By Jennifer Cafarella with Jason Zhou
Key Takeaway: ISIS’s attack campaign in Europe is expanding
despite ISIS’s losses of terrain and senior leadership in the Middle East and
North Africa. ISIS continues to plan, resource, and execute attacks from its
remaining safe havens in Syria, Iraq, and Libya. ISIS has successfully expanded
its coordinated attack campaign in Europe to target the UK and Spain. Rising
levels of ISIS-inspired attacks in Sweden and Finland may signal growing online
ISIS activity targeting vulnerable populations in those states and receptivity
among those populations to the ISIS message. Coordinated attack attempts could
follow. ISIS is sustaining its attack efforts in its initial target states of
France and Germany, meanwhile. ISIS’s activity in Belgium, also an initial
target state, is much lower, but the lack of ISIS attacks in Belgium does not
signal incapacity. ISIS may be using its networks in Belgium to support attack
cells elsewhere in Europe. ISIS also appears increasingly successful at
inspiring low-level attacks in Europe despite its territorial losses,
indicating its messaging is still resonant. ISIS’s campaign in Europe will
continue and may even increase despite its losses in Iraq and Syria.
Methodology
ISW has refined its methodology for assessing ISIS’s campaign in
Europe to leverage new published information such as details from the trials of
arrested ISIS members. ISW has curated its database of terrorist attacks in Europe,
ranging from clear instances of coordinated ISIS attacks to low-level attacks
that may have little to no direct ISIS involvement. This broad collection
aperture enables ISW to analyze the rising levels of Salafi-jihadi violence in
Europe that ISIS uses to justify and advertise its methodology and ideology.
This collection aperture also enables ISW to assess how much of the trend of
Salafi jihadi violence in Europe ISIS is actually commanding and controlling.
ISW sorts each attack into one of three categories: coordinated
ISIS attacks, inspired ISIS attacks, and unknown attacks. ISW also collects all
instances of attempted attacks, which also range from low-level would-be
attackers with unknown links to ISIS to complex, coordinated ISIS attack plots.
ISW maps both successful attacks and the arrests of thwarted attack cell
members to gain insight into where and how ISIS is attempting to penetrate
European security and to evaluate the success of ISIS’s campaign. The Appendix discusses ISW’s
methodology for assessing attempted attacks in more detail. The four categories
of attacks – both attempted and successful – that ISW has collected are:
- Coordinated ISIS attacks are deliberate, planned attacks that ISIS has designed, resourced, and supported from Syria, Iraq, or Libya. Senior ISIS leaders are often involved in planning these attacks and training recruits. Coordinated ISIS attacks vary in scale and complexity from relatively low-level attacks such as vehicle rammings to sophisticated operations such as the 2015 Paris attacks.[1] ISW has subcategorized each coordinated ISIS attack based on the type of attacker in order to gain insight into how ISIS is executing its campaign. The attackers in ISIS coordinated attacks to date have been returning ISIS foreign fighters, ISIS refugee operatives, or local ISIS recruits who conducted or attempted to conduct an attack while in contact with an ISIS “cyberplanner.” ISIS cyberplanners are foreign fighters who conduct online recruitment for ISIS, but also perform remote logistical and other support functions by leveraging criminal and other networks in Europe to enable ISIS recruits to access resources necessary for an attack. US-led coalition airstrikes against the ISIS external attack network in Syria and Iraq have focused on eliminating these nodes.[i]
- Inspired ISIS attacks are attacks consistent with ISIS’s methodology and calls for attacks in Europe. ISW assesses an attack to be inspired if the attacker(s) have demonstrated pro-ISIS sympathies such as possessing ISIS propaganda or pledging allegiance to ISIS online. Some of the attacks ISIS has inspired in Europe are consistent with the US military’s doctrinal definition for a “complex attack.”[2] Many of these attacks may actually be coordinated by ISIS cyberplanners, but ISW assesses them to be inspired until or unless the involvement of a cyberplanner has been adequately documented in publically available information.
- Unknown attacks fit ISIS’s methodology and calls for “lone jihad” but have no clear links to ISIS or in some cases even terrorism in publically available reporting. The attackers may have been inspired by ISIS or other jihadist groups such as al Qaeda, which has also sent operatives to Europe, but ISW cannot assess such links with confidence. ISW categorizes these attacks as “unknown” due to a lack of sufficient evidence of ISIS or al Qaeda sympathies. ISW has included this data because these attacks support ISIS’s claim of momentum and narrative of a growing global war between Sunni Muslim populations and the majority non-Muslim world.
ISW updates its assessment of each attack when new information
emerges. The assessment presented below is based on publicly available
information as of September 14, 2017.
ISIS successfully expanded the scope of its coordinated attack campaign in Europe to the United Kingdom and Spain in 2017.
The initial waves of ISIS’s coordinated attacks in Europe primarily targeted France, Belgium, and Germany in 2014-2016. Returnee foreign fighters conducted most of these attacks. ISW assesses that ISIS returnee foreign fighters also tried and failed to conduct attacks in at least the UK, Spain, Morocco, Italy, Albania, and Kosovo in that timeframe.
The EU Counterterrorism Chief stated on September 12, 2017 that
ISIS still has as many as 2,500 European foreign
fighters in
its ranks in Iraq and Syria and that at least 1,500 have returned to Europe to
date. ISIS’s European foreign fighter
population in Iraq and Syria will continue to provide the organization with
links to jihadist and criminal networks in Europe even if the foreign fighters
do not return to Europe. The foreign fighters that have already returned to
Europe provide ISIS with latent capability to conduct attacks in addition to
logistical and other support operations. ISIS is likely leveraging its foreign
fighter cadres to attack new states rather than execute coordinated attacks in
states where levels of ISIS-inspired attacks are rising.
ISIS’s success demonstrates that it continues to generate attack
capability faster than security services can disrupt new ISIS cells. In the UK,
an ISIS returnee
foreign fighter detonated a suicide vest
(SVEST) at a concert venue in Manchester on May 22, 2017
in the first attack in the UK to date that fits ISW’s definition of a
coordinated attack. The attacker met with members of an ISIS external
operations cell in Libya prior to the attack, indicating that ISIS is leveraging command
and control outside of Syria and Iraq to support its European operations. In
Spain, members of an ISIS cell conducted two separate car-ramming attacks in Barcelona and Cambrilis as a
contingency operation after an explosion at the cell’s TATP factory killed its
leader and other members of the cell. TATP is an explosive that ISIS operatives
in Europe commonly use. The cell’s original plan was to conduct
a coordinated attack using TATP against the Sagrada Familia Church, a popular
tourist destination in Barcelona. The extent of
ISIS’s direct support to this attack cell is unclear, due in part to the death
of the cell’s leader
and numerous other cell members in the explosion of the TATP factory. Reports that
the cell’s leader traveled to
Belgium in
late 2016 could indicate that ISIS has a command-and-control node in Belgium that supported
the attack.
More coordinated ISIS attack plots in Europe are likely underway. Unconfirmed
reports indicate that ISIS’s external operations node in Libya has also dispatched foreign
fighters to Belgium and France in addition to the UK. It is possible that a
failed coordinated attack in Paris in 2017 was linked to the Libyan node. ISW
cannot confirm any coordinated attack cells in Belgium in 2017, but French and
Belgian police arrested one cross-border cell with likely
links to ISIS in July 2017. This cell may have been planning attacks. The returnee
foreign fighters may also be using Belgium as a base for command and control and
logistical operations instead of a base for attacks, as the travel of the
Spanish cell’s leader to Belgium suggests. They may have joined a pre-existing
ISIS network in Brussels comprised of the initial wave of returnee foreign
fighters that reached Belgium before ISIS’s major successful attacks in Paris
and Brussels in November 2015 and March 2016, respectively.
Sustained ISIS attempts to conduct coordinated attacks in France
and Germany in 2017 indicate that ISIS continues to prioritize those countries.
ISIS’s Iraq-based French cyberplanner, Rachid Kassim, planned a coordinated
attack in Paris, France involving TATP before a
coalition airstrike killed him near Mosul, Iraq in February 2017. French police
successfully disrupted the attack and
arrested 2 cell members on September 6th, at least one of whom had
been in contact with Kassim. German police meanwhile disrupted what could have
been a coordinated ISIS attack attempt in Essen by a German foreign fighter in
March 2017 who was reportedly recruiting
people in the area to conduct an
attack.
Future ISIS success are also likely in the states that thwarted coordinated
ISIS plots from 2014- 2016, which include at least Italy, Albania, and Kosovo. ISIS’s
links to criminal networks in Italy may reduce the group's incentive to attack
there in the near term, since law enforcement responses to such attacks could disrupt
important support nodes. ISIS could also risk alienating business partners such
as elements of the Italian Mafia if it attacks Italy.
The anti-ISIS coalition has eliminated
numerous ISIS external operators in Syria tasked with managing ISIS’s attack
campaign in Albania and Kosovo in airstrikes in June 2017, meanwhile.
These strikes may have disrupted ISIS’s ability to generate attack cells in the
Balkans. ISIS may be attempting to leverage Balkan foreign fighters to conduct
attacks elsewhere in Europe, however. Italian police arrested a Kosovar cell including at
least one returnee ISIS foreign fighter in March 2017 that was planning an explosive
attack against the Rialto Bridge. Available
reporting does not confirm that ISIS provided direct support to this cell,
which could have been merely inspired by ISIS. ISW will update this assessment
as new details become available.
ISIS’s coordinated attack campaign in Germany relies less on a
foreign fighter cadre than elsewhere in Europe. ISIS is also using recruited
and possibly trained refugees to conduct coordinated attacks in Germany. ISIS has conducted two successful coordinated
attacks in Germany using one returnee foreign fighter and one refugee operative
to date. The refugee was a Syrian who had reportedly fought with
ISIS before leaving for Europe in
2013. He detonated an
SVEST outside
a concert in Ansbach on
July 24, 2016. German police later discovered chemicals and other bomb-making
materials in his room at a refugee center in Germany. German authorities have reportedly
thwarted six coordinated ISIS attack attempts, involving three refugees, two returnees,
and one local who was likely in contact with an ISIS cyberplanner. Germany
authorities have reportedly thwarted an additional nine attacks that could
include attempted ISIS coordinated attacks, but for which adequate information
does not yet exist.
Refugees have conducted attacks in other countries, but ISW cannot
assess any coordinated ISIS involvement with confidence at the time of writing.
ISW’s assessment places ISIS-inspired attacks conducted by refugees into the
same category as all other instances of ISIS-inspired attacks. Future ISW
products will examine the trend of ISIS-inspired attacks in Europe in more
detail, to include when and where refugees have conducted such operations.
ISIS seeks to create momentum behind a campaign of attacks in
Europe that will require less direct input from ISIS over time. ISW assessed in November
2015 that ISIS’s goal in Europe was to provoke overreactions by European
governments that would alienate Muslim communities and radicalize them over
time. ISIS designed a campaign to inject violence into European societies in
order to jumpstart a campaign of low-level attacks against non-Muslim
populations in Europe that would further polarize European communities.
The scope and volume of low-level attacks that fit ISIS’s calls for
“lone jihad” in Europe nearly quadrupled in Europe from January 2014 to
September 2017. This trend could signal a growing resonance of ISIS’s messaging
to vulnerable populations despite ISIS’s territorial losses in Iraq and Syria. If
so, this trend would demonstrate ISIS success generating a campaign of violence
in Europe that requires progressively less direct input from ISIS to sustain.
It is still possible that ISIS cyberplanners or returnee foreign fighters coordinated many of these attacks, however. Available information does not enable ISW to assess these attacks to be coordinated at the time of writing. Attacks consistent with the ISIS calls for “lone wolf” jihad expanded to Spain,[ii] Italy,[iii] Switzerland,[iv] and Finland[v] in 2017. The attacks in Finland and rising levels of similar attacks in Sweden are the most likely to have been coordinated by ISIS, since they are in a new theater. Finland raised its threat level in early 2017, which could signal intelligence indicating ISIS was actively attempting to coordinate attacks. The chief of Sweden’s security service (SAPO) warned in June 2017 that extremist activity was rising in multiple Swedish cities. Norway also raised its threat level in early 2017, possibly indicating new ISIS attack efforts. It is also possible that some of these attacks have been inspired or enabled by al Qaeda rather than ISIS, but the available data does not confirm al Qaeda links.
The success of anti-ISIS operations in Europe remains limited. ISIS continues to generate and inspire attacks on a scope and scale larger than European security services can handle. New countermeasures such as “vehicle mitigation barriers” can reduce the lethality of ISIS tactics but are unlikely to disrupt ISIS’s ability to inspire and recruit attackers. Anti-ISIS operations in Syria and Iraq have not severed the link between ISIS’s senior leadership and its operatives abroad, moreover. Coalition airstrikes in Iraq and Syria have eliminated many ISIS external operatives, but have not sufficiently degraded ISIS’s capability. ISIS also continues to use safe haven in Libya as a base from which to support attacks in Europe even after its loss of Sirte, demonstrating how removing ISIS from cities is insufficient to prevent ISIS from conducting attacks. The anti-ISIS coalition is unlikely to dismantle the global ISIS attack network without broadening the scope of anti-ISIS operations beyond a narrow terrain focus. ISIS can use safe-havens in rural and even desert areas to plan, coordinate, and support the conduct of attacks in the West.
It must also refocus on addressing the grievances and fears of vulnerable Sunni populations that make them vulnerable to ISIS messaging. The widespread perception that European states and the U.S. are aligned with Iran and the Assad regime against Sunni populations in Syria and Iraq, as well as the rise of anti-Muslim sentiments and perceived anti-Muslim policies in Europe and the U.S. will continue to fuel toleration of and limited but growing support for ISIS (and al Qaeda) attack operations in the West. ISIS is waging a social and informational campaign to gain support among Western populations—Western states will not be able to kill and arrest their way out of this problem.
The first graphic in this report depicts the number of attacks and
attempted attacks per month in Europe from January 2014 to September 14, 2017.
The chart begins in January because it is the month when the first known ISIS
attack operative entered Europe after ISIS’s separation from al Qaeda’s Syrian
affiliate Jabhat al Nusra in mid-2013. French police arrested that operative,
named Abdelkader
Tliba,
thereby preventing what would have been the first coordinated ISIS attack in
Europe. ISW’s data set includes every such known attempted attack in Europe
since January 2014.
ISW’s data set most likely under-represents the number of thwarted
ISIS attack cells in Europe, which are the most difficult to discern from
openly available reporting. The “count” of attempted attacks per month in
Europe is the number of thwarted attack cells with proven links to ISIS or that
ISW assesses are possibly linked to ISIS based on openly available reporting. The
“count” is not estimate of the number of attacks that any given cell would have
conducted if not arrested. The actual number of attacks that ISIS has attempted
to conduct in Europe may be higher than the graphic in this report conveys,
therefore.
The “count” also does not measure the complexity of the thwarted
attack cell’s structure or geographic disposition. Some of the attack cells
included in this data set are individual attackers who were planning to conduct
a single operation based on instructions from an ISIS cyberplanner. Others are
larger networks of operatives spread between numerous safe houses in numerous
countries. Many fall somewhere in between, or reflect instances where European
security services arrested a cell before it had finalized an attack plan.
The “count” for the successful attacks in Europe is the sum of the locations at which successful attacks occurred. For example, the ISIS attack in Paris November 2015 has a “count” of six. ISW has coded the attack data based on each attack location because each separate attack location reflects a separate successful attack operation that ISIS chose to coordinate and execute simultaneously. This approach is in line with the methodologies used by U.S. military forces in Iraq, Afghanistan and elsewhere, which tally each individual kinetic event even when multiple attacks take place in a coordinated fashion simultaneously, but in different locations.
The comparison of attempted attacks versus attacks provides a proxy
for assessing the success of ISIS’s campaign in Europe. The ratio favors ISIS,
as ISIS appears to be able to generate attacks faster than European security services can disrupt them.
ISW’s data set does not include instances of partial disruption of
an ISIS attack cell. An example of a partial disruption would be the arrest of
one of five suicide bombers that reduced the “count” of the successful attack
to the observed four attacks. This data
set is not an exhaustive accounting of all of the successes of European
security services against ISIS, therefore.
ISW has sorted attempted attacks into the same four categories as
successful attacks based on available evidence as of September 14, 2017:
attempted coordinated ISIS attacks, attempted ISIS-inspired attacks, and
unknown attempted attacks for which few details are publically available. ISW
routinely updates and re-evaluates the assessment of each attempted attack as
new details become available, such as new information about a given would-be
attacker’s links to ISIS cyberplanners. ISW will publish updates and refined
assessments as appropriate.
ISW’s data set includes more events and counts differently than official
European reports. For example, ISW’s data for 2016 includes eleven more attacks
in EU countries than the EU’s 2017 counterterrorism report and dozens more attempted attacks. The primary
reason for these differences is that ISW counts events that the EU member
states have not definitively ruled as terrorism. European states must discuss
terror attacks on the basis of definitive evidence and the proper application
of European laws. ISW’s approach enhances analysis of the ISIS campaign in
Europe by widening the aperture to include the entire set of events that likely
fit within the ISIS campaign even if insufficient evidence exists at present confidently
to designate each event as a terrorist attack. ISW also seeks to inform
analysis of the perceived trend of attacks in Europe, which ISIS and
other jihadist groups use to recruit even if based in part of false attribution
of some acts of violence, as this report explains.
ISW’s methodology to consider each attack location a separate
attack also contributes to differences between ISW and European reporting. The
EU report considers the March 2016 ISIS attack in Brussels to be a single
attack, for example; ISW counts it as three separate, coordinated attacks.
----------------------------------------
The authors would like to thank Ryan Rockwell for his tremendous research support to this product.
[1]
ISW derived
this type of attack from the US military’s doctrinal definition of a
coordinated attacks which is: “an attack that exhibits deliberate planning
conducted by multiple hostile elements, against one or more targets from
multiple locations. A coordinated attack may involve any number of weapon
systems. [The] key difference between complex and coordinated is that a
coordinated attack requires the indication of insurgent long term planning.”
[2]
“An attack
conducted by multiple hostile elements which employ at least two distinct
classes of weapon systems (i.e. indirect fire and direct fire, IED and surface
to air fire) against one or more targets.”
[i] For
example, the US killed ISIS’s
Albanian foreign fighter and attack
planner Lavdrim Muhaxeri in an airstrike on June 7,
2017 near Mayadin, Syria.
[ii] An attack consistent with
ISIS’s calls for “lone jihad” targeted a
Spanish-Moroccan border post on July 25,
2017 before the ISIS cell in Barcelona conducted its attacks.
