Daveed Gartenstein-Ross and Nathaniel Barr
In late May 2016, the Islamic State (ISIL) released an audio statement featuring Abu Muhammad al-Adnani, the group’s chief spokesman, celebrating the upcoming lunar month of Ramadan. Adnani exhorted ISIL’s supporters to make Ramadan “a month of calamity everywhere for the non-believers” and urged everyone considering migrating to the caliphate to instead carry out attacks in their home countries. Adnani’s statement proved to be an ugly portent of things to come. Militants acting in ISIL’s name struck in over 10 countries during the group’s Ramadan offensive. Highly visible attacks in Istanbul, Dhaka, Orlando, and Baghdad together left hundreds of civilians dead as operatives targeted airports, restaurants, night clubs, and shopping centers.
While almost all of these attacks were claimed by ISIL, observers have expressed skepticism about the extent of the organization’s involvement. Some argued that ISIL’s role in most attacks during Ramadan was limited to providing ideological inspiration and encouragement to so-called lone wolves or wolf packs, who may have mobilized in response to Adnani’s call to arms but did not coordinate with ISIL operatives.
Yet, a growing body of evidence suggests that the Ramadan offensive was largely a coordinated and deliberate ISIL campaign. Though some militants may have acted of their own accord, it is probable that ISIL as an organization played a pivotal role in organizing and directing the majority of attacks that occurred during Ramadan. Some attacks, such as the Istanbul and Baghdad bombings, were centrally directed by ISIL attack networks, with the organization deploying trained operatives. Other operations were the product of collaboration between local networks and ISIL operatives based in Syria and Iraq, who helped to organize and coordinate the attacks remotely. Through this combination of both central and virtual planning, ISIL mounted an unprecedented wave of attacks.
This is a model that ISIL is likely to replicate in the future.
The Tip of the Spear
The Ramadan offensive bears the hallmark of the Amn al-Kharji, the Islamic State’s secretive external operations wing, which is responsible for planning espionage activities and terrorist operations outside the caliphate’s core territory. Under the guidance of an enigmatic Frenchman known by his nom de guerre, Abu Sulayman al-Faransi, the Amn al-Kharji built a robust infrastructure that enables it to coordinate and direct attacks across the globe. Faransi, who is believed to have played an integral role in planning the November 2015 Paris attacks, directs a cadre of theater commanders who are responsible for coordinating terrorist operations in different regions, including those as far afield as Southeast Asia and Europe. These theater commanders are the center of gravity within the Amn al-Kharji and featured prominently in the Ramadan campaign, directing operations and providing guidance to local networks.
Relatively little was known about the Amn al-Kharji’s structure in various theaters until the March 2016 attacks in Brussels. Subsequent investigations helped peel back the layers on ISIL’s European network. At the helm of the European network is Salim Benghalem, who served as an ISIL prison guard in Syria before ascending the Amn al-Kharji’s ranks. Benghalem’s highest profile deputy is Fabien Clain, a French convert to Islam who likely selected the Bataclan theater as one of the targets of the November 2015 Paris attacks. These two operatives, who are believed to be in Syria or Iraq, have been remarkably successful at running operatives and networks into Europe.
The Ramadan campaign pulled back the curtain on ISIL’s external operations networks in other parts of the world. The June 28 assault on the Istanbul airport, like the Paris and Brussels attacks, appears to have organized and coordinated by an experienced Syria-based external operations planner. According to Turkish police, the attack’s mastermind was Ahmet Chatayev, a Chechen-born militant and former member of the Caucasus Emirate who now resides in ISIL-controlled territory. In October 2015, the United Nations concluded that Chatayev was involved in training and deploying Russian-speaking militants to Russia to conduct terrorist attacks there. Meanwhile, the three attackers who perpetrated the Istanbul attack are believed to have traveled from Raqqa to Turkey about a month before that attack, reportedly bringing suicide vests and bombs with them. This evidence leaves little doubt that the Islamic State centrally planned the Istanbul airport attack.
Chatayev’s role in the Istanbul attack signals a shift in the Islamic State’s external operations in Turkey. Previous Islamic State attacks in Turkey had been coordinated by the group’s Turkish network, which is led by Turkish citizens, including the former al-Qaeda operative Halis Bayancuk (a.k.a. Abu Hanzala) and Mustafa Dokumacı, who ran a network out of the southeastern Turkish province of Adıyaman. Chatayev’s involvement in the Istanbul airport attack suggests that ISIL is now using Russian-speaking units to perpetrate attacks in Turkey. Turkish intelligence officials similarly concluded that ISIL instructed militants from the Caucasus region and Azerbaijan to conduct operations in both Turkey and Azerbaijan.
Statements from security officials indicate that other attacks in ISIL’s “near abroad” (the region surrounding ISIL-controlled territory) during Ramadan were similarly directed by operatives inside the caliphate. A spokesman for the Saudi interior ministry asserted that the three suicide attacks that struck Saudi Arabia on July 4 were planned in Syria, and he suggested that the suicide vests for the attacks may have also been built abroad. Similarly, Lebanon’s interior minister concluded that the eight suicide bombers who attacked the northern Lebanese town of al-Qaa on June 27 came from Syria.
The attacks in Lebanon, Saudi Arabia, and Turkey paint a clear picture of ISIL’s external operations capabilities in its near abroad. ISIL has developed robust networks in countries across the Middle East by both tapping into local recruitment pools and deploying operatives from inside the caliphate to set up shop in neighboring states. The leadership of the Amn al-Kharji has maintained direct contact with its cells abroad, and the Ramadan campaign highlighted ISIL’s ability to mobilize these networks as a part of a coordinated campaign.
The Virtual Planners
The Ramadan campaign also shed light on the Islamic State’s approach to coordinating and directing attacks elsewhere in the world. In regions far from ISIL’s territorial stronghold, the group’s ability to play a hands-on role in operational planning may be somewhat limited. Thus, ISIL engaged in what can be described as virtual planning: having Syria-based foreign fighters coordinate attacks via online communications with local networks in the fighters’ countries or regions of origin. Though ISIL sacrifices some command and control over attacks through this approach, the virtual planning model greatly expands the group’s operational reach. Virtual planning has become a cornerstone of the Amn al-Kharji’s strategy and a key element of the Ramadan campaign.
ISIL’s unsuccessful attempt to coordinate an attack in India during Ramadan provides an example of how the group has used virtual planning. In late June, Indian security services disrupted an ISIL cell in Hyderabad, arresting five individuals and recovering weapons, ammunition, and chemicals. Following the arrests, Indian officials learned that the cell had been planning to conduct a series of attacks on police stations, malls, places of worship, and other targets.
Investigators soon learned that the cell had been in contact (possibly via encrypted email software) with Shafi Armar (a.k.a. Yusuf al-Hindi), a former member of Indian Mujahideen and the current head of Ansar-ut Tawhid, ISIL’s South Asian wing. According to Indian authorities, Armar, who is believed to be in Syria or Iraq, instructed the cell to use TATP, the same explosive used in both the Paris and Brussels attacks, and to develop an escape plan. Members of the Hyderabad cell also reportedly sent a scanned letter to Armar pledging allegiance to ISIL’s caliph, Abu Bakr al-Baghdadi.
Armar’s involvement in the Hyderabad plot illustrates how virtual planners can direct attacks in the far abroad. Hisconnections with ISIL recruiters in India likely enabled him to identify a pool of operatives. He provided operational and technical assistance to the cell, instructing the group on the construction of explosives and shaping the group’s attack plan. The cell’s failure to carry out the attack highlights a major obstacle of virtual planning: Local networks that have not received in-person training may not possess the expertise to perfectly follow their handlers’ instructions. (Virtual planning also leaves cells more at risk of being detected by SIGINT efforts.) Still, Armar’s ability to run networks inside India illustrates the potency of the virtual planning model. And since Armar is responsible for the Amn al-Kharji’s South Asia portfolio, he may have been involved in the early July assault on the Holey Artisan Bakery in Dhaka. ISIL claimed the Dhaka attack while it was still in progress, the first time the group has done so, suggesting that ISIL may have been aware of the attack before it occurred.
ISIL used the virtual planning model to activate networks elsewhere in Asia during the Ramadan campaign. According to Malaysian security officials, two militants who threw a hand grenade into a nightclub in the western Malaysian state of Selangor in late June received orders from Muhammad Wanndy Mohamed Jedi, a Malaysian ISIL operative based in Syria. He has been featured in numerous propaganda videos, including one where he beheaded a Syrian man. Similarly, a suicide bomber who struck a police station in the Indonesian city of Solo in early July reportedly received instructions, via an unspecified mobile messaging application, on building explosives from Bahrun Naim, an Indonesian militant based in Syria. Naim is one of the top officials in the Islamic State’s Southeast Asian wing, Katibah Nusantara. He was previously involved in directing the January 2016 Jakarta attack, highlighting his proficiency as a virtual planner. Neither the Malaysia operation nor Indonesia suicide attack resulted in fatalities, again illustrating the limitations of virtual planning. But ISIL’s success in mobilizing cells in countries thousands of miles from the caliphate underscores the utility of the virtual planning model. Not all such attacks will similarly fail.
A Professional Network
The Ramadan campaign consisted of a series of coordinated and premeditated attacks. Obviously, there are fundamental differences between centrally planned operations (such as the Istanbul airport attack) and attacks coordinated by virtual planners, with the latter generally being less sophisticated and less lethal. But it is remarkable, and worrisome, how many of the Ramadan attacks are clearly linked to the Amn al-Kharji. And the group’s ability to use encrypted online communications to interact with operatives abroad leaves open the possibility of links that have not yet been discovered.
In essence, ISIL operates a professionalized external operations wing that is capable of directing and coordinating operations across the globe. Attacks that seem disparate or disconnected may actually be part of a broader campaign. Attackers who appear, at first glance, to have acted alone may be linked with a clandestine network.
As we investigate the heinous assault in Nice, we should keep this in mind.
