Archive for the ‘CTC Sentinel’ Category

As ever, I have been very delinquent in my posting, so am going to do a catch up blast on a Sunday. First up is my latest interview for the CTC Sentinel’s series with the EU’s Counter-terror coordinator Gilles de Kerchove.

A View From the CT Foxhole: Gilles de Kerchove, European Union (EU) Counter-Terrorism Coordinator

DE-KERCHOVE-Gilles-1

August 2020, Volume 13, Issue 8

Authors: Raffaello Pantucci

Gilles de Kerchove has been the EU Counter-Terrorism Coordinator since September 2007. From 1995 to 2007, he was Director for Justice and Home Affairs at the Council Secretariat. From 1999 to 2000, he was deputy secretary of the convention that drafted the charter of the fundamental rights of the European Union. Between 1986 and 1995, he worked for the Belgian government. He is also a European law professor at the Catholic University of Louvain, the Free University of Brussels, and the Université Saint Louis-Brussels, and has published a number of books and articles on European law and security issues.

CTC: What role does the European Union’s Counter-Terrorism Coordinator play?

De Kerchove: The position was created by the Heads of State and Government in the wake of the 2004 Madrid bombings, and I am the second incumbent, having been in the job for 13 years. The aim is to contribute to the implementation and evaluation of the E.U.’s counterterrorism strategy as well as to ensure coordination between the various relevant policy strands. This implies, on the one hand, to support coherence between the E.U.’s internal and external counterterrorism (CT) policies and to foster better communication and cooperation between the E.U., third countries,a and international organizations such as U.N., NATO, IMF, WB, etc.; and, on the other, to present policy recommendations and propose priority areas for action to the European Council and to the Council,b informed by threat analysis and reports not least from INTCENc and Europol.1

Heads of State and Government wanted someone to look into every aspect of CT and identify loopholes in cooperation, not only at the E.U. institutions level in Brussels, but also between Brussels and member states. Additionally, they wanted an independent voice to assess policy and inject new ideas as well as identify and anticipate problems. I have always tried to spot looming problems to allow the system to start to prepare. I think I was probably the first to raise the issue of foreign terrorist fighters (FTFs) within an E.U. context, and I presented a package of ideas as early as 2013. Now I am focusing on what I call the effect of disruptive tech and extremist ideology, but I will explain that later. Our goal in the EU Counter-Terrorism Coordinator’s office is to alert the system and come up with relevant policy proposals.

In doing so, I am engaging with many different communities (intelligence, law enforcement, criminal justice, diplomats, development, humanitarian, Defence, Finance, private sector, non-profit sector, academia) inside Europe with its 27 member states, close allies, international organizations, as well as other external partner nations.

I do not really have a single counterpart in the American system. My counterpart in Washington could be said to be within the State Department, but when I visit, I also have meetings with senior officials in several other departments, depending on the issues: DOJ (access to digital evidence, encryption, cooperation between the FBI and Europol), DHS (aviation security, access to travel data (PNR,d APIe), counter violent extremism), Treasury (sanctions, terrorism financing). And then I also interact with the relevant parts of the intelligence community, including the ODNI [Office of the Director of National Intelligence], the NCTC [National Counter Terrorism Center], and the relevant counterterrorism person within the White House.

At the end of the day, I am not involved in operations but am rather looking at policy. But it is extremely important to be very close to the operational people, from intelligence, law enforcement, and prosecution. When I visit member states of the E.U., I always see the head of police, the head of the prosecution service, the head of the internal security service, and sometimes the head of the external intelligence service as well. The difference between the U.S. and E.U. is that the E.U. is not a federal state, as most of the policies in the areas that I am looking at are in the member states’ hands. The role is one that is very much in support of member states, but it has transformed a great deal in the past five years. After the Daesh [the Islamic State] attacks in Paris and Brussels, member states asked for a much more ambitious involvement of the E.U. in CT, which led to an increase in my office’s role and responsibilities to help coordination, as those attacks highlighted deficiencies in the system.

CTC: What is the biggest terrorist threat you see to Europe at the moment?

De Kerchove: The threat from terrorist organizations like Daesh and al-Qa`ida remains high, but it has morphed in different forms. The fact that the number of Daesh-inspired attacks has declined in the E.U. does not mean that the threat has disappeared. It primarily means that we have got better at detecting and breaking up terrorist plots, as demonstrated by continuing arrests of terrorist suspects in E.U. member states. Home-grown radicalization remains a challenge. Daesh’s presence on the internet remains strong. Extremist Islamist proselytization and violent right-wing propaganda create a fertile ground for terrorism. There are several additional risks which are of growing concern such as the hundreds of prison leavers convicted for terrorism-related offenses but who have served short sentences, FTF returnees, and FTFs and families still in Syria and Iraq, who—be they E.U. nationals or otherwise—need to be prevented from entering the E.U. undetected.

Over the course of the last two or three years, we have become increasingly concerned about the rise of attacks perpetrated by right-wing violent extremists. In 2019, Europe faced several terrorist attacks motivated by right-wing violent extremism. We’re also witnessing a dramatic rise of right-wing violent extremist propaganda on the internet and increasing cross-border connectivity (notably online) between right-wing violent extremists. Right-wing extremist terrorists in Norway, Germany, the United States, and New Zealand have all referenced previous atrocities and attempted to broadcast their own attacks online.

Finally, I worry about instability in Europe’s immediate neighborhood in the Middle East and North and West Africa, especially in Syria and Iraq as well as in Libya and the Sahel because the presence of terrorist groups there constitutes a threat to the EU’s security.

The threats from violent separatists in Europe is much reduced. In Northern Ireland, there is still a low level of what the British call national security incidents (attacks on police and prison officers), but these threats do not seem to have extended across the sea to Great Britain. Whilst the numbers of incidents have been low in recent years, the level of capability retained by terrorist groups in Northern Ireland remains serious. There was a concern that the potential reestablishment of a border between the north and the Republic of Ireland would maybe have a negative impact on security and inflame tensions; this has not materialized significantly to date, but concerns remain and recent arrests indicate that police and security services continue to work hard to keep the threat under control. The Spanish terrorist group ETA is completely over as an entity, thanks to the relentless efforts of the Spanish security apparatus. Two E.U. instruments have helped in this fight: the European Arrest Warrant (EAW), which changed completely the way Spain was able to secure arrests and deal with Basque terrorists hidden in other member states, and the Joint Investigation Teams (JITs), which facilitated the way in which the French and Spanish were able to crack down on the organization.

And I hope that I am wrong, but we may see the development of other forms of extremism like technophobia or something like that in the coming years. With the development of disruptive technologies, some people may feel disenfranchised or marginalized by this rapid evolution of technology and its impact on society, and they might react violently. We have maybe already started to see this develop during the COVID crisis, where we have seen 5G masts being burned2 and the offices of telecom companies being attacked. This is something that we have to monitor; it may evolve in a more worrying direction. And let us suppose that it is linked to environmental violence, people who believe that the world is close to collapsing and government is not taking the right decisions to address the warnings on global warming. They might believe that they need to use violence to wake the government up. You could see developments around this technophobia linked with some sort of ecological extremism. But this is not the core of the threat, which remains foremost violent Islamists and to a much lesser extent the rising right-wing violent extremism.

CTC: Thousands of Europeans are believed to have joined the Islamic State or al-Qa`ida-affiliated terrorist groups as foreign terrorist fighters (FTF) in Syria and Iraq. How is the European Union working to manage the potential threat they pose?

De Kerchove: This is a priority for me. Tens of thousands of people have left their own countries and joined Daesh, including about 5,000 Europeans. About 25 percent of them have returned to Europe and another 25 percent have died on the battlefield, but others could in the future perpetrate terrorist attacks at home or in third countries.

Internally within the European Union, we are working to implement agreed arrangements on our border security to ensure that known foreign terrorist fighters (both E.U. citizens and non-citizens) are detected and stopped at the EU’s external borders. Furthermore, as part of an interoperability project, the E.U. is connecting six centralized E.U. databases in the fields of security, migration, and borders so that border guards and police officers can, under precisely defined circumstances, check data in a comprehensive fashion, detect identity fraud, and hence better spot third-country terrorist suspects. The E.U. is also strengthening the use of biometric data in this context. For those who already returned, E.U. supports sharing of good practices (through a Radicalisation Awareness Network (RAN)f handbook). And a number of member states have specialized programs for children.

The E.U. has also been working on better access to battlefield information to support investigations, prosecutions of FTF returnees, and border security. We must ensure that foreign terrorist fighters can be investigated and tried in a court of law. To this end, we are studying how information gathered by coalition armed forces on the battlefield in Syria and Iraq can be made available to investigators and prosecutors, in ways that are useful during trial procedures. For the material collected by the Iraqi forces, we have been pushing a program for all the information collected to be indexed and digitalized so that it can be analyzed and processed properly. One of the reasons our member states are so wary of repatriating FTFs is a lack of evidence of the acts they committed on the battlefield in Syria and Iraq, which can be used against them in a court of law. If someone gets back to Europe and we do not have enough evidence, the best you can secure is three or four years in prison for the crime of participation in a terrorist organization, even if, based on intelligence information, you know he or she may have killed people. So, it is very difficult to tell the population that you are bringing back someone who is a real murderer and he will be back on the streets of Paris, Brussels, or Madrid three years after his return. The more we can get access to evidence, the more likely we will be to secure long-term sentences and the more likely the public and governments are to accept repatriation.

As this is material and information primarily collected by coalition military personnel on the battlefield, it is not easy for investigators and prosecutors in Europe to locate it and then introduce it into criminal proceedings in courts in member states. Prosecutors and judges are used to a specific forensic treatment of material, which battlefield information often lacks as it is not collected by police officers who are forensically trained but rather is picked up in a battle situation. The material or information is often fragmented and can only be used as a lead or supplement to other evidence. U.S. authorities have gained a lot of experience in the use of battlefield information in criminal proceedings since 9/11. In addition, the U.S. military has been able to collect battlefield information from important theaters such as Afghanistan and Iraq. For these reasons, the U.S. government is an important partner for us in this particular issue.

It is also important to address the legacy of the caliphate in Syria and Iraq. Member states are deciding on repatriations on a case-by-case basis; the E.U. is not involved. Some member states do seek to repatriate children but on a case-by-case basis, and they try to start with orphans. But the problem here is that sometimes the Kurdish-led Syrian Democratic Forces do not want to repatriate the children alone and want to send them back with their mothers.

Several member states are working to find a solution so that their nationals can be tried in the region where they committed their crimes. There is currently an ongoing negotiation between these member states and Iraq to try them in Baghdad courts. There are numerous challenges: the death penalty, fair trial, what to do post-conviction, who will detain them, and who will pay for all of this. The Kurds in Syria recently suggested they could do it themselves. They want to get international support to set up a court themselves, but this is not something the E.U. is involved in.

While we wait for an outcome of this negotiation or possible repatriation, the E.U. is exploring how to improve the situation in the camps and prisons in Kurdish-held territory in northeastern Syria. It is indeed important to reduce radicalization in the camps, in particular Al-Hol and its international annex, which is in the hands of the most radical women, and prevent them from becoming a time bomb for radicalization. The camps are a mess, and there is some money that is coming in through crowdfunding so the women can bribe the guards and arrange escapes. The kids are forced to follow sharia classes and are getting more and more radicalized in some cases. We should focus on trying to reduce these particular problems, as some of these children may end up going home one day and they will be a lot more radicalized than they were at the beginning. In addition, the sanitary conditions in the camps and prisons are very bad, including problems around tuberculosis, and we are very worried that COVID-19 may enter.3 This may lead to riots and prison breaks. We know Daesh is very keen to support flights and prison breaks.

The E.U. has just adopted a support package for the prevention of radicalization in northeastern Syria, which does include support for the camps. The following additional measures are currently being analyzed. First, we are trying to find ways to decongest Al-Hol by helping the return of Syrian women and children to their Sunni tribes in northeast Syria. There is a system of sponsorship for their return, similar to something that was run in Afghanistan, and we can support that process. I am also in contact with senior officials in Iraq to see if we can speed up the return of some of the Iraqi women and children currently in Al-Hol to Iraq. Second, we have been working to encourage a Prevent-type programg in Al-Hol through NGOs, focused in particular on children. Third, we are working to improve the detention conditions in the prison, something that the International Committee for the Red Cross (ICRC) in particular has asked us to do. There are currently several hundred young people detained with adults. They should never have been placed in a prison facility. The global coalition suggests that an existing youth rehabilitation center is expanded to be able to receive these young people. Fourth, an evaluation of the women in the international annex of Al-Hol would allow us to obtain a better picture of what is actually going on and to separate the most radicalized women from the rest, and offer more assistance, including psycho-social support and rehabilitation to the less radicalized women and their children.

There is still a window of opportunity to act right now. A new escalation could lead to the dispersal of terrorists, including possible travel of some FTFs to Europe. My efforts are focused on what we can do in the short- and medium-term to make sure the situation does not worsen.

The E.U. is also providing assistance to third countries to deal with FTF returnees and their families, including via the U.N. We have developed several programs to help Tunisia, the Western Balkans, and many other countries to do that in the best way possible.

CTC: In April 2020, German authorities thwarted a plot against U.S. military facilities by a network of Central Asians who, according to prosecutors, had contacts with high-ranking Islamic State figures in both Syria and Afghanistan.4 Can you talk us through how this plot fits into your sense of the threat in Europe, including from the Islamic State in Afghanistan?

De Kerchove: This plot shows, once again, that we should remain vigilant about the threat of Daesh attacks in Europe and that the threat does not come only from individuals who are inspired by terrorist propaganda online and act independently. Daesh continues to seek contact with potential attackers in Europe whenever it spots an opportunity to do so, to guide them in their attack plans. This should inform our response as well. The threat from Daesh remains diverse, and we need to prepare for a range of attack methodologies with widely divergent levels of sophistication and for attackers whose profiles vary a great deal.

Afghanistan does not represent the same level of terrorist threat to Europe as Syria. That said, we should never be complacent about the threat of armed terrorist groups, even if they are located far away from the E.U. Many Daesh and AQ affiliates do not currently focus on attacks in the West but would not hesitate to support or facilitate one if they had the chance. This applies to Daesh in Afghanistan, but also to Daesh and al-Qa`ida affiliates in Africa.

We have been working on the Central Asian threat picture for some years. Part of the problem of why a lot of Central Asians were joining Daesh in Syria and Iraq was that a lot of them were working in Russia and lost their jobs because of the economic crisis there. Many of the Central Asian countries they come from are not wealthy, making it difficult for them to return home to find employment or continue to support their families remotely with remittances. When these individuals lost their jobs and became disenfranchised, they started to become attracted by Daesh rhetoric. There was a very active Russian language propaganda effort from Daesh in Syria and Iraq, which drew some people there. That was not the E.U.’s top priority in 2015. The main focus was on the E.U.’s immediate neighborhood. Now there is a wide consensus to do a lot more in Central Asia. We have deployed a CT expert in the region, we have supported a number of UN projects in the region, and I have myself visited many of these countries.

CTC: There has long been concern about al-Qa`ida reemerging as a global threat, and it appears the group’s Yemeni affiliate had a significant role in the December 2019 shooting in Pensacola, Florida.5 What kind of threat does al-Qa`ida pose today? Would you place it as a higher or lower risk than the Islamic State or an ideology like the extreme right-wing?

De Kerchove: This is an important question because we sometimes underestimate the continuing threat from al-Qa`ida. AQ remains an important threat to Europe today. Core AQ, as well as affiliates such as AQ in the Arabian Peninsula, have long planned for mass-casualty attacks in the West, notably on aviation. Core AQ is still present in Afghanistan. Admittedly, the peace agreement between the Americans and the Taliban has explicitly foreseen that the link between AQ and the Taliban should be completely severed, but I do not know if this will happen. History shows that the Taliban have always lied on that front, so it is still a concern. AQ in the Islamic Maghreb and the organizations it controls are killing European soldiers in the Sahel through sophisticated attacks. They constitute a serious threat to countries in the region. In some regions, AQ’s branches are often stronger than Daesh affiliates.

Ranking the threat of terrorist organizations is not an exact science. There is little point in stating that one terrorist group represents a slightly higher threat than another. My general assessment is that the threat from Daesh and AQ to Europe remains high and that the threat from right-wing violent extremism has risen quite significantly.

The current threat within Europe is mainly from people who have no formal link to Daesh or al-Qa`ida and are inspired by the ideology. For these groups, attacks by people who endorse their ideology and who they later praise represent a low-cost attack strategy. The threat now comes more from inspired attacks rather than the kind of directed attacks we saw in the 2015 and 2016 attacks in Paris and Brussels.

In the past, the threat from AQ in the Arabian Peninsula, in particular to aviation, was very strong. At the moment, my assessment is that neither AQ nor Daesh have the capability to launch a major attack in Europe, but they still have the intent. They will not hesitate to attack if we let down our guard. There is still a threat to European citizens when they travel to other countries, and of course, there is a threat to the countries themselves where the groups are still active. If they are able to destabilize and make countries such as Mali and Burkina Faso ungovernable, it would pose a serious problem for everyone. This is why we have to help countries overseas to address the threats from al-Qa`ida and Daesh.

There are several places around the world where AQ keeps developing, and in fact, they have learned from their mistakes and become much more patient than Daesh. They understood that using extreme and indiscriminate violence was not the best way to attract hearts and minds. In the period when we focused on Daesh, AQ continued building, focusing on local grievances

In Syria, and Idlib in particular, where HTS [Hayat Tahrir al-Sham] and Hurras al-Din are active, there are a lot of violent people who are AQ related. And of course, you have AQ affiliated al-Shabaab in East Africa.

CTC: There is a lot of talk of a reemergent extreme right-wing as a major threat, yet the attacks we have seen remain predominantly lone-actor type attacks. Can you sketch out whether you see the potential for this escalating into something more organized?

De Kerchove: Right-wing violent extremist groups realize that lone-actor terrorism is more beneficial to them than any form of violence that they organize themselves. Structured right-wing violent extremist groups often know exactly how far they can go in their statements and in their activities to remain just within the limits of what is legal. In the meantime, they leave it to ‘fanboys’ on the internet to take action by themselves, without any risk to the organization.

Unorganized right-wing violent extremists, who used to get together at concerts, motorcycle gatherings and other events in the past, now meet online. I do not know whether the spate of lone-actor attacks could escalate into something more organized, but I think that—from the perspective of the violent right-wing extremist scene—a sustained campaign of lone-actor attacks can be far more effective. I am certainly expecting more of those.

In recent years, we have witnessed a growing number of right-wing violent extremist attacks. The extent of violent acts motivated by racism, xenophobia, and other forms of bigotry may actually be underestimated in Europe, as we do not have a uniform method of classification. Some attacks are counted as hate crimes; others are treated as ordinary forms of criminality. At [the] E.U. level, we need to agree on a methodology to systematically count and classify these attacks in order to appreciate the extent of the problem and to combat it better.

We see increased international connectivity between right-wing extremists, notably via the internet. Individual right-wing violent extremists often imitate and reference previous attackers when carrying out a violent act. A formerly disparate group of marginal extremists thus increasingly turn themselves into a well-connected movement with a coherent ideology structured around the notion of the “Great Replacement.”

There are some differences between the right-wing violent extremism in the U.S. and Europe, but I think they all share the common rhetoric with the Great Replacement book written by Renaud Camus.6 It is also notable how much jihadi rhetoric and ideology share with right-wing violent extremism rhetoric. It is often about misogyny, with Incel7 a good example of this particular aspect of the phenomenon. It is a lot about a rejection of globalization. It is often about projecting a black-and-white vision of the world, hatred of Jews and anti-Semitism. Anti-Semitism is not just linked to the right-wing, by the way; Islamist extremism is a case in point, but there is a strong strain of anti-Semitism on the far left as well, but this is linked to anti-Zionism and an anti-Netanyahu feeling rather than the exact same strands of ideology linked to the far right. There are some survivalists amongst those on the far right, and I acknowledge there is a wide diversity of elements in the right-wing violent ideology, but what is interesting is that there are some key ideas that tie them together—hatred toward Arabs and Jews, misogyny, anti-globalization, for example.

There are also foreign powers that are playing into this and extending their outreach into Europe as part of a hybrid warfare, which focuses on destabilizing Europe. There is an interesting confluence in online ideas at the moment. Terrorism speech, hate speech, and disinformation are all coming together. Disinformation has been pushed both by state actors and non-state actors. One of the policy answers I draw from that is that we need to have a greater coordination between various strands of policy work in the online space. We currently have three separate dialogues with internet companies: one on terrorism speech, which we will soon result in legislation; a separate one on hate speech; and a third one on disinformation. To be more efficient in our dialogue with technology companies, we should be bringing these three together, as the strands and necessary responses are likely interlinked.

We have not looked enough at the phenomenon of foreign fighters going to Ukraine. I was very impressed by the figures produced by the Soufan Center recently about the many hundreds of right-wing Europeans who had gone to fight in Ukraine on both sides of the conflict.8 There are more and more people traveling in Europe to rally and train around right-wing violent extremism groups in different parts of Europe. Fears around globalization, migration, “the Great Replacement,” and the threat to the white community are key elements that tie the right-wing violent extremists together on both sides of the Atlantic.

CTC: What other ideologies do you see on the horizon or at the moment that have the potential to pose a major terrorist threat to Europe?

De Kerchove: The potential future rise of new forms of terrorism, rooted in conspiracy theories and technophobia, is a cause for concern. Disinformation is not necessarily rooted in political ideologies, although it is often amplified by right-wing and left-wing extremists. We have already seen small-scale acts of violence caused by a belief in conspiracy theories—for example, as I already noted, against telecom masts—and given the amount of disinformation online, we could see more serious examples of this in the future. I am also concerned about increasingly violent ecologist and animal rights groups.

In parts of Europe, left-wing violent extremism is already a threat. Left-wing violent extremists are responsible for a large number of non-lethal attacks. Depending on how the economic crisis develops in the wake of the health crisis we are currently facing, inequality is going to be exacerbated, and this might inspire more violent left-wing extremism that could have the potential to become more lethal and more geographically dispersed than it currently is.

CTC: What indicators do you see of these kind of threats that are developing as a result of the impact of COVID-19?

De Kerchove: I do not have many indicators around these threats at the moment. But if I take only my country, Belgium, it is one which is always split along the border between the Flemish part and the Walloon. It is interesting to see that telecom company Proximus has had a lot of problems trying to deploy 5G in the southern part of the country, in contrast to the more economically dynamic northern part. This could be an interesting indicator.

We are just at the beginning of a major change in society. I do not think we realize how different the world will be in five years’ time thanks to artificial intelligence. A lot of it we can see coming very quickly and will have deep-reaching impacts. The way justice will be delivered in the future will no longer be the same. The delineation between law enforcement and intelligence might be a bit blurred, and the digitalization of everything will have an impact across society and security.

In the last two decades, the left-wing violent extremism menace was more located in Italy and Greece, and we still have some groups there, but the truth is Europe is not homogenous when it comes to left-wing and right-wing violent extremism. Right-wing violent extremism is, for the time being, a major concern in the northern part of Europe, Scandinavia, Germany, and the U.K., on top of what is happening in the United States, where some assess it is now a bigger threat than jihadism. Other countries, like France, emphasize left-wing violent extremism, like the ultra-gilets jaunes, the violent segment of the group.h

It is interesting because there was something like that going on just before 9/11, in the form of a very active anti-globalization movement. This was the main topic on the agenda when discussing emergent extremisms in Europe. You had groups of violent left-wing extremists traveling all over Europe to disturb G7 meetings, meetings of the European Council, and so on, and it was definitely a growing movement. And then 9/11 happened, and this disappeared completely for many years. But now we can see left-wing violent extremism coming once again. We have seen it in Germany last year, we see it at some big international events, and the French in particular are raising the issue as one of growing concern. And we may see, but of course this is just speculation for the time being, that it starts to grow once again because of the COVID-19 crisis and the economic fallout. I am in the midst of doing some work on this, in much the same way as I did some work on the right-wing violent extremism threat before. It is not at the same level of intensity as the right-wing violent extremism, but if you take the economic concerns and add those to some of the criticism that we see online with the debate around COVID-19 tracing apps and the perception that there is a big-brother society that is gathering data on people to control everything, we could maybe see this develop into something more coherent and growing dramatically.

CTC: We are entering a moment of great-power tension. This can have repercussions in the non-state actor space through the use of proxies. Do you see a rising threat in Europe from state-supported terrorist actors? For example, from Russia or Iran?

De Kerchove: No. But that is not to say that there are no violent consequences resulting from some third countries’ deliberate interference to weaken our democracy and undermine the European Union. While they do not use terrorist proxies, some foreign powers deliberately spread disinformation and conspiracy theories to divide us. Their support to ultra-nationalist and right-wing extremist worldviews indirectly fosters violence because this sort of propaganda also fuels the actions of violent extremists and terrorists.

The current stance of the E.U. is that we only placed the military branch of Hezbollah in Lebanon on the E.U. list of terrorist organizations in the wake of the attack in Burgas and a plot in Cyprus.i Some of our member states have chosen recently to go further than just the military branch.9 In Germany, it is not a formal listing, like in the U.S., but a ban, which is legally a bit different. I am not sure we would follow our American friends and expand to a listing for the whole organization, but it is important to note that the E.U. proscription is not a precondition for prosecution and anyhow we are active and vigilant on the organized crime aspect of the organization. The organization is indeed collecting money from all over the world with sophisticated money-laundering schemes with links to Africa, Latin America, using drugs and the like. Europol, working closely with the American law enforcement agencies, conducted a major operation called Cedarj a few years ago in which millions, if not hundreds of millions, of euro being laundered between cartels in America, Latin America, Europe, and Africa were traced and linked to the Lebanese Hezbollah group. We are not soft on the organization, but there is no unanimous decision to list the whole organization.

On Iran, the E.U. put a directorate within the Ministry of Intelligence [and Security] (MOIS) on the list of terrorist organizations, as well as two members of the Iranian government.10 This was done after a foiled attempt to murder an exiled Iranian from the Arab Struggle Movement for the Liberation of Ahvaz (ASMLA)k in Denmark, and the disruption of a plot to blow up the yearly meeting of the Mujahedeen-e-Khalk (MeK)l in Paris, which was due to be attended by Rudy Giuliani, President Trump’s close adviser. This is a new development, placing a part of the State of Iran and officials of Iran on the EU’s list. We have had several recent cases of proxy fights between Gulf States and Iran in the Scandinavian countries.11 This does not quite qualify as terrorism, but it is criminal behavior. It is, of course, unacceptable that other states use European soil as a place to target each other by proxy.

As to Russia, we have had several cases of major concern around killings of Chechens in Europe. The Germans are currently prosecuting someone for the killing of a Chechen commander on their soil.12 And there are cases like Sergei Skripal.m But these again are cases which do not meet the criteria of being terrorism. They are not done to influence the population or the host government into changing its policy. These incidents and attacks are more about internal Russian and Iranian domestic politics, targeting dissidents, with Europe simply the location where they are taking place.

CTC: Could you talk us through some of the impact of Brexit on European counterterrorism?

De Kerchove: It is always a bit difficult for me to express myself on this topic because we are in the middle of a difficult negotiation and I do not want to say anything which could have a negative impact on these negotiations. The starting point is what former Prime Minister Theresa May said, “Brexit means Brexit.” Brexit has consequences. Once you are no longer a member state, this means you no longer have the same rights as a member state. So that is the starting point, and I am sorry for that. The relationship will have to be different to that of other non-E.U. states who are in Europe like Norway or Switzerland as they are part of the Schengen free-movement space within Europe.

The second aspect, a lot of what we have been developing over the past 20 years in the field of justice and home affairs, like mutual recognition of criminal justice decisions or the availability of information, have only been able to develop as a result of very strong safeguards in place, and these safeguards are linked to human rights. We have the charter of fundamental rights, the human rights convention, and very strong rules on data protection and privacy. Some believe we are going too far in this direction, but that is where we are. And so it is difficult to have the same agreements in place with non-E.U. members who might not have the same safeguards in place in the future.

Having said this, I have spent the last 25 years of my life working in the field of security and justice in transatlantic affairs, going back to when Janet Reno was the U.S. Attorney General. During that time, we have built an amazing amount of cooperation between the U.S. and Europe. I would be very surprised if we did not do the same with the U.K. outside the European Union. I do not see why the U.K. would end up in a lesser position than the U.S. in this regard. So, it could be a U.S.-type relationship, and it is in our mutual interest to have a strong relationship. But there are legal constraints on what we can do, and I am sorry for that.

It is worth noting that intelligence is outside the E.U. framework. The E.U. 27 member states plus Norway, Switzerland, and the U.K. are working outside the E.U. framework already through the Counter-Terrorism Group (CTG) where they all meet. They have developed common platforms and databases, and there will not be any impact on this from Brexit. So, on the intel front, I do not see any impact. Where we will lose something—and I hope the negotiator will find a smart way to compensate for this—is the outstanding and very impressive input of the Brits on the policy side. I have myself worked very closely for the past 13 years with the U.K. in this regard, with numerous Home Secretaries, National Security Advisers, MI5, MI6, and others. In terms of ideas and shaping the policy, they were very creative and helpful. But we will keep talking to each other.

The U.K. has been and will remain an important partner in the fight against terrorism. Counterterrorism depends on swift and effective exchange of information, and on close operational and political cooperation. The E.U. and the U.K. are currently negotiating their future relationship, including a framework for cooperation in law enforcement and judicial cooperation in criminal matters, which will be the basis for future CT cooperation between the E.U. and the U.K. as a third country.

A lot of technical details are being addressed in the negotiations. Many E.U. instruments relevant for CT are based on the principles of mutual recognition and availability of information, which require certain essential safeguards (such as equivalent data protection standards, respect of the E.U. Charter of Fundamental Rights, supervision by the European Court of Justice), some of which are redlines for the U.K., which means that different ways for cooperation need to be found. As I already noted, there are models for cooperation with third countries in a similar situation, such as the U.S., where we have created a strong CT partnership over time. The Union’s ambition is clearly that the counterterrorism relationship with the U.K. will remain strong; it is in the interest of both sides.

CTC: You recently wrote a paper for the Council of the European Union looking at how terrorist threats were evolving as a result of COVID-19. What are the key takeaways?

De Kerchove: While the current health crisis appears to have had only a limited impact on the terrorist threat to date, there is an increased risk of terrorism in the future. We must prevent the current health and economic crisis from becoming a security crisis as well.

The terrorist threat depends on three factors: intent, capabilities, and resilience. Terrorists had the intent to stage mass-casualty attacks long before the current crisis. The diminished resilience of targeted countries as a result of the pandemic is already a cause for concern, and this could reinforce terrorists’ capabilities in the longer term. Extremist propaganda could resonate more as a result of the economic and sanitary crisis, strengthen terrorists’ morale, and expand the breeding ground for radicalization. COVID-19 might result in a diminished focus on CT among our law enforcement and armed forces and disrupt military and intelligence operations.

Right-wing violent extremism and terrorism was already on the rise before the pandemic. Violent right-wing extremists have been particularly shrewd in exploiting the coronavirus crisis, blaming minority groups, and spreading disinformation. Right-wing extremist hate speech and incitement to violence on the internet has increased dramatically since the start of the coronavirus crisis. Violence against minorities—particularly Jews—has increased during the pandemic. We need to tackle these problems and counter anti-Semitic hate speech and violence.

The pandemic has also sparked conspiracy theories that have no direct link to existing extremist ideologies. As I’ve already noted, as a result of such theories, telecommunications masts have been set on fire in several member states. The motivation behind this is linked to a movement of technophobes with indirect links to right-wing and left-wing violent extremists, which is gaining in strength.

CTC: Do you think there will be a reduction in CT and CVE (countering violent extremism) funding and attention post-COVID-19?

De Kerchove: I acknowledge that allocating the same level of resources to CT and CVE post-COVID-19 might be challenging, but I hope that policymakers will recognize that the prevention of terrorism remains crucially important. The E.U. is analysing the impact of COVID on terrorism and security more broadly in our neighborhood and beyond, and is providing COVID-related additional assistance. Given the probable rise in radicalization resulting from the health and socio-economic crisis, prevention and CVE will be even more important than before. Money spent on CVE is money well spent, especially in a time of crisis. Health, the economy, and security influence each other. Hence, we should prevent the emergence of a vicious circle of mutually reinforcing sanitary, socio-economic, and security problems.

CTC: Technology continues to advance rapidly, with disruptive technologies increasingly the norm from online innovations, artificial intelligence, quantum computing, robotics, novel materials, the internet of things (IoT), space, and more. These are impacting our daily lives with ever greater frequency. How do you think this will impact the terrorist threat picture and E.U. response?

De Kerchove: Around three years ago, I began to worry that at the E.U. level, not necessarily at the member state level, we may have overlooked the impact of digitalization and disruptive tech on security and criminal justice. We have not properly assessed the threats that they potentially pose. Nor have we understood or yet maximized the opportunities they provide for delivering security and justice in the future.

Disruptive technologies can be indeed looked at under three different angles: the threat that they create/amplify, the potential they offer to increase the effectiveness of the law enforcement agencies/justice, and the impact they have on the way we will provide security and justice in the future. It is important therefore that the security community devotes more attention to these techs.

From a threat perspective, terrorist and violent extremist groups are harnessing new technologies. For example, those groups use increasingly cryptocurrencies to raise funds in an undetected way. Online gaming is another new field which deserves to be looked at. The scale is unbelievable, with about two billion people playing games online, who could be potentially targeted by terrorist and violent extremist propaganda. Another example, COVID may inspire people to use bioweapons, having seen the impact that the virus has had.13 If I were the head of a terrorist organization, I would say, that is clearly the best way to cause chaos and disrupt the West. But at the moment, it is quite difficult to weaponize the virus. You may send some ricin or anthrax by letter, which people have tried, but with COVID, this is going to be much harder.

But I do not exclude that in the coming years, it will be possible for a lone actor to mount an attack with catastrophic consequences. The current assessment is that the lone actor will just use a knife or a car and mount a low-cost attack. But for someone with the relevant education, armed with the democratization of knowledge, it might be much easier to process a virus in a cloud lab.n So, when you look at the convergence of these threats, you see a quite dangerous potential threat on the horizon. Someone could process a virus in a cloud lab, take a drone and use a GPS geolocation system to steer the drone, and go to a football stadium to spread the virus created and kill 50,000 people. So, my point is that we need to properly assess every possible threat that these new disruptive techs might pose.

At the same time, the opportunities provided by big data analytics, notably to find weak signals on the internet, artificial intelligence, facial recognition technology, robots, drones, and more are already helping police as well as justice, and will likely do more in the future. From a European perspective, the key will be to make sure this takes place across the E.U.

There is also the transformative impact. For instance, within five years, we might lose a significant percentage of the workforce in the field of justice because machines will do some jobs better than humans. I have worked hard to try to convince E.U. institutions to invest a lot more on this, because we were a bit lagging behind.

Disruptive techs raise several huge challenges. First, we should ensure that law enforcement and the judiciary maintain their lawful tools of interception. On 5G, the E.U. is working towards ensuring that lawful interception remains possible, and is active in standardizing processes for such interception across the continent. The E.U. has worked on encryption for several years, in particular device encryption, via Europol and the European Commission’s JRC.o I believe there is a need for a more comprehensive, legislative solution.

Second, we see more and more the importance of data protection and privacy, with consequences on security. The question is, how much can we rebalance this relationship? One of the reasons why the Americans or the Chinese are much more advanced in AI than Europe is because every day, their firms get billions of data points from you and me. They get this information for free and can process it to help with their machine learning. In Europe, it is much harder for companies to get access to the volume of data necessary to train their algorithms because they are protected by GDPR [the European Union General Data Protection Regulation]. GDPR is a great achievement to curb the loss of control on personal data by Europeans, but its implementation should at the same time seek to foster innovation. It is then important to work closely with regulators and supervisors of data protection and fundamental rights, to take full profit of GDPR’s flexibilities to experiment, through regulatory sandboxes and testing facilities (where companies can test out new potentially disruptive technologies, and reflect on adapting/adopting regulation), [and] see how this might be used in the justice space as well as putting oversight mechanisms.

Third, disruptive techs also raise issues of sovereignty, and where information and data are kept. The COVID crisis has highlighted what current supply chains and dependencies look like with greater clarity, and in particular how dependent Europe had become on non-E.U. countries like China. To some degree, we are lagging behind the Americans and Chinese in most of these disruptive techs, and there is therefore a need to bolster transatlantic cooperation on this. Fortunately, this European Commission has decided to invest a lot into research technology and digitalization to catch up.

Turning back again to the threat that disruptive technologies create/amplify, there is a direct impact from internet companies and the degree to which social media companies have amplified the jihadist and right-wing violent extremist propaganda. We have started working on this, but not enough.

I’m worried by what I call algorithm amplification, whereby these companies—YouTube, Facebook, TikTok, and so on—design their algorithm in a way that they keep you online as long as possible because their business model is based on watch time for selling ads. And the issue is to hook people by giving them a lot more problematic content. I am not suggesting illegal content, but a lot more conspiracy theories, a lot more titillating material. It is like junk food. It is not by coincidence that junk food is full of salt to keep you coming back. It is the same with the internet; they bring stuff that is exciting and interesting and will draw you in. If you are interested in violent, hateful speeches, you will get more of the same and often more and more extremist content. It creates a common dynamic between disinformation, hate speech, and terrorist content.

There is a lot more we can do in this space. I have been working with the European Commission on looking at how we can bring the law enforcement and criminal justice community more into all these files and create an innovation hub at Europol which brings together all the interior and justice ministries from member states, as well as all the many European agencies that cover related security issues (Europol, Eurojust,p Frontex,q CEPOL,r eu-LISA,s etc.), with the ambition to later connect to cyber, space, and defense actors. We need people (at policy as well as operational levels) who understand all of the different issues to be able to deal with them.

CTC: There has been considerable debate about the threat posed by terrorist recidivism and whether prison sentences for terrorism offenders should be extended. A recent study in this publication by Thomas Renard that focused on Belgium argued that the phenomenon of terrorist recidivism, while a problem, has been “overblown.”14 What is your view on this issue?

De Kerchove: It is good that Thomas Renard has systematically looked at recidivism rates among terrorist convicts. His conclusions are reassuring, but of course, any terrorist attack committed by somebody previously convicted for a terrorist offense is one too many. In this context, it should also be borne in mind that terrorist acts have a very serious impact on society—more serious, in fact, than most ordinary crimes.

The fact that several hundred inmates convicted for terrorist-related offenses will be released from European prisons in the very near future also compels us to prioritize rehabilitation and disengagement efforts. Even if only a small number of them reoffend, then the sheer magnitude of the wave of prison releases still creates a significant additional security risk and pressure on security forces.

That is why I think the EU Council conclusions of 6 June 2019 on “preventing and combatting radicalisation in prisons, and on dealing with terrorist and violent extremist offenders after release”15 are important. The E.U. is supporting risk assessment and rehabilitation programs in prisons in member states and sharing of good practices and lessons learned.

CTC: What is the role of mental health and other personality disorders, and how does this affect the threat picture and response?

De Kerchove: This is a subject that attracts increasing attention among CT practitioners and policymakers, including at E.U. level. There is no clear profile or prototype of a terrorist. It is clear that mental disorders do not cause terrorist acts, but they sometimes influence terrorist behavior in connection with other—political, sociological—factors. There may be a greater than average prevalence of mental disorders notably among lone-actor terrorists. A number of lone actor terrorist attacks in Europe in the last two years—for example, in France, the U.K., and the Netherlands—were committed by lone actors with underlying mental health problems.

Given the increase in lone-actor attacks in the West, we should pay more attention to mental health issues in our policy response. The COVID-19 crisis, which is likely to exacerbate mental health problems in some individuals and to make them spend more time online, makes this an even more important topic.

How can we use knowledge on mental health in CT? We can, for instance, look at risk assessment tools: while psychopathology in itself is not predictive of terrorist behavior, mental health issues play a useful role in risk assessments, in combination with other factors. It is worth looking at it in rehabilitation and disengagement programs—using customized treatment to rehabilitate former terrorists or to achieve disengagement of radicalized individuals.

I know that much research on the role of mental health issues in radicalization and terrorism has been conducted with regard to jihadist radicalization. But we need to understand better what role mental health problems play in driving the men responsible for right-wing violent extremist attacks as well. The E.U.-sponsored Radicalisation Awareness Network (RAN) recently published a very useful handbook for practitioners on dealing with mental health in the context of CT.16

Finally, I am concerned about the mental health of the women and children in the camps in northeastern Syria with a risk of future radicalization and involvement in terrorism. I already talked about what we’re doing to prevent this from happening and why. On a case-by-case basis, member states are repatriating minors from the camp. It is important that they receive good psychiatric and psychological care.

CTC: What do you see as the biggest outstanding problems in CT and CVE?

De Kerchove: I have touched upon several of the biggest outstanding issues in CT during this interview. The fight against the rising threat of right-wing violent extremism and terrorism is certainly one of those. Contrary to the U.S., the E.U. legal framework applies to all forms of terrorism. I expect that the EU Internet Referral Unit at Europol will soon start flagging violent right-wing extremist content in addition to its current work on jihadi content. We also need to look into ways to curtail financing of right-wing violent extremist propaganda and step up prevention, rehabilitation, and exit programs; some member states have an interesting experience in this context.

We have been working for many years in the area of prevention of terrorism. The E.U. has been funding projects, for instance, among vulnerable youngsters to prevent radicalization. The E.U. is facilitating exchange of best practices between policymakers and practitioners (such as teachers, social workers, police personnel, etc.). We have always included all forms of radicalization in these programs, but we need to focus even more on right-wing and left-wing violent extremism in the near future.

Additionally, we need to do more to counter the ideologies that fuel terrorism, in particular Islamist extremism. While there is a range of factors that drive people to become terrorists, terrorism would not exist at all without underlying extremist ideology. Hence, we should not avoid this difficult subject, but talk about it. Many mainstream Muslims are worried about Islamist extremism dominating the dissemination of Islamic religious texts, supported by wealthy donors from the Gulf area. This is a problem for integration in the E.U., which the E.U. has started to analyse within its borders and beyond, and has initiated a dialogue with relevant third countries. It is important to take note of the many European Muslims raising concern about extremist Islamist influences which challenge the values, fundamental rights, and rule of law which bind Europe together.

We should do more to combat terrorist content, hate speech, and disinformation online while protecting the right to free speech. The E.U. is working on a new Regulation on Terrorist Content Online, which will oblige digital companies to block terrorist content within one hour when they are alerted to such content. At the same time, digital companies should do more to enforce their own terms and conditions on hate speech and disinformation. They need to stop the amplification of sensationalist hateful content via algorithms aimed at generating as much user traffic as possible.

Last but not least, the many threats that stem from the rapid digitalization of our society and the quick development of disruptive technologies, as I have explained above, call for a major investment of the security community in this field. The excellent communication on the EU Security Union Strategy that the European Commission adopted at the end of July17 illustrates the strong determination of the E.U. to rise to the challenges.     CTC

Substantive Notes

[a] Editor’s note: Defined by the European Union as “a country that is not a member of the European Union as well as a country or territory whose citizens do not enjoy the European Union right to free movement.”

[b] Editor’s note: The European Council consists of “the heads of State or Government of the 27 EU Member States, the European Council President and the President of the European Commission” and “defines the EU’s overall political direction and priorities.” See https://www.consilium.europa.eu/en/european-council/. The ‘Council’ (full name: The Council of the E.U.) “is the institution representing the member states’ governments. Also known informally as the EU Council, it is where national ministers from each EU country meet to adopt laws and coordinate policies.” See https://www.consilium.europa.eu/en/council-eu/

[c] Editor’s note: INTCEN is the EU Intelligence and Situation Centre, a central intelligence collection and assessment body that works with the European Union’s foreign service, the European External Action Service (EEAS).

[d] Editor’s note: Passenger Name Recognition

[e] Editor’s note: Advance passenger Information

[f] Editor’s note: The Radicalisation Awareness Network (RAN) is an E.U.-sponsored network of practitioners across Europe that seeks to bring together best practices in counterterrorism and countering violent extremism (CVE) work.

[g] Editor’s note: “Prevent” is the pillar of the U.K. counterterrorism strategy that seeks to stop people from becoming terrorists or supporting terrorism.

[h] Editor’s note: The gilets jaunes (literally, yellow jackets) are a protest movement active across France.

[i] Editor’s note: In July 2012, a Hezbollah-linked suicide bomber targeted a busload of Israeli tourists in Burgas, Bulgaria, killing seven, including the bomber. The same month, Israel accused Hezbollah of plotting to attack Israeli citizens in Cyprus. Angel Krasimirov, “Bulgaria says clear signs Hezbollah behind Burgas bombing,” Reuters, July 18, 2013; Dan Williams, “Israel PM accuses Hezbollah of Cyprus attack plot,” Reuters, July 15, 2012.

[j] Editor’s note: According to congressional testimony by analyst Emanuele Ottolenghi, “DEA revealed the full extent of Hezbollah’s terror-crime nexus and its centrality to Hezbollah’s organizational structure in 2016, when it announced multiple Hezbollah arrests across Europe in an operation, codenamed Operation Cedar, involving seven countries. According to a former U.S. official familiar with the case, the targeted ring involved shipments of cocaine to Europe, which were paid for in euro, and were then transferred to the Middle East by couriers. Hezbollah made more than €20 million a month selling its own cocaine in Europe. It also laundered tens of millions of euro of cocaine proceeds on behalf of the cartels via the Black Market Peso Exchange, retaining a fee.” Emanuele Ottolenghi, “State Sponsors of Terrorism: An Examination of Iran’s Global Terrorism Network,” Testimony Before the House Homeland Security Committee Subcommittee on Counterterrorism and Intelligence, April 17, 2018.

[k] Editor’s note: The Arab Struggle Movement for the Liberation of Ahvaz (ASMLA) was established in 1999 seeking to establish an independent Arab state from Iran’s southwest. Iran classifies ASMLA as a terrorist group, and it has been linked to violent incidents within Iran, as well as in Europe where a number of the group’s members reportedly reside. For more information, see “The Story behind Iran’s ‘murder plot’ in Denmark,” BBC, October 31, 2018, and Nada Bashir, Euan McKirdy, and Kara Fox, “Denmark arrests suspect over Iranian ‘assassination’ plot,” CNN, October 31, 2018.

[l] Editor’s note: MeK is an Iranian group that opposes the regime in Tehran.

[m] Editor’s note: Sergei Skripal, a former Russian intelligence officer recruited by the British as a spy, was, according to the U.K. government, targeted for assassination by Russian military intelligence agents in the United Kingdom, but he survived the attempt to kill him with a military grade nerve agent. “UK blames Russian military intelligence agents for Skripal attack,” Financial Times, September 5, 2018; Michael Schwirtz and Ellen Barry, “A Spy Story: Sergei Skripal Was a Little Fish. He Had a Big Enemy,” New York Times, September 9, 2018.

[n] Editor’s note: Cloud labs refer to automated labs using AI to synthetize genetic sequences that can become the basis to produce a toxin or a bio-agent. See Eleonore Pauwels, “The new geopolitics of converging risks – The UN and prevention in the era of AI,” UN University, 2019.

[o] Editor’s note: The European Commission’s Joint Research Centre (DG JRC)

[p] Editor’s note: European Union Agency for Criminal Justice Cooperation

[q] Editor’s note: European Union Border and Coast Guard Agency

[r] Editor’s note: European Union Agency for Law Enforcement Training

[s] Editor’s note: European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice​

Citations
[1] Editor’s note: For more on Europol, the European Union’s law enforcement agency, see Paul Cruickshank, “A View from the CT Foxhole: Catherine De Bolle, Executive Director, Europol,” CTC Sentinel 12:6 (2019).

[2] Editor’s note: See, for example, Nazia Parveen and Jim Waterson, “UK phone masts attacked amid 5G-coronavirus conspiracy theory,” Guardian, April 4, 2020.

[3] Editor’s note: For more on this issue, see Audrey Alexander, “The Security Threat COVID-19 Poses to the Northern Syria Detention Camps Holding Islamic State Members,” CTC Sentinel 13:6 (2020).

[4] “Germany arrests IS suspects plotting attacks on US bases,” DW, April 15, 2020.

[5] “Attorney General William P. Barr and FBI Director Christopher Wray Announce Significant Developments in the Investigation of the Naval Air Station Pensacola Shooting,” U.S. Department of Justice, May 18, 2020.

[6] Editor’s note: For more on Camus, see Norimitsu Onishi, “The Man Behind a Toxic Slogan Promoting White Supremacy,” New York Times, September 20, 2019.

[7] Editor’s note: For more on the Incel subculture, see Zack Beauchamp, “Our incel problem: How a support group for the dateless became one of the internet’s most dangerous subcultures,” Vox, April 23, 2019.

[8] Editor’s note: See “White Supremacy Extremism: The Transnational Rise of the Violent White Supremacist Movement,” Soufan Center, September 27, 2019, p. 29.

[9] Editor’s note: For more on this, see Christopher F. Schuetze and Melissa Eddy, “Germany Hardens Ban on Hezbollah,” New York Times, April 30, 2020.

[10] Editor’s note: “Fight against terrorism: Council renews the designations on the EU terrorist list and adds two Iranian individuals and one Iranian entity in response to recent foiled attacks on European soil,” European Council press release, January 9, 2019. See also Jacob Gronholt-Pedersen, Robin Emmott, Anthony Deutsch, “In shift, EU sanctions Iran over planned Europe attacks,” Reuters, January 8, 2019.

[11] Editor’s note: For example, see Sune Engel Rasmussen, “Trial Exposes Iran-Saudi Battle in Europe,” Wall Street Journal, June 26, 2020.

[12] Editor’s note: Bojan Pancevski, “German prosecutors say man charged in Berlin murder was acting for Moscow,” Wall Street Journal, June 18, 2020.

[13] Editor’s note: For more on the potential implications of COVID-19 for counterterrorism, including in relation to bioterrorism, see Paul Cruickshank and Don Rassler, “A View from the CT Foxhole: A Virtual Roundtable on COVID-19 and Counterterrorism with Audrey Kurth Cronin, Lieutenant General (Ret) Michael Nagata, Magnus Ranstorp, Ali Soufan, and Juan Zarate,” CTC Sentinel 13:6 (2020).

[14] Thomas Renard, “Overblown: Exploring the Gap Between the Fear of Terrorist Recidivism and the Evidence,” CTC Sentinel 13:4 (2020).

[15] Editor’s note: See “Radicalisation in prisons: Council adopts conclusions,” European Union Council press release, June 6, 2019.

[16] Editor’s note: Jordy Krasenberg and Lieke Wouterse, “Understanding the mental health disorders pathway leading to violent extremism,” RAN Ex Post Paper, March 13, 2019.

[17] Editor’s note: “Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Security Union Strategy,” COM(2020) 605 final, July 24, 2020.

More belated posting, this time of another interview with CTC Sentinel of a senior UK counter-terrorism official, this time Jonathan Evans the former head of MI5. Previous ones have been with the current head of Counter-Terrorism Command and the former head of JTAC. Lots of interesting thoughts, insights and a few new details which might appeal to some.

A View from the CT Foxhole: Jonathan Evans, Former Director General, MI5

Lord-Jonathan-Evans-preferred-1-1200x800

March 2020, Volume 13, Issue 3

Authors: Raffaello Pantucci

Lord Evans of Weardale served as Director General of the U.K. Security Service MI5 between April 2007 and April 2013. He joined the Security Service in 1980, and he first worked on counter-espionage investigations. During the late 1980s and 1990s, he had various postings in Irish-related counterterrorism. From 1999 onward, Evans was directly involved in countering the threat from international terrorism. In 2001, he was appointed to the Security Service’s Management Board as Director of international counter terrorism, 10 days before the 9/11 attacks on the World Trade Center in New York. Evans became Deputy Director General in 2005. It was announced in October 2014 that he would become a Cross Bench life peer, after a personal nomination by the Prime Minister for his public service.

CTC: Your career in the Security Service, MI5, spanned a series of terrorist threats. Could you tell us which were the biggest evolutions you noted across ideologies and groups?

Evans: There were a number of key developments over the period I was in the Service [MI5]. First amongst them was the rise of Irish terrorism as a strategic threat rather than just something that was of concern in Northern Ireland. During my time in the Service, it became very central to London government concerns, and the Service was very involved in countering it. But it was very political terrorism, carefully calibrated to try to have a specific policy impact on the British government in contrast to the different focus of some other groups.

At the same time, we were also looking at a variety of other smaller—from the U.K. point of view—threats in terms of Palestinian terrorism in the late 70s and particularly into the 80s, and terrorism arriving from the various diaspora communities in the U.K. At one stage, we were putting a lot of focus on Sikh extremism, as there was quite a lot of support activity here which was important to the Sikh extremist activities in India. The same with the PKKa who were doing a lot of fundraising in the U.K. from Kurdish communities. A lot was done through intimidation, basically racketeering, by PKK elements in north London.

But the other really big development was the emergence of al-Qa`ida as an issue in the 1990s. From a U.K. point of view, this issue impacted us through the fact that quite a lot of the ideologues from whom groups sought fatwas were based in the U.K., like Abu Qatada, Abu Hamza, and so on. A number of people involved in the Algerian GIA—the early forerunners of what then became al-Qa`ida in the Islamic Maghreb [AQIM]—were based in the U.K., and so we were looking at al-Qa`ida from that point of view. Partly because the Americans were so focused on it, because of the attack on the USS Cole and the Africa embassy attacks, and then that transferring into the domestic threat in the period after 9/11. After then, it became by far the biggest terrorism threat that we were facing.

The initial turning point at which we took this seriously was in the second half of the 1990s, when we found that some of our European partners—in particular, the French—were very focused on the Algerian threat. Their view was that there were significant elements of this based in the U.K. This is the Londonistan period. They assessed that the Algerian elements in London were feeding into the threat that expressed themselves through the metro bombings in 1995 in Paris. So, in a sense, our initial response was in support of European friends, rather than on our own account.

There are various conspiracy theories about the Londonistan period including the notion that Her Majesty’s Government (HMG) in some way gave a free pass to the terrorist sympathizers in the U.K. on the basis that they would not attack us. This is a complete fabrication. The problem was that we didn’t actually know what was going on because we were not looking. There was all sorts of stuff going on that we just were not aware of. It was not that we were deliberately turning a blind eye, just that we had not noticed. With the creation of al-Qa`ida, the threats in the Middle East, and the problems in France particularly from the Algerians, we started to pay more attention, and once we started looking, the more we found. But at that stage, it was not actually plots to mount attacks in the U.K.

The first indication that we had an actual, live, real threat in the U.K. was in November 2000 with the arrest of Moinul Abedin and a co-conspirator in Birmingham.1 The co-conspirator was completely exonerated by the courts and subsequently rearrested on other charges. There was some precursor activity by them in Manchester some years before the attempt.

The lead that started the Birmingham investigation came to us from another European country, where, because they had come across an attempt to purchase terrorist equipment through criminal circles, they tipped us off and said “we came across this; you probably ought to look at these people.” That was the first time we’d come across them. We investigated and eventually realized that they were doing something which was immediately threatening. They were arrested on the 23rd of November [2000], which was the first arrest of anybody in the U.K. linked to al-Qa`ida who was planning an attack here. We knew they had to be planning an attack here because they had a large quantity of very volatile homemade explosive in their apartment, although we [still] don’t know the target.

At the time, we couldn’t directly link it into al-Qa`ida, although it looked as though it probably was. However, with the fall of the Taliban and the Afghan camps in 2001/2002, evidence came to light which demonstrated that this was an at least inspired al-Qa`ida plot of some sort. A few individuals such as Tariq Mahmood, known as T-Bone, who subsequently became very instrumental in fomenting terrorism out of Pakistan’s tribal areas into the West, appear to be have been involved in the margins of that operation.b

CTC: Having been involved in the investigation into the United Kingdom’s first al-Qa`ida-linked plot, you then watched as the threat evolved and matured through a whole series of plots including the July 7, 2005, attack on the London public transport system. Could you tell us about how that pre-9/11 investigation was similar or different to subsequent plot investigations?

Evans: That particular pre-9/11 investigation was the only one that appeared to have an element of direct threat to the U.K. in it. After 9/11, obviously, there was a lot of pressure on MI5 to provide assurance to HMG that if there were anything like a 9/11 being planned in the U.K., that that was identified. And in fact, there was not, as far as I recall, a huge amount of directly threatening activity that we could identify immediately after 9/11. We had a lot of resources given to us, but it was entirely proportionate to the threat we found. We were able to put the resources to good use. But in the immediate wake of 9/11, it was certainly not the sort of level of threat that developed later.

We started to see attempted attacks from 2002/2003 onwards, the most visible and probably the best known of which was the attack plan that we called Operation Crevice. It was a complex interlocking set of activities involving individuals in the U.K. home counties based out of Crawley and up into Luton. They were mostly likely planning to attack the Bluewater shopping center, but they had also talked in some detail about central London. They did not appear to have necessarily pinned down exactly what their target was going to be. But there was also a separate leg to the plot, which was an attempt to purchase what they thought was radiological material in Belgium. In fact, they were unable to source anything radiological, and it turned out to be a relatively common scam at the time, which was called Red Mercury.

The plot itself, however, appeared to be encouraged and fomented by al-Qa`ida in the tribal areas. It was one of the early ones we saw. It involved predominantly British citizens or British residents of Pakistani heritage, something which became something of a theme for this period.

One of the people who appeared in the margins of Operation Crevice was Mohammed Siddique Khan. At the time, we assessed him—probably rightly actually—as not being a terrorist himself but being a criminal who had some little scam going on at the edges of the Crevice group. He was noted and not prioritized because there was a lot going on and there were a whole series of investigations running at that point. We saw a very significant change in temperature between the second half of 2001 and the second half of 2003/2004. We saw a lot more apparent attack planning of various sorts, some of which was clear to us as a result of the questioning of American detainees who were giving information on networks in the U.K. Prioritization became very acute during this period, and unfortunately, one of the individuals who was prioritized out was Mohammed Siddique Khan, who went on to be the primary instigator of the 7 July [2005] bombings in London.

One notable thing about the July 7 bombings is that while they were an appalling and ambitious attack that killed many, the group of plotters did not fundamentally differ from all the other plans that failed to come to fruition. The only difference between the July 7 cell and all the others was that the police weren’t able to arrest them beforehand.

What you had that was different about the threat picture then versus now was the deliberate initiation or promulgation of plans from Pakistan, using intermediaries from al-Qa`ida Central into the U.K., using U.K. residents or citizens as the people who mounted the attack. Rashid Rauf is the most obvious of these intermediaries.2 Tariq Mahmood, T-Bone, became another of them, and there were one or two others. And that was characteristic of the period. From an intelligence point of view, this was a vulnerability because they were planning and trying to have an element of command and control over what was going on, which gives you some attack surface from an investigative perspective.

Whereas if you are merely facing the sort of terrorism that one has been seeing in the last few years involving low ambition and technology, without a command and control network, there is not nearly as much to investigate. On top of this all, the ‘flash to bang’ [in this more recent type of terrorism] can be very rapid.

After the July 7, 2005, attack, the next lowlight—so to speak—was the liquid bomb plot, Operation Overt, in 2006. With the police and the other agencies, we developed very good coverage of the plot as it matured. Again, it was fomented from Pakistan, there was command and control back into al-Qa`ida senior leadership in the tribal areas, and we were able to watch carefully and then move to intervene at the critical point in order to stop anything happening. That plot felt like some of the later-stage investigations into Irish terrorism that we had been doing. Because we had good intelligence coverage of what the Irish terrorist cells were doing, we could intervene at the relevant point, and we felt like we had a good insight into individual plots that were being prepared. Had that plot come to fruition, it would have possibly killed more people than were killed by 9/11 and would have been extremely difficult in terms of Anglo-U.S. relations. At the time, we were working extremely closely with the U.S., and we owe them a huge debt of gratitude for the support they were giving to us over that period. The U.S. have a quite extraordinary scale and spread of intelligence capabilities, and those were being used very regularly to help safeguard the U.K. There were some tensions in the run-up to the conclusion of Overt, but the fact of the matter is that actual arrest decision was triggered maybe just 24 hours earlier than might have been the case had we not had that American pressure. But it was a matter of judgment; I do not think it was a very critical issue.

CTC: To move to the present day, could we turn to the topic of resource allocation? If you think back to 2017, the volume of people being investigated for Islamist terrorism in the United Kingdom was around 3,000, and there was discussion of another 20,000 posing a residual risk.3 Could you talk through the capability to manage this kind of threat volume?

Evans: The question of managing the volume of threat intelligence, or potential threat intelligence, has been one of the continuing themes of the last 20 years. As you grow your intelligence capability, as the public become aware of the fact that they need to be alert and not alarmed, as the police are very focused on terrorism cases, then that does create a lot of incoming material that may indicate potential threats. But you cannot, despite the enormous investment in capacity that the British government has made over the past 15-20 years, follow up everything with equal speed and attention. So, you have to make judgments.

We developed quite a lot of resource into what one might call triage: looking at the whole flow of incoming intelligence, deciding what was most credible and most indicative of a threat, and focusing on that. This helped us decide how to deploy resources to deal with the most credible and threatening material in order to chase down any threats, which is the only logical way of dealing with it. During the time that I was involved in counterterrorism, I do not think we ever had a successful terrorist attack that came about from one of the top priority operations we were focused on. This was because we were able to put a lot of resources into priority investigations, get insight into what was going on, and make sure that the threat did not materialize. The problem was always with the material that had been assessed to be of a lesser priority, because it was in there that risks would suddenly eventuate. Because even though it was entirely logical and sensible to not focus on them on the basis of what you knew, actually you never have perfect insight.

As you grow the intelligence machinery, we started to know something about everybody who did something threatening on the streets of the U.K. And having this information but not acting upon it could be said to be a demonstration of the reach and effectiveness of the intelligence service or it could be interpreted as a blunder. But it is almost intrinsic to the nature of intelligence prioritization that the most important decision made is what not to do. And it is there that the risk lies. That is now well recognized, and post the 2017 attacks in the U.K., there was a review into this area, some work done on additional resources and further work into whether there are ways in which you can provide a degree of automation of this process. The idea being that it becomes an anomaly detection issue: you have normal activity taking place, then something changes, and this provides you with some direction about where in the potential target population you should look for a threat. Logically, this makes a lot of sense, as long as you’ve got good enough intelligence coverage to be able to detect anomalous or changed behavior. But again, if what you are looking for is a 9/11-sized plot, then you have quite a lot of opportunity to gather intelligence. If you’ve got somebody who’s been self-radicalized and whose weapon of choice is a hire [rental] car, then what is it that you’re going to spot? Hiring a car and driving to London does not necessarily suggest that there is a threat, but it does mean you could if you choose to kill people.

It is surprising to me it has taken so long for terrorist groups to get to this stage. I can remember talking 10 or 12 years ago and saying if al-Qa`ida stopped trying to outdo themselves with a plot that was even more dramatic than 9/11 and just got on with killing some people, that would be really difficult for us. Unfortunately, that’s exactly what happened. But what I would say—and this sounds rather a harsh point, but it is an important one—as a society, we can, if we choose to, continue with normal life relatively unaffected by occasional stabbings and vehicles being driven into the general public. Horrible and terrible as those events are, they are not a strategic threat to us. We are speaking soon after the atrocious events on London Bridge where [on November 29, 2019] two individuals were killed through stabbing by a known terrorist. I don’t know for certain, but I suspect if you look across London that week, there were probably other people killed in stabbings that have nothing to do with terrorism and do not get the publicity. We give the terrorists something of what they want in the way in which we react to their terrorism, which of course is classic terrorism theory from the 1960s. We need to think about how we respond to this and just not play up to what the terrorists are trying to get us to do.

CTC: Looking at the case of the November 2019 London Bridge attacker Usman Khan in particular, this raised a whole series of issues about people who have been in prison. A lot of those you were investigating are now coming toward the end of their prison sentences, if they have not already. How do you think HMG can manage or mitigate this problem, and do you think there are adequate measures in place to deal with it?

Evans: I do not think there are adequate measures in place to deal with this problem. I personally feel that we should have considerably longer sentences for terrorist aggravation where there are offenses. Deradicalization and the whole Prevent agenda is absolutely critical, but it is also by far the most difficult for government of the four pillars of the Contest strategy.c Because, from a government perspective, if you want more of the Pursue pillar, which is the part of the response which is following terrorists around and stopping them [from] doing nasty things, then you give more money to the Security Service, Police, and so on, and it happens. The Protect pillar, which focuses on hardening targets and building defenses, is similar: if you want to reduce vulnerability in the environment you allocate adequate resources, and it happens. But Prevent is about changing people’s minds. It is about arguing with them about their theology, something Western governments are peculiarly badly equipped to do. It is also very difficult to tell whether it’s working because how do you know whether somebody has genuinely repented or whether they are merely saying it because they want to be released from prison? There are clear successes in the Prevent strategy, but equally, there are some pretty spectacular failures.

We need to keep trying to find the best way of working on deradicalization [and] anti-radicalization. Anti-radicalization might be a bit easier than deradicalization, but it is always going to be something which is difficult for a secular Western government to engage with. I believe that there is a strong religious element in some of the Islamist terrorism. In the early days, [the U.K.] government was very uncomfortable about anything that had religion in it and did not want to talk about it and did not want to see it as a religious issue. They would much rather see it as an issue to do with politics, economic deprivation, or whatever. And while I am sure all those have a contributory element to them, religion does as well. However, having an argument about religion is something which government departments are not that great at. It is much easier for the Emiratis who used to be very puzzled as to why we didn’t do more about this. They would issue the sermons for mosques from their government to be read out in the mosques every Friday. I do not think the British government has many people who could write credible sermons for the mosques around the U.K. even if they had the ambition to do so.

There is also the question about what is the definition of success. The British government has been slightly in two minds about this over the years. Is the measure of success that people stop terrorism, or is it that they stop adopting what might be perceived as extremist views? Government has changed its mind periodically on that question. It is probably easier to stop people adhering to terrorism than it is stopping them adhering to views that be might be not aligned to what might be perceived as British values.

A number of the programs in the Middle East [that] seem to have had some success are successful in giving strong theological support to the idea that people should not be attacking the regime because it is an Islamic government and deserves at least their acquiescence. But this acceptance is (a) very different thing from saying that somebody necessarily signs up to what might be seen as mainstream British values on rights of women and so on. The government has chopped and changed a bit on where it stands. Some of what appeared to be fairly successful anti-radicalization measures that were being implemented at one stage were dependent upon support and engagement from some parts of the Muslim community that had extremely conservative views on issues such as women, and may have had views on Israel that diverged from the British government’s. But crucially, on the issue of whether Muslims have a moral and religious duty to attack the United Kingdom, they and the U.K. government had come to the same conclusion. All this complicated things: you are giving government support to a group who, in a number of their areas of their belief, are very far from the mainstream and whose views might be seen as extremist. As a result, I am always slightly skeptical of the viability in the U.K. of the counter-radicalization efforts some Arab countries have proclaimed to be successful, because it is not always clear to me that this is transferable to the U.K. And even if it was, it would probably be struck down by the courts in the U.K.

CTC: Turning to the question of foreign terrorist fighters [FTFs], what kind of a threat do you see from the contingent of people who went to Syria and Iraq, those who are still at large? And what do you think the government should be doing with the ones in SDF [Syrian Democratic Forces] custody?

Evans: I think there is a threat. I have considerable sympathy for the view that Ed Husain takes,d which is that if people have been involved in violent extremism and then decide that this actually has been an error and a mistake on their part, we could reasonably expect them to actively seek to counter extremism in this country rather than just saying “oh I made a mistake, I’m very sorry.” If there is genuine belief that they made an error and they have seen the error of their ways, then I do not know why you would not expect them to be giving evidence against people with whom they were cooperating and who took part in appalling crimes in Iraq and Syria. There has been a problem with getting evidence from those areas that could be accessible in the British courts. The question is why are the repentant members of that group not giving evidence and audibly reaching out to the community in saying that they want to help push back against extremism. Some people are contributing in this way, but many are not. I would like to see actions as well as words if we are going to accept that people have changed their minds.

CTC: On the FTF question, how does this compare to the earlier flows that you saw going? For example, those who went to Afghanistan.

Evans: There are some parallels. If you look at the history of radicalization in the U.K., there are similarities with earlier flows. The whole Kashmir dispute and conflict was very important in pushing people towards political, in fact relatively extreme political, positions and then across into more general extremism. Then there was the Balkans conflict, which radicalized a broader pool, where quite a lot of the grand old men of British Islamism were involved, and then went on to be very influential in bringing those sorts of messages back to the U.K. Then finally you had the same process in Afghanistan in 1999-2001 with the al-Qa`ida camps there [being] a sort of university of terrorism. From that, 9/11 was spawned alongside lots of the attacks that we saw in 2003-2010 period.

Syria has many of the same characteristics. There were people going out knowingly and actively taking extremist positions, others instead taking humanitarian positions to get out there. But once they are there and have the experience of being out there, the teaching they receive on the battlefield, the bonds of comradeship they form, the actual physical experience of battle, all work together to make them more radicalized and then ultimately bringing the threat back with them. It was absolutely clear during the post-9/11 period that this threat had been exported from Afghanistan and by those that had gone to Afghanistan, and I think that even from my slightly more distant position today, Iraq/Syria has many of the same characteristics.

The unique selling proposition for IS [the Islamic State] was the fact that it presented itself [as] a caliphate and it held territory. I always took the view that the very first thing you have to do in this particular case is take the territory away from them so as to demolish their claim to a status of a caliphate. But you needed a military process to take away some of their legitimacy. And now we will go, I guess, into a long period of threat from the [jihadi] alumni of Iraq/Syria.

CTC: I did want to pick up on your mention of the Kashmir issue and its capacity to be a push-factor toward radicalization in the United Kingdom, given the recent tensions in the region.

Evans: My main point there was that because of the particular shape of the Pakistan-Kashmiri diaspora in the U.K., Kashmir is a real hot-button issue. Inevitably, the recent actions of the Indians in Kashmir are likely to further have inflamed tempers. People care desperately about Kashmir in places like Bradford, and it is a radicalizing issue. So I would have thought that it is an exacerbating factor, although I don’t have a particular reason to believe that it will then turn itself against the U.K., given the fact this is an India-Pakistan conflict point. I can certainly see it as an intercommunal issue, although on the whole over the years, intercommunal issues haven’t really played out very heavily in the U.K. People have very strong views, but surprisingly, they don’t tend, for the most part, to play out on the streets of our cities.

CTC: An ideology that has increasingly worried people and has come under greater focus recently is the extreme right wing. Has its rise as a threat surprised you? Was it something you were focused on?

Evans: Yes, I was focused on right-wing extremism. I have always taken an interest in the far right, partly zoologically, because some of the individuals involved are so wacky that it is quite fascinating to watch them. I can remember back in the 1980s and 1990s, the saving grace of far-right extremists is that because they had such extreme and odd views, they tended to be extreme and odd people who did not tend to be very good at working with each other. You saw groups that tended to fragment and split like something out of a Monty Python film into smaller and purer groups. So, they never quite managed to get their act together into something more substantial. But from the early 2000s, and in those days it was mostly a police focus, from time to time individuals would come to light who were on the fringes of the far-right groups, who had been building bombs in their garden sheds, and who hated Muslims and so on. These cases were redolent of other earlier cases such as the London nail bomber, David Copeland, who went on a bombing campaign in London in 1999.4 He was on the fringes of the far right, not an active member of any particular organization, but took it upon himself to build bombs which he used to attack the ethnic and gay communities in London. Around the same time, there was a group called Combat 18, which was quite active and was itself a fragment of the far right. There were a few individuals in that group who started to espouse the idea of terrorism The [Security] Service worked closely with police to undertake some disruptions in the late 1990s of Combat 18 associated individuals who were consorting with people of similar cast of mind in Eastern Europe and the former Soviet bloc. These groups had explicitly decided that terrorism was part of the way forward in order to try to destabilize what they characterized as the Zionist Organized Government (ZOG).

We’re seeing similar sorts of actors again now in the far-right scene. Partly I suspect it is a reflection of the social pressures on communities as a result of austerity measures [in the U.K. in the years after the 2008 financial crisis]. There seems to be a constituency of disaffected males (for the most part, but not entirely) who find extreme right-wing beliefs attractive. And they have started to get their acts together to organize into groups and plot. And there is some evidence that they have been consciously and deliberately inspired by the perceived success of the violent Islamists in getting their grievances on the table as a result of violence and thought and thinking “well, we can do something like that.” Certainly during my time, it was the English Defence League (EDL) who had started to develop this narrative. The EDL was not quite the same as other extreme right-wing groups, but they were a reactionary group that fed off and were mutually symbiotic with [the British Islamist extremist grouping] Al Muhajiroun (ALM). The EDL emerged explicitly in response to ALM activity, though in fact they both needed each other ideologically to advance. ALM needed the EDL because they gave them justification for their position and vice versa. So, they were both mutually beneficial to each other. Looking at the threat picture now and how it is evolving, I am not surprised that we have an extreme right-wing threat. We have seen signs of it emerging for 10 years-plus, and the fact that it is now more organized with groups like National Action [a proscribed U.K. extreme right-wing group] was almost predictable.

CTC: Turning to the threat from Irish terrorism and its current state, you mentioned the importance of the threat when you joined the Service. Currently, the threat to Northern Ireland from Northern Ireland-related terrorism is assessed to be higher than the terrorist threat facing the United Kingdom as a whole from all forms of terrorism.e Could you give us some reflections on the current state of this threat?

Evans: MI5 took over primacy for national security in Northern Ireland when devolution took place in 2007, given national security cannot be devolved.f This led to greater responsibilities for MI5 in the region, and it became fairly evident quite quickly that despite the tremendous political success of the 1998 Good Friday Agreement, there was a rather fissiparous, but significant group of dissidents who did not accept the political settlement and wanted to foment terrorism. The solution, insofar as it was a solution, to IRA terrorism at the time was a political solution, which was to reach a negotiated accommodation between the different communities which both sides could just about manage to accept. There was a deliberate decision back then on the part of the republican groups to go down the political route because they saw that as a more effective way of achieving their aims, and as a result of that, there was also a diminution of support for terrorism for violence by the loyalist groups.

The current problem is that there is not a similar deal to be done with the dissidents that are left because they are irreconcilables and therefore the response to them over past 10 years has been a straight security response. During the time I was the Director General of MI5, we had more officers pro rata in Northern Ireland than we had in the rest of the U.K. because of the fact that there were many potentially lethal plots being fomented by the dissident groups. And from time to time, one of those would succeed. There has been a periodic drumbeat of terrorism for the last 10 or 15 years in Northern Ireland, with occasional attacks or attempted attacks on police or prison officers. There was a bomb outside our headquarters just outside Belfast in 20105 [and then subsequently another in 20156]. This hasn’t gone away. And there is the additional problem that because of the link between criminality and terrorism, various people have an interest in it not entirely going away.

The question of the moment is whether the political tensions in Northern Ireland around Brexit and the potential for a hard border with the Republic will mean terrorism will rebound? My view on this [is that] it will give probably a little twist and boost to the dissident groups. They will be able to say that the entire settlement that created the more stable current situation was based on the false premise of European unity. But I would be completely astonished if Sinn Fein [the political party that was closely associated with the IRA] decided to go back to terrorism because the Good Friday Agreement has worked well for them; they are the only political party which has got significant and substantial representation north and south of the border [in both Northern Ireland and Ireland]. If anything, the recent developments with regard [to] Brexit probably give them more hope that a future poll might lead to reunification through the ballot box, so why spoil that potential opportunity by going back to violence. So I would totally discount the idea that the IRA might decide to return to terrorism. The dissidents will probably get a boost, but they [would] struggle to get things back to where they stood in 1985. Partly because security capabilities have developed considerably over that period and [because] there is much greater investment, and therefore I think it would be harder for them. And also, I don’t think they have a core of community support which is sufficient to sustain a big, long-term terrorism threat in the way that Sinn Fein were able to do for the IRA during the 1970s, 80s, and 90s.

CTC: To talk briefly about Brexit, you’ve been vocal about the negative consequences on U.K. security. Could you comment on that more broadly than Ireland? And how it will impact the United Kingdom’s response to terrorism?

Evans: I think the narrow question of intelligence sharing in Europe will not be immediately impacted by Brexit because intelligence sharing and intelligence matters have never been within European Community (E.C.) competence, and therefore the structures for enabling that are not E.U. structures. Those relationships will continue. The U.K. has been an overall net contributor to those relationships, and it is valuable to both sides that those relationships continue. But when it comes to interventions [disruption operations], those are very often law enforcement interventions. And law enforcement, policing, is within E.C. competence, and therefore things like Europol will be impacted. Whilst I would imagine that we will be able to negotiate sensible engagement with Europol, we will not be part of the core Europol community because we will not be part of the European Union. So, remaining involved with Europol will, at the very least, require extensive negotiation; it is not simply a case of people saying, “well, we want them in, so we let them in.” It would be a legal question, and it is unlikely we will be in as advantageous a position in terms of law enforcement cooperation as when we were members. The net effect will be a less effective response, in my view.

Secondly, and very importantly, the U.K. has been for some time a voice in political discussions within Europe for the security dimension of problems to be given appropriate weight. On issues such as data sharing, data protection, and so on, the fact that the U.K. has very forcefully promoted the importance of national security, as well as data privacy, has meant that the overall policy positions that the E.U. have come to have tended to be ones which were different than would have been the case if the U.K. had not been there. The U.K. has had allies in achieving these outcomes, of course, but we have been very vocal and effective in lobbying to get these goals. Now we are not going to be at the table in the same way, and while we have a wonderful diplomatic service who will excellently represent our interests and seek to influence others, it will not be the same as being at the table with a vote. From that point of view, one of the dangers is that the E.U. will take policy positions which are less security-friendly than they would otherwise have been had the U.K. been there in the debate as a full member. And whilst we will not be a member of the European Union, we will still be deeply affected by the decisions they make because we are a close neighbor and we are still going to be closely connected. The danger is that we get a policy framework which is less facilitative of information sharing and security concerns than would otherwise have been the case, something that will be a net negative in national security terms.

CTC: Finally, a more future-looking question. You mentioned earlier the attention you historically paid to the PKK and Sikh extremism, and we have talked about the threat from extreme right-wing terrorism. Are there any other issues or ideologies out there which you see as brewing terrorist threats?

Evans: I do find that a very difficult question. I suppose the question is whether there is an unspoken-for political movement out there which could become the fuel for future terrorist threats. There was a kind of canary in the mineshaft in regard to what happened with Islamism in the U.K. in the Salman Rushdie affairg because it demonstrated that there was a very vigorously held strand of thought out there which was in tension with the assumptions of the way in which British society should work in the 1980s and 90s. And I’m not trying to overemphasize the linkage, but the protests and anger around the Rushdie Affair amongst Britain’s Muslims did show that there was an issue here, which, because of circumstances, grew. The problem is identifying similar issues in the future. Predicting the future is an unsatisfactory process, because the truth is you do not know what is going to happen and how things will develop. I cannot identify here and now what the next such issue might be, but the key to establishing what might emerge in the future is to look at the areas where there is political tension which is not being addressed as this is where problems are likely to emerge.

CTC: Some have, in the past, expressed concern that the radicalization of [elements of] the environmental movement might lead to violence. Do you think this is a possible risk?

Evans: I suspect it is not an area where terrorism would be the response. The truth is that non-violent activism by [environmental activists] has had an impact over the last few months and is changing people’s political minds. Within this context, terrorism would be counterproductive. It is like animal rights in many ways: there will always be a small group of people who will go for violence because they have a predilection for it. Animal rights was quite a concern 15 years ago, and there were moves in the late 1990s towards terrorism by some of the extremists amongst the movement. And you could maybe see something like that emerge amongst the more extreme environmental position, but that’s different to mainstream environmentalism. So you might see individuals going down the route of violence, but I doubt that it will develop into the major phenomenon that Irish terrorism was for a generation, that Islamist terrorism has been, or even the far right, because you need a particular set of issues to take place to it for it to mature to that point. Key to this is a large, unaddressed political issue.

So whatever you think of the outcome of the recent election in the U.K., the fact that some of the legitimate concerns, that were being used as a pretext by English nationalists, have now been formally acknowledged at the ballot box might be a good outcome, even though it is sort of disconcerting for southern liberals. There was a significant alienated and disenfranchised group out there who didn’t think the system was taking any notice of them. And that’s where you need to be concerned about extremists exploiting legitimate concerns. Disaffected English nationalists were manifesting themselves at the extremes in things like the British National Party (BNP) and National Action, which fed the undertone that articulated itself as extreme right-wing terrorism. And attention still needs to be paid to this group, as it is not clear that they will feel entirely assuaged as a result of the fact that people are paying wider attention to them now. Terrorist problems emerge when you have a significant population who feel alienated and nobody takes notice of them, causing frustration and anger.     CTC

Substantive Notes
[a] Editor’s note: The PKK is the Kurdish Workers Party, a Kurdish militant group based in Turkey focused on creating a free Kurdish state. They have recently become known for their links to Kurdish groups fighting against the Islamic State, but are more prominently known for their decades-long terrorist campaign against the Turkish state.

[b] Editor’s note: Tariq Mahmood, a U.K. national from Birmingham, was announced arrested by Pakistani authorities in late 2003 and accused of links to al-Qa`ida. “Pakistan holds British al-Qa’eda suspect,” The Telegraph, November 17, 2003.

[c] Editor’s note: There are four pillars to CONTEST, the U.K. government’s counterterrorism strategy. These are: “Prevent: to stop people becoming terrorists or supporting terrorism; Pursue: to stop terrorist attacks; Protect: to strengthen our protection against a terrorist attack; Prepare: to mitigate the impact of a terrorist attacks.” See “CONTEST: The United Kingdom’s Strategy for Countering Terrorism June 2018,” p. 8.

[d] Editor’s note: See Ed Husain, “Take these claims of ‘rehabilitation’ with a bucket of salt,” Daily Telegraph, December 7, 2019. Ed Husain is a British commentator who rose to prominence in 2007 when he published The Islamist, an account of his experiences as a member of Hizb ut Tahrir in the United Kingdom. Having left the group and repudiated extremism, he rose to prominence as a commentator, author, and activist speaking, writing, and advising on Islam around the world.

[e] At the time of publication, the assessed threat to the United Kingdom from terrorism is “substantial” and the threat to Northern Ireland from Northern Ireland-related terrorism is “severe.” See “Threat Levels,” Security Service MI5.

[f] Editor’s note: The United Kingdom is made up of England, Wales, Scotland, and Northern Ireland but administered from London. Devolution has occurred over time and meant that greater powers have passed to regional assemblies like the Scottish Parliament, the National Assembly for Wales, the London Assembly, and the Northern Ireland executive. This grants these regional legislatures and their executives powers over certain legislation. National security sits outside this system, however, and is controlled and implemented centrally across the entire country.

[g] Editor’s note: Salman Rushdie’s 1988 novel Satanic Verses resulted in anger among a significant number of Muslims around the world, including inside the United Kingdom. In 1989, Iran’s Ayatollah Khomeini issued a fatwa against Rushdie. In 1998, the Iranian government declared that it no longer sought Rushdie’s death. For more, see “Satanic Verses, Novel by Rushdie,” Encyclopaedia Britannica.

Citations
[1] Editor’s note: For more on this case, see Phil Mackie, “Moinul Abedin: UK’s first al-Qaeda inspired bomber,” BBC, March 2, 2012.

[2] Editor’s note: Rauf’s involvement in al-Qa`ida plots against the United Kingdom is outlined in detail in Raffaello Pantucci, “A Biography of Rashid Rauf: Al-Qa’ida’s British Operative,” CTC Sentinel 5:7 (2012).

[3] Andrew Parker, “Director General Andrew Parker – 2017 Speech,” Security Service MI5, October 17, 2017.

[4] Editor’s note: For more on this case, see Sarah Lee, “London nail bombings remembered 20 years on,” BBC, April 30, 2019.

[5] Editor’s note: “Bomb explodes outside MI5 headquarters in Northern Ireland,” Reuters, April 12, 2010.

[6] Editor’s note: Henry McDonald, “Police investigate explosion at MI5 headquarters in Northern Ireland,” Guardian, August 14, 2015.

And finally in this catch up blast, a longer piece in the form of an interview with the former head of the UK’s JTAC Suzanne Raine for the excellent CTC Sentinel. Not the first of this form, and more longer pieces for CTC Sentinel to come soon. Thanks to Paul and his superb team for their support and work on these interviews.

Beyond this writing, spoke to the Telegraph about Hamza bin Laden’s death (which was picked up in the Canadian press), to the Daily Mail about British Airways suspension of flights from Cairo, an older interview with the Mail on Sunday was re-used to talk about the ISIS threat to the west, to the National about a network of heavily armed right wingers in Italy, while my recent Telegraph piece about Kashmir was picked up by Pakistani outlets. On the other side of the coin, spoke to the Economist about China in Central Asia which ran in a much bigger piece about China-Russia relations more broadly.

A View from the CT Foxhole: Suzanne Raine, Former Head of the United Kingdom’s Joint Terrorism Analysis Centre

Suzanne-Raine-1200x800

August 2019, Volume 12, Issue 7

Authors: Raffaello Pantucci

Suzanne Raine worked for the U.K. Foreign & Commonwealth Office from 1995 until 2019, specializing in counterterrorism. Between January 2015 and September 2017, she was head of the United Kingdom’s Joint Terrorism Analysis Centre.

CTC: What role does JTAC play in U.K. counterterrorism efforts?

Raine: JTAC stands for the Joint Terrorism Analysis Centre. It was established in response to the 2002 Bali bombings, with the aim of having one central place within the U.K.’s system where terrorism threat assessments are made. It is staffed by analysts from about 16 different government departments who are brought together in a single place. These individuals are linked back into their own systems, reading all of the information available from all of their respective departments and feeding it into their assessments. This makes [for] a system which is greater than the sum of its parts and provides a way of pushing information in both directions. This helps support the threat assessment both in immediate tactical terms in the U.K. and abroad, but also the strategic development of the threat picture and trends within it. Its closest equivalent in the American system is NCTC [National Counterterrorism Center]. JTAC is also responsible for operating the U.K.’s national threat level system. It makes independent judgments free of any political influence, which informs the response posture either in advance of or after a terrorist attack.

CTC: What is your current evaluation of the threat from the Islamic State, especially in the wake of the Easter 2019 attacks in Sri Lanka? Did those particular attacks change your general assessment of the group’s trajectory?

Raine: It is a good time to ask that question because it is now five years since the declaration of the caliphate, and that should give us a moment to pause. It is quite a startling fact that the territorial caliphate survived that long. Not many things last five years. At the end of it all, just at the point where we were declaring territorial defeat, up pops Abu Bakr al-Baghdadi in a video to say, ‘I’m still here, guys.’1 It is an uncomfortable reminder that there still is a strategic mind at the heart of the group. It is not just a group engaged in a war in the desert, but it is an organization with leadership, structure, and organizational goals, however disrupted they have been.

Territory is nice for a terrorist group to have but is not a prerequisite. The establishment of the caliphate enabled them to become a massive global phenomenon, but territory brings with itself its own problems. It requires governance, policing, and defense, all of which requires lots of resource. The challenge for ISIS will be how they manage the transition away from (a) guerrilla state without disintegrating. Al-Baghdadi turning up five years later is their way of starting to think that through.

In terms of the threat from ISIS, the U.K. had a horrible year in 2017, and 2018 was much better. But this is sometimes an illusion. The question if we look at this five-year period and analyze it properly is, what does that show? To do this, we need to go back to the first three years of the group’s caliphate, which were a significant challenge for those of us whose job it was to counter it because it was growing so quickly; they had the impetus and the initiative. It is not true to say that the scale of the problem in 2015-17 took us by surprise, because we had watched it develop in 2013-14, but it is true to say that the way it changed, mobilized young people, generated spontaneity and common cause were exceptionally challenging to deal with. That put real demands on the instruments that we had at our disposal. A lot of things subsequently happened in response, but it took time and finally the coalition efforts in Syria and Iraq have pushed them back and kept them firmly on the back foot over the last couple of years. But it has been at significant cost to the coalition, and there is a huge debt of gratitude to the Syrian Kurds without whom it would not have been possible to push ISIS from their territory in Syria. Now ISIS is on the back foot; their media machine has been significantly disrupted; they’ve lost a lot of operational planners and have been substantially degraded.

In addition to this, we started to get on top of their networks in the West, leading to a lot of disruptions. This makes it much more difficult for them to conduct the kind of attacks they were conducting earlier on.

But there is a long legacy that the group has left behind. It can be categorized in two ways: their media and their network of foreign fighters. They have had more than five years as a group of living and fighting together, and we are talking about an unprecedented number of nationals from an unprecedented number of countries, including both men and women. The women are equally significant in this regard because I reject any suggestion that the women are less responsible for their decisions and actions than the men are. Foreign fighters are going to continue to pose a huge problem for the international security community because we are going to have to track them as well as find ways to monitor the effect that the inspirational ideas have on our domestic populations.

However weakened ISIS may now be, they are still a truly global movement, and we are globally vulnerable. Paradoxically, nothing should surprise us about what happens next, but we need to be prepared to be surprised. Sri Lanka is a good example of that, because whatever their exact connections, they were clearly inspired and connected to ISIS’ ideology at the very least. What Sri Lanka also showed was the difference between a lone-actor and a multiple-actor attack. There is no straightforward equation that says a lone actor will cause lower casualties and do less physical damage, but you can see from Sri Lanka that an attack with multiple actors who conduct their attack simultaneously is very effective. This is something that we see with alarming regularity in places like Afghanistan. We are going to continue to face both the lone-actor inspired attacks, as well as multiple-actor. The threat picture continues to contain almost every sort of threat within it.

CTC: Given the Islamic State is a globalized threat as you describe, are there any places that are of greater or lesser concern? Where might the next Sri Lanka come from?

Raine: There are multiple different factors at play. One is how many of the foreign fighters are left and whether they get home. And we still don’t really know the answer to how many we are talking about in total when it comes to those who left or survived, nor where they are. Local conditions are going to be a determining factor in how they settle. North Africa is clearly of concern, not least because of the numbers of foreign fighters from North Africa, but also as historically the region has tended to produce amongst the most committed and battle-hardened fighters. The environment is one into which they are able to return—either to continue the fight they started in Syria and Iraq, fit into existing groups, or start up something new. This is very concerning. I also continue to worry about Afghanistan, where returning fighters are an additional dimension to the political quagmire. It is possible that a deal done with the Taliban becomes not actually very useful anymore because, in fact, the problem is a whole new generation of people who have been radicalized by a different kind of extremist group. This might lead to new fighting and new groups. It is not a given that this is what is going to happen, but it has to be a concern. And then clearly there are a large number of fighters from Southeast Asia who are going to return somewhere and pose a threat. And finally, I worry about Syria and Iraq because once they cease to pose an international threat, the interest and resource will shift elsewhere while the internal problems remain as complex as they were before the war.

CTC: Part of the threat spectrum facing Western countries has been instigated or inspired attacks. The Islamic State’s use of this methodology was not new. Al-Qa`ida used to use it. But how was the Islamic State able to weaponize it so effectively?

Raine: As you point out, it is not new. AQAP [al-Qa`ida in the Arabian Peninsula] ideologue Anwar al-Awlaki was brilliant at it. He was an incredibly powerful voice in the British community and beyond because of his ability to speak in English about modern things. ISIS has upgraded this approach for the modern generation. They’ve been exceptionally innovative at exploiting the explosion of new ways of using social media that we use in society today. They had an army of young, dextrous, tech-savvy people who spoke multiple languages and who knew how to speak to people in their home countries. This was a major advantage they had over Anwar al-Awlaki since he only had a very small group of people supporting him. They were able to communicate directly, sitting together building a critical mass in the media center where they would learn from each other and experiment. A fascinating aspect was that they were communicating with us all the time as well. We were not always attentive to what was being said. I was often struck by the amount of humor and mischief they would use in their messaging. One well known example which resonated with a British audience was the Islamic State Health Service, for example, when the group took the National Health Service (NHS) logo and turned it into their own. It was creative and appealed to people.

The genius of what they did with the inspired attack was to elevate it into a sort of art form, so that anyone who did anything anywhere in the world that fitted their paradigm could be claimed by them. This created an idea of a mass movement without them actually needing to have one. And once you have this fictive mass movement, it gives greater appeal to the group. You create the impression of an organization that is bigger than it is. For those potential recruits sitting at home living their ‘boring’ lives, seeking ‘meaning,’ wanting to be part of something bigger and better, this provides them with a substantial organization to join.

At its height, ISIS had a media machine that was able to publish in 10 languages simultaneously. It has been significantly damaged through a concerted effort in both military and disruptive online terms by multiple actors. But it still exists, and one of the problems we have is that whenever an attack is conducted and a claim is issued, it is rebroadcast all over conventional media. All the group needs to do is get the claim out to create a sense of responsibility around the act without having to have done much work themselves. Sri Lanka was notable in this regard.

The other difference with al-Qa`ida was that ISIS was not afraid to use their media machine and to broadcast rapidly. During the first three years of the caliphate, they took particular advantage of this, as their media broadcasters were in far less danger than al-Qa`ida’s. Al-Qa`ida’s messengers learned that if you stand there with a telephone, somebody is going to bomb you. Anwar al-Awlaki had to go to enormous lengths to get Inspire magazine out there because he had to hide his identity and hide his location. The chaos in Syria meant that ISIS broadcasters were able to hide much more easily. For as long as they were not afraid, they could do it with real confidence, and they were able to maintain a strong voice in the public domain. This helped them create an identity online which they still take advantage of today. It is obviously not the same now, but it was an element of their game plan which took us a little bit of time to adapt and respond to.

CTC: Do you think the group’s brand was degraded because of spurious attack claims? For example, they claimed Stephen Paddock’s October 2017 Las Vegas massacre, an attack that clearly had no link to the group. How long can you claim such random things without people losing belief in you?

Raine: It is certainly true that in the early years, they did not make false claims. They put effort into making sure and verifying that attacks were conducted by their adherents. And then they became a bit sloppier. The only explanation I can offer is that while we may have noticed that their claims are no longer very accurate, the people who support them did not notice. All their claim does, however spurious, is create a hook into the public conversation. An ISIS claim reminds people about the organization’s presence and existence, even if they didn’t actually do it. And by the time everyone has proved that the claim was indeed spurious and the incident had nothing to do with them, everyone has forgotten and moved on to the next thing. The group, however, still gets some brief resonance in the public space.

CTC: There are some indications of a possible al-Qa`ida resurgence.a How is that materializing in terms of threats to the West? Where is the actual threat that we see from al-Qa`ida? And to tie into a bigger question, how do we ever know when a terrorist campaign is over?

Raine: This is a problem. One of the biggest difficulties we have with al-Qa`ida is latency—the ability of the group to exist without necessarily being constantly active and visible. We know al-Qa`ida is a thoughtful organization that has demonstrated strategic patience. The leadership has been absolutely consistent about its objectives for a very long time. And although they have been significantly degraded over the last nearly 20 years by a very persistent campaign against them, some of the key leaders are still around and hidden in very difficult to get to places like Yemen, Syria, Iran, Afghanistan, Pakistan, and North Africa. We cannot be sure that we know what they are doing or even what their new generation looks like. We are aware of the group’s continued ability to exist, its committed leadership, but we are not clear on what the new generations are like or what they think.

Their experience in Syria has been a real roller coaster ride. On the one hand, it has given them a new purpose at various stages of the conflict and, of course, a lot of new recruits, including a lot of Britons who were always al-Qa`ida supporters, as well as other nationalities, like Chechens. And just as the ISIS foreign fighters have been with the group for around five years now, the al-Qa`ida ones have as well. On the other hand, al-Qa`ida is now completely bogged down with factional in-fighting about who is governing Idlib. This is just indicative of the difficulties of being in Syria. It has given al-Qa`ida a platform, and it has given them a massive headache. And we have insights into what is going on with the group with infighting and governance challenges, but we just don’t understand the whole picture.

This highlights the really big challenge for those working in counterterrorism, which is that we know they are there, we know their intent has not changed, we know they have got capability, and the underlying conditions in many parts of the world where they operate are no different now to how they were pre-9/11. In fact, in some parts of the world, they are worse. We know that we cannot get the kind of information that we would want around the group, so how do we interpret the lack of information? How will we know when the absence of information means that an attack is not being planned, or whether it is just that we are not good enough at collecting information on attack plans? And for me, this is the difficulty that we have got ourselves into with the War on Terror because the phrase implies at some point there is going to be a winner and a loser, closure and an end, a treaty. And I just do not see and cannot imagine the point where we are going to be confident enough to say: ‘they are still there, but we are confident that they do not mean us any harm.’

CTC: Is al-Qa`ida or the Islamic State the greater long-term threat to the United Kingdom?

Raine: Rather than one group or another being the long-term threat, the danger comes from the likelihood that they persist and expand—by which I mean, how receptive their target audience is in the long term to the alternative form of governance or ideology that they offer, which is based on a higher belief system and justification for action that is very different to that which secular Western governments offer. Rather than our political system, built on gradual change and reform, they offer a violent and rapid answer, which will consistently be a challenge for us because it is an alternative that will appeal to some people.

We also need to recognize how long some of the participants on their side, be it AQ or ISIL or whomever, have been involved in this fight already. Abu Bakr al-Baghdadi is my age, as is Abdulmalek Droukdel. Ayman al-Zawahiri and Saif al-`Adl are even older. Qasim al-Raymi is relatively young at the age of 41. And if we think about it at a rational human level, very few of us have fundamentally changed our core beliefs in decades, so why should we expect individuals involved in ideologically motivated groups to? And their children and grandchildren are being brought up with this mentality and ideology around them.

I absolutely agree with the need to prevent, de-radicalize, and counter the narrative that these groups espouse in whatever way we can. But I also feel very strongly that this is a very difficult thing to do, and I still can’t think of any significant examples where de-radicalization has been successful in serious numbers. Because we are trying to tell people to believe something other than that which they believe. And that’s really hard.

In terms of al-Qa`ida or ISIS posing the longer-term threat, it is not so much the groups but the conditions in the world at the moment which pose the threat. Syria, in particular, has created an environment where a whole new generation of threat can emerge. And that will ultimately express itself differently in different places. It may be for the moment that the individuals linked to ISIS or al-Qa`ida stay aligned to the local groups that already exist in the various contexts that they are operating in. It may be that returnees or off-shoots of these groups end up being subsumed into more local conflicts on the ground. Or it may be that they end up becoming part of groups which play a role in proxy conflicts in different parts of the world—for example, the Kashmiri groups that we have long seen active in South Asia, but there are plenty of others. We are likely entering a phase of everything been thrown up into the air. It will eventually settle down again, and we will have to adjust to whatever form that takes.

There are clearly going to be tactical problems dotted around. Somalia is an example of a tactical problem which is a long-term headache because of al-Shabaab, but also because there are ISIS supporters there. North Africa is really interesting because there is a lot of fluidity between groups across the entire region. While I am not a North African specialist, what is striking is the commitment to the ideology in that particular context, and then the pragmatic decision-making about how to act, which is hugely effective. I think we will see tactical, pragmatic, local reshaping, and then we have to bear in mind something that was noted in Ed Fitton-Brown’s recent interview with this publication,2 which is that it does not take very many people to come up with the big plot. The question for us is where they will be located when they decide that they want to launch an attack and where it will ultimately be that they find the time and space to plan something on that scale, rather than simply become subsumed into a local conflict.

CTC: You touched briefly on state-sponsored threats. Do you think they are going to become more significant than al-Qa`ida or Islamic State threats? Or will they merge? How will that relationship develop, and what is your assessment of what will become a greater threat going forward?

Raine: The two types of threat have co-existed for a long time. For example, LeT [Lashkar-e-Taiba], the Kashmiri group behind the Mumbai attack, grew out of the jihad in Afghanistan and was linked initially more with Abdullah Azzam and UBL [Usama bin Ladin] before it became more focused on state-supported jihad in Kashmir. The dangerous bit is the overlap between the local and the global. For the U.K., the fusion that was seen in Kashmir was a particular problem, as the struggle in Kashmir provided a strong, local call to action that resonated deeply with Kashmiri diaspora communities in the U.K. At the same time, on the ground in South Asia, these groups were close to al-Qa`ida and ultimately became the connection that produced a series of terrorist plots in the U.K. It is entirely possible that the development of this sort of link could be a product of what emerges from what we have been observing in Syria.

The danger of these sorts of threats, and the many flashpoints in which they exist, is that if they become much more active conflicts, they can become places that draw more people in. The Kashmiri one is the obvious flashpoint that could really draw people in if the violence and conflict were to escalate. The Middle East is another source of potential danger in this regard and has numerous proxy groups and conflicts. In a way, the Syria war is a massive proxy group war, and the war in Yemen is another proxy group war. At the same time, the conflicts become a draw for outsiders and create an environment in which terrorist groups can fight, learn, and plot. States use terrorist groups for their own ends, but don’t forget that terrorist groups also use states for their own ends.

CTC: In a recent issue of this publication, Edmund Fitton-Brown, the Coordinator of the ISIL (Daesh)/Al-Qaida/Taliban Monitoring Team at the United Nations, highlighted the large numbers of foreign terrorist fighters (FTFs) that are still around.b Young and old, they all pose a potential risk. How do you manage a generational struggle of this scale?

Raine: This is a time bomb problem. To start with, none of us really know the exact figures of people who have gone out there and might still be there. It is difficult to know, as I mentioned earlier, the degree to which the threat they pose is something that is blended into a local threat picture or something new and different. What we do know is that there is nothing to suggest that many of them have changed their minds, and there is nothing to suggest that if we do nothing, they will change their mindset. So, we have got to do something. The big challenge for the global counterterrorism community is how do we create a globally coordinated response when we have all got our own domestic considerations and our own legal systems. In Western-allied countries, we have ended up managing this problem largely through defense and security, with the closest possible collaboration we can have. This means sharing data, which enables us to identify potential terrorists who can be disrupted before they do anything, and doing this according to our liberal values, which limits the amount of intrusion into people’s privacy or the length of time that people can be locked up.

There are other countries with different values that are applying different solutions to the problem of both foreign terrorist fighters and the broader problem of radicalization at home. The Chinese are locking up, if we believe the reports, around a million Uighurs.3 The Russians have taken some quite punitive measures in the Caucasus. Then there is a serious question about places which just remain completely lawless—though if we are honest, there is no such thing as an ungoverned space; rather it is governed by someone we do not like. Libya is an example of a place where Western governments have to cooperate with a confusing group of actors on the ground to ensure that the ungoverned spaces are not exploited by Islamist extremists. Then there are countries which are themselves making a complicated series of calculations about how to deal with terrorist problems which have deep local roots, as well as external links. Pakistan and Turkey would fall into that category. The West needs them to be a partner to deal with threats that we are worried about, but they are also trying to manage their own local dynamics. And then finally, there are the countries which cannot cope with these threats, need international support, and need to be part of a global counterterror coalition but are not. We are far from having a unified international response.

The problem is further complicated by the inevitability that the different sets of responses going on around the world will create different sets of unintended consequences. For example, it is not clear what effect repression of the Uighurs will have in terms of the globalist narrative that extremist groups use. It may well be that China’s response suppresses the problem to the extent that they are unable to respond, but it may well be that they then fight back in different ways. Or it may be that other groups will take up their banner. This highlights how there is a particular context in which we have to work together, but at the same time, this is rendered almost impossible nowadays because of the geopolitical environment in which we are operating.

A second question for us as liberal democracies is how we do this while also staying true to our values. So, for example, we struggle to convict those we suspect of terrorism-related crimes at home because we cannot collect evidence to the standards we would require in a war zone. At the same time, we expect other countries to manage them without the evidence. We end up asking more of other countries than we ask of ourselves. Additionally, we are rightly prohibited from sharing information with countries where there is too great a misalignment of our legal systems—which could be construed as lack of due process—or where there is a possibility that mistreatment will occur. We cannot cooperate with another state if the outcome might be an act which we would consider unlawful. How do we forge safe partnerships with countries whose approach to human rights is very different from our own without creating legal jeopardy for ourselves? We have not had the kind of conversation we need to about that.

The other big issue these longer-term threats throw up is predictability, something particularly illustrated by the Easter attack in Sri Lanka. People want to know what is safe and what is not. Sri Lanka demonstrated that it is impossible to have certainty. And this is a perennial problem. For example, it is very difficult to say that the conditions which allowed the October 2002 Bali bombings to happen in Indonesia have completely gone away or not been exacerbated by current conflicts in the region or elsewhere. But we cannot tell everybody not to go to Indonesia on holiday just because something bad might happen. This means that the strain of mitigating these risks is taken by protective security measures, and this requires increasing resources to manage these issues in a broad range of places, like North Africa, Turkey, or Southeast Asia to ensure that people are safe when they go there. But the result is that changes the way we live.

CTC: Looking into the future, what terrorist ideologies are of greatest concern to you?

Raine: Islamist terrorism is not going to go away. It might change and become more local, fueled by proxy wars, but the underlying causes that drive these groups and ideologies have not changed and indeed go back a long way.

In addition to this, over the last few years, we have seen—certainly across the English-speaking and Western world—an increase in seriousness and coherence of extreme right-wing groups. It used to look like the extreme right was made up of political movements, and when they conducted violent acts, it was often a lone actor. What we are seeing now is groups of likeminded individuals coming together and talking in a type of language and approach that is used by violent Islamists, using words such as “embracing martyrdom.” In part, this is a response to the broader political context. The far-right parties and movements now have an increasingly coherent narrative, and stronger links to a shared philosophy. Books which espouse this extreme right-wing philosophy are readily available on Amazon, where they have multiple five-star reviews, very few negative reviews, and through algorithms lead the reader to other similarly extreme material. We have not yet worked out, as we did previously with violent Islamist material, what is and is not acceptable on the extreme right-wing side of the ideological equation. The New Zealand attack demonstrated this very clearly when he titled his manifesto “The Great Replacement,” drawing on a French right-wing philosophical tract of the same name.

But in many ways, my biggest concern with the future of terrorism is what we do in response to it. I am concerned that there is an expectation that this can be stopped, but we’re a long way from working out what the tools are that will enable us to deliver that outcome. Instead, we go through very predictable cycles of intervention and non-intervention overseas, with unclear results. We are committed to liberal values, but then how do we deal with people who we can’t lock up and whose minds we can’t change? In many ways, the challenge of getting our response right is as big as the problem itself.

CTC: Are there terrorist tactics that you’ve seen develop over your time in government and since that seem to be growing into more worrying problems?

Raine: There have been big changes in the threat picture. The inspired threat is a change that has already happened and is still happening. Then there are things which have not changed—for example, the determination to conduct a spectacular attack against aviation, something that is just a huge challenge for governments and the aviation industry. You don’t want to put people off flying by being overly protective. But global coordination of effective aviation security has been very slow. The recent conviction in relation to the 2017 Sydney passenger jet plot is a good example of the persistent nature of this threat.4

The two new things that everybody talks about are drones and chemical/biological weapons. The likelihood of their use has increased as a result of the war in Syria and as technology develops, because in Syria a significant amount of people have been able to experiment with both types of weapons on the battlefield. We saw in the United Kingdom what disruption drones could do to airports earlier in the year. But at the same time, while we can sometimes get carried away with our creativity about what terrorists might do, they still seem to revert to type. While the panic and disruption caused by the drones at Gatwick airport were hugely damaging,5 terrorists seem to continue to prefer incidents that cause horrible deaths and injuries. Notwithstanding the availability of new technology, they still continue to like to focus on trying to blow things up.     CTC

Substantive Notes
[a] Editor’s note: See, for example, Tim Shipman, “Al-Qaeda terror group returns to target airliners and airports,” Sunday Times (U.K.), December 23, 2018, and Jami Forbes, “Does al-Qa`ida’s Increasing Media Outreach Signal Revitalization?” CTC Sentinel 12:1 (2019).

[b] Editor’s note: According to Fitton-Brown, out of the over 40,000 foreign terrorist fighters who joined the so-called caliphate, “We could have anything up to nearly 30,000 who remain alive, but nobody knows the true figure.” See Paul Cruickshank, “A View from the CT Foxhole: Edmund Fitton-Brown, Coordinator, ISIL (Daesh)/Al-Qaida/Taliban Monitoring Team, United Nations,” CTC Sentinel 12:4 (2019).

Citations
[1] “Abu Bakr al-Baghdadi: IS leader appears in first video in five years,” BBC, April 30, 2019.

[2] See Paul Cruickshank, “A View from the CT Foxhole: Edmund Fitton-Brown, Coordinator, ISIL (Daesh)/Al-Qaida/Taliban Monitoring Team, United Nations,” CTC Sentinel 12:4 (2019).

[3] Stephanie Nebehay, “U.N. says it has credible reports that China holds million Uighurs in secret camps,” Reuters, August 10, 2018.

[4] “Australian guilty of plane bomb plot involving meat grinder,” BBC, May 1, 2019.

[5] Hallie Detrick, “Gatwick’s December Drone Closure Cost Airlines $64.5 million,” Fortune, January 22, 2019.

A new piece for an excellent outlet that I occasionally contribute to, the CTC Sentinel, which is an interview with Neil Basu, the Senior National Coordinator for Counterterrorism Policing in the UK. It is quite a wide-ranging discussion around the current threat picture, recent problems, and future threats that might mature. It got a bit of a bounce getting picked up by The Times, Daily Mail, The Sun, Asharq al Awsat, and some other local UK outlets. It was also suitably spun by RT. Thanks to editor Paul for all his hard work on it! Separately, spoke to Vice about the Jihadi Beatles, and Arab News about foreigners fighting with Kurds.

A View from the CT Foxhole: Neil Basu, Senior National Coordinator for Counterterrorism Policing in the United Kingdom

DAC-Neil-Basu-06-600x429

February 2018, Volume 11, Issue 2

Authors: Raffaello Pantucci

Deputy Assistant Commissioner Neil Basu is Senior National Coordinator for Counterterrorism Policing in the United Kingdom, a role he was appointed to in October 2016. He is responsible for delivering the police response to the Pursue and Prevent elements of the Government’s CONTEST strategy. In this role, he coordinates the policing response to threats arising from terrorism and domestic extremism nationally and also manages the Metropolitan Police Service’s Counter Terrorism Command (SO15). In his career, Basu has worked as a detective in all ranks to Detective Superintendent, served as the Area commander for South East London, and headed London’s Armed Policing within Specialist Crime & Operation.

CTC: How has U.K. counterterrorism policing evolved to confront the changing threat?

Basu: 9/11 was the contemporary game changer. In the U.K., it started off with some plotting between 2002 and 2004, which wasn’t just concentrated in London. It was also regional. Then you get to 2005, and in the worst way possible, we were taught that this was actually embedded in local communities: domestic home-grown terrorism with some direction from abroad. So there was a need to build regional capability, and that was the start of the network that we have today. Now we have nine counterterrorism units—embedded regionally, collocated with MI5, building intelligence in local communities, [and] connected into local community policing.

Given the nature of the threat we now face, we need to be even more focused on communities and more focused on getting local information. While the ambition is still there for the mass spectacular—and the July 2017 airline plot in Sydney, Australia, was a recent example of that—IS [the Islamic State] has been encouraging supporters living in the West to carry out high-impact/low-complexity attacks. Because of the military push on the ground in Syria and Iraq and the effective eradication of IS’ geographical territory and their ability to project that abroad, it is much harder for them to send trained people back. Borders have closed. Turkey has done well with their border.

The big threat for us now is the ideology that’s been diffused onto the internet and the calls for attacks by its followers in the West by IS online. The caliphate may have been defeated militarily, but it has now become a virtual network. What we’re not seeing is a reduction in people’s willingness to align themselves with this ideology. So even though there is no caliphate to go and fight for, in the minds of some British extremists, the fight carries on because they can aspire to go to Libya or another ‘province.’

In confronting this evolving threat, we have to be more ‘fleet of foot’ at a time when ‘going dark,’ due to the widespread availability of encrypted apps, has become the new norm. We can no longer depend upon all the usual intelligence-gathering apparatus.

CTC: Has the locus of the threat abroad shifted? Syria and Iraq was where the threat was, but would you now look to Libya as a place where you could see the same sort of a threat emanating from?

Basu: You would be completely foolish not to worry about Libya. All of the coalition thinks that that is going to be a tremendous problem in years to come. Anywhere there is ungoverned space, anywhere there is fragile political governance is a potential source of threat. But it is not clear that it is going to be easy for terrorists to move from location to location. We already know of eight or nine IS affiliates around the world that have claimed allegiance, with [fighters in] Libya being one example. Libya is very close to home for Europe and our allies, but for a long time, it was not the focus for our attention. For us in the U.K., what happened in Manchester was a big wake-up call to the fact that there were people who had traveled back and forth to Libya doing much the same thing we were preventing people from doing in Iraq and Syria and who had a similar hatred for this country. And oddly enough, these travelers were second or third generation [immigrants], not necessarily the generation you would assume.

CTC: The Manchester attack and its links to Libya were particularly striking given the similarities with other networks and plots seen previously in the U.K., in particular historical networks linked back to terrorist groups in Pakistan.

Basu: You would have to take a huge leap of faith to say Salman Abedi [the Manchester suicide bomber] was not traveling to and from Libya with some malicious intent and that it was all just about family and socializing and not about training. We’ve long known that training overseas can battle-harden people. It’s not just being able to fire a gun; it’s the psychological bar that you overcome by being brutalized in theater. Once you get a taste for violence, the second time is much easier. And cops know that from dealing with violent criminals.

CTC: A year after the cluster of plots in the first half of 2017, do we have any more clarity on what precipitated all of that terrorist activity in the U.K.? 

Basu: JTAC [Joint Terrorism Analysis Centre] was very good at saying something is coming. Security analysts understood that once there was a military push on the ground against them [Islamic State fighters] in Syria and Iraq, they were going to start lashing out. Leaders like [Abu Bakr] al-Baghdadi and [Abu Muhammad] al-Adnani, before he was killed, were telling followers in the West they didn’t need to ask permission from an emir; they could just go ahead and launch attacks.

This was the backdrop that was making security forces nervous. Then, and this is a personal view, Khalid Masood [the March 2017 Westminster bridge attacker] launched his attack. He had no clear and obvious connection to either IS or al-Qa`ida. He was clearly someone who cherry-picked the bits of Islam that he believed justified what he did. Whether his particular religious interpretations was the actual driver for what he did, I am of two minds, but his motivation died with him. There is no concrete information that it was for the glory of the caliphate or for the glory of IS or for the glory of AQ. But what he did achieve was that he gave fellow violent extremists the understanding that the U.K. was not such a hostile place to launch attacks and that by using this simple methodology you could succeed. Some violent extremists admired him for actually going ahead and doing it. Some criticized him for not doing a very ‘good job.’ But at the end of the day, what it did say to them was that ‘my plot could work. What I have been thinking of doing, I could actually do.’

CTC: Have you seen much of a change in the threat picture since Raqqa has fallen? Or has it had no effect?

Basu: What we’ve seen is a lot more chatter, a lot more people thinking that they have a chance of successfully carrying out attacks. So the pace and tempo, the number of leads that we think are concerning, the pace has gone up. Whether or not this is linked to the push in Raqqa is hard to tell.

In terms of plots, the trend is towards less sophistication, more amateurism. We’ve not seen a growth of extremists. We’ve seen more conversations among extremists expressing the belief they can launch successful attacks here. So definitely the pace of plotting activity we’re looking at has gone up. But then that was predictable as well. I don’t think anyone thought the military defeat of the group in Syria and Iraq was going to be the end of this. We are dealing with an ideology, which is being spread online and has global reach, and we to need to confront this by clamping down on what’s being spread through the internet and better engaging with people who are vulnerable to the extremist message.

CTC: Earlier this year, Minister of State for Security Ben Wallace stated a significant number of British nationals who signed up to fight with extremist groups in Syria and Iraq had gone missing somewhere in the region.1 What do we think has happened to those who are unaccounted for? Where have they ended up? 

Basu: I think there’s probably more in detention overseas, including in YPG or Kurdish or SDF detention, than we currently know. We obviously won’t know everyone who’s died. It’s a warzone and difficult to be definitively accurate. We estimate that 15 percent of the 850 foreign fighters that have traveled from the U.K. to Syria and Iraq have died. There are some we absolutely know died, and there are ones we guess are deceased because, for example, they are no longer communicating. Establishing the fate of the others is going to be very difficult.

I think we have made it very clear how hostile it would be for foreign fighters if they return here. The policy is very clear. You do not get to come back here if you did manage to get over there and you are a fighter.

About half of the 850 who traveled to Syria and Iraq since the onset of the Syrian civil war have returned to the UK. The large majority of these came back very quickly and early on. Some of those were genuine aid workers. Some were people who thought they were going to build a caliphate, not necessarily be immersed in a war. Generally speaking, the people who came back quickly are not where the bigger threat lies.

The larger threat is posed by the return of committed recruits who went there to be trained. When it comes to people who we know are back in the U.K. that we suspect fall into this category, we have either tried to build a case or we’ve monitored them or we have talked to people who know them. As far as those who are still overseas are concerned, we have been making it very clear that this will be a very hostile place to come back to, and I do not think most of these foreign fighters will want to come back. They will want to fight on, and that’s why they have been so committed to being in theater for this length of time.

We are still not seeing what many predicted was going to be a large reverse flow as the so-called ‘caliphate’ disintegrated. Instead, we are seeing just the odd person come back.

When it comes to those still unaccounted for—and who are not being held in detention in the region—I have no doubt a number might be trying to reach other IS strongholds. It is almost impossible to say what has happened to these people. I think we overestimated the stand-and-fight-until-you-die attitude. Some of these foreign fighters will want to fight another day. It is also too early to say where they will coalesce. Could it be the Philippines? Could it be Libya? But it is worth thinking about how practically easy it would be for somebody who is not Arab-speaking, doesn’t necessarily ‘look the part,’ to meld into society in a place like Libya. Very difficult, I would think.

If you crunch the figures: about 850 foreign fighters who went, about half who came back, 15 percent who died, you’re probably looking at a cohort of about 300 that we know traveled who are still out there. Not all of those are mono-Brits; a lot of those are dual nationals. Like other countries, we operate on the principle that we don’t want you back, and therefore we will deprive you of your British passport. And the government has done that. Because of this, the ones who could come back are about a third of this 300 number. And for those among these who end up coming back, we are absolutely waiting for them. That’s the bottom line.

CTC: British officials have said a residual risk is posed by about 20,000 individuals who were previously the subject of counterterrorism investigations. This is a very large number. How is it possible to manage the risk from such a large community of people? Who is going be responsible for managing this? Is this a job for the security services?

Basu: It’s impossible for any country to allocate resources for that kind of number. And every country will have a similar issue. That number will always grow. Because there will always be people who have been considered a national security threat but are no longer considered a national security threat. There is no way the security services or policing can manage all of those on their own. What we have to make sure is that there are ways of assessing whether the risks still exist or not in specific cases, and that’s going to involve something that the security agencies have never done before, which is sharing information from the secret space into multi-agency partners who may be able to help assess that risk. This is not a new concept. Multi-agency public protection arrangements for serious and violent offenders already exist. These individuals live in communities, and there are all kinds of measures in place to manage them. Local authorities need to be informed in a similar way as when people convicted of TACT [terrorism legislation] offenses return to their communities.

People get hung up on the full 20,000 number that is circulated, but what we need to be focused on is what the actual risk in that group is. The bigger risk to us are the additional 3,000 open cases that U.K. security minister Ben Wallace has talked about. That’s where the larger risk lies. A lot of the nervousness has come from the fact that we had two people come out of the 20,000 pot and attack us last year—Khalid Masood and Salman Abedi—while London Bridge attacker Khurram Butt was in the 3,000 who were being looked at. But we would be making a terrible mathematical mistake if we said that we need to swivel all of our guns onto the 20,000, when the 3,000 is where the big risk is.

What exists in that 20,000 is the possibility of people reengaging, like Abedi and Masood. How do you spot that reengagement? Do we have the right triggers in place so that when somebody who has previously shown signs of violent extremism reengages or does something or contacts someone of concern, it comes onto our radar screen?

The only way we are ever going to significantly improve coverage of this is by alerting a broader number of U.K. agencies about who is in the 20,000 pot. David Anderson [former Independent Reviewer of Terrorism Legislation in the United Kingdom] has stated this is something we are going to have to get much better at. We have already learned a great deal from the Operational Improvement Review in the wake of the attacks, and Mr. Anderson praised the work that had been done. But clearly more needs to be undertaken to tighten up our processes to prevent such attacks from taking place.

We are going to run pilot programs and see where we get to on this larger group, to see whether there are issues around reengagement. As a result in some of those cases, we will end up moving them deeper into the safeguarding space: they don’t want to be engaged in extremist activity, they might choose to volunteer, and they might want assistance in all kinds of ways, whether that’s mental health, education, or intervention providers providing religious instruction. There might be people who genuinely want to get off this extremism carousel. And there might be others who are reengaging who become a risk again, and we need to look at them from a law enforcement and security perspective. We are only going to be able to know this is the case if more people are helping us, and that includes my core policing colleagues outside of the specialism of counterterrorism policing. They will be used to the principles; they just need to learn to apply them to terrorism offenders. The key is information sharing and spreading the risk, but because we work in a top-secret world, that’s a cultural change, which is easy to call for out loud like this but really difficult to achieve.

CTC: We keep seeing TATP showing up in terrorist plotting. Is there more that could be done to stop that? 

Basu: A few very obvious things need to be done. We need much more help from the private sector. Anyone who sells materials that could be used in this process needs to be engaged with, and we need to be much quicker at spotting suspicious purchasing activity. Same with the banking sector and suspicious transactions—all of which has been in place for some time, but we need to be much better at it. And we need to make sure that we remove anything that looks like bomb-making instruction from anywhere on the internet. The difficulty is that some of this stuff is O-level [type] chemistry experimentationa that is available online and aimed at children and students. So some of it is not IS appearing online saying ‘this is how to blow people up.’ And so there is a danger is being disproportionate in what we take down and what we don’t. TATP is still dangerous, volatile, and difficult to make, but it is probably not as difficult as we thought it was. So you don’t need to be a chemical engineer to be able to do this kind of stuff.

CTC: When it comes to social media and its role in encouraging or directing terrorism, is there more, from the policing perspective, that you can do? 

Basu: This is principally a role for intelligence agencies rather than police. What it does require, however, is close cooperation from social media companies. And where there isn’t cooperation, we need to consider coercive measures. Governments need to consider legislation. In reality, 2017 was a wake-up for the U.K. and for a lot of companies, not just in the CSP [communication service provider] space. It is about corporate social responsibility [for] how they protect their clients. I do not think it is acceptable anymore to say, “I’m defending free speech” if free speech involves blowing people up. The companies need to be in that space. There are positive signs that they are in that space. They’ve been in front of various hearings and political leaders. I’ve no doubt that they are listening, but they need to make sure their business models are effective in dealing with this now. They’ve got the brainpower, and they’ve got the resources, and they need to help.

CTC: Turning to the threat posed by the Extreme Right Wing (XRW) in the U.K. It has been discussed as an escalating problem for some time. Has it now crossed the threshold of being a national security threat?

Basu: It is too early to see how much it should be escalated. The threat assessment should be looked at by JTAC, and where we think there is a national security threat, then the security services should be involved. The far-right group National Action was the first time we saw anybody who was organized in the XRW space in a way that would represent a national security threat. Thankfully, it is nowhere near the same scale or problem as we’ve had from the IS-inspired or -directed [threat] or the AQ [threat] prior to that or the IRA threat prior to that. That is really something to be proud of in the U.K. culture and tradition that we don’t have this mass wave of extreme right wing. So far, we have seen people try to get on the back of that and not be incredibly successful. They are still relatively small, relatively disconnected, relatively disorganized groups.

My biggest concern about the extreme right wing, which is not a national security threat, is the Darren Osbornesb of the world, the Thomas Mairs of the world [the murderer of Member of Parliament Jo Cox], and the lone actor with the mental health problems, depression, drugs, and the personal grievance who is acting alone. It is spotting people doing something like that which is very difficult.

The biggest concern for the country should [be] that violent Islamist extremism and violent right wing extremism will feed off each other. Islamophobia is something we have to be really clear about in policing: hate is hate. And we should be very, very robust and have a zero tolerance towards hate crime. And if we don’t do that, and Muslim communities are being stigmatized and attacked because of things a tiny minority of people are doing, I think we will create problems for ourselves. The Muslim community is going to be thinking that it is unfair and unjust. I think we don’t have parity at the moment in the way that we look at things. But we don’t have parity because at the moment, the scale of the threat is not the same. I do not want to wait for the scale of the threat to get to a point that something has to be done about it. You have seen a lot of the robust action we’ve taken against National Action, and that was because we were determined to stop this [from] becoming the next problem.

CTC: What about the policy side? The latest iteration of CONTEST [the U.K. counterterrorism strategy] is due out in a few months. What is your particular view on the “Prevent”c pillar of the strategy? 

Basu: Prevent is the hugely controversial part of the strategy. Government will not thank me for saying this, but an independent reviewer of Prevent, as suggested by David Anderson, would be a healthy thing. In fact, he would be excellent in the role. Prevent is, as a Prevent officer who used to work for me said, five percent of the budget but 85 percent of the conversation. Prevent is the most important pillar of the four pillar strategy.d There is no doubt in my mind about it. We’re pretty good at Pursue; we’re pretty good at Prepare, as people have seen in our response. What needs to be better in Protect is the private sector, and I think there’s a big willingness, like there is with CSPs, to understand that they need to protect their customer base better. And whether that’s insider threats, cyber threats, or security guards [in] crowded places, there is an understanding that they need to invest more in that. But Prevent is the key.

There is still this hangover of toxicity around the Prevent campaign that we need to stop, because people need to understand that this about stopping people in the pre-criminal space ever getting anywhere near criminality. And Prevent needs to concentrate on how it does that. That cannot be a job for the police and security services. That has got to be a wider societal pillar. The more that policing and security service could withdraw from Prevent in order to focus Prevent work on problem solving within communities and getting communities to deal with it, the better in the long-term. There will always be a role for policing because we are a frontline. And here I don’t mean counterterrorism policing but the other 115,000 or so police officers who are in the frontline working together with communities. But actually the big responsibility is how do we get everyone else interested and involved and talking positively about some of the brilliant work that is going on.

Prevent, at the moment, is owned by the government, but I think it should be outside central government altogether. I think people who are running their local communities should be taking the lead. Local leaders around the country should be standing up and talking about this, not central government, security services, and counterterrorism police. Communities should be talking about protecting themselves from the grassroots up. When you see Prevent working on the ground brilliantly, that’s where it’s working, and largely unsung and un-talked about. Substantial community resilience is produced by that sort of work, and giving people that resilience is important and communities have to help each other do that. I would love to see a professional communications company say, as part of their social responsibility programming, “I’ll give free training to anybody from youth or whoever who wants to start a conversation around this.” That would be great. Rather than the government handing over a sum of money and then it becoming state sponsored with accusations of demonizing communities, it should be locally generated. We have gotten all of that messaging the wrong way around, it should be grassroots up.

Previously, this was not being done. But there are increasingly some phenomenal voices who’ve got real gravitas in their communities who are beginning to talk about the issues. The mayor of London, Sadiq Khan, is a really good example of that. He is not central government, he runs a city, and the protection of the city is his concern, he should be doing that, not MI5. Not the Cabinet, and the National Security Council and New Scotland Yard.

CTC: The threat picture we talked about is about a scattering of diffuse, random, isolated loners who latch onto ideologies, launching lone actor-style attacks. Have you seen any evidence in the attack planning of anything more substantial than that? Or is that really where the heart of the threat now sits? And is that where the threat picture going forward is going to be?

Basu: We will never eradicate the ambition [of extremists] to put a complicated network together to do a big, spectacular attack. The difficulty with that for a terrorist is that all that planning and all that preparation makes you very vulnerable. Where people aren’t vulnerable is when they are sitting in their bedrooms, using encrypted apps or not using any technology at all, and not having any contact with the outside world. Thomas Mair was a good example of that: no one spotted that happening because he was just a bit of an odd, loner, social misfit. No one saw any triggers that would be interpreted as leading him to that extreme level of violence. That is the bit that concerns me. We are seeing people who are vulnerable to suggestion, who have low-level mental health challenges, which probably don’t hit any clinical threshold. So even if they presented to the National Health Service, they would not look like they were someone of concern. It might be a low-level mental illness, but it’s a low-level mental illness with a lot of other red flag markers around it—for example a propensity towards violence. You can be seriously mentally ill and not violent. Nobody should ever stigmatize people with mental health, or put the two things together. But it is that kind of thing that concerns me most, and we are seeing more of that. And most disturbingly, very young and more female interest in violence.

That disturbs me and has got to have come from social media, if you think where kids get all of their information and how fast that they get it … and then how easy it is to go from—it’s a horrible expression—‘flash-to-bang,’ from having no understanding [of] what they are dealing with to a tiny, partial, ridiculous kind of notion of what religion or what violence, or what freedom of expression, or what these things mean because they picked it up in six-second soundbites on their phone. That malleability worries me a lot, and that concern seems to be being replayed around the world in my conversations with partner agencies across the European continent. So how we influence that younger, very vulnerable generation is going to be a key question. A revamped Prevent strategy is going to be a large part of the answer.     CTC

Substantive Notes
[a] O-levels are exams students in the United Kingdom used to take at age 16.

[b] Darren Osborne is the recently convicted extreme right-wing terrorist who drove into a crowd outside the Finsbury Park mosque in June 2017.

[c] “Prevent” is the forward-looking aspect of the strategy that focuses on preventing individuals from being drawn to extremist ideas.

[d] The other three pillars are “Pursue,” “Prepare,” and “Protect.”

Citations
[1] Roger Baird, “Government has lost track of hundreds of British jihadi fighters,” International Business Times, January 5, 2018.

It has been a busy day. Events in Barcelona are still a bit unclear, but it sounds like we are moving towards some resolution. In the meantime, catching up on posting latest contribution for the excellent West Point Combating Terrorism Center’s journal CTC Sentinel. Thanks to Paul for his excellent and patient editing. More to come on this topic invariably, and some more catch up to do after this week’s atrocities in Spain.

Britain on Alert: The Attacks in London and Manchester and the Evolving Threat

Abstract: After a respite from mass-casualty terrorism for more than a decade, thus far in 2017 the United Kingdom has suffered three such attacks and a higher tempo of jihadi terrorist plotting than ever before. Absent from the threat picture so far are any Paris-style plots in which the Islamic State has dispatched operatives to launch attacks in the United Kingdom. At this early stage of the investigations, it appears that the Westminster attacker had no contact with the Islamic State and that the Manchester and London Bridge attackers were at most loosely connected to the group. The current threat environment is mostly made up of individuals and smaller scattered cells planning lower-tech attacks with very short planning and operational cycles—sometimes remotely guided by the Islamic State—rather than cells trained and dispatched by the group. But this could change as more British Islamic State recruits return home. With over 20,000 British nationals and residents subject to counterterrorism investigations since 9/11, a growing number of ‘frustrated travelers,’ and a complex and unpredictable set of threats, the United Kingdom faces an unprecedented security challenge. 

It has been a difficult year so far in the United Kingdom. After a period of relative stability, the United Kingdom has abruptly faced a period of deep political turmoil and a series of terrorist strikes that killed 36 people. While the full story around the terrorist plots that rocked the country during the first half of the year is not yet entirely clear—with multiple public and confidential reviews currently underway—the series of cases has led to deep introspection about how the United Kingdom manages the risk posed by the growing number of radicalized individuals at home. In July, Commissioner of the Metropolitan Police Cressida Dick stated that “since March this year, the [threat] tempo has changed. What we are seeing is now being described by the experts as a ‘shift’ in threat, not a spike.”1

This article argues this shift has to be understood as a permanent adjustment in the threat. There has been significant continuity in recent years in the nature of the threat faced by the United Kingdom, with a noticeable move away from large-scale plots to smaller scattered cells, with the tempo of plotting increasing noticeably. The article builds on a previous article in this publication in March 2016, which laid out the United Kingdom’s threat picture through analysis of a series of disrupted terror plots.2 The conclusion then was that “the public threat picture has been dominated by lone-actor plots”3 rather than more ambitious plots directed by the Islamic State like the Paris and Brussels attacks, an assessment that has not been challenged by the attacks in London and Manchester this year. Although only tentative conclusions can be made at this stage, the information that has come to light suggests these plots were significantly less ambitious and complex than some of the conspiracies seen in continental Europe and were carried out by men with at most loose connections to the Islamic State.

This article first outlines what is now known about the March 2017 Westminster Bridge attack, the May 2017 Manchester bombing, and the June 2017 attack on London Bridge and Borough Market. It then assesses what these attacks and other thwarted plots reveal about the broader threat picture in the United Kingdom and the challenges faced by security services.

The return of terrorism to the headlines in the United Kingdom this year was all too predictable. After a period of almost three years with the threat level at the second-highest level of ‘severe,’ British authorities had long warned that an attack was highly likely. Disruptions took place regularly. In early March 2017, the Metropolitan Police Service’s Assistant Commissioner for Specialist Operations Mark Rowley, who is also the National Police Chiefs’ Council (NPCC) lead for counterterrorism, stated that since the murder of Lee Rigby in May 2013, authorities had disrupted 13 terrorist plots. In defining the nature of the plots, Rowley stated “some of them have been more sophisticated [in their] planning looking to attack public spaces, or police offices or the military, not that dissimilar to some of the attacks we have seen in Belgium and France and elsewhere. There is a whole range from the simple to the complicated.”4 This built on comments by then-Prime Minister David Cameron in the wake of the Paris attacks of 2015 in which he stated that agencies had disrupted at least seven plots in the previous six months, “albeit attacks planned on a smaller scale.”5

The Westminster Bridge Attack
Notwithstanding this tempo of disruptions and public statements about the terrorist menace, Khalid Masood’s attack on Parliament on March 22, 2017, still shocked the British public. Using a Hyundai Tucson SUV rented in Birmingham a day earlier,6 Masood drove through the crowds of mostly tourists crossing Westminster Bridge at 2.40 PM. Hitting numerous pedestrians and knocking some into the river, he drove into the gates in front of the Houses of Parliament and then ran at a police officer standing guard, stabbing him with a knife. Masood was then shot dead by the close protection team of Defence Secretary Michael Fallon, who happened to be leaving Parliament at that moment.7

In the wake of the attack, which killed five people, authorities undertook a number of arrests near locations where Masood had lived, detaining 12 people in total. All were subsequently released.8 Born Adrian Russell Elms, Masood was a troubled 52-year-old who had lived an itinerant life, married three times, and had four children by two different women. He appears to have converted in prison while serving time for assault.9 He was twice incarcerated and arrested numerous other times for incidents involving attacking others. His case was of such concern to Sussex Police that in 2009, they filed a report highlighting the escalating nature of his violent behavior.10

In addition, Masood had featured in counterterrorism investigations. Prime Minister Theresa May confirmed that he had surfaced on the fringes of previous cases, stating “he was once investigated by MI5 in relation to concerns about violent extremism. He was a peripheral figure. The case is historic. He is not part of the current intelligence picture.”11 He was investigated after his telephone number was found among the contacts of a member of a cell of individuals from Luton who were jailed in 2013 for planning to bomb an Army barracks.12But he was not a priority of the investigation, and greater attention has been placed on his further radicalization more recently in Birmingham.13

Nevertheless, there has been little evidence produced that Masood was linked to any other co-conspirators or that he had conducted his assault with any external direction. He sent a WhatsApp message shortly before his assault reportedly stating his attack was a response to Western interventions in the Middle East, but the person he sent it to was cleared by authorities of any prior knowledge of the attack or culpability.14 A claim issued by the Islamic State in the wake of the attack was also dismissed as it showed no evidence of being anything but opportunistic. The group has praised Masood in subsequent publications, including quite specific incitement to people to emulate his attack, but the group has never demonstrated any access to information pertaining to him that was not already in the public domain. Authorities have concluded that Masood most likely acted alone and that the full extent of his motivations may never be known.15 As Neil Basu, NPCC’s senior national coordinator for counterterrorism, put it, while the police “found no evidence of an association with Islamic State or al-Qa`ida, there is clearly an interest in jihad.”16 While it is unlikely that Masood was completely isolated, the lack of any subsequent arrests or any charges issued as well as some fairly telling statements by police that his motivations may never be known highlights that, for authorities, the case is largely closed.

The Manchester Bombing 
The contrast between the Westminster attack and the bombing exactly two months later on May 22 in Manchester by Salman Abedi is stark. Using a device that he appears to have constructed himself in Manchester using tools that are publicly available,17 Salman Abedi, a 22-year-old British national of Libyan descent, walked into a crowd of families and children as they left an Ariana Grande concert and detonated a well-built bomb made of TATP and packed with shrapnel.18 Killing himself and 22 others, Abedi’s attack immediately sparked something of a panic among U.K. authorities. Concerned about the sophisticated nature of the device and the fact that Abedi was a known figure with deep extremist contacts, counterterrorism agencies immediately feared that a bomb maker might be on the loose. A wide net was cast, and the terrorist threat level was raised by the Joint Terrorism Analysis Center (JTAC) to its highest level, ‘critical,’ meaning an “attack is expected imminently.”19


Emergency response vehicles parked outside the scene of the terror attack in Manchester, England, on May 23, 2017. (Paul Ellis/AFP/Getty Images)

Nevertheless, while over 20 arrests were carried out, no charges have been issued. In early July, Greater Manchester Police held a press conference at which they highlighted that while they believed Abedi may not have acted alone, he was not part of a larger network. “We don’t have evidence of a large network. We do, however, suspect others were either aware [of] or complicit in the knowledge of this attack … We do believe that there are other people potentially involved in this … further arrests are possible,” Detective Chief Superintendent Russ Jackson, head of the North-West Counter Terrorism Unit (NWCTU), stated. 20

Abedi is reported to have had significant connections in radical circles in Manchester. Many of Abedi’s links tie back to the community of young men from the city going to fight in Syria. He reportedly visited wheelchair-bound (following injuries sustained during his involvement in the 2011 uprising in Libya) Abdal Raouf Abdallah, another Libyan-British national, in jail a number of times in early 2017. Abdallah had been jailed for his role in facilitating the travel of others to Syria.21 He was also reportedly in close contact with Raphael Hostey, a prominent British Islamic State fighter from nearby in Manchester, who used the kunya Abu Qaqaa and was the sponsor for numerous Britons who joined the group.22

It is, however, Abedi’s links in Libya that have raised the most scrutiny. His father, Ramadan Abedi, a prominent onetime member of the now-defunct Libyan Islamic Fighting Group (LIFG), reportedly returned to fight—bringing his son Salman with him—in the revolution that overtook the country in 2011.23 A long-time and committed member of the LIFG, he was well-connected in the community around the jihadi group and was also reportedly seen in Bosnia a number of times during the civil war in that country in the 1990s.24

British authorities have made clear they wish to question Abedi’s brother Hashem.25 On May 24, 2017, the Special Deterrence Force, a Tripoli-based militia under the nominal control of the Interior Ministry, released a statement saying it had detained Abedi’s father and brother Hashem. The militia claimed that Hashem had confessed while in detention that both he and Salman were members of the Islamic State and that Hashem had admitted he had been in the United Kingdom during the planning phase of the attack, had been aware of the plot, and had been “constantly in touch” with his brother. Hashem also reportedly admitted to helping to purchase the bomb components. On May 25, a spokesperson for the militia stated on Libyan television that the two brothers had been in contact by phone just 15 minutes before the bombing.26 Questions remain over these confessions, including over whether they were made under duress. Hashem is still in Libya and has not been charged in the United Kingdom. Analysis of his social media accounts show he was in contact with Hostey’s brother.27

According to the Greater Manchester Police, the two Abedi brothers both left for Libya on April 15, with Salman returning to the United Kingdom on May 18, just four days before the bombing. It was the latest in a number of trips Abedi had made back and forth to Libya. Investigators believe bomb-making materials were obtained before the trip to Libya and stored in a car and that when Salman Abedi returned to Manchester, he purchased other materials for the device including nuts as shrapnel and quickly assembled the bomb.28 The high volatility of TATP—the quick speed at which it evaporates or sublimes and thus becomes useless as an explosive—meant he almost certainly made the explosive substance in the days between his return from Libya and the attack, sources told CNN.29

It remains unclear whether Abedi received training while in Libya. Abedi appeared to be single-mindedly focused on building the bomb when he returned to the United Kingdom, suggesting it is possible he received training or final instructions on his last trip.

Similar to Masood’s attack, the Islamic State issued a statement praising Abedi’s act, but it demonstrated no proof of any prior knowledge.30 Notwithstanding the alleged declarations by his brother to the Tripoli militia, had Salman been closely linked to the Islamic State in Libya, it would be surprising that he would not have recorded a martyrdom video and left it with the group, or least some photographic evidence showing his connections. At the same time, investigators continue to believe that he had some greater degree of links to terrorist groups abroad than Masood. However, the exact nature of these links remains unclear.

The London Bridge and Borough Market Attack 
On June 3, 2017, less than two weeks after the Manchester bombing, London was struck once again. On a balmy evening, Khuram Butt, Rachid Redouane, and Youssef Zaghba drove a van they had rented earlier in the afternoon into the Saturday night crowds gathered near London Bridge. Ramming the van into a fence adjacent to the pavement near the end of the bridge, the trio then leapt out of the vehicle and started attacking passersby in the adjoining Borough Market area with long knives they had bound to their wrists with leather straps. They wore plastic bottles covered in black tape wrapped around their bodies to give the impression of wearing suicide vests and had a number of Molotov cocktails made up in the van.31 Within eight minutes of police receiving the call, armed response officers arrived and shot and killed the three men, though not before eight revelers had been killed and 48 injured.32

One of the attackers was almost immediately identified as a figure well-known to the security services. Butt, who authorities believe was the ringleader of the group, was a prominent and active member of the al Muhajiroun network of extremists that has been at the center of the United Kingdom’s violent Islamist terrorist threat for the past two decades. Butt himself had been repeatedly featured at the center of investigations and was most recently on bail for ‘low-level’ fraud for which he was not ultimately going to be prosecuted.33 More embarrassingly for British authorities, he had been featured in a widely viewed documentary called The Jihadis Next Door, which followed a number of prominent al Muhajiroun members, including Siddartha Dhar, also known as Abu Rumaysah (who fled to Syria with his family soon after filming and was believed to have become a new “Jihadi John” figure in Islamic State films34), as well as others who have been convicted of a variety of terrorism and extremism charges.35

The other two were less well known to British investigators, though it rapidly emerged that the Moroccan-Italian Zaghba had been flagged to British authorities through a European intelligence sharing system as someone of concern to Italian authorities after he was stopped at Bologna airport in March 2016 on his way to Turkey. Carrying a small bag, little money, a telephone with Islamic State videos on it, and a one-way ticket, he raised suspicions by telling authorities that he wanted to head to Syria.36 Nevertheless, he was released after being turned back. He subsequently traveled onto his native Morocco and then ultimately London, where he took on part-time work in the services industry.37 The third attacker, Redouane, appears to have led an equally peripatetic life, alternatively claiming to be Moroccan or Libyan and stating his birthdate was in 1986 and 1991 on different documents.38 He had married an Irish woman and had a child with her, who he appears to have visited at his estranged partner’s home in Barking the night prior to the attack after a lengthy hiatus.39

Planning for the event appears to have taken place over a two- to three-week period prior to the attack.40Police believe Redouane’s bedsit in Barking was the location where plotting occurred,41 though the men appear to have also congregated in a number of sporting locations, including an outdoor pool42 and a gym that was established by a pair of brothers who had previously been identified as being involved in al Muhajiroun activity.43

It remains unclear the degree to which the London Bridge attackers may have been directed by the Islamic State or any other extremist group, though the Islamic State did again claim the attack.44 Given Butt’s known association with individuals who have gone on to become prominent figures within the Islamic State, like Abu Rumaysah (who is still suspected to be at large and was featured in the same British television documentary), he would have had ample opportunities to establish contact with the group. Senior leadership figures within al Muhajiroun, like Anjem Choudary and Mizanur Rahman, have been prosecuted for supporting the Islamic State.45 Others like Abu Rahin Aziz,46 Shahan Choudhury,47 Mohammed Reza Haque,48 and Hamza Yaqub49have been publicly identified as having fled to join the group. Many others have tried going to Syria and been caught at various stages of their journeys. Given the close contact the group’s members maintain with those back in the United Kingdom even after they have gone over to Syria, it seems likely that Butt would have had at least some contact at some point with Islamic State operatives in Syria.

While the Islamic State’s immediate claim contained no information that was not already in the public domain, the group’s subsequent mention of the attack in the 10th edition of its magazine Rumiyah did offer battlefield names (kunyas) for the fighters, which had not been discussed in the public domain, identifying them as Abu Sadiq al-Britani, Abu Mujahid al-Britani, and Abu Yusuf al-Britani.50 The accuracy of this information is unclear, however, with it contrasting with Butt’s known kunya of Abu Zeitoun.

Observations on the Three Attacks 
One key question for authorities is the degree to which the three cases were connected.51 Thus far, no evidence has been made public to show any level of connectivity, beyond the potential that the three plotters were somehow inspired in their timing by each other’s actions.a The available evidence suggests the attacks were carried out by individuals or small cells who, though possibly inspired by the Islamic State’s ideology, were either not connected to the group (Westminster) or only loosely connected (Manchester and London Bridge). There is no indication that the Westminster and London Bridge attackers trained overseas. In the London Bridge plot, at least two of the attackers, Butt52 and Zaghba, were frustrated travelers to Syria. In the Manchester plot, Abedi is known to have traveled to Libya a number of times (though the exact nature of these trips is complicated by his Libyan heritage). Abedi’s single-minded focus in constructing a device just a few days after returning from Libya suggests it is possible he traveled to Libya for the purpose of learning how to build a device.53 The New York Times, citing U.S. and European intelligence sources, reported Abedi met with members of Katiba al-Battar, a Libyan Islamic State brigade, at some point while in Libya and kept in touch with the group on trips back to the United Kingdom, but this has not been confirmed by British authorities.54Given that Abedi reportedly participated in fighting against Muammar Qaddafi, one possibility is he received bomb-making training while spending time with a militia group in Libya. There was some public speculation Abedi may have traveled to Syria as well, but this has not been substantiated.55 No evidence has yet surfaced of external direction, and it cannot be ruled out that Abedi learned to build the bomb off the internet given there is evidence he viewed various online videos on bomb making.56 But the relative sophistication and effectiveness of the device, and the trickiness of making TATP, points to the possibility of at least some bomb-making training or practice overseas.

Increased Tempo
In the wake of the Westminster attack, there was a noticeable uptick in the tempo of arrests being conducted by police disrupting active attack planning. In June, Commissioner Dick said about one person a day was being arrested in counterterrorism investigations.57 The reasons for this increase are not totally clear, but it is likely the result of both lower tolerance of risk by British authorities and a growing threat. In the first instance, a successful attack highlighting a failure in intelligence would change counterterrorism agencies’ perspectives on ongoing investigations, making them reconsider various subjects of concern. Second, police concerns of copycat attacks likely sped up arrests of subjects of interest who had been under surveillance for some time. A third likely reason is the increasing push and resonance of Islamic State messaging about individuals staying home to launch attacks. This is a phenomenon that has been obvious since Abu Muhammad al-Adnani’s speech in May 2016 in which he stated, “The smallest action you do in the heart of their land is dearer to us than the largest action by us, and more effective and more damaging to them … And if one of you wishes and tries hard to reach the Islamic State, then one of us wishes to be in your place to hurt the Crusaders.”58 As it has become harder to travel to Syria and the group has been losing territory, more supporters of the group in the United Kingdom are becoming frustrated travelers who are responding to this messaging.

British police thwarted five plots in between the Westminster Bridge and Manchester attacks.59 Just over a week after Masood’s attack, police in Birmingham arrested brother and sister Ummariyat Mirza and Zainub Mirza, who were accused of planning a beheading attack.60 Two weeks later, Ummariyat Mirza’s wife, Madihah Taheer, was arrested and charged with supporting her husband in his plot.61 At around the same time, police arrested a 17-year-old girl of Moroccan origin from London for allegedly plotting to launch some sort of attack under direction of a fighter from Coventry who was killed in April by a drone strike in Syria. The teenager, who cannot be named for legal reasons, was apparently married to the fighter through Skype and had sought to obtain guns and grenades to launch an attack in the United Kingdom under explicit direction from the Islamic State.62

Even more alarmingly, 27-year-old Khalid Ali was detained in Whitehall, a short month after Khalid Masood’s attack on Westminster, in a dramatic mid-afternoon swoop as he walked around with a bag full of knives and shortly after throwing his phone into the river. He was charged with bomb making linked to activity he undertook in Afghanistan years before, as well as the alleged plan he was in the midst of when he was arrested in Whitehall.63

The same day that Ali was detained along Whitehall, police in Willesden in northwest London and Kent undertook a series of raids, detaining six people in what they believed was another cell actively plotting attacks. The case was deemed of such concern that authorities stormed the premises using CS gas and guns. One woman was shot during the entry.64 The initial reporting indicated a cell of six were involved, including an individual who had been stopped in Turkey alongside two teenagers who were reportedly en route to Syria.65 In the end, however, the failed traveler was not charged, and three women (including a mother and daughter) were presented in court for allegedly planning an unspecified knife attack.66 Finally, five days prior to Abedi’s attack, police in East London arrested four men for planning an alleged car bomb and knife attack in central London reportedly inspired by Masood’s actions.67 The four men were arrested on May 17.b

This intense spate of arrests presaged the Manchester and London Bridge attacks and reflected a changed threat assessment by authorities as they sought to roll up a number of cells that had been under surveillance for some time. As noted above, in many cases, authorities feared that Masood’s abrupt success might stimulate others to emulate him—something that had been seen historically after successful attacks. The murder of Lee Rigby in May 2013 by two extremists linked to al Muhajiroun helped stimulate others to attack, including an extremist who the very next day attacked a French soldier patrolling in the La Defence area of Paris. More generally, the attack model deployed against Rigby is one that has become a template many British extremists seek to emulate, often themselves making direct reference to that 2013 attack.

Arrests have continued at a high rate in recent weeks. Three men were picked up on the day of the general election, June 8, with one charged on an unspecified plot. The 33-year-old man in question, Irfan Khan, was allegedly a long-time consumer of online radical material and had allegedly recently viewed material linked to the London Bridge attack when he was arrested, demonstrating the potential inspirational effect of that attack.68 Later in June, police in Birmingham arrested Tarik Chadlioui, a 43-year-old Moroccan cleric who was wanted on terrorism charges in Spain for being the spiritual leader of a cell supporting the Islamic State.69 One of his followers in Majorca is accused of planning a stabbing attack of pedestrians on the island.70

A Constant Threat 
None of this, however, points to large-scale attack planning in the United Kingdom. While a number of the disruptions suggest plots approaching the scale of the London Bridge or Manchester attacks, there was little evidence presented in court of conspiracies with the capability to launch larger Paris-style assaults. Unlike disruptions on the continent in Europe, where cells in possession of automatic weapons and with clear evidence of individuals who have been to foreign battlefields are regularly disrupted, so far there is no evidence that has been made public of this model of plot in the United Kingdom.

More typical have been plots similar to that mounted by a cell of individuals from Birmingham who were planning a knife and bomb attack in the United Kingdom before their arrest in late 2016. Although the so-called “three Musketeers” behind this plot were potentially dangerous, and two had, five years previously, very briefly made it to a training camp in Pakistan, there was no evidence presented at the trial that their plot was directed from overseas; it emerged at trial that the conspirators joked about their inadequate skills, with one likened to one of the useless extremist characters from the film Four Lions, a satirical movie that pokes fun at some of more inept practices of British jihadis.c

The earliest disrupted plot linked to Syria, that of Erol Incedal, included accusations of a planned marauding gunman scenario with some direction from overseas.71 Incedal was cleared of these charges and ultimately convicted of possession of a bomb-making manual.72 But beyond this, the attack planning seen in the United Kingdom has been fairly consistently small cells or isolated individuals seeking to launch low-grade attacks on soft targets around the country. While there are often links to known extremists or networks, where there has been direction, it has been in the form of remote guidance by extremists based in Syria and Iraq.73

None of this is to say that authorities do not continue to see aspiration and intent by terrorist groups to launch more sophisticated plots in the United Kingdom. Thus far, however, the threat has mainly consisted of small-scale unsophisticated plots. While this suggests terrorist groups like the Islamic State have been facing difficulties in infiltrating directed cells into the United Kingdom, authorities are still confronted by a challenging threat picture and one that is in many ways more complicated with these scattered and disparate cells, which are difficult to track. Adding to the challenge is the unpredictability of individuals or small cells autonomously deciding to act using very low-tech methods and weapons, which makes it a very difficult to manage and prioritize threats accurately.

Managing Risk 
The question of prioritization is the key issue at the heart of considerations about how to manage the current U.K. threat picture.d In all three of the cases featured in this article, attackers were known and had been investigated—to varying degrees—by authorities. In at least two cases, Abedi and Butt, they had been a focus of investigations, but no prosecutable case had materialized, leading investigators to move on to other cases that appeared to be of higher priority. With limited resources, such choices have to be made.

The volume of activity that U.K. security services are currently focused on was illustrated most clearly in the wake of the Manchester bombing when Security Minister Ben Wallace revealed on the BBC’s flagship Today program that authorities had 500 investigations underway, involving some 3,000 subjects of interest. In addition, he revealed, there were a further 20,000 former subjects of interest (i.e. former targets of counterterrorism investigations in the post-9/11 period) who remained of peripheral interest to the security services. The numbers have since grown even higher, according to British police. Butt, the London Bridge ringleader, was among the 3,000 current subjects of interest. But it was from the 20,000 considered to be only a residual risk that the Manchester and Westminster attackers had come.74 This larger pool includes individuals who have featured in investigations over the past almost two decades of counterterrorism cases in the United Kingdom. Some are individuals who were on the fringes of plots; others are those who have been charged, convicted, served their sentences, and are now free once again. However, due to their observed activity, they are not deemed to be current priorities and have therefore been relegated by security services who instead focus their attention on those who have been demonstrating a higher level of alarming activity or potential attack planning. Given limitations in security services resources, only about 3,000 individuals can be focused on, and while the others are not forgotten, they are allocated a lower prioritization.75

In the wake of the two London and Manchester attacks, questions are being raised about whether this prioritization has been accurately calibrated.76 After the London Bridge attack, Prime Minister May stressed police and the Security Service MI5 would be reviewing their methods and more generally “how the terror threat is evolving, the way that terrorism is breeding terrorism and the increased tempo of attacks … in a way we haven’t seen before.”77 It has been reported that after the Manchester bombings, Britain’s security services began reevaluating the risk level of individuals categorized as former subjects of interest. One idea reportedly under consideration is to create systems for counterterrorism agencies to share information about former subjects of interest with the broader police force, taking advantage of the general police’s greater numbers of eyes and ears inside local communities. “It’s that wider cohort [of 20,000] that we have to keep an eye on as well; to see if any of them that reactivate, so to speak, and become dangerous again,” Mark Rowley, head of National Counter Terrorism Policing, stated in an interview earlier this month. “We’re going to have to improve what we do, but it is going to take a whole system effect—not simply counter terrorist specialists and MI5, but local policing, councils, and the public—to be able to deal with something which is becoming more of a cultish movement and less of a small terrorist organisation.”78

The U.K. threat picture is populated with seemingly disparate cells of individuals or clusters who are in some cases receiving direction from abroad through encrypted applications or social media, but in many cases are made up of perpetrators, as Prime Minister May stated, “inspired to attack not only on the basis of carefully constructed plots after years of planning and training—and not even as lone attackers radicalized online—but by copying one another and often using the crudest of means of attack.”79 The fact that the United Kingdom is also grappling with a threat from right-wing and anti-Muslim extremism risks provoking the sort of social tensions the Islamic State has long hoped would boost its appeal in the West.

It is, of course, still early days in the investigations into the London Bridge and Manchester attacks. It is possible more will be uncovered to show their connectivity to wider networks and plots. The plotting activity observed so far in 2017 points to a deeply diffuse and complicated threat picture in the United Kingdom, which is causing security services to revisit their methodologies and leading to arrests at increasingly early stages of the attack cycle. This can complicate subsequent convictions, but it is an imperative at a time when many plots are being carried out through low-tech means already in most citizens’ possession—cars and knives—and at a time when the flash-to-bang in plots can be counted in days rather than years.

Atop this complex domestic picture is the potential threat posed by the growing number of British jihadis who are expected to be returning home from Syria and Iraq. Exact numbers are impossible to know, but with hundreds already back,e authorities are already bracing themselves for an even more challenging threat environment when these battle-hardened veterans and their families return.     CTC

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Follow @raffpantucci

Substantive Notes
[a] This certainly seems to have been the case in the subsequent anti-Muslim terrorist attack launched by Darren Osborne, a 47-year-old who drove a van into the crowd outside Finsbury Park mosque on the morning of June 19, killing one. A long-troubled individual, Osborne was reported by neighbors to have been incensed by the London Bridge attack. No evidence has publicly surfaced that he was linked to extreme right groups. And it is suspected that Osborne may have intended to strike an al-Quds, pro-Palestine march through central London earlier in the day, but had been too late and chose the mosque instead. Osborne was reported to have been raving drunkenly at a local pub the night before the attack and to have been flagged to police as drunk and asleep in his vehicle later the same evening. Martin Evans, Ben Farmer, Hayley Dixon, and Hannah Furness, “Finsbury Park terror suspect ‘planned to attack’ Muslim march in London but was too late, it is claimed,” Telegraph, June 20, 2017.

[b] The four were charged on May 25. One was not charged with terror offenses but instead for seeking to “possess any firearm or imitation firearm with intent to cause fear of violence.” “Update: Four charged following Counter Terrorism investigation,” Metropolitan Police press release, May 25, 2017.

[c] The most disturbing aspect of the plot was that three of the plotters had been convicted and served time for previous terrorism offenses. Two of those convicted, Naweed Ali and Khobaib Hussain, had been previously arrested for going to training camps in Pakistan. They were also linked to a cell arrested in 2011 in Birmingham that was seeking to launch an al-Qa`ida-directed attack in the United Kingdom and helping others get to training camps in Pakistan. Mohibur Rahman, the third convicted “Musketeer,” had been previously convicted for possession of extremist material. He was initially arrested as part of a cell that pleaded guilty of plotting in 2010 to bomb the London Stock Exchange. The three “Musketeers” had met and re-radicalized during their prison sentences, raising questions around prison radicalization. “Operation Pitsford: The 11 men,” BBC News, April 26, 2013; “Terrorism gang jailed for plotting to blow up London Stock Exchange,” Telegraph, February 9, 2012; “Three Musketeers’ guilty of planning UK terror plot,” BBC News, August 2, 2017; Dominic Casciani, “Birmingham terror plot: Inside the sting that caught four jihadis,” BBC News, August 2, 2017.

[d] The issue of prioritization is also key in several other Western countries facing a significant threat, including the United States. For example, Orlando nightclub shooter Omar Mateen had been the subject of an FBI counterterrorism investigation, but the case was closed before he carried out the attack. Matt Apuzzo and Eric Lichtblau, “After FBI’s Enquiry into Omar Mateen, A Focus on What Else Could Be Done,” New York Times,June 14, 2016.

[e] While there are no official figures, most reports say that some half of the 850 U.K. nationals reported to have gone to Syria and Iraq have returned home. Martin Chulov, Jamie Grierson, and Jon Swaine, “ISIS faces exodus of foreign fighters as its ‘caliphate’ crumbles,” Guardian, April 26, 2017.

Citations
[1] Cressida Dick, “Commissioner gives key note speech at Mansion House,” MetPolice Blog, July 20, 2017.

[2] Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel9:3 (2016).

[3] Ibid.

[4] Matthew Weaver, “UK police have thwarted Paris-style terror plots, top officer says,” Guardian, March 6, 2017.

[5] Matt Dathan, “David Cameron to recruit 2,000 new spies amid claims UK foiled seven terror attacks in six months,” Independent, November 16, 2015.

[6] “Car used in Westminster terror attack was hired from Enterprise in Spring Hill,” Birmingham Updates, March 23, 2017.

[7] Ewan MacAskill, “Westminster attacker acted alone and motive may never be known, say police,” Guardian, March 25, 2017.

[8] Chris Johnston, “All 12 people arrested over Westminster attack released without charge,” Guardian, April 1, 2017.

[9] “Killer Khalid Masood left jail a Muslim, says childhood friend,” Press Association, March 25, 2017.

[10] Alice Ross, “Westminster attacker had record of increasingly violent attacks,” Guardian, May 15, 2017.

[11] Rowena Mason, “Theresa May’s statement – key extracts,” Guardian, March 23, 2017.

[12] “Four ‘planned to bomb Territorial Army base’ with toy car,” BBC NewsApril 15, 2013.

[13] Xantha Leatham and Omar Wahid, “Westminster terror attacker was radicalised in Birmingham in the past 12 months, sources claim,” Mail on Sunday, April 2, 2017.

[14] Kim Sengupta, “Last message left by Westminster attacker Khalid Masood uncovered by security agencies,” Independent, April 27, 2017.

[15] Vikram Dodd, “Westminster attack: Masood did act alone, police conclude,” Guardian, April 13, 2017.

[16] Robert Booth, “Westminster attacker Khalid Masood had interest in jihad, say police,” Guardian, March 27, 2017.

[17] Nick Hudson, “Manchester suicide attack: Abedi bought most bomb parts ‘himself,’” Policeprofessional.com, May 31, 2017.

[18] Paul Cruickshank, “London attack ringleader was under active investigation at time of assault,” CNN, June 8, 2017; C.J. Chivers, “Found at the Scene in Manchester: Shrapnel, a Backpack and a Battery,” New York Times, May 24, 2017.

[19] “Threat levels,” Security Service, MI5.

[20] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say,” Telegraph, July 6, 2017; Neal Keeling, “Police suspect others were involved in Manchester Arena attack – and may make further arrests,” Manchester Evening News, July 6, 2017.

[21] Joe Thomas, “Manchester Arena bomber visited terror convict in Liverpool prison,” Liverpool Echo, June 25, 2017.

[22] Andy Hughes, “Manchester suicide bomber Salman Abedi linked to key UK IS recruiter,” May 25, 2017.

[23] Nazia Parveen, “Bomber’s father fought against Gaddafi regime with ‘terrorist’ group,” Guardian, May 24, 2017; Jonathan Ungoed-Thomas and Dipesh Gadher, “Salman Abedi: the Manchester killer who was bloodied on the battlefields of Libya and brought evil back home,” Sunday Times, May 28, 2017.

[24] “Otac teroriste iz Mancestera bio kod mudzahedina u BiH,” Glas Srpske, May 31, 2017.

[25] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say.”

[26] Bel Trew, “Salman Abedi’s brother bought parts for Manchester bomb,” Times, June 9, 2017; “Manchester bomber’s brother and father arrested in Tripoli,” Libya Herald, May 24, 2017; Laura Smith-Spark and Hala Gorani, “Manchester suicide bomber spoke with brother 15 minutes before attack,” CNN, May 26, 2017.

[27] Josie Ensor, “Manchester bomber’s brother was ‘plotting attack on UN envoy in Libya,’” Telegraph, May 27, 2017.

[28] “Latest Statement from Detective Chief Superintendent Russ Jackson, Greater Manchester Police,” June 11, 2017. The statement is available at https://twitter.com/gmpolice/status/873926655059927041 and https://twitter.com/gmpolice/status/873926742553112578; Lizzie Dearden, “Salman Abedi travelled through Turkey and Germany four days before launching Manchester suicide attack,” Independent, May 25, 2017.

[29] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[30] SITE Intel Group, “#ISIS releases English-language version of claim for #Manchester bombing,” Twitter, May 23, 2017.

[31] “Terror ringleader ‘tried to hire 7.5 tonne lorry hours before London attack,’” ITV News, June 10, 2017.

[32] “London attack: What happened where in eight minutes of terror,” Sky News, June 5, 2017.

[33] Ralph Blackburn, “London Bridge terrorist Khuram Butt taught primary school children in Ilford,” Barking and Dagenham Post, August 2, 2017.

[34] Richard Kerbaj, “Jihadi Sid told sister: I’ll die for ISIS,” Sunday Times, January 10, 2016.

[35] “The Jihadis Next Door,” Channel 4; Vikram Dodd, Matthew Taylor, Alice Ross, and Jamie Grierson, “London Bridge attackers were regulars at Sunday afternoon pool sessions,” Guardian, June 7, 2017.

[36] Fiorenza Sarzanini, “L’Italia segnalo il killer di Londra fermato a Bologna per terrorismo,” Corriere della Sera, June 6, 2017.

[37] Ibid.

[38] “Update: London Bridge terror attack investigation,” Metropolitan Police press release, June 16, 2017.

[39] Sarah Knapton, Martin Evans, Nicola Harley, Harry Yorke, Ben Farmer, and Robert Mendick, “Khuram Butt, Rachid Redouane and Youssef Zaghba named: Everything we know about the London Bridge terrorists,” Telegraph, June 6, 2017.

[40] Paul Cruickshank and Nic Roberts, “London ringleader Khuram Butt was intensely investigated,” CNN, June 6, 2017.

[41] “Appeal for information on knives used in London Bridge terrorist attack,” Metropolitan Police Press Release, June 9, 2017.

[42] Dodd, Taylor, Ross, and Grierson.

[43] Neil Johnston, Georgie Keate, John Simpson, and Katie Gibbons, “Police were warned two years ago that gym was ‘training jihadists,’” Times, June 9, 2017.

[44] Francesca Gillet, “London attack: ISIS claims responsibility for London Bridge horror which left seven dead, Islamist State media agency confirms,” Evening Standard, June 4, 2017.

[45] Raffaello Pantucci, “Al-Muhajiroun’s European Recruiting Pipeline,” CTC Sentinel 8:8 (2015).

[46] Ruth Sherlock, “British man who joined Islamic State to skip bail ‘killed’ in Syria,” Telegraph, July 5, 2015.

[47] Dipesh Gadher, “Housing benefit funds family’s dash to ISIS,” Sunday Times, March 19, 2017.

[48] Josh Barrie, “The Giant: Second British extremist ‘identified in ISIS video,’” Independent, January 17, 2017.

[49] C vs. HM Treasury, before The Hon Mr Justice Cranston, judgment handed down August 5, 2016.

[50] Rumiyah 10, June 2017.

[51] “PM statement following London terror attack,” Downing Street press release, June 4, 2017.

[52] Damien Gayle and Jamie Grierson, “London attack: Khuram Butt’s family stopped him going to Syria, says cousin,” Guardian, June 8, 2017.

[53] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[54] Rukmini Callimachi, “Manchester Bomber met with ISIS unit in Libya, Officials say,” New York Times, June 3, 2017.

[55] Saim Saeed, “French interior minister: Salman Abedi had ‘proven’ links with Islamic State,” Politico, May 24, 2017.

[56] Fiona Hamilton and Alexi Mostrous, “Manchester Arena killer Salman Abedi used YouTube to build bomb,” Times, June 24, 2017.

[57] “London Bridge attack latest: Terrorists named as police say they were not under surveillance as they posed ‘low risk,’” Telegraph, June 6, 2017.

[58] Paul Cruickshank, “Orlando shooting follows ISIS call for U.S. Ramadan attacks,” CNN, June 13, 2016.

[59] “UK security services have thwarted five plots since March Westminster attack: source,” Reuters, May 25, 2017.

[60] Darren Campbell, “Two arrested in Alum Rock Road charged with multiple terror offences,” Birmingham Mail, April 5, 2017.

[61] Charlotte Paxton, “Birmingham wife of alleged extremist is charged with terror offenses,” Birmingham Mail, April 25, 2017.

[62] Vikram Dodd, “Teenage girl accused in court of plotting terror attack in UK,” Guardian, July 26, 2017.

[63] Martin Evans, “Westminster terror suspect appears in court charged with bomb making offences,” Telegraph, May 10, 2017.

[64] “Willsden shooting: Police foil ‘active terror plot,’” BBC News, April 28, 2017.

[65] Dipesh Gadher, Robin Henry, Rebecca Myers, and Luke Mintz, “Banned Saudi preacher link to raided ‘house of terror,’” Sunday Times, April 30, 2017.

[66] Danny Boyle, “Mother and daughter in terror plot case ordered to lift veils by magistrate who demands to see their eyes,” Telegraph, May 11, 2017.

[67] Steve Robson and Rachel Burnett, “Three men ‘plotted London terror attack involving car bomb driven through Westminster Bridge inspired by Khalid Masood atrocity,’” Mirror, May 27, 2017.

[68] “Man arrested in east London charged with terror offences,” Metropolitan Police press release, June 20, 2017, and “Terror suspect viewed London Bridge attack material before arrest,” Court News UK, June 21, 2017.

[69] Ben Farmer and James Badcock, “Birmingham counter-terror arrest: Alleged ‘spiritual leader’ of Majorca-based cell is held,” Telegraph, June 28, 2017.

[70] Fernando J. Perez, “Uno de los yihadistas detenidos en Mallorca planeo una ‘matanza’ en Inca,” El Pais, June 30, 2017.

[71] “Erol Incedal: terror accused enjoyed billionaire’s lifestyle secret trial files reveal,” Telegraph, December 11, 2015.

[72] Tom Whitehead, “Erol Incedal jailed for three-and-a-half years over bomb-making manual,” Telegraph, April 1, 2015.

[73] See Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel 9:3 (2016).

[74] “23,000 people have been ‘subjects of interest’ as scale of terror threat emerges after Manchester attack,” Telegraph, May 27, 2017; Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism,” Metropolitan Police, August 11, 2017.

[75] Dominic Casciani, “Manchester attack: The bewildering complexity of a terror inquiry,” BBC News, May 25, 2017; Sean O’Neill, “Spies gather to focus on biggest threats,” Times, June 8, 2017.

[76] Francis Elliott and Sean O’Neill, “May tells MI5 to ‘keep up’ with changing terror threat,” Times, June 5, 2017.

[77] Rowena Mason, “MI5 to review handling of London Bridge attack, says Theresa May,” Guardian, June 6, 2017.

[78] Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism.”

[79] “PM statement following London terror attack.”

A new piece for the CTC Sentinel looking at recent terrorist attack planning in the UK, trying to identify the specific nature of the threats. For the most part, there has been little evidence at trial of direct attack planning though it certainly is something that lurks in the background of a couple. Undoubtedly a topic there will sadly be more on as time goes forwards.

The Islamic State Threat to Britain: Evidence from Recent Terror Trials

March 17, 2016

Author(s): Raffaello Pantucci

While clearly at the top of the Islamic State’s targeting list, the United Kingdom so far has been spared from any major terrorist atrocities at home with direct links to the Islamic State. A review of the trials of those accused of terrorist plotting in the country between 2013 and 2015 reveals that the violent Islamist threat picture has instead been dominated by lone-actor plots, with some demonstrating connections of some sort to individuals on the battlefield in Syria or Iraq. Going forward, however, the threat is likely to become more acute as the Islamic State pivots toward international terror.

In the wake of November’s terrorist attack in Paris, a series of Islamic State videos suggested the United Kingdom was next on the target list.[1] For British officials, the threat was not new. As British Prime Minister David Cameron put it days after the Paris attack, “Our security services have stopped seven attacks in the last six months, albeit on a smaller scale.”[2] Earlier this month, Assistant Commissioner Mark Rowley, who oversees counterterrorism efforts for the London Metropolitan Police, warned, “In recent months we’ve seen a broadening of that—much more plans to attack Western lifestyle, going from that narrow focus on police and military as symbols of the state to something much broader. And you see a terrorist group which has big ambitions for enormous and spectacular attacks, not just the types that we’ve seen foiled to date.”[3]

This article takes stock of the threat to the United Kingdom, drawing on court documents of recent British terror trials of those accused of plotting between 2013 and 2015. Currently, most of the cases that have passed through Britain’s courts have not shown clear evidence of Islamic State direction, though the plots covered in these cases for the most part predate the group’s active surge of international plotting last year that culminated in the Paris attacks in November. Up to this point, most plotting seen in the United Kingdom appears to demonstrate an ideological affinity to the Islamic State, with most plots fitting the lone-actor model and having no clear command and control from Islamic State operatives in Syria and Iraq. Going forward, however, security officials see a growing, direct threat from the Islamic State, with Richard Walton, the former head of the Metropolitan Police’s Counter-terrorism Command, stating in January, “We are concerned about Daesh’s external ambitions to project their terror overseas rather than them just trying to consolidate their so-called caliphate.”[4][a]

Alleged Instigation Overseas: The Erol Incedal Case 
In October 2013, as part of a series of coordinated arrests, four men were detained for allegedly plotting to launch a “Mumbai-style” attack in London. Two men were released soon afterward while Erol Incedal, a British passport holder of Turkish-Alawite descent, and Mounir Rarmoul-Bouhadjar, a British-Algerian were brought to trial. Rarmoul-Bouhadjar pleaded guilty to possession of a bomb-making manual and was sentenced to three years in prison while Incedal instead chose to fight the charges against him. In a first for the British judicial system, the trial was held partially under secret circumstances for reasons that were not publicly revealed.

The public part of this trial shed light on the accused’s travels and contacts. In late 2012 the two men tried to reach Syria through Turkey. Rather than getting across the border, however, they ended up in a safe house in Hatay full of people “engaged somewhat in the resistance against Assad.”[5] Here they met “Ahmed,” a British-Yemeni extremist who would become a key figure in the prosecution’s case. Ahmed had spent time in France, and he claimed to have fled to the Syrian-Turkish border area as he felt under pressure from security services in the United Kingdom. In court, Incedal described him as having ‘“sympathies with the global jihad”[6] though Incedal was also quick to highlight that he was angry at the West since some of his family members had reportedly been killed in drone strikes in Yemen.

By early March Incedal and Rarmoul-Bouhadjar were bored of the inactivity at the safe house and told Ahmed they were going to head back to the United Kingdom. According to Incedal, Ahmed told them, ““Bruv, you know, you are going back, I wish, you know, you could do something in the UK” do some – he actually said “shit,” “do some shit in the UK, blow these guys up” and, you know, basically do an attack in the UK.””[7] In court Incedal stated that Ahmed’s view was not shared by all in the safe house. “The majority of the people there were thinking more specific to Syria and not worried about the West,” he testified. Nevertheless, Ahmed apparently saw value in the men back in the United Kingdom, telling them, “It would be nice to keep in touch and maybe you can help us in this global cause in the U.K.”[8]

Once back in the United Kingdom, the men entered into a world of semi-criminal activity and partying. An Azerbaijani friend named Ruslan who was connected to wealthy Azeris provided them with an entrée into London’s high life. Incedal appears to have been close to the sons of the Egyptian extremist cleric Abu Hamza, who, according to Incedal, were now involved in post office robberies “because their father [had] given them the right to do it.”[9] Incedal appears to have considered ways of working with them and of raising money to buy guns for protection during drug deals.[10] During this time, Incedal appears to have maintained contact with Ahmed (who was either in Turkey or Syria) through Skype conversations during which they discussed sourcing weapon “straps,” getting detonators sent to the United Kingdom from Syria, and whether Rarmoul-Bouhadjar still remembered any bomb-making training he had received at the safe house.[11]

In the end the jury cleared Incedal of the charges of plotting a terrorist attack, he was found guilty of possessing a bomb-making manual and sentenced to three-and-a-half years in prison.[12] Rarmoul-Bouhadjar, who had pleaded guilty to the same charge, served some time in prison and was discharged on restrictive release.

In the second half of 2014, British authorities disrupted several separate plots involving attack planning. The missing element from this cluster of cells, however, was clear direction from the Islamic State, though there were clear sympathies.

Stay-at-Home Jihadi: The Brusthom Ziamani Case
The first of these cases was that of Brusthom Ziamani, an 18-year-old extremist known as Mujahid Karim, from Peckham in south London. Raised a Jehovah’s Witness, Ziamani was thrown out of his family’s home after converting to Islam. He subsequently moved (or moved deeper) into the orbit of al Muhajiroun, a British extremist grouping supportive of the Islamic State. In June 2014 he was arrested on an unrelated charge, and during a search of his belongings police found a letter addressed to his parents in which he declared:

“Because I have no means ov gettin there [Syria and Iraq] I will wage war against the british government on this soil the british government will have a taste ov there own medicine they will be humiliated this is ISIB Islamic States of Ireland and Britain.”[13]

Under interview he confirmed that the letter was his but denied he was planning an attack in the United Kingdom. He praised Michael Adebolajo and Michael Adebowale, the murderers of the British soldier Lee Rigby in Woolwich in May 2013, and stated that the letters were “written in case he went abroad and died fighting there, or if the U.K. became an Islamic state, in which case he would join in the uprising.[14] He was bailed, and officials working in the British government’s deradicalization program “Prevent” repeatedly tried to engage him to see if he could be moved off a path of violent extremism. These efforts failed, and Ziamani continued to seek out radical material online. On the morning of August 19 he appeared at his ex-girlfriend’s house with a black backpack in which he showed her he had a large knife, a hammer, and an Islamic flag. He told her, “Me and the brothers are planning a terrorist attack,” though not a bombing. “No, not like that, basically to kill soldiers.”[15]

Later that afternoon police stopped him as he was walking in the street in East London. Searching his belongings, they found his weapons and took him into custody, charging him with terrorist offenses. Months later he told a security officer in prison that he “loved” Michael Adebolajo and had handed out leaflets with him. He also confessed, “I was on my way to kill a British Soldier at an army barracks. I was going to behead the soldier and hold his head in the air so my friend could take a photograph.”[16] There was no evidence provided that Ziamani had any co-conspirators, though in passing a 22-year sentence, Justice Pontius stated that “he had little doubt that, like Adebolajo and Adebowale before him, he fell under the malign influence of al-Muhajiroun fanatics who were considerably older, and had been immersed in extremist ideology far longer, than him but he was, nevertheless, a willing student and all too ready to absorb and adopt their teaching.”[17]

The Power of the Fatwa: The Tarik Hassane Case 
In the second plot disrupted, police arrested a cluster of young men in West London in late September and early October 2014. Over a year later in January 2016, the trial began for four of the men arrested for planning to shoot a security officer with a Baikal gun and silencer that they had procured. The plot was alleged to have started on July 9, 2014, when one of the alleged co-conspirators—Tarik Hassane, then based in Sudan—announced to a Telegram group that some of the men were part of that he had made bay`a to Abu Bakr al-Baghdadi.[b]

Soon after this, Hassane came back to the United Kingdom via Jordan, and planning for an attack appears to have intensified. The group started to discuss obtaining something from “Umar,” later identified as Nyall Hamlett, a man currently on trial who was identified as being involved in London’s criminal fraternities and had access to weaponry. Using all sorts of coded references, Hassane, Suhaid Majeed (an accused co-conspirator also still being tried who was studying physics at King’s College in London), and others discussed trying to obtain “straps” or “creps.” They looked for a garage in Shepherd’s Bush using an online rental manager.[18] They also sought to obtain a moped.[19] By September 21, with Hassane still in Sudan, the group appears to have finally been close to obtaining a gun. Majeed told the group to “make serious dua [prayer] for me,” which the prosecution suggested was the moment at which the group knew they were obtaining their weapon.[20]

A day after senior Islamic State figure Muhammad al Adnani released his infamous fatwa calling on followers around the world who had pledged bay`a to kill disbelievers “in any manner” wherever they can find them, Majeed went through an elaborate transaction to obtain a Baikal gun, ammunition, and a silencer.[21] Once home, he searched for videos about how to handle the weapon on YouTube and spoke to his friends abroad. Not wanting to take any chances, British police moved in to arrest all of the individuals under surveillance. As Majeed’s parent’s property was being searched by armed police a gun and equipment were tossed out of the window.[22] During the search of co-defendant Nathan Cuffy’s premises they found a series of four different guns and ammunition.[23]

All of this activity was taking place as Hassane was still abroad. On September 30 he returned home and was arrested soon afterward. Hassane pleaded guilty to the charges against him, while the other three continue to fight their charges.[24]

Frustrated Travelers: The Nadir Syed Case 
The al-Adnani fatwa also provided an inflection point for a third plot disrupted in the second half of 2014. The alleged co-conspirators, Haseeb Hamayoun and cousins Nadir Syed[c] and Yousaf Syed, were all from London and of Pakistani origin. The story of their plot begins in December 2013 when Nadir Syed was arrested for public order incidents and released under strict bail conditions.[25] In breach of these, on January 19, 2014, he was stopped from boarding a plane trying to travel to Turkey, alongside his cousin Yousaf and a third man, Luqman Warsame. While Nadir was prevented from traveling, Yousaf and Warsame continued their journey. Yousaf Syed returned after spending some time in Turkey, but Warsame joined the Islamic State in Syria, from where he remained in contact with the two Syeds.[26] Warsame’s current status is unclear. Yousaf Syed was stripped of his freedom to travel in April 2014. Nadir Syed also remained stuck in the United Kingdom, but in October 2014 he applied for a new passport from the Home Office.[27]

Like Ziamani, the group appears to have had a fixation with the murder of Lee Rigby and knives. Evidence was introduced at trial of Nadir Syed talking to others about the two Woolwich killers in 2013. Also introduced into evidence were the trio’s September 2014 WhatsApp conversations in which they shared images of the Woolwich attackers and their activity.[28] In the wake of an attack in Australia on September 23, 2014, in which Numan Haider, a Melbourne teenager tried to stab a pair of policemen after his passport was canceled and was instead shot by the officers,[29] the men praised the attempt and compared it to Michael Adebolajo, praising Adebolajo as a “diamond geezer” in their discussions.[30] After a court appearance by Nadir Syed on November 6, 2014, for his public order offense charges, Haseeb Hamayoun met him outside the courtroom and the men seem to have gone straight to a kitchen shop.[31] Soon after this, authorities decided to intervene, and all three men were arrested separately later that same day.

In the end, the court was unable to reach a conclusion about Hamayoun and Yousaf Syed, though Nadir was found guilty of planning to murder a security official around Remembrance Day with a knife.[32] Hamayoon and Yousaf Syed face a retrial.[33] The reasoning behind Nadir Syed’s plot is best discerned from Nadir’s online commentary after Adnani’s September 2013 fatwa: “These governments need to rethink their policy…esp after Adnani’s speech, why the hell would you let an ISIS supporter stay here….in other words the muslim in the west is left with two choices, either turn back from your deen or end up in jail,” he stated.[34]

Other Cases: The Disconnected, the Very Young, and the Isolated 
The fourth plot thwarted in the second half of 2014 was that of Kazi Islam, the nephew of Kazi Rahman, a former jailed terrorist linked to the 7/7 cell. Arrested in November 2014, Islam was jailed in May 2015 for “grooming” another young man to try to build a bomb or conduct a terrorist attack. An apparent attendee of al Muhajiroun lectures, Islam was undone when the 18-year-old he was spurring on to launch an attack failed to get the right materials to build a bomb and told friends about the plan.[35] Although the exact nature of the plot is not entirely clear, Islam appears to have been pushing the boy to build bombs, obtain knives, and think about targeting security officials.[36]

In late March 2015 police in northwest England arrested a 14-year-old boy from Blackburn after he threatened to behead his teachers, accusing him of being involved in instigating a terrorist plot in Australia linked to attacking a security official on Australia’s day of remembrance, Anzac Day. The boy was accused of talking to Australian Sevdet Besim, a radicalized teenager who was part of a larger community of concern in Australia and spurring him on “to run a cop over or the anzac parade & then continue to kill a cop then take ghanimah and run to shahadah?”[37] Besim was further connected to Numan Haider, the Melbourne teen shot by police in September 2014.[38] While the exact role of Islamic State behind this network is unclear, the group was all connected to the now-deceased[39] Neil Prakash, a notorious Australian jihadi fighting alongside the group in Syria also known as Abu Khaled al Kambodi.[40] The boy was found guilty, becoming the youngest convicted terrorist in the United Kingdom.[d]

The shambolic nature of Kazi Islam’s November 2014 “grooming” plot was matched in May 2015 when police arrested the married couple Mohammed Rehman and Sana Ahmed Khan after Mohammed Rehman tweeted from his Twitter account,[e] “Silent Bomber,” the question “Westfield shopping center of London underground? Any advice would be greatly appreciated.”[41] The question—seeking suggestions about which target he should attempt to attack—caught the attention of authorities. Investigators uncovered Mohammed Rehman, an unemployed drug addict still living with his family. His wife, Sana Khan, also lived at home with her parents who disapproved of Rehman. The two decided that they wanted to launch a terrorist attack against the London Underground or a shopping center, with Rehman seeking chemicals online to detonate a bomb while Khan provided the funding. The couple discussed bomb tests, and Rehman eventually tested a bomb in his backyard. Two weeks after they were detected online, the couple was arrested, and after a short trial, they were given life sentences.[42]

In neither case was there any clear evidence of direction by a terrorist group overseas or links to any other plots. Both appear to be fairly classic, disconnected lone-actor plots with the only clear connections to the Islamic State being either through consumption of radical material (magazines like Dabiq), statements of intent to join the group (which apparently Kazi Islam made to his friends), or a letter that Rehman left pledging his allegiance to Abu Bakr al-Baghdadi.[43]

Alleged Communication with the Islamic State: The Junead and Shazib Khan Case 
An alleged plot targeting the RAF Lakenheath airbase, home of the U.S. Air Force 48th fighter wing, disrupted in July 2015 was more clearly linked to external networks, though any degree of external direction is unclear and the trials are ongoing.[44] Junead Khan and his uncle Shazib Khan (the two were so close in age, they refered to each other as cousins) from Luton are currently standing trial for planning to join the Islamic State, with Junead also accused of wanting to launch an attack in the United Kingdom against “military personnel” at military bases in Lakenheath or Molesworth.[45] Junead apparently knew and admired another local Luton man who had gone to fight (and was subsequently killed) named Rahin Aziz.[46] The men were allegedly in contact with a number of fighters in Syria, including the notorious British Islamic State operative Junaid Hussain who allegedly told Junead via the encrypted messaging app Surespot that “I can get u addresses but of British soldiers” and that “I can tell u how to make a bomb.”[47] There was further evidence presented at trial from his computer and phone that he was seeking instructions on how to make explosives. The case is ongoing and is due to conclude next month.

Conclusion
Since the emergence of the Islamic State as a major terrorist force in the Middle East, there has not been clear-cut evidence presented at trial of plots being directed by the leadership of the Islamic State against the United Kingdom. The cases formally prosecuted through the courts all suggest a threat picture that remains dominated by lone-actor terrorism, in some cases inspired by the Islamic State. The United Kingdom has also seen plots by extremists blocked from traveling to join the Islamic State, something also seen in Australia and Canada.[f]

The trials have not yet revealed clear direction by the group against the United Kingdom. There have been reports that Islamic State recruiters are seeking out Europeans with links to Germany or the United Kingdom to help facilitate attacks there,[48] but thus far, the evidence offered in courts is not as clear cut. Security authorities certainly see an escalating threat, something reflected in Assistant Commissioner Rowley’s warning that British authorities fear a spectacular Paris-style attack.

While the nature of the threat in the United Kingdom is different than in France in certain respects —for example, there is easier access to heavy weaponry and ammunition on the European continent—the Islamic State itself has made clear that the United Kingdom is a priority target. Until now the public threat picture has been dominated by lone-actor plots. Going forward, however, with the Islamic State appearing to pivot toward international terrorism and around 1000 British extremists having traveled to Syria and Iraq, half of whom are still there,[49] there is a growing danger of Islamic State-directed plots against the British homeland.

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Follow @raffpantucci

Substantive Notes
[a] The British government refers to the Islamic State as Daesh.

[b] Hassane went on to post his pledge in full: statement that showed “that I, poor servant of Allah, Tariq Hassan (sic), swear allegiance to the Amir of [leader] of the faithful, Abu Bakr al-Baghdadi, Abullah Ibrahim ibn Awad al-Quraishi al-Husseini, Caliph of the Muslims, he owes me to listen and obey him through thick and thin as much as I can.” Regina vs Tarik Hassane et al, January 15, 2016, p. 26.

[c] Nadir Syed was part of the broader community around the al Muhajiroun community in the U.K., most clearly as part of a WhatsApp group called ‘the lads’ with prominent figures Abu Waleed and Abu Haleema. See Lisa O’Carroll, “Man convicted of planning Isis-inspired Remembrance Sunday attack,” Guardian, December 14, 2015.

[d] He received a life sentence with a review in five years to see if he had been de-radicalized prior to him ascending into the adult prison population. “Anzac Day terror plot: Blackburn boy sentenced to life,” BBC News, October 2, 2015.

[e] His Twitter account profile photo was an image of Islamic State executioner “Jihadi John.”

[f] The Australian case was the aforementioned case of Numan Haider. In Canada, Quebec attacker Martin Couture-Rouleau was blocked from traveling to join the Islamic State, and Ottawa shooter Michael Zehaf-Bibeau was blocked from traveling to the region. See Allan Woods, “How Martin Couture-Rouleau became an aspiring Islamic State fighter,” Star, October 26, 2015; “How Michael Zehaf-Bibeau went from petty criminal to the face of homegrown terrorism,” National Post, November 7, 2014.

Citations
[1] Raya Jalabi, “Isis video threatening UK claims to show Paris attackers in Syria and Iraq,” Guardian, January 25, 2016.

[2] David Cameron interview with BBC Radio 4 Today program, November 16, 2015.

[3] Vikram Dodd, “Isis planning ‘enormous and spectacular attacks’, anti-terror chief warns,” Guardian, March 7, 2016.

[4] Paul Cruickshank, “A View from the CT Foxhole: An Interview with Richard Walton, Head, Counter Terrorism Command, London Metropolitan Police,” CTC Sentinel 9:1 (2016).

[5] Regina vs Incedal and Rarmoul-Bouhadjar, March 11, 2015, p. 13.

[6] Regina vs Incedal and Rarmoul-Bouhadjar, March 11, 2015, p. 16.

[7] Regina vs Incedal and Rarmoul-Bouhadjar, March 11, 2015, p. 41.

[8] Regina vs Incedal and Rarmoul-Bouhadjar, March 11, 2015, p. 49.

[9] Regina vs Incedal and Rarmoul-Bouhadjar, March 13, 2015, p. 49.

[10] Regina vs Incedal and Rarmoul-Bouhadjar, March 12, 2015, p. 41.

[11] Regina vs Incedal and Rarmoul-Bouhadjar, March 12, 2015, pp. 7-8.

[12] “Erol Incedal Jailed for 42 months over bomb-making manual,” BBC, April 1, 2015.

[13] (Typos as rendered in the document) Regina vs Ziamani, February 9, 2015, p. 4.

[14] Regina vs Ziamani, February 9, 2015, p. 6.

[15] Regina vs Ziamani, February 9, 2015.

[16] Regina vs Ziamani, February 9, 2015.

[17] Regina vs Brusthom Ziamani, Sentencing remarks of HHJ Pontius, Central Criminal Court, March 20, 2015.

[18] Regina vs Tarik Hassane et al., January 15, 2016, p. 68.

[19] Regina vs Tarik Hassane et al., January 15, 2016, p. 69.

[20] Regina vs Tarik Hassane et al., January 15, 2016, p. 87.

[21] Regina vs Tarik Hassane et al., January 15, 2016, p. 95.

[22] Regina vs Tarik Hassane et al., January 15, 2016, p. 101.

[23] Regina vs Tarik Hassane et al., January 15, 2016, p. 109.

[24] Sebastian Mann, “Terror accused have told ‘buffed and polished’ lies to mask guilt, court hears,” Evening Standard, March 8, 2016.

[25] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 6.

[26] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 9.

[27] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 9.

[28] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 11.

[29] Melissa Davey, “Police had no choice but to shoot Numan Haider, inquest hears,” Guardian, March 7, 2016.

[30] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 21.

[31] Regina vs Hasib Hamayoon et al., October 8, 2015, p. 34.

[32] Lisa O’Carroll, “Man convicted of planning Isis-inspired Remembrance Sunday attack,” Guardian, December 14, 2015.

[33] Tom Whitehead, “Extremists allowed to leave UK to ease home terror threat,” Telegraph, December 15, 2015.

[34] Regina vs Hasib Hamayoon et al., October 8, 2015, p.20.

[35] Duncan Gardham and Amanda Williams, “Teenage Islamic terrorist who groomed man with learning difficulties to carry out Lee Rigby-style attack on British soldier is jailed for eight years,” Daily Mail, May 29, 2015.

[36] Ibid.

[37] “Anzac Day terror plot: Blackburn boy sentenced to life,” BBC News, October 2, 2015.

[38] Dan Oakes, “Numan Haider inquest: Anzac Day terror accused Sevdet Besim called to give evidence,” Australia Plus, March 7, 2016.

[39] Joshua Robertson, “Neil Prakash, Australia’s most senior operative in Islamic State, reported dead,” Guardian, January 31, 2016.

[40] Oakes.

[41] Regina vs Mohammed Rehman and Sana Ahmed Khan, November 14, 2015.

[42] Tom Whitehead, “7/7 suicide bomb plot couple jailed for life,” Telegraph, December 30, 2015.

[43] Tom Whitehead and David Barrett, “Middle class daughter of magistrate who turned to suicide bomb plotter,” Telegraph, December 30, 2015.

[44] “Man allegedly planned Lee Rigby-style attacks on US soldiers in UK,” Guardian, February 17, 2016.

[45] Regina vs Junead Ahmed Khan and Shazib Ahmed Khan, February 12, 2016.

[46] “Alleged extremist accused of ‘planning attack on RAF base in East Anglia’ takes stand in trial,” Cambridge News, March 4, 2016.

[47] Regina vs Junead Ahmed Khan and Shazib Ahmed Khan, February 12, 2016.

[48] “You will lose the feeling of being a human being,” BBC Radio 4 PM, February 22, 2016.

[49] Patrick Wintor and Shiv Malik, “Hundreds of Britain caught trying to join jihadis, says Foreign Secretary,” Guardian, January 15, 2016.

After a period of silence, a couple of new pieces, the first for the CTC Sentinel, West Point’s excellent counter-terrorism journal. This one looks at the pernicious influence of al Muhajiroun, Anjem Choudhary and Omar Bakri Mohammed’s group across Europe. It is a subject a lot more could be written about, and the volume of information is simply massive, but at the same time there is only limited space here. The topic will become more relevant again when Anjem and Mizanur’s trial comes about, and maybe around then something else could be done on the topic.

Beyond this, had a few media conversations in the past weeks. Will save the ones around the incident at the weekend on the Thalys train for the next post, but I spoke to the South China Morning Post about the bombing in Bangkok and some Chinese terror arrests, the Telegraph about the death of the last of the Portsmouth cluster of British jihadi’s in Syria/Iraq, the Daily Mail about the plan to use soldiers in cases of emergency on UK streets, the Times about the death of Muhsin al Fadhli in Syria, and the New York Times for a large piece they did about ISIS recruitment in the UK.

Al-Muhajiroun’s European Recruiting Pipeline

August 21, 2015
Author(s): Raffaello Pantucci

On August 5, 2015 Anjem Choudary and Mizanur Rahman appeared in court to be charged and detained without bail. Initially arrested September 24, 2014, the men had been free on bail as investigators dug into their histories.[1] When the decision to formally arrest and charge was made, the Crown Prosecution Service charged the men with inviting ”support for a proscribed terrorist organization, namely ISIL, also known as ISIS or the Islamic State, contrary to section 12 Terrorism Act 2000.”[2] The specific charges seemed to crystallize a reality that was increasingly observable across Europe that the various groups associated with the al-Muhajiroun (ALM) constellation of organizations were at the heart of current European recruitment networks sending radicals to fight in Syria and Iraq.

A long-standing feature of Europe’s extremist landscape, the al-Muhajiroun family of organizations is one that has been linked to a variety of terrorist organizations. One survey of plots linked to the group in the UK concluded that of 51 incidents and plots emanating from the UK from the late 1990s until 2013, 23 were linked to the group.[3] Britain’s first known suicide bomber in Syria, Abdul Waheed Majid, had been a feature at group events since the 1990s.[4] A similar French organization Forsane Alizza was disbanded after Mohammed Merah’s murderous rampage in 2012, while one of their associates Oumar Diaby ended up heading a French brigade in Syria.[5] The group’s tentacles and links reach across the continent and are increasingly showing up at the sharper end of the terrorist threat that Europe is facing.

Al-Muhajiroun’s European History

Al-Muhajiroun (the emigrants) was born in Europe in February 1996 when Omar Bakri Mohammed Fostok (hereon Omar Bakri) was ejected from the organization Hizb ut Tahrir (HuT) in the UK. A long-term HuT activist, Omar Bakri arrived in the United Kingdom in 1984 having fled Saudi Arabia where his activities as an Islamist activist clashed with the state. In the UK he sought political asylum and soon rose to public prominence through his willingness to make provocative statements at any opportunity to any available media outlet.[6] The birth of ALM in 1996 was likely the product of this style of leadership and media management clashing with the traditionally low-key and secretive HuT. The founding of ALM unleashed Omar Bakri, with the group ramping up its provocative actions and organizing an International Islamic Conference on September 8, 1996 to which Osama bin Laden, Abdullah Azzam, and many other jihadi leaders were purportedly invited. The event was cancelled at the last minute, though the publicity it generated in terms of media coverage and a documentary about Omar Bakri entitled “Tottenham Ayatollah” likely served the organization’s initial intent to attract attention.[7]

Present in the background of the documentary is Anjem Choudary, at the time a lawyer who was working as Omar Bakri’s assistant. Over time, his role evolved and in the wake of the London bombings of 2005, when Omar Bakri chose to flee the country,[8] Choudary took over as UK leader for the group. A few months prior to Omar Bakri’s departure, the group announced its dissolution in an attempt to get ahead of security services, with a series of sub-groups emerging largely reflecting the same ideology as ALM with Choudary effectively at the helm. In the wake of the attacks, British authorities focused on the group, adding the sub-groups to the proscribed terror list at various points and seeking greater powers to restrict their ability to operate. The group, however, has continued to operate with the leadership remaining fairly constant. This became most prominently visible in around 2009 when the group adopted the name Islam4Uk, which was proscribed a year or so later.

This style of nomenclature was soon seen replicated across Europe with Shariah4Belgium, Shariah4Holland, Shariah4Denmark, Shariah4Italy, Shariah4Finland, and even briefly Shariah4Poland. In France a group called Forsane Alizza (Knights of Pride) emerged as the local clone of the group (sometimes using Shariah4France) and in Germany Millatu Ibrahim (the religious community of Ibrahim, a name drawing on the title of a book by Muhammad al Maqdisi) took on the mantle. Millatu Ibrahim is a name that has since appeared in Norway, Holland, and Denmark as well). In Scandinavia, Profetens Ummah (the Umma of the Prophet) represents the ideology in Norway and Kadet til Islam (Call to Islam) is the lead group in Denmark.

All of these groups adopted a narrative and approach clearly modeled on ALM, and in many cases this was allegedly the product of direct contact and training by Choudary. For example, in March 2013, he visited Helsinki, Finland where he spoke alongside Awat Hamasalih, a British national of Kurdish origin from Birmingham, at an event organized by Shariah4Finland to celebrate the tenth anniversary of local Iraqi radical leader Mullah Krekar’s incarceration.[9] Choudary reciprocated this generous hosting, inviting Hamasalih to speak when he was back in the UK.[10]

This example of travel is representative of Choudary’s contacts with affiliate groups, and there are reports that he and other key ALM members travelled around Europe to support their events.[11] Similarly, there are reports that key individuals from regional affiliates have come to London. And there are multiple reports of Choudary (and Omar Bakri) preaching to supporters in Europe over PalTalk using web cameras and interactive online messaging.[12] Both Choudary and Mizanur Rahman  have also communicated extensively with supporters over Twitter.[13]

In terms of how Choudary sees his role with these groups, some clarity is provided in his supportive comments towards his Norwegian clone Profetens Ummah:

I have regular contact with Hussain and Ibraheem (two group leaders). There are no administrative links between us, but I am a mentor and adviser for them. There are many people who claim they represent Islam, but I see the Prophet’s Umma as one of the few voices in Europe that speak the truth about Islam without compromise.[14]

Choudary helped Profetens publish videos and develop a style to preach and call people to their radical brand of Islam.[15]

In other contexts people reached out to Choudary having heard about him in the press. Anas el-Abboubi was a young man born in Morocco who moved to Italy when he was young. An up-and-coming rapper, he was featured on MTV Italia as one to watch under his rap nom-de-music MC Khalif. This lifestyle, however, seemed unappealing to him and instead he was drawn to violent Islamist ideas and began an online conversation with Choudary over social media in which he asked for his advice about how he could advance radical ideas in Italy. El-Abboubi also participated in PalTalk sessions led by the group’s creator Omar Bakri and he bought plane tickets to visit the Shariah4Belgium group who he had also connected with online.

Soon after this, el-Abboubi established Shariah4Italy, a short-lived organization that seemed to flourish and shrink with its founder.[16] By October 2013 he fled Italy to join the Islamic State along a route that took him through Albania. The degree of influence that Choudary had over his decision-making process is unclear from the public domain, but it is clear that he and ALM had some influence over the young man, something exemplified by his establishing of Shariah4Italy despite a background in Italy that was largely detached from extremist ideologies and groups.

The Current Picture

There increasingly appears to be a consensus across European security agencies that Choudary’s group plays a role in networks that provide new recruits to fight in Syria and Iraq. In both the 2013 and 2014 TE-SAT Terrorism Situation and Trends report issued by Europol, the agency depicted  “al-Muhajiroun and its latest incarnation the Sharia4 movement” as being a driver for people to go and fight in Syria and Iraq.[17] Watching a pan-European trend, Europol observed:

some salafist individuals and groups in the EU, such as the Sharia4 movement, seem to have heeded the advice of prominent jihadist ideologues to stop their controversial public appearances in Europe….instead, they have been encouraged to participate in what these ideologues describe as a ‘jihad’ against un-Islamic rule in Muslim countries.[18]

There is further evidence of Omar Bakri playing an active role in helping people go fight in Syria. This is evident in the case of Shariah4Belgium,[19] a clone established in 2010 after Fouad Belkacem, a Moroccan-Belgian who had served some time in prison for theft and fraud, came to the UK to learn about how “to start something in Belgium.” Drawn to the bright light of Choudary’s celebrity, Belkacem listened as the established Briton “went through the history of ALM, how we set it up.”[20] The Belgian took the lessons to heart and returned to establish a similarly confrontational organization back home. Choudary and others were occasional visitors and both Choudary and ALM “godfather” Omar Bakri would provide online classes for the group in Belgium.[21]

In 2011, one of Shariah4Belgium’s core members left Belgium to seek out their mentor Omar Bakri in Lebanon. Now formally excluded from the United Kingdom by the Home Secretary, Omar Bakri continued to draw journalists and radicals from across the world. Nabil Kasmi was one of these young men, arriving in Lebanon as the conflict in Syria was catching fire. He returned to Belgium a few months later, but then in March 2012 headed off to the Levant again, this time going through Lebanon to Syria.[22]

At around the same time, another group associated with Shariah4Belgium were intercepted traveling to Yemen on suspicion of trying to join a terrorist group. Nabil Kasmi’s success, however, highlighted the options offered by the conflict in Syria.[23] In August he returned to Europe, only to leave again on August 20, this time followed days later by a cluster of some five members from the group who all ended up fighting with the Islamic State in Syria.[24] Over time, more and more of the group went to Syria, drawing on their Belgian and other European contacts from the broad ALM family of organizations. The exact numbers are unclear, but it is believed that at least 50 Belgian fighters in Syria and Iraq have roots in Shariah4Belgium.[25]

One of the few who failed to travel to Syria or Iraq was Fouad Belkacem, who was instead jailed in February 2015 for 12 years for recruiting and radicalizing people to go fight in Syria and Iraq.[26] On trial with another 47 people (the majority of which failed to appear in court as they were believed to be fighting or dead in the Levant), Belkacem’s trial seemed to be the capstone in the story of ALM’s European links to the battlefield in Syria and Iraq.

European Plotting?

What is not yet completely clear is the degree to which these networks are ones that are producing terrorist plots back in Europe. There are growing numbers of plots being disrupted in Europe with links to the battlefield in Syria and Iraq, though it remains uncertain whether these are being directed by the Islamic State or other groups from their safe haven in Syria and Iraq. Some plots, like that in Verviers, Belgium and at least one of those in the UK, are reported by authorities to show clear evidence of connections to the battlefield, but the nature of these links remains somewhat opaque.[27]

Looking to the ALM-associated networks across Europe, it remains unclear the degree to which they have thus far been credibly associated with attack planning. Reports around the January raid in Verviers, suggested some possible linkages (especially given the timing near Fouad Belkacem’s trial), but they have yet to be confirmed publicly.[28]

What has been seen, however, is the emergence of lone actor-style terrorism on the periphery of the group’s networks. A case in point is that of Brusthom Ziamani in the UK. Ziamani was a troubled teenager who sought out Anjem Choudary and his friends as a surrogate family. Having tried to ingratiate himself with the group and even considering travel to Syria, Ziamani instead decided to emulate his heroes Michael Adebolajo and Michael Adebowale and their murder of British soldier Lee Rigby in 2013. Taking a knife, axe, and Islamist flag, Ziamani was planning on butchering a member of the security forces before police intercepted him.[29] He was convicted of attempted murder and plotting to commit a terrorist act, and sentenced to 27 years incarceration.[30] There is no clear evidence that Ziamani told Choudary what he was going to do, but Ziamani’s case has been championed by ALM-associated Twitter accounts in the UK.[31]

In contrast, on the battlefield, individuals associated with ALM- related organizations appear in a number of both prominent and less high-profile roles. Reflecting their preference for noisy self-promotion and in-your-face dawa (proselytization), many are active on social media. One particularly prominent figure in this regard was Rahin Aziz, who fled to Syria after being sought in conjunction with an assault on a football fan in the UK. In Syria he quickly aligned himself with the Islamic State, and started to actively post across social media platforms. Among images to emerge were ones of him posing with weapons with Denis Cuspert, a prominent member of the German al-Mujahiroun linked group Millatu Ibrahim.[32]

For Aziz, the connection to ALM was instrumental in helping him build his networks in Syria and Iraq, as well as highlighting how interconnected the community across Europe was. In a conversation over Twitter he reported:

when I came to sham the amount of brothers from other countries who recognized me and agreed n even said were by us….what we did with demos etc aided the jihad, global awareness etc which motivated many to go fight jihad.[33]

Prior to going to the Levant, he reported going to:

Belgium many times, delivered lectures and me met from Europe there….many 3-4 times….France twice….Holland where we took part in a conference about khilafah…I knew the brothers from Germany….Their ameer abu usama al Ghareeb contacted me when he came out of prison….he asked me to do some videos for them….met Denmark guys in Belgium even in UK they came to visit us.[34]

It was a network fostered in Europe maturing and re-networking on the battlefield in the Levant.

Others seem to have taken to the battlefield to undertake activities largely similar to those they were carrying out previously in the United Kingdom. For example, Siddartha Dhar, a Hindu convert also known as Abu Rumaysah, was arrested alongside Anjem Choudary in September 2014. However, unlike his teacher, he took his passport and jumped on a bus to Paris with his pregnant wife and family, the first leg in a journey that ended with him living under the Islamic State a month later. In typical ALM style, Dhar decided to alert authorities to his presence through the posting of a photo of himself holding an AK-47 in one hand and his newborn baby in the other. Since then, Dhar has periodically re-emerged on Twitter and other social media, and in May 2015 became prominent once again when a book was published under his kunya (jihadi name) about life under the Islamic State.[35]

These are only a few of the men and women to have gone to join the Islamic State from the ALM networks. Exact numbers are difficult to know, but certainly from the UK alone, more than a dozen prominent individuals from these networks have gone over, while others have attempted to go. What remains worrying is that there continues to be a community of activists associated with these groups who are seeking to go fight in Syria and Iraq, and also that the pool of support in Europe remains fairly constant.

One illustration of this is that in the wake of the reports of Rahin Aziz’s death in a U.S. strike, a sweet shop in East London issued candies celebrating his martyrdom and a vigil was held for him that appeared to show a few dozen people praying in his honor.[36] A few days later, three men were arrested in the Luton area.[37] One was released while the other two (an uncle and nephew) were charged with plotting to carry out a terrorist attack in the UK intended to attack and kill military personnel.[38] Some reports suggested the plot was an attempted beheading of a U.S. serviceperson in revenge for Aziz’s death.[39] Details are unclear, though the men were allegedly also attempting to go to the Islamic State, and the case is working its way through the courts and is likely to come to trial in 2016.[40]

Conclusion

The arrest and charging of Anjem Choudary and his principal acolyte Mizanur Rahman is a significant moment in ALM’s history. The group has developed from its early days when London was a center of jihadist thinking with ALM at its core, drawing in radicals from across Europe and around the world. Since the prominence ALM achieved in the late 2000s, it has now become a net exporter organization around Europe, still drawing people to London, but then also watching as they return home to establish affiliate networks and communities. This European generation of ALM supporters is increasingly proving to be at the heart of Europe’s radical Islamist community connected with Islamic State and the conflict in Syria and Iraq. Given the volumes of plots that have emerged from these networks in the past in the United Kingdom in particular, it seems likely that similar problems are likely to emerge from the European ALM networks.

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists (UK: Hurst/US: Oxford University Press). You can follow him at @raffpantucci.

[1] In March 2014, Choudary and other ALM activists had been identified in a set of protests in London clearly inspired by the Islamic State. Dipesh Gadher, “Preacher Anjem Choudary investigated over ‘road show’ linked to jihadists,” Sunday Times, March 9, 2014 .

[2] Statement by Metropolitan Police, August 5, 2015 .

[3] Dominic Kennedy, “Radical al-Muhajiroun group is behind most UK terror plots,” Times, March 21, 2015.

[4] Morten Storm, Paul Cruickshank and Tim Lister, Agent Storm: A Spy Inside al-Qaeda, (London: Penguin, March 2015), p. 334.

[5] Olivier Tocser, “Les Secrets d’un Emir,” Le Nouvel Observateur, March 20, 2014.

[6] Memorably on November 12, 1991 he told The Mail on Sunday: “‘John Major [then Prime Minister] is a legitimate target. If anyone gets the opportunity to assassinate him, I don’t think they should save it. It is our Islamic duty and we will celebrate his death.”

[7] The documentary is available online, and was recounted in a chapter in Jon Ronson, Them (London: Picador, 2001). Ronson was also the director of the documentary.

[8] “Cleric Bakri ‘will return’ to UK,” BBC News, August 9, 2005.

[9] Mullah Krekar, the founder of the Ansar al Islam movement that was involved in fighting in Iraq, is an infamous radical preacher with whom Choudary has developed a link. Laura Helminen, “Radical Muslim Preacher Spoke in Helsinki,” Helsingin Sanomat, March 13, March 28, 2013.

[10]. In January 2015, authorities in Finland sought to eject Hamasalih. According to coverage around this time, Hamasalih, in contrast to most Kurds, was not seeking nationhood with his activity, but instead “his goal [was] jihad, an Islamic caliphate, and sharia, the law of Islam”  as the local newspaper said. Anu Nousiainen: “Finland Expelled Radical Extremist From Turku to UK – ‘Serious Threat to Public Security,’” Helsingin Sanomat, January 15, 2015.

[11] See Ben Taub, “Journey to Jihad,” New Yorker, June 1, 2015.

[12] Shortly prior to their arrest, Rahman and Choudary (alongside others), made a PalTalk video in which they answered questions from an American audience. Similar videos have been made for European audiences.

[13] There has been no comprehensive mapping of ALM’s online links and contacts, but almost all of the prominent members (in Syria and Iraq or back in Europe) have accounts and numerous others who aspire to be involved in these groups’ proselytization create accounts that are very similar. The best sense of outreach and effectiveness of this online contact is suggested in the fact that Choudary has 32.9K followers on Twitter, while Rahman has 29K. Of course, number of followers does not equate to contact and influence, but both are very active online and respond to people’s questions and contacts.

[14] Andreas Bakke Foss, “British Extremist Calls Himself a Mentor for Norwegian Islamists,” Aftenposten, March 3, 2013.

[15] Ibid.

[16] Lorenzo Vidino, Home-Grown Jihadism in Italy: Birth, Development and Radicalization Dynamics, (Milan: Istituto per gli Studi di Politica Internazionale, 2015), pp. 63-67.

[17] European Union Terrorism Situation and Trend Report 2014, (The Hague: Europol, 2014), p. 21.

[18] Ibid, p.23.

[19] Paul Cruickshank, “A View from the CT Foxhole: Interview with Alain Grignard,”  CTC Sentinel,  8:8 (August, 2015).

[20] Taub.

[21] Ibid.

[22] Ibid.

[23] Ibid.

[24] Ibid.

[25] Ibid.

[26] J. La. Avec Belga, “Sharia4Belgium qualifie de groupe terroriste, 12 ans de prison pour Fouad Belkacem,” La Libre, February 11, 2015.

[27] Paul Cruickshank, Steve Almasy, and Deborah Feyerick, “Source: Belgium terror cell has links to ISIS, some members still at large,” CNN, January 17, 2015.

[28] “Aantal radicalen in Wallonie wordt onderschat,” Het Laatste Nieuws, January 16, 2015.

[29] Tom Whitehead, “Brusthom Ziamani: the former Jehovah’s Witness who was radicalised within weeks,” Telegraph, February 19, 2015; Prosecution Opening Note, Regina vs. Brusthom Ziamani, Central Criminal Court, February 9. 2015.

[30] Regina vs Brusthom Ziamani, Sentencing Remarks of HHJ Pontius, Central Criminal Court, March 20, 2015.

[31] Tweet from @muslimprisoners, January 5, 2015 3:06pm

[32] Also known as Deso Dogg or Abu Talha al-Almani, Cuspert was a prominent German former rap star turned jihadi and activist for German ALM equivalent Millatu Ibrahim. He was one of several Miltatu Ibrahim figures to travel Syria. The Austrian founder of the group Mohammed Mahmoud was one of Cuspert’s close contacts. Mahhmoud left home aged 17 in 2002 to train in an Ansar al-Islam camp in Iraq. After his return to Europe he played a major role in the Global Islamic Media Front (GIMF), a source for non-Arabic language translations of jihadi material. In 2007 he was arrested by authorities, leading to a four year jail sentence. On his release he moved to Berlin and founded Millatu Ibrahim, which rapidly became the center of Germany’s Salafi scene. In 2012 he fled to Egypt before becoming a senior figure in the insurgency in Syria. He  is now considered one of the most senior figures in the German and European foreign fighter contingent, helping produce the Islamic State propaganda magazine Dabiq and al-Hayat media center releases. He is believed to continue to draw on his ALM-linked European contacts to recruit. See “In Search of ‘True’ Islam: Salafists Abandon Germany for Egypt,” Der Spiegel, August 13, 2002; Souad Mekhennet, “Austrian Returns, Unrepentant, to Online Jihad,” New York Times, November 15, 2011; Petra Ramsauer, “Mohamed Mahmoud: A Holy Warrior’s Book,” Profil, August 17, 2015.

[33] Author archive: Twitter conversation between Secunder Kermani and Rahin Aziz.

[34] Author archive: Twitter conversation between Secunder Kermani and Rahin Aziz.

[35] “New Brit propaganda guide by Brit sells ‘Costa’ caliphate,” Channel 4, May 19, 2015.

[36] Tweet with pictures by @TawheedNetwrk July 8, 2015 4:41pm

[37] “Three in terror-related arrests in Luton and Letchworth,” BBC News, July 14, 2015.

[38] “Man charged with US military terrorist plot,” Sky News, July 21, 2015.

[39] Mike Sullivan, “Foiled: British terror attacks in days,” Sun, July 14, 2015.

[40] “Man charged with US military terrorist plot,” Sky News, July 21, 2015.

A very belated posting of an article that came out a while ago for the CTC Sentinel. It has been a very hectic and busy time and I have let things slip, but am going to try to finally catch up. A few longer pieces are working their way through the system and should land soon, and far more exciting my book on Jihad in the UK is finally done and printed. So look to a lot more in that direction soon. To catch up on a few conversations I had with the media, I spoke to ITN about a recent case which is featured in this article, Brutschom Ziamani, to the Washington Post about terrorists getting guns in Europe, to Channel 4 about ISIS, Aftenposten about UK terrorism, spoke to Foreign Policy about terrorism in Xinjiang, to McClatchy about Uighurs going to join ISIS, and a longer interview for NPR in the US about responses and the threat in the wake of the Charlie Hebdo attack.

Britain’s Terror Threat From The Levant

January 20, 2015

Author(s): Raffaello Pantucci

On January 8, 2014, in the immediate wake of the Paris terrorist attacks, MI5 Director-General Andrew Parker gave his second public speech, during which, among other things, he outlined the nature of the threat that the United Kingdom faces from Syria. As he put it, “Terrorists based in Syria harbour [terrorist] ambitions towards the United Kingdom, trying to direct attacks against our country and exhorting extremists here to act independently.”[1] He highlighted how the Islamic State in Iraq and the Levant (ISIL) has tried to “direct terrorist attacks in the UK and elsewhere from Syria” as well as “seeking through propaganda to provoke individuals in the UK to carry out violent acts here.”[2] He also highlighted how the threat faced was one that comes not only from ISIL extremists, but also “that a group of core al-Qa’ida terrorists in Syria is planning mass casualty attacks against the West.”[3]

So far, there have been five publicly identifiable, alleged plots disrupted in the United Kingdom as well as a number of scares. The alleged plotting dates back to October 14, 2013, when British police in London conducted a series of dramatic arrests to foil what was at the time characterized as a “suspected Islamist terror plot to attack London.”[4] Almost exactly a year later, the trial against the two defendants charged in the wake of the arrests (two other individuals were released without charge) took place, providing Britain with the most detailed look yet into the nature of the threat that Britain’s security services see emanating from Syria. Ultimately, one of the men pleaded guilty while the jury could not reach a verdict in the other case. Amplifying the perception of the threat to the United Kingdom, as the trial was underway, police arrested another group of individuals who stand accused of plotting terrorism,[5] and the United Kingdom experienced its first reported suicide bomber in Iraq.[6]

This article will examine the current landscape of Islamist terror activity linked to Syria and Iraq in the United Kingdom, examining both recent plotting on the domestic front and the growing role of Britons in Syria and Iraq. It concludes that the lines and links between these two categories of radicalized Britons present a fluid and complicated community that is continuing to produce a steady stream of plots and networks of concern to security services. Both are building on significant challenges that have been extant in the United Kingdom for some time and that were most recently highlighted in a parliamentary report into the May 2013 murder of Lee Rigby by Islamist extremists.[7] That plot, and the parliamentary investigation, showed the complexity of the lone-actor terrorist threat the United Kingdom faces from both isolated individuals and those already on the radar screen of intelligence services, something that is increasingly also seen among the pool of potential threats emerging from radicalization of Britons in the wake of the rise of the Islamic State in Iraq and the Levant (ISIL).[8]

The threat from Syria and Iraq is increasingly maturing and following a trajectory that reflects broader trends that have been visible in the United Kingdom for some time. Syria and Iraq and the associated foreign fighter flow is something that British security services expect will occupy their attention for the immediate future.

Mumbai-Style Plot
The trial of Mounir Rarmoul-Bouhadjar, a 26-year-old British national of Algerian descent, and Erol Incedal, a 26-year-old of Turkish origin, opened October 8, 2014, at the Old Bailey. Initially, the trial was to be held in secret with the two defendants listed anonymously as AB and CD, but after a media-led battle in the courts, it was decided that only some of the trial would be held in secret and that the two defendants would be named.[9] On the eve of the trial, Rarmoul-Bouhadjar pleaded guilty to possessing a “document containing information of a kind likely to be useful to a person committing or preparing an act of terrorism, namely a document entitled ‘Bomb making.’”[10] A second charge of improperly obtaining an identity document was dropped.[11] Incedal, on the other hand, fought the case, and after a month long trial a jury was unable to reach a verdict. The judge dismissed the jury and the Crown Prosecution Services (CPS) declared it would seek a retrial.

Much of Incedal’s defense was held behind closed doors, while the prosecution was able to lay its case out publicly. Incedal had been in possession of a Secure Digital card taped to his mobile phone, in which the same bomb-making material that Rarmoul-Bouhadjar owned was saved, labeled “good stuff.” According to expert-witness testimony provided during the trial, the instructions contained in the document would have made an extremely sensitive mix of triacetone triperoxide (TATP). As the witness stated on the stand, the document “generally contains correct information that could be used to produce viable devices. However, it lacks detail and further information might be required.”[12] In a further reference to bomb-making, another file on the memory card stated, “The first rule of bomb-making is that your first mistake will be your last.”[13]

Incedal was born to a Kurdish family in Turkey, where his father, an active communist, died when he was six weeks old. His mother, an Alawite, moved to Britain when Incedal was a year old, leaving her children to join her later in the UK. His older sister joined the Kurdistan Workers’ Party[14] and died fighting alongside the group, while his older brother was later sectioned (taken into a secure mental hospital) under the mental health act. As a young man in the United Kingdom, Incedal was involved in gangs and arrested for attempted theft in October 2001. A year or so later he became religious, and soon afterward was drawn to Tablighi Jamaat,[15] enjoying the brotherhood it provided. He traveled with the group to Greece, India, Bangladesh, and New York, and met his co-defendant Rarmoul-Bouhadjar in Tablighi Jamaat.[16] Sometime in 2011 he became connected to the now-jailed sons of cleric Abu Hamza, Hamza, Sufyan, and Yaasir, with whom he was allegedly planning frauds and armed robberies of post offices.[17] It is not clear what became of these plans.

The prosecution’s case centered on the accusation that the defendants were planning a Mumbai-style attack[18]or possibly a targeted assassination of former Prime Minister Tony Blair.[19] In Skype conversations in which he used the name Fatima Hamoodi to communicate with an individual abroad who called himself Zaynab Alawi, Incedal wrote, “These straps are not the little ones, they are like the ones we have here – y knw k 1122aa shhh etc.” “Straps” was believed to refer to guns (a traditional terminology amongst urban youth in London) and “k 1122aa shhh” to Kalashnikov.[20] Later in the Skype conversation the two Skype accounts were recorded discussing, “If they’re able to get these type and it works, may want you to MO 88M 55BAY style,” something the prosecution interpreted as being a reference to the Mumbai attacks of 2008.[21] However, at the time of their arrests the men were not found in possession of any guns, though they were overheard through a police listening device discussing purchasing one in their car, using the slang “sausage” to refer to a gun and “sauce” for bullets.[22]

The plotting around the assassination of Tony Blair was far more circumstantial. Incedal was pulled over under the guise of a traffic stop in September, during which time authorities searched his car. In the process they found a Versace glasses case, which contained one of Tony Blair’s addresses. This same case was then later found at a second flat that Incedal failed to report to authorities when he was arrested. They also found evidence of multiple inhabitants and the computer on which Incedal was talking to someone abroad.[23]

At another moment during the trial, the two defendants were overheard seeming to refer to their time in Syria. In a conversation recorded in their vehicle Rarmoul-Bouhadjar was heard saying, “In Syria the weather was . . .” before Incedal interrupts saying, “Wallahi [I swear] it was like minus 20 degrees because we were on a mountain.”[24] At another moment while the men were overheard watching extremist videos in which men were shooting, Incedal comments “we used that,” while in another moment Incedal reports that ISIL undertakes a lot of “drive by shootings” that he finds inspiring: “They do it a love bruv. And they’ve got this special like machine Uzi gun like and silence on it – its nuts.”[25]

It is unclear why the jury returned an inconclusive verdict, though likely the absence of weaponry or a clearly defined plan of attack left some major gaps in the prosecution’s case. It is likely that Incedal’s defense will eventually be revealed, though at this point it is being kept behind the veil of secrecy. The re-trial is expected to occur sometime this year.

Targeting of Officials
This is the not the only plot that British security services believe they have intercepted. In early October 2014, police arrested five individuals believed to be involved in a plot targeting police officers with a Russian-made Baikal machine gun and ammunition.[26] Tarik Hassane, 21, a medical student at university in Sudan; Suhaib Majeed, 20, a physics student at King’s College London; Momen Motasim, 21; and Nyall Hamlett, 24, all stand accused of planning to use the gun and a moped to conduct a drive-by shooting of security officers. A fifth man charged alongside them was accused of supplying the gun.[27] The men were believed to be inspired by ISIL and had allegedly downloaded ISIL spokesperson Abu Muhammad al-Adnani’s fatwa calling on followers to launch attacks, taken pictures of police officers, discussed ISIL online, undertaken online reconnaissance of a police station in west London, and pledged allegiance to the group.[28] Charged with planning a terrorist attack, the men face trial this year.

More recently, on the eve of the 2014 November 11th Remembrance Day celebrations in the United Kingdom, police arrested a further four men in raids that were believed to be linked to a plot to target security officials at a public event.[29] The main suspect in the case, Yousaf Syed, is a 19-year-old who had his passport canceled after security services believed he tried to travel to Pakistan in 2013 for “terrorist purposes” and then in 2014 attempted to go to Syria.[30] On November 20, 2014, three men (Yousaf Syed, Yousaf’s cousin Nadir Ali Sayed, and Haseeb Hamayoon) were charged with plotting to behead a member of the public on the streets of Britain.[31] The men were reported to have “laughed hysterically” as the charges against them were read out in court and were reported in court to have been inspired by ISIL.[32] They also face trial this year.

Reflecting a threat picture that from the security services’ perspective has widened beyond networks of people plotting attacks to include “lone actor” terrorists, police separately arrested 19-year-old Brustchom Ziamani and 18-year-old Kazi Jawad Islam. Both men stand accused of planning to launch attacks against government security forces, though in different ways. Jawad Islam was arrested in east London on August 13, 2014, having reportedly given the order to unknown others to kill a British soldier. In court he was reported to have been overheard saying, “When I give the order I want you to kill a soldier.” He is alleged to have searched for materials to help him produce an improvised explosive device as well as possessed a document entitled “How to Make Semtex.”[33]

A Congolese-British convert, Ziamani was also arrested in August in the wake of the release of the ISIL video in which the American reporter James Foley was beheaded. Accused of planning an attack similar to the one against British soldier Lee Rigby in Woolwich in May 2013, Ziamani was arrested with a knife and a hammer wrapped in an Islamic flag in a bag on his back. In presenting Ziamani to the court, the prosecution stated that “he is 19 and of previous good character. He said to (a female teenager) he is going to commit a … terrorist atrocity either on troops or members of the government.”[34] He was further accused of wanting to go to Syria to fight alongside ISIL. Both men are due to stand trial this year.

The lone-actor plot, in particular targeting authorities, has become the heart of the threat that British security services currently see. In early December 2014, a threat believed to have come through social media ignited concern that police officers in Birmingham were to be targeted for attack. One man was arrested as a result.[35] This concern escalated further around Christmas with armed police standing guard outside prominent locations in London where formal sentries stand to attention in dress uniform (such as Buckingham Palace or the famous Horseguards Parade), while service personnel were told not to wear their uniforms to and from work.[36]

Britain’s Levantine Connection Strengthens
This escalating number of plots took place against a backdrop of revelations that British fighters were killed in U.S. airstrikes against Khorasan Group camps near Aleppo on September 23, 2014;[37] that a number of Britons died fighting alongside ISIL in Kobane, Syria;[38] and that a Briton was involved in a suicide bombing attack alongside the group in Iraq. The suicide bomber was Derby-born Kabir Ahmed, who was revealed to have been previously convicted of hate crimes, and had gone to Syria in 2012.[39] Ahmed is the second British suicide bomber to have been publicly revealed as dying in Iraq or Syria, though it is believed more than 30 Britons have died in total during the conflict so far.[40]

Furthermore, British-linked fighters are believed to be rising in the ranks of groups fighting in Syria and Iraq, most prominently in the case of the infamous “Jihadi John,” who is accused of being the executioner in the ISIL beheading videos and separately as the leader of a group called Kateeba al Kawthar. In proscribing the latter group, British Minister James Brokenshire described its leader as an individual with a British accent who is featured in recruitment videos under the name Abu Musab but whose true name was revealed as Rabah Tahari.[41] Tahari’s wife and son were arrested and charged in Birmingham, accused of sending goods to him in Syria.[42] Ultimately, charges against both of them were dropped, and Tahari is believed to continue to be out of  the United Kingdom. All of this presents a worrying picture for security services who are concerned about the fact that British nationals are being radicalized, are fighting alongside numerous different groups, and are taking leadership roles in some cases.

At the same time, the public debate in the United Kingdom has been increasingly colored by and focused on the question of what to do with returning fighters. This debate became livelier with the revelations in early September 2014 that a group of British fighters in Syria contacted researchers at King’s College and asked them to facilitate their return to the UK.[43] Other groups of fighters have also allegedly been identified, though it is unclear the degree to which these clusters of individuals are real fighters or are British nationals who went out under the auspices of aid work and ended up becoming embroiled in the fighting and now find themselves with nowhere to go. The dilemma of what to do with returnees is something that security forces balance against the number of disrupted plots that they have faced. One report to emerge in the wake of the Charlie Hebdo attacks in Paris stated that “more than 30 ISIS fighters in the UK have been placed under surveillance by MI5 because they are considered a serious threat” and that “a further 120 who retain ‘extremist’ views but have escaped detailed scrutiny will be reassessed amid fears that they have the firearms training to commit a copycat attack.”[44]

Conclusion
It is not clear whether the plots discussed in this article were directed by foreign groups or networks like ISIL, al-Nusra Front, or the cluster identified as the Khorasan Group on the battlefield in Syria or Iraq. In Incedal’s case, it seems that he was discussing his plans with someone abroad, but in the other cases no evidence of direction from overseas has yet been provided, though clearly the head of MI5 has identified that his service has seen such active plotting. Instead, the publicly identified and detailed plots appear to bear the hallmarks of being inspired by ISIL or potentially loosely linked to individuals with direct experience on the battlefield.

The plots appear to be the product of a fusion of trends, of lone actors and foreign fighters, with some individuals seemingly heeding al-Adnani’s call to “kill a disbelieving American or European–especially the spiteful and filthy French–or an Australian, or a Canadian, or any other disbeliever from the disbelievers waging war, including the citizens of the countries that entered into a coalition against the Islamic State, then rely upon Allah, and kill him in any manner or way however it may be….Do not ask for anyone’s advice and do not seek anyone’s verdict. Kill the disbeliever whether he is civilian or military, for they have the same ruling. Both of them are disbelievers.”[45]

Having already experienced the Woolwich incident, in which a pair of radicalized individuals who were longstanding subjects of counterterrorism investigations abruptly decided to run over in a car and brutally butcher an off-duty soldier, British forces are already alert to the possible threat from such small-cell or lone-actor terrorist activity. But given the potential numbers of individuals of concern connected with Syria and Iraq (of whom about 250-300 are believed to have returned home), the threat picture is one that has multiplied significantly.

Distinguishing the fighters who are genuine in their desire to return home to ordinary lives from those who might pose a terrorist threat is a major challenge. However, given the current trend of plots that appear to have loose connections to the battlefield but limited direction, British security forces seem to be dealing with two distinct groups. One group within the United Kingdom seems to be radicalizing and, inspired by narratives that ISIL is broadcasting, is choosing to plot terrorist attacks at home. The other is choosing to go abroad to fight with some possibly returning home to plan attacks. The line between these two groups is unclear, but what does seem clear is that these two parallel trends, and their increasing collision together, will cause major counterterrorism challenges for the next several years at least.

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI).

[1] Andrew Parker, “Terrorism, Technology and Accountability,” Address by the Director-General of the Security Service, Andrew Parker, to the Royal United Services Institute (RUSI), Thames House, January 9, 2015.
[2] Ibid.
[3] Ibid.
[4] Justin Davenport, “Police foil ‘major Islamist terror plot’ after armed raids across London,” The Evening Standard, October 15, 2013.
[5] Patrick Sawer, Nicola Harley, and Tom Whitehead, “Armed police arrest four men amid fears of Islamist Remembrance Day terror plot,” The Telegraph, November 7, 2014.
[6] Martin Naylor, “Suicide Bomber: report claims Islamic State suicide bomber in Kabir Ahmed, of Normanton, Derby,” Derby Telegraph, November 10, 2014.
[7] “Report on the intelligence relating the murder of Fusilier Lee Rigby,” Intelligence and Security Committee of Parliament, November 25, 2014.
[8] Ibid.
[9] Guardian News and Media Ltd vs AB CD, Royal Courts of Justice, Strand, Case No: 2014/02393C1, judgment handed down June 12, 2014.
[10] “Defendant in UK’s first secret trial pleads guilty,” The Telegraph, October 9, 2014.
[11] Ibid.
[12] Duncan Gardham, “Terror suspect had ‘reasonable excuse’ for having bomb-making plans,’” The Times, October 27, 2014.
[13] Sean O’Neill, “Armed police hunted Mercedes of terror suspect and blew out tires,” The Times, October 15, 2014.
[14] In Kurdish, Partiya Karkerên Kurdistanê (PKK).
[15] Tablighi Jamaat is a Muslim movement whose name literally translates as “society for spreading faith” and is an off-shoot of the Deobandi movement in South Asia.
[16] Duncan Gardham, “Terror suspect had ‘reasonable excuse’ for having bomb-making plans,” The Times, October 27, 2014.
[17] Tom Whitehead, “Secret terror trial hears Erol Incedal considered joining forces with Abu Hamza’s sons,” The Telegraph, November 3, 2014.
[18] This refers to the 2008 terrorist attack in Mumbai, India, during which teams of Lashkar-i-Tayyiba attackers assaulted multiple targets in Mumbai using small arms and taking hostages, ultimately killing 164 people (including 10 attackers).
[19] Sean O’Neill, “Tony Blair was a ‘terror target,’” The Times, October 14, 2014.
[20] Tom Whitehead, “Erol Incedal secret terror trial: jury discharged and retrial ordered,” The Telegraph, November 11, 2014.
[21] Sean O’Neill, “Armed police hunted Mercedes of terror suspect and blew out tires,” The Times, October 15, 2014.
[22] Victoria Ward, “Secret terror trial hears Erol Incedal used code word ‘sausage’ to buy a gun,” The Telegraph, October 16, 2014.
[23] Victoria Ward, “Tony and Cherie Blair named in secret terror trial as potential targets,” The Telegraph, October 14, 2014.
[24] Sean O’Neill and Duncan Gardham, “Terror suspect ‘discussed Syria and buying firearm,’” The Times, October 17, 2014.
[25] “Terror accused ‘praised jihadist battles in Syria and Iraq,’” BBC News, October 15, 2014.
[26] Fiona Hamilton and Sean O’Neill, “Terror suspects charged with moped plot to shoot police,” The Times, October 18, 2014.
[27] Fiona Hamilton and Sean O’Neill, “Terror suspects charged with moped plot to shoot police,” The Times, October 18, 2014.
[28] Victoria Ward and Nicola Harley, “ISIL terror suspect Tarik Hassane offered place at top UK university,” The Telegraph, October 8, 2014.
[29] Michael Powell and Duncan Gardham, “Teenage suspect in ‘Poppy terror plot’ tried to travel to Syria six months ago to ‘take part in extremist activity,’” The Mail on Sunday, November 8, 2014.
[30] Ibid.
[31] Martin Evans, “Terror suspects plotted to behead member of the public, court hears,” The Telegraph, November 20, 2014.
[32] Ibid.
[33] “Islam: Teenager Gave ‘Kill Solider’ Order,” Court News UK, December 4, 2014.
[34] Martin Robinson, “British-born Muslim convert ‘plotted atrocity and had a knife and hammer wrapped in an Islamic flag,’” Daily Mail, August 21, 2014.
[35] Vikram Dodd, “Man arrested in West Midlands after police warning of security threat,” The Guardian, December 9, 2014.
[36] Abul Taher and Mark Nichol, “Retreating of the Queen’s Guard: End of an era as palace sentries fall back in face of mounting fears of new ‘lone wolf’ terrorist attack,” The Mail on Sunday, December 27, 2014.
[37] Secunder Kermani, “Friend of British jihadist Ibrahim Kamara tells of fight,” BBC Newsnight, September 25, 2014.
[38] Patrick Sawer and Duncan Gardham, “Portsmouth private school jihadi killed in Syria,” The Telegraph, October 25, 2014.
[39] Martin Naylor, “Derby would-be suicide bomber: He is dad Kabir Ahmed with gay-hatred convictions,” Derby Telegraph, July 24, 2014.
[40] Tom Whitehead, John Bingham, and Sarah Knapton, “Up to 30 British jihadists now dead in Syria but toll will rise with ISIS lure,” The Telegraph, October 15, 2014.
[41] Hansard Parliamentary record, June 19, 2014.
[42] “Tahari: Mum and Son Bailed Over Syria Terrorism Charges,” Court News UK, March 17, 2014.
[43] Tom Coghlan, “Let us come home, say young British jihadists,” The Times, September 5, 2014.
[44] Tim Shipman, Richard Kerbaj, Dipesh Gadher, and Tom Harper, “Terror alert over 150 UK jihadists,” The Sunday Times, January 11, 2015.
[45] Helen Davidson, “ISIS instructs followers to kill Australians and other ‘disbelievers,’” The Guardian, September 23, 2014.

My new piece for CTC’s Sentinel, this one an update for a piece I did for them last February looking at the UK-Syria connection. Lots more on this topic coming.

The British Foreign Fighter Contingent in Syria

45

In mid-April 2014, the British government released its latest annual report on CONTEST, the British counterterrorism strategy. Focusing on the persistent threat from international terrorism faced by the United Kingdom, the document highlighted how the British government is “concerned about the threat to the UK from Syria based groups and the threat from foreign fighters returning to this country.”[1] Officials spoke of 33-50% of security service casework having a Syria component to it.[2]

The threat of returning fighters from Syria is one that British security officials already believe they have seen and disrupted, specifically in the form of a “Mumbai-style” plot targeting the United Kingdom in October 2013 that reportedly had links to Syria.[3] On the ground in Syria, British fighters continue to die and broadcast their activities through a variety of social media platforms, while publicly denying the accusation of wanting to launch attacks in the United Kingdom.[4] The community of Britons in Syria, however, reveals a group with strong links to criminal networks in the United Kingdom, as well as a growing willingness to publicize violent activity that might constitute war crimes.

Taken alongside the fact that Britons appear to be fighting with a multiplicity of groups (many British fighters who announce their affiliation claim to be members of the Islamic State in Iraq and the Levant, although others appear in images fighting alongside groups connected to Jabhat al-Nusra or even other smaller units), it seems that the threat to the United Kingdom is growing. The actual number of British fighters in Syria is an imprecise science, with French President Francois Hollande saying in January 2014 that some 700 Britons were fighting in Syria, a figure downplayed by the British government who stood by 350 fighters.[5] The International Center for the Study of Radicalisation (ICSR) estimated in December 2013 that there were somewhere between 43-366 British fighters who had traveled to Syria.[6] A more recent figure was offered by Helen Ball, the senior national coordinator for counterterrorism in the Metropolitan Police, who admitted that as many as 700 Britons might be fighting in Syria.[7]

This article offers a brief background on the alleged Mumbai-style plot that was disrupted in October 2013, and then looks more specifically at the community of British fighters in Syria. It finds that while most British foreign fighters in Syria may not pose a domestic threat to the United Kingdom, it appears likely that some might, especially in light of the recent Mumbai-style plot that reportedly had connections to the Syrian battlefield.

Mumbai-Style Plot
On the evening of October 14, 2013, police staged a dramatic series of arrests across London.[8] Four men, all allegedly long-term investigative suspects, were picked up in the sweep after authorities believed the group might have had access to firearms.[9] Two individuals were arrested in a “hard stop” involving shotgun rounds used to blow out the wheels of the car they were driving, a third at his home in Peckham and a final suspect outside an Iranian restaurant in Westbourne Grove.[10]

The identities of the four men were not confirmed beyond their ethnicities and ages: all were British nationals, but one each of Algerian, Azerbaijani, Pakistani and Turkish ethnicity. Ultimately, charges were only brought against the Algerian and Turkish individuals, who were both charged with “making record of information of a kind likely to be useful to a person committing or preparing an act of terrorism or possessing a document or record containing information of that kind.”[11] The Turkish individual was also accused of “preparing a terrorist act,” while the Algerian was accused of “possession with a false document.”[12] It is believed the other two were released.

There has been a tight hold on further information allowed in the public domain, although the understanding is that the men were believed to be planning a “Mumbai-style” shooting spree attack and the plot was one which had connections to Syria.[13] One report suggested the men may have met in Syria.[14] Information around the case has been limited with the names of the charged men kept out of the public domain. The case is due to go to trial later in the year.

British Fighters Increasingly Bold in Syria
Syria continues to have connections to Britain’s longstanding Islamist community, and the police have moved to clamp down heavily on the foreign fighter phenomenon at home. In the first three months of 2014, authorities made more than 40 arrests connected to Syria-related activity.[15] At the same time, the groups in Syria have become more bold, with British fighters communicating with the media to discuss their intentions and even going so far as to establish their own media outlet and group in December 2013 known as Rayat al-Tawhid.

The Rayat al-Tawhid branding has become an increasingly prominent feature of reporting in the United Kingdom around Syria, with the group publishing a series of videos and pictures through YouTube, Instagram and Twitter accounts that offer insights into personal experiences on the battlefield. The videos have glorified the fighting, calling on people to leave “the gangster life behind and join the life of jihad.”[16] Other more recent videos have shown the background of their lives near the battlefield, characterizing it as “Five Star Jihad”—a likely ironic reference to earlier images that emerged off the battlefield in which Britons described the luxurious lives they were leading with sweets from home and abandoned mansions with swimming pools in which to live.[17] Rayat al-Tawhid videos reflect a harder life on the battlefield, illustrating the basic living conditions, while also using the videos to solicit funding from the United Kingdom.[18] The group has also posted images of members involved in the apparent execution of an individual identified as a rapist, and in another image one of them is seen with a bag of heads that are apparently from a group of regime soldiers.[19]

It is not clear who is behind Rayat al-Tawhid, although their activities and publicity are reminiscent of longstanding British extremist groups. They speak with British accents, and their references to gang culture suggest at least a working knowledge of that life. What is somewhat disturbing about the group is their ease with the extreme violence and brutality of the battlefield in Syria, including involvement in battlefield executions, beheadings and possibly torture. The men all seem eager to maintain their anonymity and only appear in videos with their faces covered, which suggests that they want to protect their families back home from the attention of the authorities, or that they might plan to eventually return to the United Kingdom. This latter prospect is of great concern to British authorities, given their brutalization and apparent ability to manufacture explosives (a skillset suggested in images in which they show homemade bombs).

Kataib al-Muhajirin/Kataib al-Kawthar
This is not the first time that Britons have emerged in such a public way on the Syrian battlefield. In early 2013, a group called Kataib al-Kawthar began to produce tweets under the handle @KAlKawthar and established a Facebook page that on March 31, 2013, released a video entitled Commander Abu Musab’s Weekly Address, purporting to be “the first weekly address of Abu Musab, a western Mujaahid commander who is currently leading his forces against the oppressive regime of al-Assad.”[20] Delivered in fluent, but accented, English, the blurb promised regular weekly updates, although it is not clear if any more statements emerged. At around the same time as the video’s publication, Kataib al-Kawthar released a hagiographical video of Abu Kamal al-Swedee in both English and Arabic, with the English language delivered in native sounding English.[21] Abu Kamal was identified as a Finnish-born Swede with a convert Finnish mother and Swedish father.[22]

The video about Abu Kamal appeared to be produced by a parallel or sister group to Kataib al-Kawthar called Kataib al-Muhajirin, a grouping composed of foreign fighters in Syria apparently led by the Georgian Omar al-Shishani. The divisions between the group are unclear, with Abu Musab being referred to in a video released by Kataib al-Muhajirin as one of Omar al-Shishani’s commanders. The Abu Musab in the second video speaks only in Arabic, although prominent in the video are also Sayfullah al-Shishani and Ibrahim al-Mazwagi, a Libyan-Brit who was the first confirmed Briton killed in Syria.[23] A prominent figure who shows up repeatedly in Kataib al-Muhajirin videos, al-Mazwagi (also known as Abu Fidaa) fought previously in Libya and appeared to have enjoyed being filmed fighting in Syria.[24] Subsequent to his death, for example, a mini-film emerged showing his activities on the battlefield, joking around with fellow foreign fighters and marrying a Swedish woman who had come to the front.[25] In the Abu Kamal video, Abu Fidaa is referred to alongside suspected British national Abu Qudamah as carrying their fallen Swedish comrade’s body back to an ambulance.[26] Abu Qudamah seems to be the battlefield name of another British man from London who was later killed and who features prominently in images released by Kataib al-Muhajirin.

Abu Qudamah and Ibrahim al-Mazwagi feature in a number of images together, as well as with other individuals. Al-Mazwagi is later photographed alongside Omar al-Shishani, while Abu Qudamah is instead featured in a montage set of images published on Facebook by a now closed account in which a group of individuals were heralded as “Green Birds.”[27] What is particularly striking about this collection of images is that alongside Abu Qudamah, the montages feature Mohammed el-Araj, Bilal al-Berjawi and Mohammed Sakr. Al-Berjawi and Sakr were two Britons who came from west London and were killed in Somalia fighting alongside al-Shabab.[28] Mohammed el-Araj, on the other hand, was a Briton of Palestinian descent from Ladbroke Grove in west London who was killed in Syria in August 2013.[29] El-Araj was an engineering student who was arrested in January 2009 at a protest outside the Israeli Embassy.[30] Also arrested at the protest were Mohammed Sakr and Walla Rehman, although both received far lighter punishments than el-Araj—Sakr and Rehman were charged with affray under the public order act, while el-Araj was charged with handling stolen goods. Rehman’s significance within this context comes from the fact that he was identified as being involved in the same network as al-Berjawi and Sakr in East Africa.[31]

It is of course impossible to know the extent or importance of these connections, although it is notable that the men all come from a relatively similar part of London. It is possible that the young men all knew each other and the grouping behind them is one that has previously helped fighters reach Somalia and is now directing people toward Syria.[32] What is certainly concerning about this grouping is that it has clearly pledged allegiance and fought alongside Omar al-Shishani, a man who was the leader of foreign fighters in Syria and has now moved over to be a sub-commander to Abu Bakr al-Baghdadi, the head of the Islamic State in Iraq and the Levant (ISIL)—one of the most violent groups in Syria. The other Chechen visible in the aforementioned video featuring Omar and Abu Musab, Sayfullah al-Shishani, appears to have broken away from Omar to set up a more independent faction fighting alongside Jabhat al-Nusra.[33] He was killed in early February 2014 in an attack on Aleppo prison where the first recorded British suicide bomber, Abdul Waheed Majid, killed himself.[34] A long-term activist himself, Abdul Waheed Majid had featured on the periphery of serious terrorist investigations in the United Kingdom for some time, including the large 2004 plot called Crevice that intended to target a shopping mall outside London with a large fertilizer-based explosive device.[35]

Historical and Criminal Networks
The war in Syria also has connections to longstanding members of the jihadist community in the United Kingdom. British foreign fighter Abdel Majed Abdel Bary, for example, is the son of Adel Abdel Bary, who was extradited to the United States in 2012 after spending years in British custody.[36] He stands accused of being the leader of Egyptian Islamic Jihad’s cell in London in the 1990s and of providing support to Usama bin Ladin by helping to run a media outpost for al-Qa`ida.[37] He is also accused of involvement in the 1998 East Africa U.S. Embassy bombings.[38] The younger Bary, a former grime music rapper from west London, seems to have had a radical damascene moment in mid-2013, and in July declared on his Facebook page that “the unknown mixtape with my bro tabanacle will be the last music I’m ever releasing. I have left everything for the sake of Allah.”[39] In October 2013, he used his Twitter feed to ask “for everyone that still asks me about where my videos have gone, like I said a while back I quit music & I took all the vids I can down….& if you own a channel that has any of my music up can you take it down also, appreciated. Bless.”[40]

In other moments, the younger Bary referred to his missing father, pushed back against those who defamed the ISIL, and repeatedly denied accusations that he was in some way connected to prominent British extremist preacher Anjem Choudary. Mentioned in an early profile that exposed him publicly as fighting in Syria,[41] Bary seemed offended by the prospect, stating at one point “why linking me to anjem choudary again though, I dont know the man and we aint on the same wave lol hes on that microphone jihad.”[42] In another post, he reported how he and a fellow Briton were “kidnapped/tortured by FSA/IF scum they stole our ak’s and a 7mm, my vehicle & our phones and cash.”[43] Highlighting the circles in which he operated back in the United Kingdom, in mid-March 2014 he declared that “my lil brother ahmed got sentenced to life…26 years minimum….love lil bro see you in the afterlife inshallah #kasper.”[44] He appears to be referring to Ahmed Kasper Mikhaimar, a convicted burglar who in January 2014 was sentenced to 26 years incarceration for the murder of a teenager on London’s streets.[45]

This link to serious criminality can be found elsewhere among Britain’s community of fighters in Syria. Choukri Ellekhlifi, a Briton of Moroccan descent from Paddington west London who used the name Abu Hujama, was killed in August 2013 alongside his brother-in-arms Mohammed el-Araj.[46] Prior to coming to Syria, Ellekhlifi had been arrested with Mohammed Elyasse Taleouine and Mohammed Ibrahim in August 2012 after a series of brutal robberies in London’s affluent Belgravia district where masked men on bicycles attacked people walking the streets, threatening them with a taser while they stole their possessions.[47] In two cases, they used the taser on their victims.[48] The men were released on bail, and it appears that at this point Ellekhlifi fled the country and traveled to Syria where he joined the fighting.[49] Taleouine was re-arrested on January 10, 2013, when counterterrorism officers undertook an “intelligence-led operation” into “alleged facilitation of travel overseas for terrorism.”[50] Searching Taleouine’s property, police discovered a converted 9mm MAC-10 submachine gun, and he ultimately pleaded guilty to firearms offenses and robbery charges.[51] Taleouine was sentenced to 10 years in jail.[52]

Abdel Majed Abdel Bary also provides a connection to another relation of a prominent British individual previously accused of involvement with radical circles. On April 18, 2014, Bary tweeted “Subhanallah just seen the brother less than 2 weeks ago, may Allah accept his shahada, Abdullah Deghayas, martyr inshallah.”[53] This was a reference to Abdullah Deghayes, an 18-year-old Briton of Libyan descent who was killed fighting in Kassab, Latakia.[54] The nephew of former Guantanamo detainee Omar Deghayes, Abdullah is the middle child of three brothers who have left their homes in Brighton to fight alongside a Libyan unit in Syria called al-Battar.[55] His older brother Amer was shot in the stomach during the same clash, while his younger brother Jaffer is the youngest publicly confirmed Briton fighting in Syria at 16 years of age.[56] Their father has since pleaded for his two remaining sons to return home, although it seems uncertain whether this will be possible.[57]

The final connection to longstanding members of the UK jihadist scene is the case of Moazzam Begg, the former Guantanamo Bay detainee and founder of the Azzam Publications bookshop in Birmingham.[58] UK authorities arrested Begg on February 25, 2014, and charged him with providing terrorist training as well as funding terrorism overseas.[59] Arrested alongside him were Gerrie and Mouloud Tahari, a mother and son who are also charged with supporting terrorism overseas.[60] Begg’s arrest elicited substantial public outcry and his trial later in the year is likely to prove a major spectacle as he fights against perceived persecution.

Portsmouth’s Bangladeshi Bad Boys
Another cluster of Britons drawn to Syria can be found in Portsmouth where a group that seems to in part echo a local da`wa (propagation) community has gone to fight in Syria alongside the ISIL. The Portsmouth Da`wa Team continues to carry out its peaceful activities in the city center, and there has been no evidence presented that it is connected to terrorism. A number of former members, however, have gone to fight in Syria. Most prominently, Iftekar Jaman, a former call center employee and son of fast food restaurant owners, became something of a celebrity jihadist through his online media profile.[61] In November 2013, he achieved particular notoriety when he was interviewed by the BBC’s flagship Newsnight program.[62] He was also responsible for helping to facilitate travel to Syria for two other Britons who used the pseudonyms Abu Qaqa and Abu Layth al-Khorasani.[63] Abu Layth was later revealed to be a Manchester-born student at Liverpool University and part-time amateur boxer called Anil Khalil Raoufi.[64] Both Raoufi and Iftekar Jaman have since been killed fighting.[65]

Others from the Portsmouth cluster who are still fighting in Syria include former private schoolboy and fitness fanatic Muhammad Hassan.[66] Hassan, another participant in the Portsmouth da`wa group, is a regular on social media and promotes the ISIL’s cause.[67] In mid-November 2013, another Portsmouth man, Muhammad Hamidur Rahman, a manager at a local retail clothing store, told his family he was heading to Syria as part of an aid convoy only to reemerge weeks later as a fighter alongside the ISIL.[68] Both men are believed to still be fighting in Syria.

In contrast, Mashudur Choudhury, who recently became the first Briton to be convicted of terrorism charges related to the conflict in Syria,[69] was arrested upon his return to the United Kingdom on October 26, 2013.[70] He had left for Syria on October 8 with four other Portsmouth men on a commercial flight to Turkey (including Muhammad Hamidur Rahman and Muhammad Hassan) after long conversations via various social media and online communication methods, including Skype, with Iftekar Jaman.[71] In one of these messages, Choudhury suggested that the group he was traveling with should call themselves the “Britani brigade Bangladeshi bad boys,” which elicited a “lol sounds long” from Jaman.[72] Choudhury was also revealed to have argued about his activity with his wife who saw him as a fantasist and who finally told him in a July text message to “go die in battlefield. Go die, I really mean it just go. I’ll be relieved. At last. At last.”[73]

Conclusion

The flow of foreign fighters to Syria from the United Kingdom continues, although the scale is difficult to determine. The trends are worrisome, with the preponderance of longstanding networks of individuals involved in radical activity, the continued featuring of British nationals fighting alongside the ISIL, and the fact that a number of these nationals are connected to serious criminal networks in the United Kingdom. These factors highlight a trend that is likely to develop into future threats. The twin incidents of the murder of Lee Rigby in Woolwich by longstanding activist Michael Adebolajo and the suicide bombing in Aleppo by Abdul Waheed Majid, a man with almost two decades of radical activity, serve to highlight the persistent and long-term threat that such radicalized individuals can pose.

Thus far, only one domestic terrorist plot in the United Kingdom has been reported as having a connection to Syria, but there is an expectation that more will emerge.[74] While most fighters who return from Syria may not pose a threat, it is likely that some will. British fighters state that they have no intention of carrying out attacks in the United Kingdom, but the indicators from across Europe (including the recently foiled Mumbai-style plot) suggest that future domestic threats connected to the war in Syria are likely to emerge.[75]

Raffaello Pantucci is a Senior Research Fellow at the Royal United Services Institute for Defence and Security Studies (RUSI) and is grateful for the support of the Airey Neave Trust in his work on foreign fighters.

[1] “CONTEST: The United Kingdom’s Strategy for Countering Terrorism, Annual Report,” UK Home Office, April 9, 2014.

[2] Ibid.

[3] Duncan Gardham, “Police Foil ‘Mumbai-Style’ Terrorist Plot in London, Say Security Sources,” Guardian, October 14, 2013.

[4] “British Fighters in Syria ‘Not Planning UK Attacks,’” ITV News, April 8, 2014.

[5] Tom Whitehead, “700 Britons Fighting in Syria Terror Groups, Warns Hollande,” Telegraph, January 31, 2014.

[6] “Up to 11,000 Foreign Fighters in Syria; Steep Rise Among Western Europeans,” The International Centre for the Study of Radicalisation, December 17, 2013.

[7] Tom Whitehead, “Up to 700 Britons Feared to be in Syria,” Telegraph, April 24, 2014.

[8] Sean O’Neill and David Brown, “Syria Link to Terror Arrests in London Raids,” Times, October 15, 2014.

[9] Justin Davenport, “Police Foil ‘Major Islamist Terror Plot’ After Armed Raids Across London,” Evening Standard, October 14, 2013.

[10] Ibid.

[11] “Two Men Charged with Terrorism Offences,” Press Association, October 20, 2013.

[12] Ibid.

[13] Gardham, “Police Foil ‘Mumbai-Style’ Terrorist Plot in London, Say Security Sources”; Justin Davenport, “Islamist Terror Suspects Could Have Met During Syria Conflict,” Evening Standard, October 15, 2013; Amanda Williams, “Hundreds of British Jihadis Returning From Fight in Syria Spark Terror Alert After Police and MI5 Thwart Mumbai-Style Attack on London,” Mail Online, February 16, 2014.

[14] Ibid.

[15] Tom Whitehead, “Syria-Related Arrests Soar as Police Urge Mothers and Wives to Stop Would-be Jihadis,” Telegraph, April 24, 2014.

[16] Steve Swann, “British Man Recruits for Syria Jihad,” BBC, December 20, 2013.

[17] Aris Roussinos, “Jihad Selfies: These British Extremists in Syria Love Social Media,” Vice, December 5, 2013.

[18] Know Your Role, Rayat al-Tawhid, April 25, 2014, available on Instagram.

[19] The image of the severed heads was posted on Instagram. The execution video was made public through the reporting of Tom Rayner, “British Fighters Filmed in Syria ‘War Crime,’” Sky News, May 2, 2014.

[20] Commander Abu Musab’s Weekly Address, Kataib al-Kawthar, March 30, 2013, available at http://www.youtube.com/watch?v=3wE0VWLgQnA.

[21] Shaheed Abu Kamal English Version, Kataib al Muhajirin, March 13, 2013, available at http://www.youtube.com/watch?v=vn_8Ul4K_Gc.

[22] Per Gudmundson, “The Swedish Foreign Fighter Contingent in Syria,” CTC Sentinel 6:9 (2013).

[23] Richard Kerbaj and Malik al-Abdeh, “Dead at 21: Britain’s Veteran Jihadist,” Sunday Times, March 3, 2013.

[24] Ibid.

[25] Inigo Gilmore, “Britons Fighting with Syria’s Jihadi ‘Band of Brothers,’” Channel 4 News, June 14, 2013.

[26] Shaheed Abu Kamal English Version.

[27] Roussinos.

[28] For a more complete story about al-Berjawi’s and Sakr’s adventures in Somalia, see Raffaello Pantucci, “Bilal al-Berjawi and the Shifting Fortunes of Foreign Fighters in Somalia,” CTC Sentinel 6:9 (2013).

[29] Shiv Malik and Haroon Siddique, “Briton Killed Fighting in Syria Civil War,” Guardian, November 20, 2013.

[30] Ibid.

[31] J1 v. The Secretary of State for the Home Department, Royal Courts of Justice, 2013.

[32] It is possible that there is a similar structure at play in Belgium in a case currently working its way through the system in which fighters were being sent to both Somalia and Syria. See “L’epouse de Rachid Benomari lui envoyait de l’argent en Somalie,” La Libre, March 10, 2014.

[33] “An In-Depth Look At Chechen Fighters in Syria – Part I: Sayfullah Al-Shishani and His Circle,” Middle East Media Research Institute, December 6, 2013.

[34] “UK ‘Suicide Bomber’ Abdul Waheed Majid Video Posted Online,” BBC, February 14, 2014.

[35] Raffaello Pantucci, “Syria’s First British Suicide Bomber: The UK Jihadist Backdrop,” Royal United Services Institute, February 14, 2014.

[36] Chris Greenwood, “Fighting Jihad in Syria, The British ‘Grime’ Rapper from £1m Home in Maida Vale, West London, Who is the Son of a Suspected Al Qaeda Mastermind,” Daily Mail, December 31, 2013.

[37] “Fact Sheet on Extradition of 5 Terrorism Suspects to US: Information on Charges,” U.S. Embassy London, October 5, 2012.

[38] Ibid.

[39] This post, dated July 1, 2013, is available at http://www.facebook.com/LyricistJinn/posts/634492946562118.

[40] Twitter feed @ItsLJinny, October 9, 2013.

[41] Greenwood.

[42] Twitter feed @ItsLJinny, March 9, 2014.

[43] “The Scum Stole our Cash,” Daily Mail, March 9, 2014.

[44] Twitter feed @ItsLJinny, March 13, 2014.

[45] William Turvill, “Five Thugs who Killed a Schoolboy Stabbing Him with Swords and Meat Cleavers in one of Britain’s Wealthiest Postcodes are Jailed for 131 Years,” Daily Mail, January 31, 2014.

[46] Amie Keeley, “Four Britons ‘Killed Fighting in Syrian Civil War With Al Qaeda Rebels,’” Mail Online, November 20, 2013.

[47] Duncan Gardham, ‘The Al Qaeda Fanatic from Britain who Funded Jihad Trip to Syria by Mugging Londoners with a Taser,” Mail on Sunday, November 30, 2013.

[48] Ibid.

[49] Ibid.

[50] Metropolitan Police statement, undated, available at http://www.facebook.com/media/set/?set=a.538475426199901.1073741856.423306314383480&type=3.

[51] Ibid.

[52] Ibid.

[53] Twitter feed @ItsLJinny, April 18, 2014.

[54] “Father Scared for Sons in Syria,” Press Association, April 21, 2014.

[55] Conal Urquhart and Shiv Malik, “Teenager From Brighton Killed Within Weeks of Joining Syrian Conflict,” Guardian, April 18, 2014.

[56] Urquhart and Malik.

[57] Shiv Malik, “Father of UK Teenager Killed in Syria Implores his Other Sons to Return,” Guardian, April 20, 2014.

[58] “UK Ex-Guantanamo Detainee Moazzam Begg Remanded in Custody,” BBC, March 1, 2014.

[59] Ibid.

[60] “Mouloud Tahari: Briton, 20, Charged over Funding Syria Terrorism,” Independent, March 4, 2014.

[61] Edward Malnick and Richard Spencer, “British ‘Celebrity Jihadi’ and Chef Dies in Syria,” Telegraph, December 17, 2013.

[62] Richard Watson, “Briton ‘Doing his Duty’ by Fighting with Group Linked to al Qaeda in Syria,” BBC, November 21, 2013.

[63] Tam Hussein, “Social Media Jihadi: The Inside Story of a Briton who Died Fighting for ISIS,” Huffington Post, February 6, 2014.

[64] Yakub Qureshi, “Anil Khalil Raoufi, 20, Killed Fighting in Syria Thought War was ‘Like Star Wars,’” Manchester Evening News, February 13, 2014.

[65] Ibid.

[66] Dipesh Gadher, David Leppard, Hala Jaber, Toby Harnden and Laura Molyneaux, “‘We Need to Start Taking Heads Off’: The YouTube Jihadists who Pose a Risk to Britain,” Sunday Times, January 12, 2014.

[67] Dipesh Gadher and Laura Molyneaux, “Portsmouth’s Primark Jihadist Surfaces in Syria,” Sunday Times, December 1, 2013.

[68] Ibid.

[69] Dominic Casciani, “Mashudur Choudhury: Serial Liar and Jihadist,” BBC, May 20, 2014.

[70] Tom Whitehead, “Man Travelled to Syrian Terror Training Camp After Angry Wife Said ‘Go Die on Battlefield,’ Court Told,” Telegraph, May 7, 2014.

[71] Ibid.

[72] Ibid.

[73] Ibid.

[74] O’Neill and Brown.

[75] Raffaello Pantucci, “Thick as Thieves: European Criminals Take to Syria’s Battlefield,” Royal United Services Institute, March 31, 2014.

My latest piece for CTC Sentinel has finally landed in timely fashion, about Bilal el Berjawi a British-Lebanese man who ended up connected with al Qaeda and al Shabaab in Somalia. Quite apt in the wake of events in Nairobi, about which I have done a few media hits. More on that later. I was on al Jazeera English’s channel talking about trouble in Sinai and Euronews on foreign fighters going to Syria.

Bilal al-Berjawi and the Shifting Fortunes of Foreign Fighters in Somalia

Sep 24, 2013

Author: Raffaello Pantucci
On September 21, 2013, al-Shabab militants attacked an upscale shopping mall in Nairobi, the Kenyan capital. The brazen operation comes in the aftermath of al-Shabab leader Ahmed “Mukhtar Abu al-Zubayr” Godane’s consolidation of power. In June, Godane swept aside a raft of senior leaders in the group. His power grab marked a watershed event in a period of dramatic turmoil for al-Shabab.

One individual, Bilal al-Berjawi, whose death may have come as part of an early expression of this schism, returned to public attention when al-Shabab published a number of videos and materials celebrating him in early 2013. A British citizen who was drawn to Somalia before al-Shabab formally existed, he rose through the ranks of al-Shabab and the foreign fighter cell linked to al-Qa`ida to become a figure who was reportedly second only to the head of al-Qa`ida’s East Africa operations, Fazul Abdullah Mohammad (also known as Fadil Harun). Al-Berjawi’s death in January 2012 reportedly triggered tensions within al-Shabab, culminating in Godane’s takeover earlier this year. Yet al-Shabab emphasized that al-Berjawi’s death was the product of Western intelligence efforts, rather than an internal purge.[1]

The accuracy of al-Shabab’s claims in the videos remain to be proven, but the releases provide an interesting view on current developments within al-Shabab as well as illuminating al-Berjawi’s role within the group and his narrative as an epigraph for foreigners drawn to al-Shabab.

This article offers an in-depth look into al-Berjawi’s life, as well as some thoughts on how he may have become enmeshed within the contingent of al-Shabab that has been sidelined. Al-Berjawi’s death, the reported death of American al-Shabab fighter Omar Hammami alongside another Briton,[2] the death of long-time al-Shabab leader Ibrahim al-Afghani, the disappearance of Mukhtar Robow, and Hassan Dahir Aweys’ decision to turn himself in to authorities all point to a change within the organization that seems to have been punctuated by the ambitious attack in Nairobi. The ultimate result is still developing, but al-Berjawi’s rise and fall provides a useful window with which to look at the role of foreigners in the conflict in Somalia.

The Life of Bilal al-Berjawi
Bilal al-Berjawi was a Lebanon-born, British-educated young man also known as Abu Hafsa.[3] Born in Beirut in September 1984, his parents brought him to the United Kingdom when he was a baby.[4] Raised in west London, he lived as a young man near an Egyptian family whose son, Mohammed Sakr, became his close friend. Characterized as “two peas in a pod” by fellow Somalia-based foreign jihadist Omar Hammami, al-Berjawi’s and Sakr’s stories seem closely intertwined.[5] Sakr’s family reported that the two men met as boys when Sakr was 12-years-old, and then lived adjacent to each other.[6] Most references to the men in jihadist materials mention them as a pair.

In a martyrdom notice for al-Berjawi, al-Shabab said that he was from west London,[7] while the BBC identified him as being from St. Johns Wood in the northwest of the city.[8] A community worker who knew al-Berjawi in his teenage years said that he was involved in teenage gang violence in west London, specifically in clashes between Irish gangs and Muslim youth in the area.[9] He was not particularly religious, although he appeared to be a contemplative young man.[10] He had a wife of Somali origin who he married when he was 19- or 20-years-old, and a child who was conceived after he had risen up the ranks of al-Qa`ida’s East Africa cell.[11]

According to a longer martyrdom notice published almost a year after his death as part of a series called “Biographies of the Flags of the Martyrs in East Africa,”[12] al-Berjawi was trained by al-Qa`ida operatives Fazul Abdullah Mohammad and Salah Ali Salah Nabhan when he first arrived in Somalia in 2006.[13] Under their tutelage, he seems to have flourished, although when the Islamic Courts Union (ICU) fled as a result of the Ethiopian invasion, al-Berjawi returned to the United Kingdom to fundraise and find ways to send money back to East Africa.[14] Al-Berjawi’s martyr biography praised him in this role, calling him “brilliant” and able to set up many profitable projects.[15] According to his martyrdom video released by al-Shabab’s media wing, after the release of his written biography, he decided to travel back to Lebanon from London.[16]

In February 2009, al-Berjawi and Sakr headed to Kenya, telling their families their intention was to go on a “safari.”[17] They were detained in Nairobi because they “aroused the suspicions” of a hotel manager in Mombasa.[18] Both were deported back to the United Kingdom (as British passport holders) and told different accounts of their actions to awaiting security officials.[19] When Mohammed Sakr’s father confronted his son about his actions, Sakr said, “Daddy, it’s finished, it will never happen again. It’s all done and dusted.”[20]

By October 2009, the men decided to try to return to Somalia, and this time they were able to evade detection and slip out of the United Kingdom along with a third man. According to the “Biographies of the Flags of the Martyrs in East Africa,” they had to travel through a number of countries before they arrived in Somalia.[21] In November, they were reported by Ugandan authorities as being at the heart of a manhunt for individuals allegedly plotting terrorist acts in the country.[22] The two were identified alongside a third British national named Walla Eldin Abdel Rahman—a name that corresponds with British court documents.[23] Al-Berjawi, in particular, was identified as having three passports with him.[24]

According to his martyr biography, having returned to Baidoa in Somalia, al-Berjawi joined a camp and trained diligently alongside others, undertaking “difficult assignments” despite being reported as having a stomach condition.[25] He was described as being supportive of his colleagues and a lover of battles. As time passed, he seemed to have assumed greater responsibilities, helping to supply forces (with items such as clothing and weapons) and to take on responsibility for tending to families left behind by fallen warriors.[26] In early 2010, Mohammed Sakr called his parents from Somalia to reassure them that he was doing well.[27]

In July 2010, a cell linked to al-Shabab conducted a double suicide bombing in Kampala, Uganda, on two bars where people watched the soccer World Cup final. The attack claimed approximately 74 lives.[28] According to one report in the Ugandan press, al-Berjawi, Sakr and Rahman were detected entering the country in July 2010, although it remains unclear the exact role that they played, if any, in the Kampala attack.[29]

By this point, al-Berjawi was repeatedly referred to in the Ugandan press as being a direct deputy to Fazul Mohammad, the head of al-Qa`ida’s operations in East Africa, although he seems to have been close to others in al-Shabab as well.[30] The “Biographies of the Flags of the Martyrs in East Africa” identified him as being in regular direct contact with Fazul, and even helping him get into Somalia at one point.[31] A biography of Fazul released by al-Shabab and statements from American jihadist Omar Hammami corroborated this, with the biography stating that al-Berjawi was in regular contact with Fazul[32] and Hammami claiming in an interview that Fazul kept abreast of developments in Somalia through contacts with al-Berjawi and Sakr, both of whom “were very close to Fazul at the time prior to his martyrdom.”[33] In September 2010, the British home secretary sent letters to al-Berjawi’s and Sakr’s parents revoking their citizenships “on grounds of conduciveness to the public good.”[34]

In June 2011, a drone strike that may have been targeting senior al-Shabab figure Ibrahim al-Afghani supposedly injured al-Berjawi.[35] This came two weeks after Fazul took a wrong turn down a road in Mogadishu and drove straight into a Somali government roadblock. According to al-Shabab’s biography of Fazul, in the wake of his death concerns started to mount about the circumstances involved, and a number of al-Shabab commanders, alongside al-Berjawi, Sakr and others, fled the country.[36] In this version of events, as the group fled Somalia, they were targeted by the drone that injured al-Berjawi.[37] After being injured in the drone strike, al-Berjawi snuck into Kenya to recuperate with Sakr’s assistance.[38]

It is unclear at what point al-Berjawi returned to Somalia, but by early 2012 he seems to have been back in the country and is described in the regional press as having assumed Fazul’s position as the leader of al-Qa`ida in Somalia[39]—although given he had been injured so soon after Fazul’s death, it is not clear how much he would have been able to achieve in this role. Nevertheless, this would have made him a target for foreign intelligence services and, according to a video confession produced by al-Shabab and released by al-Kataib that was posted in May 2013 seemingly to affirm the narrative behind al-Berjawi’s death, it is at this time that unspecified foreign intelligence services allegedly recruited a young Somali named Isaac Omar Hassan.[40] According to Hassan’s confession to al-Shabab, he was recruited by foreign intelligence services to help them track al-Berjawi so that he could be killed in a drone strike.[41] Hassan said that al-Berjawi was the first person that the handlers asked him about.[42]

In Hassan’s telling, he recruited a friend, Yasin Osman Ahmed, who was to drive al-Berjawi that day.[43] Al-Berjawi allegedly called Ahmed on the morning of January 21, 2012, at around 9 or 10 AM as he wanted to go to the market to purchase a firearm.[44] Later, according to Hassan, al-Berjawi was driving to meet with the “amir of the mujahidin” when they stopped to make a phone call. It was at this point that the drone found its target, killing al-Berjawi.[45] In Hassan’s confessional, a month later an almost identical scenario played out, but this time with him recruiting a third man called Abdirahman Osman to act as the person who supposedly led the drone to its targets: Mohammed Sakr and another group of foreign fighters.[46]

Questions About Death
Bilal al-Berjawi’s death seems to have sparked a wave of concern within the community of al-Qa`ida in East Africa and foreigners in al-Shabab. After al-Berjawi death, hundreds of foreign fighters reportedly left Somalia. Shaykh Abuukar Ali Aden, an al-Shabab leader for Lower and Middle Jubba region, told Somalia Report that “yes, it is true that those brothers left us and went to Yemen due to some minor internal misunderstandings amongst ourselves. This started when we lost our brother Bilal al-Berjawi.”[47] An emergency meeting was held almost immediately after al-Berjawi’s death that was attended by al-Shabab leaders Ali Mohamed Rage, Hassan Dahir Aweys, Mukhtar Robow, Omar Hammami, Shaykh Fuad Mohammed Kalaf, and unidentified others.[48] Notably absent was Godane.[49] This seemed to echo another meeting that had been held prior to al-Berjawi’s death in December 2011 when al-Shabab leaders “opposed to Godane” gathered in Baidoa.[50]

Concerns seem to have focused around the fact that so many key players in al-Qa`ida’s East Africa cell and the foreign fighter community were being removed from the battlefield in quick succession. The fact that Fazul died in such odd circumstances for a man of his caliber and training,[51] followed by al-Berjawi’s death, all seemed to suggest an internal purge. When Sakr and others were killed a month after al-Berjawi, this sense seemed to harden, with Omar Hammami considering Sakr’s death “a strange incident.”[52] In between al-Berjawi’s and Sakr’s deaths, however, the new leader of al-Qa`ida, Ayman al-Zawahiri, announced al-Shabab’s official merger with the terrorist group.

The exact details of this possible leadership dispute remain unclear. Yet the recent executions of Ibrahim al-Afghani and Sheikh Maalim Burhan,[53] the reported death of American Omar Hammami,[54] Hassan Dahir Aweys’ decision to hand himself over to authorities in Mogadishu, and Mukhtar Robow’s abrupt move into hiding[55] all indicate that whatever leadership struggle was underway has now come into the open with Godane emerging victorious. What role al-Berjawi played in this remains unclear, although it seems as though his death may have been a catalyst to precipitate subsequent events. The emergence of the video confessional produced by al-Shabab seems a conscious effort to claim al-Berjawi’s death was solely the product of external intelligence efforts, rather than due to an internal purge.[56]

Al-Berjawi’s Links to Other Militants
What led Bilal al-Berjawi to fight in Somalia is uncertain. His decision to train in Somalia in 2006 when the ICU was in power suggests he was part of a larger community of London radicals who were drawn to Somalia before al-Shabab emerged as a powerful entity. The fact that he had a Somali wife likely acted as a stimulant to go to Somalia, rather than to Iraq or Afghanistan, which were popular destinations among British Islamists at the time. These individuals were part of the radical scene in London that were drawn by messages advanced by radical preachers who circled around the “Londonistan” community. Al-Berjawi was further connected, at least peripherally, to a group linked to the network that attempted to carry out a terrorist attack on London’s transportation system on July 21, 2005.

The links to this cell can be found through an individual mentioned in UK court documents as “J1.” An Ethiopian national born in 1980, J1 reportedly moved to the United Kingdom with his family in 1990 and is currently believed to be fighting deportation to Ethiopia.[57] He was part of a group that attended camps in the United Kingdom run by Mohammed Hamid, an older radical figure who took over responsibilities for the community around Finsbury Park after Abu Hamza al-Masri was taken into custody in 2003.[58]

In December 2004, J1 was picked up by police in Scotland near where Hamid was running a training camp, far away from their residences in London.[59] A former crack cocaine addict who had founded the al-Koran bookshop on Chatsworth Road, East London, Mohammed Hamid is currently in jail having been convicted of soliciting murder and providing terrorist training.[60] Most notoriously, in May 2004 he ran a training camp in Cumbria where four of the July 21, 2005, bombers attended.[61] Also at the camp was a pair of men who were later detected to have gone to Somalia in May 2005 with three other friends as part of what security services assessed was “for purposes relating to terrorism.”[62] J1 admitted knowing the men had gone to Somalia, although he claimed he thought it was for “religious purposes.”[63]

Around a month later, on July 21, 2005, J1 was in telephone contact with Hussain Osman—one of the men responsible for the attempted London bombings that day (also present at Mohammed Hamid’s camp).[64] His role in al-Berjawi’s tale is similar to that with the May 2005 group that went to Somalia. According to court documents, by 2009 J1 was a “significant member of a group of Islamist extremists in the UK” and in this role he provided support for al-Berjawi, Sakr and a third acquaintance when they went to Somalia in late 2009.[65]

Conclusion
The narrative around al-Berjawi shows the shifting relationship between al-Shabab and al-Qa`ida’s East Africa cell. His travel to the region in 2006, and then again in 2009, was during the period when jihad in East Africa was of great appeal to Western aspirants seeking jihadist adventures. The emergence of the ICU that at first seemed to emulate the Taliban provided inspiration that was then spurred on with the invasion of Somalia by U.S.-supported Ethiopian forces in 2006.[66] With the withdrawal of Ethiopian forces and the subsequent overstretch by al-Shabab, however, Somalia appears to have become a less welcoming place for foreigners seeking to advance a narrative of global jihad.[67]

This is not to say that the jihad in Somalia no longer has its foreign adherents. The elusive Samantha Lewthwaite, the convert wife of July 7, 2005, bomber Jermaine Lindsay, remains at large in East Africa and is accused of being a key figure in al-Shabab cells outside Somalia.[68] Canadian passport holder Mahad Ali Dhore was among those involved in the attack on the Mogadishu Supreme Court in April 2013.[69] Most significantly, al-Shabab claimed that a number of foreign fighters—including Americans—participated in the recent Westgate Mall attack in Nairobi.[70]

Yet Somalia has lost some of its luster, something that has been accelerated by the emergence of alternative battlefields like Syria or North Africa as places where young Western jihadist tourists can go. This is a situation that could reverse itself, but until some greater clarity is cast over Godane’s power grab in the organization and the status of al-Shabab, it seems likely that fewer foreigners will be drawn to that battlefield. The life and times of Bilal al-Berjawi offer a window with which to see the waxing and waning appeal of East Africa for Western jihadists.

Raffaello Pantucci is a Senior Research Fellow at the Royal United Services Institute (RUSI) and the author of the forthcoming We Love Death As You Love Life: Britain’s Suburban Mujahedeen (Hurst/Columbia University Press).

[1] “A Drone Strike Pronounces a Martyr,” al-Shabab, January 21, 2012.

[2] Tom Whitehead, Mike Pflanz and Ben Farmer, “British Terror Suspect Linked to ‘White Widow’ Samantha Lewthwaite Reportedly Killed,” Telegraph, September 12, 2013. In fact, it is not clear whether the individual identified in the article was the same Briton killed alongside Hammami, although it seems clear that the kunya identifying him as British was correct (Osama al-Britani).

[3] One Ugandan report also gave him the following pseudonyms: Hallway Carpet, Omar Yusuf and Bilal el Berjaour. See Barbara Among, “Police Foil Another Bomb Attack in Kampala,” New Vision, September 25, 2010. An online biography released about al-Berjawi also mentioned he liked to use the name Abu Dujana.

[4] Among; Chris Woods, “Parents of British Man Killed by US Drone Blame UK Government,” The Bureau of Investigative Journalism, March 15, 2013.

[5] This quote is based on a Twitter conversation between this author and the @abumamerican Twitter handle, April 19, 2013. Omar Hammami is believed to be the owner of that handle.

[6] Woods.

[7] “A Drone Strike Pronounces a Martyr.”

[8] Secunder Kermani, “Drone Victim’s Somalia Visits Probed,” BBC, May 30, 2013.

[9] Personal interview, Tam Hussein, community worker who knew al-Berjawi, London, August 2013.

[10] Ibid.

[11] Woods.

[12] For the entire series “Biographies of the Flags of the Martyrs in East Africa,” see http://www.jihadology.net/category/biography-of-the-flags-of-the-martyrs-in-east-africa.

[13] See “Biography of the Martyred Figures in East Africa 4: ‘Abd Allah Fadil al-Qamari,’” available on Jihadology.net, which seems to draw on Fazul Mohammad’s own published biography, “War on Islam,” and interviews with individuals like al-Berjawi.

[14] “Biography of the Martyred Figures in East Africa 5: Bilal al-Birjawi al-Lubnani (Abu Hafs),” available on Jihadology.net.

[15] Ibid.

[16] This video is available at http://www.youtube.com/watch?v=dPQGhZaxD5A&feature=youtu.be.

[17] Woods.

[18] BX v. The Secretary of State for the Home Department, Royal Courts of Justice, 2010.

[19] Ibid.

[20] Woods.

[21] “Biography of the Martyred Figures in East Africa 5: Bilal al-Birjawi al-Lubnani (Abu Hafs).”

[22] Milton Olupot, “Security Hunts for Somali Terrorists,” New Vision, November 8, 2009.

[23] J1 v. The Secretary of State for the Home Department, Royal Courts of Justice, 2013.

[24] Olupot.

[25] “Biography of the Martyred Figures in East Africa 5: Bilal al-Birjawi al-Lubnani (Abu Hafs).”

[26] Ibid.

[27] Woods.

[28] Elias Biryabarema, “Uganda Bombs Kill 74, Islamists Claim Attack,” Reuters, July 12, 2010.

[29] Among.

[30] In fact, it is not entirely clear how separate the two organizations were at this point. The al-Qa`ida in East Africa cell seems to have been quite small and largely part of al-Shabab’s community.

[31] “Biography of the Martyred Figures in East Africa 5: Bilal al-Birjawi al-Lubnani (Abu Hafs).”

[32] “Biography of the Martyred Figures in East Africa 4: ‘Abd Allah Fadil al-Qamari,’” available on Jihadology.net.

[33] “Answers to the Open Interview with the Mujahid Shaykh [Omar Hammami] Abu Mansur al-Amiriki,’” The Islamic World Issues Study Center, May 2013, available at Jihadology.net.

[34] Woods.

[35] Thomas Joscelyn and Bill Roggio, “Senior Shabaab Commander Rumored to Have Been Killed in Recent Predator Strike,” The Long War Journal, July 9, 2011.

[36] “Biography of the Martyred Figures in East Africa 4: ‘Abd Allah Fadil al-Qamari,’” available at Jihadology.net.

[37] Ibid.

[38] “Biography of the Martyred Figures in East Africa 5: Bilal al-Birjawi al-Lubnani (Abu Hafs).”

[39] “Al Qaeda Leader Killed in Somalia Blast,” The Star [Nairobi], January 24, 2012.

[40] This confession video was purportedly filmed by al-Shabab. It is worth noting that in the video the group alternates between accusing the CIA or Britain’s MI6 of being responsible for handling Hassan. The video was posted in May 2013 and is available at http://ia600707.us.archive.org/22/items/3d-f7dhrhm-2/SoBeware2_HQ.m4v.

[41] Ibid.

[42] Ibid.

[43] Ibid.

[44] Ibid.

[45] Ibid.

[46] Ibid.

[47] Rashid Nuune, “Al Qaeda, al-Shabaab Pledge Allegiance…Again,” Somalia Report, February 9, 2012.

[48] Mohammed Odowa, “Al Barjawi Assassination Widens Rift in Shabaab,” Somalia Report, January 23, 2012.

[49] Ibid.

[50] “Al Qaeda Commander Killed in Somalia Blast,” The Star, January 24, 2012.

[51] It is worth noting that in the East Africa martyrs biography about Berjawi, Fazul’s death is characterized as being a “planned” assassination, suggesting it was not an accident.

[52] This detail is based on a Twitter conversation between this author and the @abumamerican Twitter handle, April 19, 2013. Omar Hammami is believed to be the owner of that handle.

[53] “Godane Loyalists Reportedly Execute al-Shabaab Leader Ibrahim al-Afghani,” Sabahi, June 28, 2013.

[54] Whitehead et al.

[55] Hassan M. Abukar, “Somalia: The Godane Coup and the Unraveling of al-Shabaab,” African Arguments, July 3, 2013.

[56] This could certainly be true as al-Berjawi clearly was a focus of Western intelligence efforts.

[57] J1 v. The Secretary of State for the Home Department.

[58] Ibid.

[59] Ibid.

[60] Duncan Gardham, “Airlines Plot: Al-Qaeda Mastermind ‘is Still Alive,’” Telegraph, September 10, 2009.

[61] Dominic Casciani, “Top Extremist Recruiter is Jailed,” BBC, February 26, 2008.

[62] J1 v. The Secretary of State for the Home Department.

[63] Ibid.

[64] Ibid.

[65] According to court documents: “In October 2009 Berjawi, Sakr and Rahman travelled from the UK to Somalia for the purpose of terrorist training and terrorist activity in Somalia. The appellant knew in advance about the travel plans of those three men and the purpose of their expedition.” See ibid. Confirmation of support is provided through a separate court document: J1 v. The Secretary of State for the Home Department, “Deportation – Substantive (National Security) – Dismissed,” 2011.

[66] It emulated the Taliban in the sense that it was an Islamically driven movement seeking to restore order to a land overrun by warlords.

[67] Most publicly, this has been seen in the struggle around the American Omar Hammami whose writings and online activity on YouTube and Twitter highlighted the disagreements between the various factions in al-Shabab, but traces of it can also be found in Bilal al-Berjawi’s tale.

[68] Mike Pflanz, “White Widow Samantha Lewthwaite ‘was Plotting to Free Jermaine Grant,’” Telegraph, March 13, 2013. It is worth noting, however, that it was her new husband, Habib Ghani, who died alongside Omar Hammami. See Whitehead et al.

[69] Michelle Shephard, “Probe Focuses on Canadian as Shabaab Leader of Somalia Courthouse Attack,” Toronto Star, April 15, 2013.

[70] David Simpson and Arwa Damon, “Smoke Rises Over Besieged Kenya Mall,” CNN, September 23, 2013