Sunday, September 17, 2017

ISIS's Expanding Campaign in Europe

By Jennifer Cafarella with Jason Zhou

Key Takeaway:  ISIS’s attack campaign in Europe is expanding despite ISIS’s losses of terrain and senior leadership in the Middle East and North Africa. ISIS continues to plan, resource, and execute attacks from its remaining safe havens in Syria, Iraq, and Libya. ISIS has successfully expanded its coordinated attack campaign in Europe to target the UK and Spain. Rising levels of ISIS-inspired attacks in Sweden and Finland may signal growing online ISIS activity targeting vulnerable populations in those states and receptivity among those populations to the ISIS message. Coordinated attack attempts could follow. ISIS is sustaining its attack efforts in its initial target states of France and Germany, meanwhile. ISIS’s activity in Belgium, also an initial target state, is much lower, but the lack of ISIS attacks in Belgium does not signal incapacity. ISIS may be using its networks in Belgium to support attack cells elsewhere in Europe. ISIS also appears increasingly successful at inspiring low-level attacks in Europe despite its territorial losses, indicating its messaging is still resonant. ISIS’s campaign in Europe will continue and may even increase despite its losses in Iraq and Syria. 


ISW has refined its methodology for assessing ISIS’s campaign in Europe to leverage new published information such as details from the trials of arrested ISIS members. ISW has curated its database of terrorist attacks in Europe, ranging from clear instances of coordinated ISIS attacks to low-level attacks that may have little to no direct ISIS involvement. This broad collection aperture enables ISW to analyze the rising levels of Salafi-jihadi violence in Europe that ISIS uses to justify and advertise its methodology and ideology. This collection aperture also enables ISW to assess how much of the trend of Salafi jihadi violence in Europe ISIS is actually commanding and controlling.

ISW sorts each attack into one of three categories: coordinated ISIS attacks, inspired ISIS attacks, and unknown attacks. ISW also collects all instances of attempted attacks, which also range from low-level would-be attackers with unknown links to ISIS to complex, coordinated ISIS attack plots. ISW maps both successful attacks and the arrests of thwarted attack cell members to gain insight into where and how ISIS is attempting to penetrate European security and to evaluate the success of ISIS’s campaign.  The Appendix discusses ISW’s methodology for assessing attempted attacks in more detail. The four categories of attacks – both attempted and successful – that ISW has collected are:

  • Coordinated ISIS attacks are deliberate, planned attacks that ISIS has designed, resourced, and supported from Syria, Iraq, or Libya. Senior ISIS leaders are often involved in planning these attacks and training recruits. Coordinated ISIS attacks vary in scale and complexity from relatively low-level attacks such as vehicle rammings to sophisticated operations such as the 2015 Paris attacks.[1]  ISW has subcategorized each coordinated ISIS attack based on the type of attacker in order to gain insight into how ISIS is executing its campaign. The attackers in ISIS coordinated attacks to date have been returning ISIS foreign fighters, ISIS refugee operatives, or local ISIS recruits who conducted or attempted to conduct an attack while in contact with an ISIS “cyberplanner.” ISIS cyberplanners are foreign fighters who conduct online recruitment for ISIS, but also perform remote logistical and other support functions by leveraging criminal and other networks in Europe to enable ISIS recruits to access resources necessary for an attack. US-led coalition airstrikes against the ISIS external attack network in Syria and Iraq have focused on eliminating these nodes.[i]
  • Inspired ISIS attacks are attacks consistent with ISIS’s methodology and calls for attacks in Europe. ISW assesses an attack to be inspired if the attacker(s) have demonstrated pro-ISIS sympathies such as possessing ISIS propaganda or pledging allegiance to ISIS online. Some of the attacks ISIS has inspired in Europe are consistent with the US military’s doctrinal definition for a “complex attack.”[2] Many of these attacks may actually be coordinated by ISIS cyberplanners, but ISW assesses them to be inspired until or unless the involvement of a cyberplanner has been adequately documented in publically available information. 
  • Unknown attacks fit ISIS’s methodology and calls for “lone jihad” but have no clear links to ISIS or in some cases even terrorism in publically available reporting. The attackers may have been inspired by ISIS or other jihadist groups such as al Qaeda, which has also sent operatives to Europe, but ISW cannot assess such links with confidence. ISW categorizes these attacks as “unknown” due to a lack of sufficient evidence of ISIS or al Qaeda sympathies. ISW has included this data because these attacks support ISIS’s claim of momentum and narrative of a growing global war between Sunni Muslim populations and the majority non-Muslim world.
ISW updates its assessment of each attack when new information emerges. The assessment presented below is based on publicly available information as of September 14, 2017.

The Coordinated ISIS Attack Campaign in Europe

ISIS successfully expanded the scope of its coordinated attack campaign in Europe to the United Kingdom and Spain in 2017.

The initial waves of ISIS’s coordinated attacks in Europe primarily targeted France, Belgium, and Germany in 2014-2016. Returnee foreign fighters conducted most of these attacks. ISW assesses that ISIS returnee foreign fighters also tried and failed to conduct attacks in at least the UK, Spain, Morocco, Italy, Albania, and Kosovo in that timeframe.

The EU Counterterrorism Chief stated on September 12, 2017 that ISIS still has as many as 2,500 European foreign fighters in its ranks in Iraq and Syria and that at least 1,500 have returned to Europe to date. ISIS’s European foreign fighter population in Iraq and Syria will continue to provide the organization with links to jihadist and criminal networks in Europe even if the foreign fighters do not return to Europe. The foreign fighters that have already returned to Europe provide ISIS with latent capability to conduct attacks in addition to logistical and other support operations. ISIS is likely leveraging its foreign fighter cadres to attack new states rather than execute coordinated attacks in states where levels of ISIS-inspired attacks are rising. 

ISIS’s success demonstrates that it continues to generate attack capability faster than security services can disrupt new ISIS cells. In the UK, an ISIS returnee foreign fighter detonated a suicide vest (SVEST) at a concert venue in Manchester on May 22, 2017 in the first attack in the UK to date that fits ISW’s definition of a coordinated attack. The attacker met with members of an ISIS external operations cell in Libya prior to the attack, indicating that ISIS is leveraging command and control outside of Syria and Iraq to support its European operations. In Spain, members of an ISIS cell conducted two separate car-ramming attacks in Barcelona and Cambrilis as a contingency operation after an explosion at the cell’s TATP factory killed its leader and other members of the cell. TATP is an explosive that ISIS operatives in Europe commonly use.  The cell’s original plan was to conduct a coordinated attack using TATP against the Sagrada Familia Church, a popular tourist destination in Barcelona. The extent of ISIS’s direct support to this attack cell is unclear, due in part to the death of the cell’s leader and numerous other cell members in the explosion of the TATP factory. Reports that the cell’s leader traveled to Belgium in late 2016 could indicate that ISIS has a command-and-control node in Belgium that supported the attack.

More coordinated ISIS attack plots in Europe are likely underway. Unconfirmed reports indicate that ISIS’s external operations node in Libya has also dispatched foreign fighters to Belgium and France in addition to the UK. It is possible that a failed coordinated attack in Paris in 2017 was linked to the Libyan node. ISW cannot confirm any coordinated attack cells in Belgium in 2017, but French and Belgian police arrested one cross-border cell with likely links to ISIS in July 2017. This cell may have been planning attacks. The returnee foreign fighters may also be using Belgium as a base for command and control and logistical operations instead of a base for attacks, as the travel of the Spanish cell’s leader to Belgium suggests. They may have joined a pre-existing ISIS network in Brussels comprised of the initial wave of returnee foreign fighters that reached Belgium before ISIS’s major successful attacks in Paris and Brussels in November 2015 and March 2016, respectively. 

Sustained ISIS attempts to conduct coordinated attacks in France and Germany in 2017 indicate that ISIS continues to prioritize those countries. ISIS’s Iraq-based French cyberplanner, Rachid Kassim, planned a coordinated attack  in Paris, France involving TATP before a coalition airstrike killed him near Mosul, Iraq in February 2017. French police successfully disrupted the attack and arrested 2 cell members on September 6th, at least one of whom had been in contact with Kassim. German police meanwhile disrupted what could have been a coordinated ISIS attack attempt in Essen by a German foreign fighter in March 2017 who was reportedly recruiting people in the area to conduct an attack.

Future ISIS success are also likely in the states that thwarted coordinated ISIS plots from 2014- 2016, which include at least Italy, Albania, and Kosovo. ISIS’s links to criminal networks in Italy may reduce the group's incentive to attack there in the near term, since law enforcement responses to such attacks could disrupt important support nodes. ISIS could also risk alienating business partners such as elements of the Italian Mafia if it attacks Italy.  The anti-ISIS coalition has eliminated numerous ISIS external operators in Syria tasked with managing ISIS’s attack campaign in Albania and Kosovo in airstrikes in June 2017, meanwhile. These strikes may have disrupted ISIS’s ability to generate attack cells in the Balkans. ISIS may be attempting to leverage Balkan foreign fighters to conduct attacks elsewhere in Europe, however. Italian police arrested a Kosovar cell including at least one returnee ISIS foreign fighter in March 2017 that was planning an explosive attack against the Rialto Bridge. Available reporting does not confirm that ISIS provided direct support to this cell, which could have been merely inspired by ISIS. ISW will update this assessment as new details become available.

Coordinated ISIS attacks using refugees

ISIS’s coordinated attack campaign in Germany relies less on a foreign fighter cadre than elsewhere in Europe. ISIS is also using recruited and possibly trained refugees to conduct coordinated attacks in Germany.  ISIS has conducted two successful coordinated attacks in Germany using one returnee foreign fighter and one refugee operative to date. The refugee was a Syrian who had reportedly fought with ISIS before leaving for Europe in 2013. He detonated an SVEST outside a concert in Ansbach on July 24, 2016. German police later discovered chemicals and other bomb-making materials in his room at a refugee center in Germany. German authorities have reportedly thwarted six coordinated ISIS attack attempts, involving three refugees, two returnees, and one local who was likely in contact with an ISIS cyberplanner. Germany authorities have reportedly thwarted an additional nine attacks that could include attempted ISIS coordinated attacks, but for which adequate information does not yet exist.

Refugees have conducted attacks in other countries, but ISW cannot assess any coordinated ISIS involvement with confidence at the time of writing. ISW’s assessment places ISIS-inspired attacks conducted by refugees into the same category as all other instances of ISIS-inspired attacks. Future ISW products will examine the trend of ISIS-inspired attacks in Europe in more detail, to include when and where refugees have conducted such operations.

Attacks consistent with ISIS’s calls for “lone Jihad”

ISIS seeks to create momentum behind a campaign of attacks in Europe that will require less direct input from ISIS over time. ISW assessed in November 2015 that ISIS’s goal in Europe was to provoke overreactions by European governments that would alienate Muslim communities and radicalize them over time. ISIS designed a campaign to inject violence into European societies in order to jumpstart a campaign of low-level attacks against non-Muslim populations in Europe that would further polarize European communities. 

The scope and volume of low-level attacks that fit ISIS’s calls for “lone jihad” in Europe nearly quadrupled in Europe from January 2014 to September 2017. This trend could signal a growing resonance of ISIS’s messaging to vulnerable populations despite ISIS’s territorial losses in Iraq and Syria. If so, this trend would demonstrate ISIS success generating a campaign of violence in Europe that requires progressively less direct input from ISIS to sustain.


It is still possible that ISIS cyberplanners or returnee foreign fighters coordinated many of these attacks, however. Available information does not enable ISW to assess these attacks to be coordinated at the time of writing. Attacks consistent with the ISIS calls for “lone wolf” jihad expanded to Spain,[ii] Italy,[iii] Switzerland,[iv] and Finland[v] in 2017. The attacks in Finland and rising levels of similar attacks in Sweden are the most likely to have been coordinated by ISIS, since they are in a new theater. Finland raised its threat level in early 2017, which could signal intelligence indicating ISIS was actively attempting to coordinate attacks. The chief of Sweden’s security service (SAPO) warned in June 2017 that extremist activity was rising in multiple Swedish cities. Norway also raised its threat level  in early 2017, possibly indicating new ISIS attack efforts. It is also possible that some of these attacks have been inspired or enabled by al Qaeda rather than ISIS, but the available data does not confirm al Qaeda links.


The success of anti-ISIS operations in Europe remains limited. ISIS continues to generate and inspire attacks on a scope and scale larger than European security services can handle. New countermeasures such as “vehicle mitigation barriers” can reduce the lethality of ISIS tactics but are unlikely to disrupt ISIS’s ability to inspire and recruit attackers. Anti-ISIS operations in Syria and Iraq have not severed the link between ISIS’s senior leadership and its operatives abroad, moreover. Coalition airstrikes in Iraq and Syria have eliminated many ISIS external operatives, but have not sufficiently degraded ISIS’s capability. ISIS also continues to use safe haven in Libya as a base from which to support attacks in Europe even after its loss of Sirte, demonstrating how removing ISIS from cities is insufficient to prevent ISIS from conducting attacks. The anti-ISIS coalition is unlikely to dismantle the global ISIS attack network without broadening the scope of anti-ISIS operations beyond a narrow terrain focus. ISIS can use safe-havens in rural and even desert areas to plan, coordinate, and support the conduct of attacks in the West.

It must also refocus on addressing the grievances and fears of vulnerable Sunni populations that make them vulnerable to ISIS messaging. The widespread perception that European states and the U.S. are aligned with Iran and the Assad regime against Sunni populations in Syria and Iraq, as well as the rise of anti-Muslim sentiments and perceived anti-Muslim policies in Europe and the U.S. will continue to fuel toleration of and limited but growing support for ISIS (and al Qaeda) attack operations in the West. ISIS is waging a social and informational campaign to gain support among Western populations—Western states will not be able to kill and arrest their way out of this problem.

Appendix: ISW methodology for analyzing attempted attacks

The first graphic in this report depicts the number of attacks and attempted attacks per month in Europe from January 2014 to September 14, 2017. The chart begins in January because it is the month when the first known ISIS attack operative entered Europe after ISIS’s separation from al Qaeda’s Syrian affiliate Jabhat al Nusra in mid-2013. French police arrested that operative, named Abdelkader Tliba, thereby preventing what would have been the first coordinated ISIS attack in Europe. ISW’s data set includes every such known attempted attack in Europe since January 2014.
ISW’s data set most likely under-represents the number of thwarted ISIS attack cells in Europe, which are the most difficult to discern from openly available reporting. The “count” of attempted attacks per month in Europe is the number of thwarted attack cells with proven links to ISIS or that ISW assesses are possibly linked to ISIS based on openly available reporting. The “count” is not estimate of the number of attacks that any given cell would have conducted if not arrested. The actual number of attacks that ISIS has attempted to conduct in Europe may be higher than the graphic in this report conveys, therefore.

The “count” also does not measure the complexity of the thwarted attack cell’s structure or geographic disposition. Some of the attack cells included in this data set are individual attackers who were planning to conduct a single operation based on instructions from an ISIS cyberplanner. Others are larger networks of operatives spread between numerous safe houses in numerous countries. Many fall somewhere in between, or reflect instances where European security services arrested a cell before it had finalized an attack plan.

Comparing attempted vs successful attacks in Europe

The “count” for the successful attacks in Europe is the sum of the locations at which successful attacks occurred. For example, the ISIS attack in Paris November 2015 has a “count” of six. ISW has coded the attack data based on each attack location because each separate attack location reflects a separate successful attack operation that ISIS chose to coordinate and execute simultaneously. This approach is in line with the methodologies used by U.S. military forces in Iraq, Afghanistan and elsewhere, which tally each individual kinetic event even when multiple attacks take place in a coordinated fashion simultaneously, but in different locations.

The comparison of attempted attacks versus attacks provides a proxy for assessing the success of ISIS’s campaign in Europe. The ratio favors ISIS, as ISIS appears to be able to generate attacks faster than  European security services can disrupt them.

ISW’s data set does not include instances of partial disruption of an ISIS attack cell. An example of a partial disruption would be the arrest of one of five suicide bombers that reduced the “count” of the successful attack to the observed four attacks.  This data set is not an exhaustive accounting of all of the successes of European security services against ISIS, therefore.

ISW has sorted attempted attacks into the same four categories as successful attacks based on available evidence as of September 14, 2017: attempted coordinated ISIS attacks, attempted ISIS-inspired attacks, and unknown attempted attacks for which few details are publically available. ISW routinely updates and re-evaluates the assessment of each attempted attack as new details become available, such as new information about a given would-be attacker’s links to ISIS cyberplanners. ISW will publish updates and refined assessments as appropriate.

ISW’s Data Set vs. Official European Reporting

ISW’s data set includes more events and counts differently than official European reports. For example, ISW’s data for 2016 includes eleven more attacks in EU countries than the EU’s 2017 counterterrorism report and dozens more attempted attacks. The primary reason for these differences is that ISW counts events that the EU member states have not definitively ruled as terrorism. European states must discuss terror attacks on the basis of definitive evidence and the proper application of European laws. ISW’s approach enhances analysis of the ISIS campaign in Europe by widening the aperture to include the entire set of events that likely fit within the ISIS campaign even if insufficient evidence exists at present confidently to designate each event as a terrorist attack. ISW also seeks to inform analysis of the perceived trend of attacks in Europe, which ISIS and other jihadist groups use to recruit even if based in part of false attribution of some acts of violence, as this report explains.

ISW’s methodology to consider each attack location a separate attack also contributes to differences between ISW and European reporting. The EU report considers the March 2016 ISIS attack in Brussels to be a single attack, for example; ISW counts it as three separate, coordinated attacks.

The authors would like to thank Ryan Rockwell for his tremendous research support to this product.

[1] ISW derived this type of attack from the US military’s doctrinal definition of a coordinated attacks which is: “an attack that exhibits deliberate planning conducted by multiple hostile elements, against one or more targets from multiple locations. A coordinated attack may involve any number of weapon systems. [The] key difference between complex and coordinated is that a coordinated attack requires the indication of insurgent long term planning.”
[2] “An attack conducted by multiple hostile elements which employ at least two distinct classes of weapon systems (i.e. indirect fire and direct fire, IED and surface to air fire) against one or more targets.”

[i] For example, the US killed ISIS’s Albanian foreign fighter and attack planner Lavdrim Muhaxeri in an airstrike on June 7, 2017 near Mayadin, Syria.
[ii] An attack consistent with ISIS’s calls for “lone jihad” targeted a Spanish-Moroccan border post on July 25, 2017 before the ISIS cell in Barcelona conducted its attacks.
[iii] The first attack consistent with ISIS’s calls for “lone jihad” to target Italy occurred on May 18, 2017. ISW assesses the attacker was inspired by ISIS.
[iv] The first attack consistent with ISIS’s calls for “lone jihad” to target Switzerland occurred on July 24, 2017.
[v] The first attack  consistent with ISIS’s calls for “lone jihad” to target Finland occurred on August 18, 2017. ISW assesses the attacker was inspired by ISIS.