Posts Tagged ‘counter-terrorism’

Another short comment piece for London’s Evening Standard in the wake of the Parsons Green incident, and a brief discussion with Sky News.

Low-level plots like Parsons Green need even more vigilance


Armed police patrol in Westminster Underground station following the attack last week Getty Images

London has now faced its fourth terrorist attack this year. As details emerge, new peculiarities are uncovered. The brutal reality, though, is that low-level terror plots like that at Parsons Green are becoming the norm.

This is not a tacit admission of defeat, but rather a warning that we are facing an increasingly diffuse threat. This means we all have to be alert, while the authorities need to maintain and even step up the tempo of their effort to stay ahead of the threat.

There are some novel peculiarities around the Parsons Green attack. A bomb left on an Underground train with a timer is something that had not been seen for some time. Most recent bombers seemed to have had suicidal intent.

While most recent plots have been conducted by UK-born individuals, the potential presence of refugees in this attack is not entirely new.  IS’s pro-forma claim to be behind the attack lacks evidence of prior knowledge, but it is perfectly possible those responsible may have assimilated some of its ideology.

This is the larger context that the authorities are contending with: a threat made up of disparate individuals launching attacks using rudimentary and home-made means. The time it takes for them to be galvanised into action continues to shrink, and terrorist groups are emitting an ever more basic message to encourage sympathisers to launch attacks.

Given the easy access and diffuse nature of the ideology and attack methods it becomes very difficult to maintain complete cover. On top of this, the authorities are seeing more individuals who were previously under suspicion moving back into current investigations, and a continuing inflow of people from troubled areas — a limited number of whom may arrive with lethal intent.

The good news is that all terrorists are finding it increasingly difficult to launch large-scale coordinated plots.

The greater danger appears to be among the broader community from whom terrorists come. More work needs to be done tying together the many different information streams that authorities have access to and more thought given to how to prioritise them. And the pressure needs to be kept up in keeping known figures under adequate surveillance.

But there is a role for the public too. There is an onus on us Londoners to keep our eyes open.

As a child in London, I recall constant public campaigns about potential IRA devices on public transport. Tubes were held up by abandoned bags, but many attacks were prevented. There needs to be a return to this approach. We all need to keep our eyes open to protect the society in which we live.

Raffaello Pantucci is director of international security studies at the Royal United Services Institute (RUSI)

Advertisements

A final piece after a busy week, this time in a first time for London’s Evening Standard. A somewhat downbeat piece, part of a series like this over the week that try to take a longer view on the current threat picture. Undoubtedly, there will be more on this topic to come.

Spoke to a few media outlets over the past few weeks. To Politico about al Muhajiroun after the London Bridge attack, to the National about the disrupted Sydney airplane plot, to Newsweek about Israel’s views on the war in Syria, and to ABC, ITV, New York Times, Washington Post, Guardian and the Globe and Mail about the Barcelona attacks.

Using vehicles in crowded streets is a desperate tactic by fanatics struggling to make a lasting impact

High alert: Spanish police patrol the streets of Barcelona the morning after the vehicle attack which killed 13 people
High alert: Spanish police patrol the streets of Barcelona the morning after the vehicle attack which killed 13 people Getty Images

A balmy summer’s evening once again disrupted by terrorism. Tourists mowed down as they enjoy their well-deserved holidays. The incidents in Las Ramblas, Barcelona, and later in the seaside resort of Cambrils — and the wider network that is being uncovered around it — reminds us once again of the threat from international terrorism that European cities face. It is only two months since London faced its last attack. It is unlikely that this will be the last.

Given that launching an “IS-style” attack is as easy as getting a knife or car and attacking random citizens, suddenly the group has sanctioned a vast range of potential activities. For the perpetrators this model is deeply appealing as it will elevate them from being individuals simply stabbing or driving people down to a holy warrior advancing a global cause. This is a classic win-win, with the organisation and individual benefiting from the atrocity without any particular demonstration of connection beyond the individual having possibly read the group’s material online at some point.

But in this case, the other incidents that authorities have confirmed, including the deaths of five men in Cambrils who were reportedly wearing fake suicide vests and a number of other arrests, suggest something more substantial. This could be IS, which has claimed responsibility, though it could also be al Qaeda or some other network — Barcelona, it is worth remembering, was the focus of a plot in January 2008 when a cell connected to the Tehrik e Taliban Pakistan (TTP) was believed to be planning a suicide bomb attack on the city’s metro using perpetrators sent from Pakistan.

Yet it is not clear that it really matters any more who is responsible for such acts. Jihadist groups may have some sectarian and leadership differences but seen from the victims’ perspective they are all the same. The point is that terrorist groups are substantial and consistent in their desire to launch attacks against us. There is no actual dichotomy within IS or any terrorist group about launching either small-scale or large-scale attacks. These groups are dedicated to their cause and will do whatever they can deliver their brutal message to us. For them, launching small-scale attacks does not mean stopping attempting larger ones. From the security perspective, the appearance of more lower level-style attacks suggests a degree of success by security agencies as it suggests it has become too difficult to get bigger plots through.

Second attack: Armed police in Cambrils following a second attack in Spain (EPA)

Understanding attribution when it comes to the so-called Islamic State is not as easy as it sounds. The group has made an art out of spreading its extremist ideas and very basic attack methodologies as widely as possible. This means there are often terrorist attacks where individuals will launch an attack model emulating what is widely perceived as “IS-style”, without demonstrating any particular link to the group, and yet at the same time the group will claim them.

Al Qaeda first advocated the notion of using a car in mowing down the public in the October 2010 edition of its magazine Inspire. This methodology was in fact considered too much for the al Qaeda leadership, with Osama bin Laden reportedly reading the magazine in disgust and telling other acolytes that he did not consider this “proper terrorism”. Yet the methodology stuck in its simplicity, and while we saw a number of attempted or semi-attempted attacks deploying it, it was in Nice last year that its success was crystalised. The extremists leapt on this idea and issued repeated declarations in advance of this style of attack.

The difficulty for terrorist groups, however, is that as we see this patter of small-scale attacks become more regular, they will lose impact among the public. Clearly, individuals who have suffered directly in such incidents will never be the same after seeing such an incident close up. The sheer brutality of watching random fellow citizens mown down by a truck or stabbed in front of you will leave unspeakable psychological damage.

Armed police officers patrol a deserted street in Las Ramblas, in Barcelona, on Friday morning. (AP)

But while the individual may suffer, society overall will move on. And over time, lose interest in such atrocities. This is not a reflection of a lack of humanity but rather of the fact that for terrorism to be effective it must be shocking so the low-level campaign being waged now will lose its impact, something that will make individuals question whether they are willing to sacrifice themselves for this cause. Undoubtedly some still will, but increasingly this will be confused and damaged individuals whose ideological purity will be limited, and therefore will prove to be poor carriers of the extremist message that groups such as al Qaeda or IS are seeking to deliver.

This suggests that there is an end in sight for this style of attack. While it is doubtful that it will ever completely disappear (its simplicity suggests it will always prove to be a last resort for desperate individuals), it is also likely that we will see groups pushing towards more targeted or sophisticated efforts to re-assert their authority and deliver their message in a coherent fashion.

None of this will, of course, change the misery wrought in Barcelona. Terrorism has been a feature of organised human society for a long time — in Spain, prior to the current wave of Islamist terrorism, the separatist group ETA murdered hundreds in a campaign that lasted decades. But it is not clear that this path is sustainable for the terrorist organisations. While it provides a useful way of distracting security services and raising a cause, with limited broader public effect it is not advancing a strategic goal.

This ultimately is what terrorist groups are seeking to do: change the world and persuade us all of their message. If they cannot do this, they will fade away as supporters lose interest in such a clearly losing cause.

Raffaello Pantucci is director of international security studies at the Royal United Services Institute

Late to post this, as it was published over a week ago in the Telegraph on the anniversary of the July 7 bombings.

Twelve years on from the 7/7 atrocities, the terror threat has evolved. Have our defences?

We are always fighting the last war. As we reach the twelve year anniversary of the July 7, 2005 attacks it is worth taking stock of how much the threat picture from terrorism we face has changed, and ask whether our response has kept pace. From a terrorist threat that was directed by al-Qaeda using radicalised British nationals trained at camps in Pakistan, we are facing a threat of lone individuals launching confusing attacks with household weapons. It is not yet clear that our response has caught up.

Prior to 7/7 it was hard to conceptualize the fact that British nationals would commit suicide bombings at home. But once it happened, it became the norm, with security services spending much of the next decade countering similar plots. In doing so, they began to understand how the networks worked, what the processes and communications methods were, and how al-Qaeda saw British nationals as useful tools to strike against the West. Having understood the threat, they were able to develop measures to counter it, and find ways of getting into networks. What was once a source of strength, was steadily uncovered as a source of weakness, and security services adapted their practice to disrupt such networked plots.

But having closed one door, another opened. Still determined to launch attacks, terrorist groups have adapted and individuals now are instigated, inspired or directed remotely. The plots they are advancing are low tech and require little training. This shrinks the plotters footprint, making it much harder for security agencies to catch them in their nets. A link abroad still exists – and in some cases, like Salman Abedi in Manchester, a strong link – but the majority of cases appear to be more isolated with trace links abroad or to a broader radical milieu.

To counter this evolving menace a new posture needs to be taken. In the first instance, it is clear that more capacity is needed. This is something that has been clear for some time, and security agencies are growing – but this takes time to mature into useful capacity.

Second, we need to find a way of re-focusing and sharpening the way that residual or peripheral cases are managed. As we have seen in all three of the recent violent Islamist attacks in the UK, the individuals involved were people who had featured in previous investigations, but were never the main targets. Over time, the pool of individuals who fit into this category will only grow. While undoubtedly the Security Service will have to keep some attention on them, a new agency or cross-departmental team could be formed to instead focus on each case in a more intense fashion and to make sure they are getting off a path towards radicalisation. A methodical and refreshed look at them by a non-secret agency in light of the current threat picture might be useful and clear time for security agencies to focus on other priority cases.

Third, we need to get ahead of ideologies and methodologies. There are two parts to this: first, greater attention needs to be paid to the extreme right wing. It has a capacity to shock, cause misery and greater tensions that in turn exacerbate the violent Islamist threat. At the moment our focus is on violent Islamists, and yet we can see on the right wing a consistent pattern of threat and hints towards coordination and competence. Second, we need to explore new ways of mining and managing the data that is collected. The security agencies are clearly tracking new technologies that can support counter-terrorism analysis, but using AI may help throw up leads which are currently being missed among the mass of information. While this will never be completely accurate, given the disparate nature of the threat that is faced, and the manner in which it has recently kept popping out of the woodwork, it is worth considering whether something like this might help pick up some hidden leads.

Fourth, we need to have a more mature public conversation about the nature and reality of the threat that is faced and how safe we are from it. Statistically, there are innumerably more things that are threats to your health than terrorism. We are also not facing an existential threat. And we are unlikely to eradicate it in the near term future. All of these realities need to be discussed in a way that steers clear of the polemical side of the conversation that tends to crowd the public forum. Most organized human societies have faced terrorism in their histories – and in most cases they have survived. The few that have been changed have usually done so because of the overwhelming nature of the failures of governance by the power that was overthrown.

Finally, we need to make sure we do not make obvious missteps and exacerbate the very threat we are trying to counter. This means not cutting off (or threatening to) intelligence sharing with crucial allies in Europe. Not talking in the same clash of civilization terms that the extremists do. Not politicising counter-terrorism work in a way that means its effectiveness becomes stunted. And not standing idle while terrorist groups gather abroad. As we have repeatedly seen, they will come back and strike us in due course. None of these measures will likely eradicate terrorism in the medium term future, but they will set us on a course that will go in that direction and keep us even safer than we already are from terrorist attacks.

Raffaello Pantucci is the Director of International Security Studies at RUSI

More catch-up posting, this time for the Telegraph looking at trying to understand the difficulties around intelligence and counter-terrorism. Got various media posting to also catch up on, but will do soon.

Intelligence is fragmented by nature – sometimes terrorists will slip through

Three knife-wielding assailants led a deadly rampage through central London on Saturday. One was known to UK intelligence, another to the Italian police
Three knife-wielding assailants led a deadly rampage through central London on Saturday. One assailant was known to UK intelligence, another to the Italian policeCREDIT:  MATTHEW CHATTLE/BARCROFT IMAGES

It has become habit that in the wake of a terrorist incident it is soon uncovered that security agencies were aware of the individuals in question. The immediate assumption therefore is that there was a clear failure, with questions understandably asked about why those involved had not been detained and prevented from carrying out the atrocity.

The problem is that this assumption is based on fragmentary information.

First, the wider picture is unknown. How many other people were there in view at that moment in time, and how did the behaviour of the individual who launched the attack match up to theirs?

Maybe he was not doing anything particularly suspect, while the others being watched were in the midst of undertaking suspicious behaviour which appeared far more menacing. The more menacing person will merit greater attention while the other will be observed in a slightly less intense fashion.

This is ultimately a process of prioritization, where choices to deploy resources are made on the basis of activity and information.

Second, someone who comes under the suspicion of intelligence agencies is not necessarily by default guilty. Security and intelligence agencies will gather a lot of information on a lot of people: but not all of them will require any deeper investigation.

Someone may appear in an investigation by default of who they live near, who they know or who they bump into for some reason. Some will require greater investigation to understand who they are, but the majority are irrelevant and simply passers-by who happen to have encountered someone who is malicious.

Those who are investigated to a greater extent, dealt with by the police and ultimately jailed are those who are undertaking activity that is against the law and against whom a specific criminal case can be made. We live in a country where due process and jury courts require the state to produce a burden of evidence to demonstrate guilt.

Third, security and intelligence agencies are not always very keen to demonstrate their methods. Consequently information that has maybe been gathered by covert agents or through technical means is not necessarily something that is usable in an open court.

In the case of the agent, their identity may be compromised, while the revelation of technical tools will give other terrorists the opportunity to learn about what they have to do to avoid detection in future. This means that sometimes information is gathered which cannot immediately be acted upon openly.

Clearly if suspects are moving towards violent or dangerous behaviour something will be done, but if they are not doing anything criminal, and there is no usable evidence of them planning something, then observation has to be the default.

Of course we have no clear idea at this moment whether any or all of these are the reason why the existing information on the various recent plotters was not acted upon.

Questions are being understandably asked about whether the process of prioritization is calibrated correctly. Three successful attacks from the broader pool of people known to the intelligence agencies is clearly a worrying reality. Have they adequately factored into the prioritization process patterns of behaviour by terrorist groups, new methodologies of attack and how radicalisation works these days?

It is worth noting that in many ways it is a good thing that intelligence agencies have knowledge of individuals who ultimately go on to commit terrorist atrocities. It would be even worse if they did not know who they were.

Should terrorists emerge completely from the void, questions would have to be asked about how it was they had no knowledge of them. Awareness demonstrates that they are looking at the right people and places.

The reality is that intelligence information is by its nature fragmentary. Unable to see inside people’s minds, security and intelligence agencies rely on assorted inputs to develop a picture on the basis of which they make judgements and assessments about who they should devote attention to watching.

The process by which these choices are made are subject to fairly constant revision and consideration, but unfortunately, they are not perfect.

None of this will of course provide comfort to those who have lost loved ones in an atrocity, but it is something that is important to bear in mind when considering what should be done in its wake.

Clearly security and intelligence agencies will have to review their processes, but care should be paid to not move to more extreme and draconian measures that will ultimately foster the very narrative that extremists advance.

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI)

Trying to catch up on various recent posts, though am a bit behind, so apologies. A few longer pieces have landed now as well. In the short term, here is something for my institutional home RUSI about what policy ideas could be advanced to manage the long-term threat that the UK faces.

What Policy Changes Are Needed after the Manchester Attack?

Raffaello Pantucci
Commentary31 May 2017
UK Counter-terrorismTackling ExtremismSecuring BritainTerrorism

A week after the atrocity in Manchester, it is now possible to draw some preliminary conclusions: there clearly was a breakdown in the intelligence flow that led to suicide bomber Salman Abedi slipping through the net; there are enduring questions about the UK’s Prevent anti-terrorism strategy; and, finally, there are the weaknesses of ‘soft targets’ that such an attack invariably expose.

It is, of course, impossible, without full access to information, to properly understand exactly the nature of the intelligence breakdown that led to last week’s suicide attack on an Ariana Grande concert in Manchester.

Still the fact that the bomber, Salman Abedi, was flagged up to authorities a number of times, by locals in Manchester, was travelling back and forth to a country that is a warzone and came from a family with strong militant pedigrees all indicate – without the benefit of hindsight – that he was someone who should have attracted attention.

If, as suggested, he was someone who had featured in previous investigations but was sidelined in favour of what were deemed to be more menacing targets, then the attack in which 22 people were killed and dozens wounded highlights what for the intelligence services remains a perennial question: how do you determine who seems more menacing when resources are limited?

This is not only a difficult calibration to make, it is also not a way to remove someone from concerns altogether. For, as we have seen repeatedly, individuals will sometimes rise back out of this pool of downgraded threats to pose an immediate danger.

And the challenge is immense. According to Security Minister Ben Wallace, there are about 20,000 in this larger pool of people who are not seen as an immediate danger but who, like Abedi, can suddenly become one.

What can be done to manage this problem? Additional resources would help, as well as new technologies such as super computers using artificial intelligence to manage the challenge through data-crunching looking for particular patterns of behaviour. Another method is to continually challenge previous assessments about the security risks that certain individuals may pose, a determination which is bound to shift over time.

However, the principle of proportionality also has to be borne in mind: having lots of security forces chasing those individuals not only requires more resources than are currently available, but may also end up exacerbating the very problem that they are trying to manage.

Other, more extreme ideas have been advanced: internment or enhanced restrictive movement orders. The first proposal is so clearly counterproductive that it bears no consideration; internment in Northern Ireland during the early 1970s became part of the problem, rather than the solution to terrorism troubles.

The second proposal – house arrests – has greater value, except in that it does not necessarily reduce the burden on security officials. An individual who has been placed under house arrest is not actually being dealt with; rather, he or she is being put in a very publicly visible ‘holding pattern’.

Similarly, excluding people from the UK – either through passport denial or exclusion orders – is not actually dealing with the challenge; it simply postpones a determination, and pushes the individual on to another country to be dealt with.

A proportion of the work managing this pool of 20,000 ‘lower-grade’ suspects will come under the contentious Prevent strategy of counterterrorism activity. And this raises another strand of debate to emerge from the Manchester atrocity: how to reform Prevent.

One aspect that should be undertaken is to separate out the different strands of the strategy. The work of managing dangerous offenders or suspects clearly needs to stay attached to the security realm, possibly through the creation of a new specifically developed and tailored service, modelled on the probation service.

Combining probation, welfare, police and intelligence, the new agency could be staffed by individuals who are each managing a specific case-load of former offenders or suspects.

Each case will require a different sort of engagement, but this may provide a way of both keeping an eye on such cases while also focusing on trying to get them on a different path.

A version of the Channel programme, which provides early support to individuals who are at risk of being drawn into terrorism, could be used; this will be a way of providing an individually tailored ‘light touch’ over-watch.

But other parts of the Prevent that are focused on more forward-looking efforts to steer people away from radical paths before they get on to them, should instead be moved firmly out of the criminal space.

Prevent is intended to be about keeping people away from ever getting to terrorism, and this means, among other measures, actually keeping them out of the criminal justice arena. Consequently, it would seem imperative that these programmes are not handled by a security department such as the Home Office.

Finally, there are some very understandable questions about the fact that the bomber was able to walk his device into a crowded space and kill so many. Most arenas nowadays are heavily guarded and people are subject to bag checks on entry.

Clearly, some additional thought must be given to reviewing entry and exit points to such sites, with the usual difficulties of agreeing where to draw the ultimate line of the security cordon.

Much work has gone into managing security in crowded spaces: the lessons learned need to be applied more rigorously and around the entire country. Sports events or concerts that by their very nature aim to be open and accessible will continue to pose a potential problem.

It is unlikely that this will be the last terrorist attack the UK faces. Coming during an election cycle, however, this incident offers an occasion for both introspection and new ideas as future governments continue to confront the challenge.

Banner image: Armed police stand guard at Manchester Arena after Salman Abedi’s suicide bomb attack during a Ariana Grande gig. Courtesy of PA Images.

It has been a very busy week in the wake of the atrocity in Manchester. A few pieces coming over the next few days, but first up something for the New York Times looking at the intelligence spat between the US and UK around the sharing of information during counter-terrorism operations. More to come on the broader theme of the attack itself.

Why Britain Gets Angry When America Is Casual With Secrets

LONDON — The leaking of sensitive information about the investigation into Monday’s terrorist attack on the Manchester Arena, including forensic images of bomb apparatus, to United States media caused dismay and anger among British officials. The prime minister, Theresa May, went so far as to raise the issue directly with President Trump when they met at Thursday’s NATO conference in Brussels.

To modify George Bernard Shaw’s maxim, Britain and America appear to be two countries divided less by a common language than by common secrets. While British investigators jealously guard detailed information about their operations, seeking to run their leads to ground before they are exposed to view, their American counterparts seem more willing to put what they know directly into the public domain.

The Anglo-American security relationship has deep roots. Intelligence sharing and cooperation sits at its heart. Forged in history, it has deepened over time through a shared assessment of the threats they face around the world. A key part of this is countering terrorism, a mutual threat that our two countries work closely together to fight. And yet, in fighting it, they have different approaches.

A policeman in Manchester, England, on May 25. CreditJon Super/Agence France-Presse — Getty Images 

The current tensions over Manchester are the latest public expression of an issue that has arisen before. In May 2012, British intelligence officials were exasperated when their role in an operation to disrupt a plot by Al Qaeda in the Arabian Peninsula — to repeat the 2009 underwear bomber plot with a more sophisticated device — was revealed. Before that, after the July 7, 2005 bombings in London, information about the nature of the bombs was leaked to the press by American sources early in the investigation. The chief of London’s Metropolitan Police at the time, Ian Blair, made a connection between that incident and the Manchester leak.

“I’m afraid it just reminds me exactly of what happened after 7/7,” he told the BBC, “when the U.S. published a complete picture of the way the bombs in 7/7 had been made up.” In 2005, he was concerned both about the impact of the images on victims of the bombing, and about how the disclosures could complicate the job of his officers investigating what had been the most serious Qaeda-inspired attack on Britain to date.

The frustrations have gone beyond the leaking of information being gathered after an attack. Back in 2006, British and American authorities disrupted the most extensive Qaeda plot they’d seen. Codenamed Operation Overt, the plan was to send a wave of up to eight suicide bombers on flights from Britain to North America using sophisticated liquid explosives they could smuggle on board. This is the root of the liquid ban on planes we still face today.

In close cooperation with their American counterparts, British authorities had been watching the cell, coordinated by a British Pakistani named Rashid Rauf who had risen up Al Qaeda’s ranks, for some time. They had discovered a bomb factory in East London where the group was making its devices. The moment was approaching to disrupt the plot, but the British authorities wanted to monitor it further to ensure they would sweep up the full network and have evidence that could be used in court.

But when the American authorities thought that someone connected to the network had managed to get onto a plane, they used their network in Pakistan to get Mr. Rauf picked up. This forced Britain’s hand. Such was the rush to action that unarmed surveillance officers had to step out of the shadows to grab the suspects before news spread about Mr. Rauf’s arrest.

One reason behind the divergence between British and American counterterrorism operations is that the British authorities prefer to watch and wait, gathering as much information as possible before moving into action. American agencies prefer a more aggressive approach to disrupting terrorist networks and plots. In part, this is a product of the legal system: Intelligence agencies in Britain closely guard the information they collect and do not usually allow it to be used in a court of law. This was visible during the subsequent trials of the Overt case, where prosecutors had to go three rounds with two hung juries before they were able to convict; one of the key figures was cleared and released notwithstanding his deeply suspicious links.

There are deeper cultural issues, too. This week, the government’s assessment of the threat of a further terrorist attack has led to the deployment of armed soldiers on the streets of Britain’s cities. This is something that would likely pass unnoticed in the United States, but it has caused great consternation here. British security officials are also uneasy about the number of American counterterrorism investigations that use undercover agents who often appear to act as agent provocateurs; in the British view, such operations would be regarded as entrapment by courts.

These tensions in the relationship seem to have intensified under the Trump administration. Some British counter-terrorism experts express concern that Mr. Trump’s rhetoric of aggressive confrontation may serve to bolster the very narrative of civilizational conflict the extremists use. The ties that bind Anglo-American intelligence cooperation are firm; the difficulty is how to maintain trust after this transatlantic spat. We face a common threat, and it would be dangerous to take for granted our common front in fighting it.

Going to catch up on a batch of belated posting today, starting with a piece for the Australian Strategic Policy Institute’s (ASPI) annual counter-terrorism yearbook looking in particular at what China has been up to in 2016.

China’s Terrorism Threat and Response in 2016

Raffaello Pantucci

Director of International Security Studies at the Royal United Services Institute

In August 2016, China experienced what appears to have been the first targeted terrorist attack against one of its embassies.1 A Uygur suicide bomber drove a car into China’s diplomatic compound in Bishkek, Kyrgyzstan, exploding it outside the ambassador’s residence; the attacker was the only fatality, but three Kyrgyz employees were injured. While Kyrgyz authorities were quick to link the attack to a Syrian-based network—although publicly available evidence to date has been limited—for Beijing the attack was the manifestation of an increased threat from Uygur groups, which had now spread beyond China to threaten Chinese interests abroad. Clear and substantial connections between Uygur groups and international terrorist networks were also confirmed in 2016.

During the year, China increased its external security presence to mitigate these threats, while attempting to balance this against its longstanding practice of non-interference. At home, it has continued a hardline approach to managing the Uygur issue in Xinjiang, and 2016 marked a new level of regional control in the region, including an almost complete halt to media reporting of security-related incidents.

China’s terrorist threat comes primarily from the divisions in China’s westernmost region of Xinjiang, where a Uygur minority resents rule from Beijing.2 That resentment has expressed itself through social tensions, an exodus of Uygurs from the country and violence against the state. Beijing has taken a two-pronged approach to dealing with the problem. In the rst instance, it has invested heavily in the region economically (including the‘Silk Road Economic Belt’, which has opened Xinjiang to regional trading markets), but at the same time launching regular ‘strike hard’ campaigns deploying heavy security measures to control the region and enacting new regional and national CT legislation.

Beijing’s focus on terrorism is primarily concerned with Chinese Uygurs, something that has attracted some international and human rights concern as potentially unfairly dealing with its own minority citizens.3 The national CT legislation has similarly attracted criticism for not balancing strong CT measures with transparent and fair judicial process, as well as for a broad de nition of terrorism that may be at odds with international law standards for free speech, freedom of religion and peaceful protest.

Reported terrorist incidents within China decreased in 2016, and then-regional Communist Party chief Zhang Chunxian stated in March that ‘violent terrorist incidents have dropped signi cantly.’4 Indeed, only one incident was reported: an attack on 29 December in Moyu (or Karakax) County in southern Xinjiang, where a group drove explosive-laden cars into a local Communist Party office. Reporting on casualties was mixed, although o cial sources reported that three attackers, one security official and one bystander were killed.5 The explosives, while rudimentary, appeared to demonstrate an increased level of sophistication for attacks in the region.

While this incident capped an otherwise quiet year, non-state sources suggest that more was going on but not being publicly reported. The day after the incident in Moyu/Karakax County, a report published by the Hong Kong-based advocacy group, the Information Center for Human Rights and Democracy, claimed that more than 1,000 violent incidents in Xinjiang in the past year weren’t reported in the press.6 The precipitous drop in reported incidents is indeed surprising, given previous levels of violence, which had been variously estimated at between a few hundred and 2,000 fatalities per year since 2013, but is difficult to evaluate due to the difficulties of undertaking independent research in the region.7

The reported decrease in incidents may be a product of a more aggressive government security posture in the region. In August, the regional government passed CT legislation supplementing national legislation passed earlier in the year. The local legislation was seen as far more wide-ranging than the national laws, focusing in particular on recruitment and radicalisation, the dissemination of extremist material (the definition of which was also expanded) and the deradicalisation of prisoners.8 Soon after its passage, a large CT exercise was undertaken in southern Xinjiang—the part of the region that remains majority Uygur—involving around 3,000 personnel and testing 21 new types of ‘high-tech equipment, including drones, assault rotorcraft and all-terrain assault vehicles’.9

The security approach was further sharpened during the year through changes to the regional party leadership. Leader Zhang Chunxian was moved to the post of Deputy Leader of the Leading Group for Party Building and replaced by Chen Quanguo, the former party chief in Tibet. Upon arriving in the region, Chen immediately introduced hardline policies re ecting those used in Tibet, including establishing a region-wide network of ‘convenience’ police stations, providing increased state presence and surveillance. Recruiting drives for security officers were launched in Xinjiang and neighbouring regions to increase the number available for deployment.10 The importance Chen attaches to shows of strength was demonstrated in the wake of the Moyu/Karakax County attack, when he hosted a large public oath-taking ceremony and CT exercise in Urumqi.11 Nevertheless, this heavy approach to security appears to be unable to completely address the region’s problems, and the attack at the end of the year showed that local anger can still erupt into violence that gets to public attention despite the government crackdown.

Outside China, Beijing has also faced an increasingly worrying threat picture. The August attack in Bishkek followed a growing number of worrying indicators that Uygur militant groups outside the country were gaining strength.

The Syria and Iraq battlefields have also provided opportunities for anti-Chinese groups to link with Islamist terrorist groups. The Turkestan Islamic Party (TIP) is the main Uygur terrorist group.

TIP’s close link with al-Qaeda was confirmed earlier in the year through a series of videos released by the two groups. In May, the leader of TIP, Abdul Haq, who had previously been believed killed, re-emerged and released an audio message in which he attacked ISIS, praised al-Qaeda, and highlighted TIP’s proximity to the latter.12 In July, al-Qaeda’s leader, Ayman al-Zawahiri, released a video as part of a bigger series called ‘Islamic Spring’ in which he specifically praised the Uygur contribution to the jihad in Afghanistan and beyond and elevated leaders from the group into the pantheon of senior jihadi leaders.13 Both videos carried threats for China, but in many ways the most worrying aspect for Beijing was the clearly warm and public embrace shared by the two groups.

Al-Qaeda has historically had close links with Uygur militants (Abdul Haq was identified as a member of al-Qaeda’s shura, or leadership council, as early as 2005 14) but has shown little interest in dedicating resources to the Uygur cause. The videos suggested the possibility of a change.

In Syria, TIP ghts mainly alongside Jabhat al-Nusrah / Jabhat Fateh al-Sham groups and regularly publishes videos showing large numbers of well-armed ghters engaged in combat across Syria, as well as releasing messages condemning Islamic State (IS) activity. While the main body of TIP fighters is engaged in ghting in Syria, Beijing considers that Abdul Haq is hiding in northern Afghanistan. The South Asian wing of the group appears to have moved into Afghanistan in response to the Pakistani Government’s Zarb-e-Azb push that ejected them from their previous base in Pakistan’s badlands.

Evidence from the Middle East shows that a substantial number of Uygurs have joined IS. Leaked IS documents indicate between 118 and 167 IS ghters are identifiably Chinese or Uygur. Additionally, Uygurs appear to have been picked up by Turkish authorities as part of the investigation into the New Year’s Eve attack in Istanbul. Yet while IS has added China to its list of enemies, it hasn’t dedicated many resources to attacking it.

The patterns of TIP and other militant Uygur activity in Afghanistan and Syria go some way to explaining increased Chinese security activity in both countries. On 14 August, People’s Liberation Army Navy Rear Admiral Guan Youfei met Russian and Syrian security o cials in Damascus, where he pledged China’s training support to Syrian medical staff.15 In Afghanistan, building on a long history of engagement, China sought to establish a new regional security subgrouping, bringing together the army chiefs of Afghanistan, Pakistan, Tajikistan and China to discuss border security and regional terrorist groups. Tajikistan has additionally publicly confirmed that China is helping to construct border posts between Tajikistan and Afghanistan.16

Beyond warzones, Uygur militants have demonstrated increased contact with Southeast Asian terrorist groups. In August 2016, Indonesian authorities shot and killed a Uygur linked to the East Indonesia Mujahidin, one of the main terrorist groups in Indonesia, led by Santoso.17 This was the tenth Uygur killed alongside the group. The Uygur group was allegedly seeking training with the East Indonesia Mujahidin before returning to China. In November, Nur Muhammet Abdullah al Faris was jailed in Indonesia for his involvement with a network planning a series of terrorist attacks in the region. The network was also reportedly involved in people smuggling to help Uygurs flee China and in some cases receive terrorist training. Some reports indicate that the group received money from TIP (or, as it was identified in the reports, the East Turkestan Islamic Movement), which it was using to advance its own goals as well as to support terrorist training for Uygurs.18

These developments indicate increasingly deep and substantial connections between militant Uygur groups and international terrorist networks. This menacing picture for China underscores the increased need for China to act against the networks externally. The 2016 national CT law recognised this, providing a broader mandate for Chinese security forces to act outside national territory to disrupt terrorist networks. And, as discussed above, China is also increasing the substance and visibility of its security forces beyond its national territory.

The question that remains, however, is the extent to which China’s actions may be exacerbating the very threat that it seeks to mitigate. China’s Uygurs see themselves as a persecuted minority that’s subject to restrictive legislation not imposed on any other groups in China, including other Muslim minorities.19 While there’s been substantial economic investment into Xinjiang, it’s unclear whether the benefits are filtering down to the Uygur community or remaining primarily with the politically and economically dominant Han community. And the lack of information coming out of the region means that it’s impossible to independently evaluate whether the ‘strike hard’ campaign has delivered results.

Certainly, the move of Zhang Chunxian from Xinjiang to Beijing and his replacement by former Tibet party leader Chen Quanguo suggests that the central leadership had mixed feelings about Zhang’s tenure in the region, although it’s hard to discern whether his move was related to failed policies in Xinjiang or his factional connections. Within Xinjiang, it appears that a hard line is taken against officials for failure in areas where attacks occur. A recent report indicated that the party chief in Moyu/Karakax County and the party secretary of Hotan Prefecture (where Moyu/Karakax is located) were both under investigation by the Discipline Inspection Committee for corruption and dereliction of duty, seemingly linking these investigations to the security failures associated with the 29 December incident.20

China’s terrorist problem continues to grow. Last year marked a new point with the attack on the Bishkek Embassy, and the broader threat indicators are not positive. As China continues to advance its ‘Belt and Road Initiative’, its nationals and companies are increasingly going to dangerous countries and potentially finding themselves in the cross-hairs of terrorist groups.21 Also, whereas previously China was able to shield itself from attack somewhat because terrorist groups saw the US and the broader West as their targets, this will change as Uygurs rise up the ranks of international terrorist networks and China assumes a more prominent role in international affairs.

Another side to China’s growing outward push reflects the country’s increasing desire to assert itself internationally and become a more normalised security actor in international affairs. While this is reflected in continuing assertiveness in China’s maritime relationships, on land it’s often seen through the lens of CT, on which China finds a more accommodating international consensus. For Beijing, CT offers a more acceptable way to test the limits of its ability to assert its security interests abroad. But the complicated domestic nature of China’s Uygur issue has led to some calls of concern from members of the international community. At the same time, however, Beijing finds an increasingly worrying international terrorism threat picture connected with its domestic concerns, requiring a more assertive posture. In future, it’s likely that these trends mean that Beijing will continue to crack down at home while expanding its efforts abroad.

Notes

  1. Chinese compounds have previously been struck by terrorist or insurgent networks, but the strikes have typically been incidental to being in a warzone and not speci cally targeted, or have been small-scale individual attacks, as seen in Bishkek in 2009.
  2. China has also faced a number of other incidents that have a terroristic aspect to them, including mass stabbings, occasional bombings and shootings, although for the most part those incidents have tended to be linked to individuals’ complaints against the state.
  3. See, for example, Javier C Hernandez, ‘China says 5 killed in attack on Communist Party o ce in Xinjiang’, New York Times, 29 December 2016, online.
  4. ‘“Violent terrorism” in China’s Xinjiang has dropped: party official’, Reuters, 8 March 2016.
  5. Cui Jia, ‘Terrorists strike, but progress made,’ China Daily, 30 December 2016.
  6. Kenji Kawase, ‘More than 1,000 violent clashes in restive Xinjiang this year’, Nikkei Asian Review, 30 December 2016.
  7. See, for example, reporting in Richard Finney: ‘As many as 700 died in Xinjiang violence in last two years, rights group says,’ Radio Free Asia, 3 March 2015, online and ‘“At least 2,000 Uyghurs killed” in Yarkand violence: exile leader’, Radio Free Asia, 5 August 2014.
  8. Chong Koh Ping, ‘Xinjiang gets tough on terrorism’, Straits Times, 5 August 2016; ‘Xinjiang issues China’s rst local counterterrorism law’, Xinhua, 5 August 2016.
  9. ‘China’s armed police hold anti-terror exercise in Xinjiang’, Xinhua, 15 August 2016.
  10. James Leibold, Adrian Zenz, ‘Beijing’s eyes and ears grow sharper in Xinjiang’, Foreign A airs, 23 December 2016.
  11. Eva Li, ‘Show of force in Xinjiang sends hardline message’, South China Morning Post, 3 January 2017.
  12. Thomas Joscelyn, Bill Roggio, ‘Turkistan Islamic Party leader criticizes the Islamic State’s “illegitimate” caliphate’, Long War Journal, 11 June 2016.
  13. Thomas Joscelyn, ‘Zawahiri praises Uighur jihadists in ninth episode of “Islamic Spring” series’, Long War Journal, 7 July 2016.
  14. UN Security Council Subsidiary Organs,‘QDi.268 Abdul Haq, reasons for listing’, UN Security Council Committee Pursuant to Resolutions 1267 (1999) 1989 (2011) and 2253 (2015) Concerning ISIL (Da’esh) Al-Qaida and Associated Individuals Groups Undertakings and Entities, summary published 13 August 2009, online.
  15. Christopher Bodeen, ‘Chinese admiral visits Syria in show of support’, Associated Press, 18 August 2016.
  16. ‘China to build outposts for Tajik guards on Tajikistan–Afghanistan border,’ Reuters, 26 September 2016.
  17. Ruslan Sangadji, ‘Last Uighur of MIT shot dead’, Jakarta Post, 18 August 2016.
  18. Nivell Rayda, ‘Uighur terrorists sent funds to Indonesia,’ The Australian, 6 September 2016.
  19. Alice Su, ‘China doesn’t mind Islamic extremists’, Foreign Policy, 16 December 2016.
  20. Jun Mai, ‘China probes senior Xinjiang party o cials days after deadly bomb attack’, South China Morning Post, 5 January 2017.
  21. The Belt and Road Initiative, also called ‘One Belt, One Road’, is China’s broad-ranging economic development and trade initiative, aiming to increase prosperity through developing land and maritime trading links. A feature of the initiative relevant to terrorism and CT is infrastructure development across areas in China and neighbouring Central Asia.