist offences methodology for producing this annual perform or abstain from performing in the EU, and data on arrests of report was developed by Europol and an act, or seriously destabilising people suspected of involvement in endorsed by the Justice and Home or destroying the fundamental those offences, provided or confirmed Affairs (JHA) Council on 1 and 2 June political, constitutional, economic or by Member States. Similar data were 2006. social structures of a country or an collected, when available, of offences international organisation. The content of the TE-SAT is based on in which EU interests were affected information supplied by EU Member outside of the EU. As in previous years, In cases in which the wording of States, some non-EU countries and Eurojust collected data on the number Article 1 of the Framework Decision the partner organisation Eurojust, as of court proceedings in each Member leaves room for interpretation, the well as information gained from open State, the number of individuals in TE-SAT 2018 respects Member States’ sources. concluded court proceedings, the definitions of terrorist offences on number of convictions and acquittals, their territories. At times, it can be In accordance with ENFOPOL 65 the type of terrorism, the gender of difficult to assess whether a criminal (8196/2/06), the TE-SAT is produced defendants, the penalties imposed, event should be regarded as an act of annually to provide an overview of as well as the type of verdicts – final terrorism or as an act of extremism. the terrorism phenomenon in the EU, or pending judicial remedy. Eurojust Contrary to terrorism, not all forms from a law enforcement perspective. contributed data on convictions of extremism sanction the use of It seeks to record basic facts and and penalties for terrorist offences violence. Nevertheless, extremism assemble figures regarding terrorist in EU Member States and relevant as a phenomenon may be related attacks and arrests in the EU. The amendments in national legislation on to terrorism and exhibit similar report also aims to present trends and terrorism. behavioural patterns. Therefore, new developments identified from the the TE-SAT 2018 mentions criminal information available to Europol. Included as arrests are those judicial acts with the potential to seriously arrests warranted by a prosecutor The TE-SAT is a situation report which destabilise or destroy the fundamental or investigating judge, whereby a describes and analyses the outward political, constitutional, economic person is detained for questioning manifestations of terrorism, i.e. or social structures of a country, on suspicion of committing a criminal terrorist attacks and activities. It does when they were reported by the offence for which detention is not seek to analyse the root causes Member States as extremism, in an permitted by national law. The fact of terrorism, neither does it attempt effort to provide a clearer picture of that the person may subsequently be to assess the impact or effectiveness the phenomenon and its relation to provisionally released or placed under of counter-terrorism policies and law terrorism. However, these cases were house arrest does not impact the enforcement measures taken, although not considered in the statistical data calculation of the number of arrests. it can serve to illustrate some of these. of this report, which exclusively reflect The definition of the term terrorist incidents reported as terrorism by EU This edition of the TE-SAT has been offences is indicated in Article 1 of Member States. produced by Europol in consultation the Council Framework Decision with the 2018 TE-SAT Advisory Board, The EU Council Decision of 20 of 13 June 2002 on combatting composed of representatives of the September 2005 (2005/671/ JHA), terrorism (2002/475/JHA), which all past, present, and future Presidencies on the exchange of information and EU Member States have implemented of the Council of the EU, i.e. Estonia, cooperation concerning terrorist in their national legislation. This Bulgaria and Austria (the “Troika”), offences, obliges Member States Framework Decision specifies that along with permanent members, to collect all relevant information TESAT 2018 64 concerning and resulting from criminal Types of terrorism right-wing groups. Variants of right- investigations conducted by their law wing extremist groups are the neo- enforcement authorities with respect Nazi, neo-fascist and ultra-nationalist formations. to terrorist offences and sets out the The TE-SAT categorises terrorist conditions under which this information organisations by their source of should be sent to Europol. Europol motivation. However, many groups processed the data and the results were have a mixture of motivating LEFT-WING AND ANARCHIST cross-checked with the Member States. ideologies, although usually one TERRORISM In cases of divergences or gaps, the ideology or motivation dominates. It is Left-wing terrorist groups seek to results were corrected, complemented worth noting that a categorisation of replace the entire political, social and then validated by the Member individuals and terrorist groups based and economic system of a state by on the ideology or goals they espouse States. introducing a communist or socialist should not be confused with motivating structure and a classless society. Their Eurojust also collected data on factors and the paths to radicalisation. ideology is often Marxist-Leninist. A prosecutions and convictions for The underlying causes that lead people terrorist offences on the basis of to radicalisation and terrorism must be sub-category of left-wing extremism the aforementioned EU Council sought in the surroundings (structural is anarchist terrorism which promotes Decision. The data used in this report factors) and personal interpretations a revolutionary, anti-capitalist and concerns relevant court decisions (psychological factors) of the individual. anti-authoritarian agenda. Examples and legislation amendments in 2017. The choice of categories used in the TE- of left-wing terrorist groups are the Due to the specifics of reporting, SAT reflects the current situation in the Italian Brigate Rosse (Red Brigades) and Member States submit information EU, as reported by Member States. The the Greek Revolutionary Organisation on both final and non-final decisions. categories are not necessarily mutually 17 November. Therefore, reference is also made exclusive. to those decisions pending judicial remedy. Verdicts from 2017 on which ETHNO-NATIONALISM AND an appeal is pending are included in the JIHADIST SEPARATISM reporting as pending judicial remedy. Jihadist terrorist acts are those that Ethno-nationalist and separatist In cases where a verdict pronounced are committed out of a mind-set that terrorist groups are motivated by in 2017 was appealed, and the appeal rejects democracy on religious grounds nationalism, ethnicity and/or religion. was concluded before the end of the and uses the historical comparison Separatist groups seek to carve out year, Eurojust counted the proceeding with the crusades of the Middle Ages a state for themselves from a larger as one. Eurojust’s contribution was to describe current situations, in which country, or annex a territory from one verified with the Member States that it is believed that Sunni Islam is facing country to that of another. Left- or provided relevant data. a crusader alliance composed of Shi’is, right-wing ideological elements are not Christians and Jews. uncommon in these types of groups. The Irish Republican Army (IRA), the Basque ETA, and the Kurdish PKK RIGHT-WING organisations fall into this category. Right-wing terrorist organisations seek to change the entire political, SINGLE-ISSUE social and economic system on an extremist right-wing model. A core Single-issue extremist groups aim to concept in right-wing extremism is change a specific policy or practice, supremacism, or the idea that a certain as opposed to replacing the whole group of people sharing a common political, social, and economic system element (nation, race, culture, etc.) in a society. The groups within this is superior to all other people. Seeing category are usually concerned themselves in a supreme position, with animal rights, environmental protection, anti-abortion campaigns, the particular group considers it is etc. Examples of groups in this category their natural right to rule over the rest are the Earth Liberation Front (ELF), and of the population. Racist behaviour, the Animal Liberation Front (ALF). authoritarianism, xenophobia and hostility to immigration are commonly found attitudes in right-wing extremists. Right-wing terrorism refers to the use of terrorist violence by ANNEXES 65

ANNEX 6 Acronyms

AN ammonium nitrate IS so-called Islamic State AMISOM African Union Mission in Somalia ISIL Islamic State in Iraq and the Levant al-Dawla al-Islamiyya fi al-Iraq wal-Sham ALF Animal Liberation Front JHA Justice and Home Affairs ANP Arm Na Poblachta JNIM Jama’at Nusrat al-Islam wal-Muslimin AQAP al-Qaeda in the Arabian Peninsula Tanzim qa’idat al-jihad fi jazirat al-‘arab LNA Libyan National Army AQIM al-Qaeda in the Islamic Maghreb LTTE Liberation Tigers of Tamil Eelam Tanzim al-qa’ida bi-bilad al-Maghrib al-Islami MINUSMA Multidimensional Integrated Stabilisation ASG Abu Sayyaf Group Mission in Mali CBRN chemical, biological, radiological and nuclear NGO non-governmental organisation CIRA Continuity Irish Republican Army NPO non-profit organisation DHKP/C Revolutionary People’s Liberation Party/Front OMCG outlaw motorcycle gang Devrimci Halk Kurtuluş Partisi/Cephesi ONH Warriors of Ireland / Óglaigh ná h’Éireann DR Dissident Republican PBIED person-borne improvised explosive device EFP explosively formed projectile PEGIDA Patriotische Europäer gegen die Islamisierung EGC Electronic Ghosts of the Caliphate des Abendlandes Patriotic Europeans against the Islamisation ELF Earth Liberation Front of the Occident ERW explosive remnants of war PKK Partiya Karkerên Kurdistan ETA Basque Fatherland and Liberty Kurdistan Workers’ Party Euskadi ta Askatasuna RG Resistência Galega / Galician Resistance EU European Union RWE right-wing extremists FAI/FRI Federazione Anarchica Informale/Fronte SDF Syrian Democratic Forces Rivoluzionario Internazionale Informal Anarchist Federation/International TAP Trans Adriatic Pipeline Revolutionary Front TATP triacetone triperoxide FTF foreign terrorist fighter TE-SAT European Union Terrorism Situation and GNA Government of National Accord Trend Report GNS Government of National Salvation TWP Terrorism Working Party HME home-made explosive UAE United Arab Emirates HoGeSa Hooligans gegen Salafisten UAV unmanned aerial vehicle Hooligans against Salafists UGC user generated content HPG People’s Defence Force / Hêzên Parastina Gel UK United Kingdom HQN Haqqani Network UN United Nations HSM Mujahid youth movement / Harakat al- Shabab al-Mujahidin US United States (of America) IBD Identitäre Bewegung Deutschland UXO unexploded ordnance Identitarian Movement Germany VBIED vehicle-borne improvised explosive device IED improvised explosive device VOIED victim-operated improvised explosive device IDP internally displaced person WFP World Food Programme IID improvised incendiary device YPG Yekineyen Parastina Gel INTCEN EU Intelligence Analysis Centre People’s Protection Units TESAT 2018 66

ANNEX 7 Amendments in national legislation on terrorism in 2017

AUSTRIA November 2017. Furthermore, Law search, seizure and confiscation of No.2017-1510 of 30 October 2017 the proceeds from crime and on the An amendment of Section 278c of the reinforced the internal security and financing of terrorism when certain Austrian Criminal Code came into force the fight against terrorism. It came into provisions of the Greek Criminal Code on 1 September 2017. This provision force on 31 October 2017, just before are applied. lists the criminal offences which given the end of the state of emergency. The the respective intention can constitute law strengthened the administrative terrorist offences. The amendment police measures (establishment of ITALY also includes also bodily harm, not only secure perimeters, possibility of aggravated bodily harm as hitherto. Legislative Decree of 25 May 2017, n. closing places of worship), created new 90 was adopted in Italy implementing administrative control and surveillance Directive (EU) 2015/849 Directive (EU) measures and an administrative FRANCE 2015/849 of the European Parliament regime for home visits upon and of the Council of 20 May 2015 Law No.2017-258 of 28 February authorisation and under control of the on the prevention of the use of the 2017 on public security introduced Judge of Liberties and Detention of the financial system for the purposes several amendments in terrorism- Court of Paris (former administrative of money laundering or terrorist related legal provisions. It restored house searches). The law introduced financing, amending Regulation the offence of regular consultation of also a new terrorist offence making (EU) No 648/2012 of the European terrorist websites (again censured by it a crime for a person with authority Parliament and of the Council, and decision of the Constitutional Council over a minor to involve the latter in a repealing Directive 2005/60/EC of of 15 December 2017), modified the terrorist criminal conspiracy. the European Parliament and of the composition of the Special Assize Council and Commission Directive Court in charge of terrorism cases 2006/70/EC. The Decree implemented (number of assessors reduced from GREECE also Regulation (EU) 2015/847 of six to four at first instance and from Article 6 paragraph 2 of the Greek Law the European Parliament and of the eight to six on appeal) and established 4478/2017 (A’-91/23-6-2017) amended Council of 20 May 2015 on information a possibility for the Public Prosecutor paragraph 6 of Article 187A Terrorist accompanying transfers of funds of the Republic of Paris (or for the Acts of the Greek Criminal Code in and repealing Regulation (EC) No investigative Judges of the Counter- conformity with Directive 2014/42/EU 1781/2006. Among others, the Decree Terrorism Section) to communicate of the European Parliament and of the established specific rules concerning elements from terrorist judicial Council of 3 April 2014 on the freezing the cooperation between the National proceedings to intelligence services and confiscation of instrumentalities Antimafia and Counter-Terrorism (Article 706-25-2 of the Code of and proceeds of crime in the Directorate (Direzione nazionale Criminal Procedure). European Union. It provides for the antimafia e antiterrorism, DNA) and Law No.2017-1154 of 11 July 2017 consideration of irrevocable conviction the Italian FIU in order to track any extended the application of Law No. decisions, issued by courts of other suspicious transactions, including 55-385 of 3 April 1955 on the state states – members of the Council of those made with the purpose to fund of emergency, which ended on 1 Europe Convention on laundering, terrorist activities. ANNEXES 67

LITHUANIA In June 2017 a new version of the Law adapts the Portuguese legislation to on Money Laundering and Terrorist Council Decisions 2008/615/JHA and Amendments of Article 250 of the Financing Prevention was adopted to 2008/616/JHA regarding the sharing Criminal Code of the Republic of implement Directive (EU) 2015/849 of cross-border information about Lithuania came into force on 4 May of the European Parliament and the vehicles data bases. 2017. They amend the definition of Council. The law foresees significant financing and support of terrorist Furthermore, the Portuguese Criminal changes in the regulation of prevention activities (Article 250-4) to include also Code and the Industrial Property Code of money laundering and terrorist the preparatory stage and provision were amended by Law 83/2017 in financing. of support to one or several terrorists, relation to money laundering, terrorist as well as to a group having the aim of financing and judicial cooperation on committing terrorist crimes, including MALTA terrorism and cross-border crime, provision of support to persons or transposing also several EU Directives groups which recruit, train terrorists Act No. XXVIII of 2017 was and Council Decision. Several other or otherwise participate in terrorist promulgated in order to amend the acts were also adopted defining activities. The existing Article 250-5 Prevention of Money Laundering terrorist cases as priority investigations was extended to include provision Act, Cap.373, whereby Funding of (Law 96/2017), referring to approved of special knowledge necessary for Terrorism is also covered. Moreover, UN and the EU restrictive measures preparation for a terrorist crime, and the Asset Recovery Bureau Regulations (Law 96/2017), defining the new the persons who with the view to (particular articles) came into force by legal regime and special procedures use the acquired knowledge or skills virtue of Legal Notice 254 of 2017. on the intelligence officers’ access for terrorist purposes systematically to telecommunications and internet collect special knowledge or obtain data in terrorism cases (Law 96/2017), special skills which are necessary PORTUGAL and regulating the granting of visas for the preparation for, commission Between May and August 2017 to foreigners entering the national of a terrorist crime or participation several laws entered into force in territory and forbidding those visas in commission of a terrorist crime. Portugal. Law 30/2017 transposed when terrorist investigations or cases Furthermore, a new offence was Directive 2014/42/EU of the European related to the applicant are pending introduced by Article 250-6 (‘Travel for Parliament and of the Council of (Law 102/2017). Terrorist Purposes’) to be applied to 3 April 2014 on the freezing and those who go to another State seeking confiscation of instrumentalities and to prepare for or commit a terrorist proceeds of crime in the European crime, participate in the commission Union. Law 71/2017 determines of a terrorist crime, participate in the restrictions concerning applications for activities of a group having the aim of Portuguese nationality in cases when committing terrorist crimes, or seeking the national security and defence are to train terrorists or train for terrorist endangered as a result of a terrorist purposes. act. Another act - Law 46/2017 - TESAT 2018 68

UNITED KINGDOM ›› the Act ensured that UN financial sanctions (including those for the Al Qaeda and Taliban regimes) come into On 27 April 2017, the Criminal Finances Act received Royal effect in the United Kingdom immediately for a period Assent. Among other measures, the Act provided law of up to 30 days, while the EU adopts a regulation enforcement agencies with further powers to tackle terrorist to implement them, thereby avoiding delay and the financing. It amended existing legislation to: possibility of asset flight. The Act also gave powers for HM ›› introduce a disclosure order regime within the Terrorism Treasury to be able to impose a civil monetary penalty Act (TACT) 2000 whereby a court may permit a constable for breaches of UN, EU or United Kingdom financial or counter-terrorism financial investigator to answer sanctions; extended the maximum sentence for EU questions, or produce information or documents, that financial sanctions from two to seven years, in line with they consider likely to be of substantial value to the the domestic sanctions regime; and permitted deferred terrorist financing investigation; prosecution agreements and serious crime prevention orders to be used in connection with breaches of financial permit greater information sharing within the regulated ›› sanctions; sector where several conditions are satisfied, including that disclosing the information may assist in determining ›› the Act introduced a pre-charge bail limit of 28 days; whether a person is involved in a terrorist financing ›› Schedule 8 of TACT 2000 was amended by Section 71 offence, or that funds are terrorist financing funds, and of the Act to enable DNA profiles and fingerprints to allow the court to grant an order to require the provision be retained indefinitely where a person has a previous of further information arising from such a disclosure; conviction outside the UK (indefinite retention was ›› expand the definition of terrorist cash within the Anti- already provided for where the individual has a conviction Terrorism Crime and Security Act 2001 (ATCSA) to also within the UK); include gaming vouchers, fixed-value casino tokens and ›› Section 68 of the 2017 Act creates a new offence of betting receipts; breaching travel-related conditions of pre-charge bail ›› allow for the seizure and forfeiture of ‘listed assets’, (defined as ‘travel restriction conditions’) for those including precious stones, watches and so forth; arrested on suspicion of committing a terrorist offence. ›› permit the forfeiture of terrorist cash by a suitably The Criminal Justice Act 1988 (Reviews of Sentencing) Order authorised officer, without the need to go through the 2017 added 19 terrorism-related offences to schedule 1 of courts; the Review of Sentencing 2006 Order. Part IV of the Order allows the Attorney General, with leave from the Court of allow the freezing, and forfeiting of the contents of, ›› Appeal, to refer certain cases to the Court of Appeal where terrorist money held in bank accounts; he considers that a sentence imposed in the Crown Court ›› allow many terrorist financing powers to be exercised was unduly lenient, so that the sentence can be reviewed not just by a police constable, but by counter terrorist (The Unduly Lenient Sentencing (ULS) scheme). A range of financial investigators as well; terrorism-related offences were added to the list of specified offences for the ULS scheme in 2017. ›› increase from two to seven years the maximum sentence for failure to comply with a direction not to enter into The Prison (Amendment) Rules 2017 allow for a separation or continue to participate in transactions or business regime for extremist prisoners. It includes separation relationships with designated individuals which was centres, to which the Secretary of State may direct that TACT originally set out under the Counter-Terrorism Act 2008. prisoners be allocated for any of the following reasons: Furthermore, the Money Laundering, Terrorist Financing ›› in the interests of national security; and Transfer of Funds (information on the payer) Regulations › to prevent the commission, preparation or instigation 2017 implement the Fourth Money Laundering Directive › of an act of terrorism, a terrorism offence, or an offence (2015/849/EU). The UK Regulations came into force with a terrorist connection, whether in prison or alongside the Funds Transfer Regulation (2015/847/EU) and otherwise; bring regulation of industries at risk of facilitating money laundering and terrorist financing in line with international ›› to prevent the dissemination of views of beliefs that standards. The Regulations also prevent categories encourage or induce others to commit any such act of of individuals with criminal convictions from holding offence, whether in a prison or otherwise, or to protect or management functions in or being beneficial owners of safeguard others from such views or beliefs, or; regulated entities. ›› to prevent any political, religious, racial or other views or The Policing and Crime Act 2017 introduced a number of beliefs being used to undermine good order and discipline powers in relation to financial sanctions, including terrorism in a prison. sanctions, and in relation to police bail: PHOTO CREDITS

Europol: pages 4 and 60.

Shutterstock: pages 12, 14, 15, 17, 19, 21, 28, 30, 32, 44, 46, 52 and 67. ISBN 978-92-95200-91-3 DOI 10.2813/00041 QL-AJ-18-001-EN-N

Eisenhowerlaan 73, 2517 KK The Hague, the Netherlands

www.europol.europa.eu