ISIS’s Global Attack Network: November 13, 2015 – November 9, 2016

By: Jessica Lewis McFate and Melissa Pavlik

Key Takeaway

ISIS has organized a number of external attacks worldwide in the past year, some of which have been thwarted. ISIS’s global network is still operating and is poised to continue conducting external attacks in late 2016. The U.S. must recognize that the campaign to recapture Mosul and Raqqa will not defeat ISIS. Rather, any military success in Iraq and Syria must be the first phase of a campaign to counter ISIS globally, whether through military or non-military means.

Overview

ISIS has been planning an external attack from Raqqa, Syria. The U.S. and its partners in the counter-ISIS coalition are assisting the major operations to recover Raqqa and Mosul, ISIS’s main urban hubs. ISIS is conducting  counter-offensives inside Iraq to divert Coalition attention from these main efforts. Similarly, ISIS will direct its global network to launch additional counter-offensives across its global footprint. Coalition partner nations face a high risk of attacks by ISIS on their homelands and their populations abroad while the offensives to recapture Mosul and Raqqa progress. The attack threat emanating from Raqqa highlights that ISIS-linked militants across the world still receive direction from ISIS in core terrain.

ISIS’s global attack network consists of two known campaigns: a general call for individuals to conduct attacks in the name of ISIS; and specific discrete attacks that are planned, coordinated, and executed by organized groups or cells of ISIS members. The specific external attack threat emanating from Raqqa falls in the latter category, over which ISIS exerts more control. Abu Mohammad al-Adnani, ISIS’s former spokesman and director of external operations, may have masterminded this two-pronged strategy and its execution. But his death on the battlefield in Aleppo Province on August 20, 2016 did not eliminate ISIS’s ability to design and coordinate such attacks. ISIS’s global network is still operating within the campaign framework defined by Adnani and other high-ranking ISIS militants and is poised to continue external attacks in late 2016.

The map below depicts coordinated attacks attributed to ISIS’s global network since November 13, 2015, when ISIS’s network in Europe executed a complex attack in Paris, killing 150 civilians. The map illustrates levels of risk for discrete directed attacks on the basis of recent historical patterns. The attacks on the map involved forward-deployed ISIS militants, many of whom were returned foreign fighters. The analysis excludes individual attackers worldwide who responded to official calls from Adnani to attack the West. Successful attacks in the U.S.—such as those on December 2, 2016 in San Bernadino or on June 12, 2016 in Orlando—are excluded for this reason. The only event in the United States considered to fit the profile of a coordinated attack directed by ISIS is the arrest of a Maryland man on December 14, 2015. This man was allegedly given nearly $9,000 from ISIS operatives overseas to conduct an attack in the Washington, D.C. area, suggesting that ISIS in core terrain intended a specific attack.

The map juxtaposes coordinated attacks by ISIS’s global network with foreign fighter flows into Syria and Iraq documented in June 2014 and December 2015 by The Soufan Group. Returned foreign fighters form the basis of ISIS’s global attack network. They also likely form the umbilical cord between ISIS and local Salafi-Jihadi groups whom ISIS recruits worldwide. The activities of ISIS-linked local Salafi-Jihadi groups and wilayats that are conducting ground campaigns are also excluded from this map because they constitute a different arm of ISIS’s global strategy. A ground campaign is a military engagement to contest control of terrain and populations by a rival army. This map therefore excludes ISIS’s ground activities in Libya, Sinai, Somalia, Afghanistan, the Philippines, and Nigeria, which ISW classifies as ground wars. ISIS is also engaged in the ongoing civil war in Yemen, meaning ISIS activity in Yemen is excluded from this map.

Tunisia, Turkey, Saudi Arabia, France, Germany, and Morocco exhibit a high correlation between foreign fighters who left for Syria and Iraq and coordinated external attacks by ISIS’s network. Foreign fighters have also returned to Southeast Asia to plan attacks. The threat in Turkey, including to U.S. persons, is particularly high as of October 29, when the State Department evacuated personnel in Istanbul following a statement by Turkish intelligence that ISIS poses a threat within six provinces in Turkey. ISIS’s attacks in Turkey and Saudi Arabia, two targets highlighted by ISIS’s leader, Abu Bakr al-Baghdadi in a statement released on November 2, 2016, also support its strategy to weaken regional power centers, as ISW forecasted in its 2016 Ramadan report. Britain’s MI5 also highlighted the generally high threat of attacks in the United Kingdom on November 1. Recent studies indicate that ISIS is still able to conduct cross-border operations through Syria, and from Libya to Italy through its nexus with organized crime, compounding the threat of attacks that are coordinated remotely from Raqqa.

ISIS’s global campaign may increase as Mosul and Raqqa come under pressure and fall. Coalition partner nations and U.S. homeland security must continue to regard ISIS’s coordinated external operations as a threat despite the death of Adnani and ISIS’s loss of key border crossings from Syria into Turkey due to Coalition anti-ISIS operations in Syria. The U.S. must recognize that the campaign to recapture Mosul and Raqqa will not defeat ISIS. Rather, any military success in Iraq and Syria must be the first phase of a campaign to counter ISIS globally, whether through military or non-military means.