ISIS’s attack campaign in Europe is expanding despite ISIS’s losses of terrain and senior leadership in the Middle East and North Africa, like reported by iswresearch.blogspot.it.
ISIS continues to plan, resource, and execute attacks from its remaining safe havens in Syria, Iraq, and Libya. ISIS has successfully expanded its coordinated attack campaign in Europe to target the UK and Spain. Rising levels of ISIS-inspired attacks in Sweden and Finland may signal growing online ISIS activity targeting vulnerable populations in those states and receptivity among those populations to the ISIS message.
Coordinated attack attempts could follow. ISIS is sustaining its attack efforts in its initial target states of France and Germany, meanwhile. ISIS’s activity in Belgium, also an initial target state, is much lower, but the lack of ISIS attacks in Belgium does not signal incapacity. ISIS may be using its networks in Belgium to support attack cells elsewhere in Europe. ISIS also appears increasingly successful at inspiring low-level attacks in Europe despite its territorial losses, indicating its messaging is still resonant. ISIS’s campaign in Europe will continue and may even increase despite its losses in Iraq and Syria.
ISW has refined its methodology for assessing ISIS’s campaign in Europe to leverage new published information such as details from the trials of arrested ISIS members. ISW has curated its database of terrorist attacks in Europe, ranging from clear instances of coordinated ISIS attacks to low-level attacks that may have little to no direct ISIS involvement. This broad collection aperture enables ISW to analyze the rising levels of Salafi-jihadi violence in Europe that ISIS uses to justify and advertise its methodology and ideology. This collection aperture also enables ISW to assess how much of the trend of Salafi jihadi violence in Europe ISIS is actually commanding and controlling.
ISW sorts each attack into one of three categories: coordinated ISIS attacks, inspired ISIS attacks, and unknown attacks. ISW also collects all instances of attempted attacks, which also range from low-level would-be attackers with unknown links to ISIS to complex, coordinated ISIS attack plots. ISW maps both successful attacks and the arrests of thwarted attack cell members to gain insight into where and how ISIS is attempting to penetrate European security and to evaluate the success of ISIS’s campaign. The Appendix discusses ISW’s methodology for assessing attempted attacks in more detail. The four categories of attacks – both attempted and successful – that ISW has collected are:
- Coordinated ISIS attacks are deliberate, planned attacks that ISIS has designed, resourced, and supported from Syria, Iraq, or Libya. Senior ISIS leaders are often involved in planning these attacks and training recruits. Coordinated ISIS attacks vary in scale and complexity from relatively low-level attacks such as vehicle rammings to sophisticated operations such as the 2015 Paris attacks. ISW has subcategorized each coordinated ISIS attack based on the type of attacker in order to gain insight into how ISIS is executing its campaign. The attackers in ISIS coordinated attacks to date have been returning ISIS foreign fighters, ISIS refugee operatives, or local ISIS recruits who conducted or attempted to conduct an attack while in contact with an ISIS “cyberplanner.” ISIS cyberplanners are foreign fighters who conduct online recruitment for ISIS, but also perform remote logistical and other support functions by leveraging criminal and other networks in Europe to enable ISIS recruits to access resources necessary for an attack. US-led coalition airstrikes against the ISIS external attack network in Syria and Iraq have focused on eliminating these nodes.
- Inspired ISIS attacks are attacks consistent with ISIS’s methodology and calls for attacks in Europe. ISW assesses an attack to be inspired if the attacker(s) have demonstrated pro-ISIS sympathies such as possessing ISIS propaganda or pledging allegiance to ISIS online. Some of the attacks ISIS has inspired in Europe are consistent with the US military’s doctrinal definition for a “complex attack.” Many of these attacks may actually be coordinated by ISIS cyberplanners, but ISW assesses them to be inspired until or unless the involvement of a cyberplanner has been adequately documented in publically available information.
- Unknown attacks fit ISIS’s methodology and calls for “lone jihad” but have no clear links to ISIS or in some cases even terrorism in publically available reporting. The attackers may have been inspired by ISIS or other jihadist groups such as al Qaeda, whichhas also sent operatives to Europe, but ISW cannot assess such links with confidence. ISW categorizes these attacks as “unknown” due to a lack of sufficient evidence of ISIS or al Qaeda sympathies. ISW has included this data because these attacks support ISIS’s claim of momentum and narrative of a growing global war between Sunni Muslim populations and the majority non-Muslim world.
ISW updates its assessment of each attack when new information emerges. The assessment presented below is based on publicly available information as of September 14, 2017.
The Coordinated ISIS Attack Campaign in Europe
ISIS successfully expanded the scope of its coordinated attack campaign in Europe to the United Kingdom and Spain in 2017.
The initial waves of ISIS’s coordinated attacks in Europe primarily targeted France, Belgium, and Germany in 2014-2016. Returnee foreign fighters conducted most of these attacks. ISW assesses that ISIS returnee foreign fighters also tried and failed to conduct attacks in at least the UK, Spain, Morocco, Italy, Albania, and Kosovo in that timeframe.
The EU Counterterrorism Chief stated on September 12, 2017 that ISIS still has as many as 2,500 European foreign fighters in its ranks in Iraq and Syria and that at least 1,500 have returned to Europe to date. ISIS’s European foreign fighter population in Iraq and Syria will continue to provide the organization with links to jihadist and criminal networks in Europe even if the foreign fighters do not return to Europe. The foreign fighters that have already returned to Europe provide ISIS with latent capability to conduct attacks in addition to logistical and other support operations. ISIS is likely leveraging its foreign fighter cadres to attack new states rather than execute coordinated attacks in states where levels of ISIS-inspired attacks are rising.
ISIS’s success demonstrates that it continues to generate attack capability faster than security services can disrupt new ISIS cells. In the UK, an ISIS returnee foreign fighter detonated a suicide vest (SVEST) at a concert venue in Manchester on May 22, 2017 in the first attack in the UK to date that fits ISW’s definition of a coordinated attack. The attacker met with members of an ISIS external operations cell in Libyaprior to the attack, indicating that ISIS is leveraging command and control outside of Syria and Iraq to support its European operations. In Spain, members of an ISIS cell conducted two separate car-ramming attacks in Barcelona and Cambrilis as a contingency operation after an explosion at the cell’s TATP factory killed its leader and other members of the cell. TATP is an explosive that ISIS operatives in Europe commonly use. The cell’s original plan was to conduct a coordinated attack using TATP against the Sagrada Familia Church, a popular tourist destination in Barcelona. The extent of ISIS’s direct support to this attack cell is unclear, due in part to the death of the cell’s leaderand numerous other cell members in the explosion of the TATP factory. Reports that the cell’s leader traveled to Belgium in late 2016 could indicate that ISIS has a command-and-control node in Belgium that supported the attack.
More coordinated ISIS attack plots in Europe are likely underway. Unconfirmed reports indicate that ISIS’s external operations node in Libya has also dispatched foreign fighters to Belgium and France in addition to the UK. It is possible that a failed coordinated attack in Paris in 2017 was linked to the Libyan node. ISW cannot confirm any coordinated attack cells in Belgium in 2017, but French and Belgian police arrested one cross-border cell with likely links to ISIS in July 2017. This cell may have been planning attacks. The returnee foreign fighters may also be using Belgium as a base for command and control and logistical operations instead of a base for attacks, as the travel of the Spanish cell’s leader to Belgium suggests. They may have joined a pre-existing ISIS network in Brussels comprised of the initial wave of returnee foreign fighters that reached Belgium before ISIS’s major successful attacks in Paris and Brussels in November 2015 and March 2016, respectively.
Sustained ISIS attempts to conduct coordinated attacks in France and Germany in 2017 indicate that ISIS continues to prioritize those countries. ISIS’s Iraq-based French cyberplanner, Rachid Kassim, planned a coordinated attack in Paris, France involving TATP before a coalition airstrike killed him near Mosul, Iraq in February 2017. French police successfully disrupted the attack and arrested 2 cell members on September 6th, at least one of whom had been in contact with Kassim. German police meanwhile disrupted what could have been a coordinated ISIS attack attempt in Essen by a German foreign fighter in March 2017 who was reportedly recruiting people in the area to conduct an attack.
Future ISIS success are also likely in the states that thwarted coordinated ISIS plots from 2014- 2016, which include at least Italy, Albania, and Kosovo. ISIS’s links to criminal networks in Italy may reduce the group’s incentive to attack there in the near term, since law enforcement responses to such attacks could disrupt important support nodes. ISIS could also risk alienating business partners such as elements of the Italian Mafia if it attacks Italy. The anti-ISIS coalition has eliminated numerous ISIS external operators in Syria tasked with managing ISIS’s attack campaign in Albania and Kosovo in airstrikes in June 2017, meanwhile. These strikes may have disrupted ISIS’s ability to generate attack cells in the Balkans. ISIS may be attempting to leverage Balkan foreign fighters to conduct attacks elsewhere in Europe, however. Italian police arrested a Kosovar cell including at least one returnee ISIS foreign fighter in March 2017 that was planning an explosive attack against the Rialto Bridge. Available reporting does not confirm that ISIS provided direct support to this cell, which could have been merely inspired by ISIS. ISW will update this assessment as new details become available.
Coordinated ISIS attacks using refugees
ISIS’s coordinated attack campaign in Germany relies less on a foreign fighter cadre than elsewhere in Europe. ISIS is also using recruited and possibly trained refugees to conduct coordinated attacks in Germany. ISIS has conducted two successful coordinated attacks in Germany using one returnee foreign fighter and one refugee operative to date. The refugee was a Syrian who had reportedly fought with ISIS before leaving for Europe in 2013. He detonated an SVEST outside a concert in Ansbach on July 24, 2016. German police later discovered chemicals and other bomb-making materials in his room at a refugee center in Germany. German authorities have reportedly thwarted six coordinated ISIS attack attempts, involving three refugees, two returnees, and one local who was likely in contact with an ISIS cyberplanner. Germany authorities have reportedly thwarted an additional nine attacks that could include attempted ISIS coordinated attacks, but for which adequate information does not yet exist.
Refugees have conducted attacks in other countries, but ISW cannot assess any coordinated ISIS involvement with confidence at the time of writing. ISW’s assessment places ISIS-inspired attacks conducted by refugees into the same category as all other instances of ISIS-inspired attacks. Future ISW products will examine the trend of ISIS-inspired attacks in Europe in more detail, to include when and where refugees have conducted such operations.
Attacks consistent with ISIS’s calls for “lone Jihad”
ISIS seeks to create momentum behind a campaign of attacks in Europe that will require less direct input from ISIS over time. ISW assessedin November 2015 that ISIS’s goal in Europe was to provoke overreactions by European governments that would alienate Muslim communities and radicalize them over time. ISIS designed a campaign to inject violence into European societies in order to jumpstart a campaign of low-level attacks against non-Muslim populations in Europe that would further polarize European communities.
The scope and volume of low-level attacks that fit ISIS’s calls for “lone jihad” in Europe nearly quadrupled in Europe from January 2014 to September 2017. This trend could signal a growing resonance of ISIS’s messaging to vulnerable populations despite ISIS’s territorial losses in Iraq and Syria. If so, this trend would demonstrate ISIS success generating a campaign of violence in Europe that requires progressively less direct input from ISIS to sustain.
It is still possible that ISIS cyberplanners or returnee foreign fighters coordinated many of these attacks, however. Available information does not enable ISW to assess these attacks to be coordinated at the time of writing. Attacks consistent with the ISIS calls for “lone wolf” jihad expanded to Spain,Italy, Switzerland, and Finland in 2017. The attacks in Finland and rising levels of similar attacks in Sweden are the most likely to have been coordinated by ISIS, since they are in a new theater. Finland raised its threat level in early 2017, which could signal intelligence indicating ISIS was actively attempting to coordinate attacks. The chief of Sweden’s security service (SAPO)warned in June 2017 that extremist activity was rising in multiple Swedish cities. Norway also raised its threat level in early 2017, possibly indicating new ISIS attack efforts. It is also possible that some of these attacks have been inspired or enabled by al Qaeda rather than ISIS, but the available data does not confirm al Qaeda links.
Conclusion
The success of anti-ISIS operations in Europe remains limited. ISIS continues to generate and inspire attacks on a scope and scale larger than European security services can handle. New countermeasures such as “vehicle mitigation barriers” can reduce the lethality of ISIS tactics but are unlikely to disrupt ISIS’s ability to inspire and recruit attackers. Anti-ISIS operations in Syria and Iraq have not severed the link between ISIS’s senior leadership and its operatives abroad, moreover. Coalition airstrikes in Iraq and Syria have eliminated many ISIS external operatives, but have not sufficiently degraded ISIS’s capability. ISIS also continues to use safe haven in Libya as a base from which to support attacks in Europe even after its loss of Sirte, demonstrating how removing ISIS from cities is insufficient to prevent ISIS from conducting attacks. The anti-ISIS coalition is unlikely to dismantle the global ISIS attack network without broadening the scope of anti-ISIS operations beyond a narrow terrain focus. ISIS can use safe-havens in rural and even desert areas to plan, coordinate, and support the conduct of attacks in the West.
It must also refocus on addressing the grievances and fears of vulnerable Sunni populations that make them vulnerable to ISIS messaging. The widespread perception that European states and the U.S. are aligned with Iran and the Assad regime against Sunni populations in Syria and Iraq, as well as the rise of anti-Muslim sentiments and perceived anti-Muslim policies in Europe and the U.S. will continue to fuel toleration of and limited but growing support for ISIS (and al Qaeda) attack operations in the West. ISIS is waging a social and informational campaign to gain support among Western populations—Western states will not be able to kill and arrest their way out of this problem.
