Daveed Gartenstein-Ross and Madeleine Blackman
On December 19, Anis Amri plowed a hijacked truck through the Christmas market in one of Berlin’s main public squares, killing 12 people. The following day, the Amaq News Agency of the Islamic State in Iraq and the Levant (ISIL) released a statement claiming responsibility for the attack. Although some characteristically skeptical commentators suggested that ISIL could just be taking credit for an attack to which it had no real connection, the militant group left no doubt four days later when it released a video showing Amri pledging his loyalty to ISIL’s leader, Abu Bakr al-Baghdadi. Investigators also determined that Amri had communicated with ISIL operatives at least once, through the encrypted Telegram messaging app.
Although much remains unknown about Amri’s case, it bears many of the hallmarks of ISIL’s “virtual planner” model of managing lone attackers. In this model, operatives who are part of ISIL’s external operations division coordinate attacks online with supporters across the globe. Most of these supporters have never personally met the ISIL operatives they are conspiring with. Most of ISIL’s prominent virtual planners appear to be based in the group’s “caliphate” in Syria and Iraq, in large part due to proximity and access to ISIL’s top leadership. But since the main equipment that virtual planners require is an Internet connection and good encryption, they could theoretically operate from other geographic locations. Being geographically dispersed carries greater risk of detection, but particularly as ISIL continues to decline as a territorial entity, the emergence of prominent virtual planners operating from outside the Syria-Iraq theater is likely.
The virtual planner model has revolutionized jihadist external operations. ISIL has taken advantage of recent advances in online communications and encryption to engineer a process by which the group’s top operatives can directly guide lone attackers, playing an intimate role in the conceptualization, target selection, timing, and execution of attacks. Virtual planners can offer operatives the same services once provided by physical networks. This model has helped transform lone attackers who rely heavily on the Internet from the bungling wannabes of a decade ago into something more dangerous. This model has proven especially dangerous in combination with ISIL’s embrace of calls by thinkers like Abu Musab al-Suri to launch attacks with any means available: It is easier to drive a car into a crowd or launch a stabbing spree than, say, a strike the Pentagon with an explosives-laden model airplane. Further, the virtual planner model allows ISIL to maximize the impact and propaganda value of attacks waged in its name, making sure they are seamlessly incorporated into the group’s overarching strategy. At the same time, this model avoids many of the risks associated with physically training operatives.
Why hasn’t the virtual planner model been seen until fairly recently? Couldn’t al-Qaeda have done this earlier? They tried, but failed. This was for two reasons. First, as alluded to above, al-Qaeda tended to prefer complex attacks that were more easily bungled or disrupted. Second, the virtual planner could not be effective without such recent developments as the total pervasiveness of social media and especially the boom in end-to-end encryption (without which virtual planner-led plots would essentially be disrupted every time). But important questions remain. What does ISIL’s virtual planner paradigm mean for lone attackers? Is the model likely to be adopted by other militant groups? What can authorities do to counter this model and out-adapt the jihadists?
ISIL’s Highly Structured External Operations
The virtual planner model is an integral component of ISIL’s robust, highly structured external operations division. This infrastructure has thus far lacked the high-end ambitions in its terrorist attacks outside the caliphate’s territory that al-Qaeda displayed in the 9/11 attacks or the 2006 transatlantic air plot. However, ISIL has demonstrated an unprecedented ability to coordinate sustained campaigns in various theaters across the globe.
The Amniyat al-Kharji is a highly organized, hierarchical structure within ISIL charged with selecting and training external operatives, and conducting terrorist operations outside ISIL’s core territory. Before his death, it was led by Abu Muhammad al-Adnani, one of ISIL’s top officials. It is not possible to determine from open sources how involved Adnani was in planning attacks before he ended up on the receiving end of a U.S. airstrike. Some reporting describes Adnani’s management of the Amniyat as relatively hands-on, while some U.S. government analysts believe he served as more of a rubber stamp.
Regardless of Adnani’s degree of involvement as head of the Amniyat, it is clear that most of the day-to-day work has fallen to Abu Sulayman al-Faransi, a 27-year-old hailing from Morocco who was born Abdelilah Himich. Faransi manages and oversees a group of operatives who can be described as theater commanders, who are responsible for operations extending from Europe to Southeast Asia. These theater commanders are given specific geographic areas of responsibility according to their nationality and linguistic capabilities, and are tasked with planning attacks in those areas.
Virtual planners have been integrated into this geographical command structure, and function much like theater commanders, but in the cyber realm. ISIL’s virtual planners are also assigned areas of responsibility according to their nationality and linguistic skills, and tasked with actively recruiting and handling attackers from these areas.
The decision to assign virtual planners to geographic areas with which they are familiar allows them to reach back to contacts still involved in the domestic militant scene. For example, in April 2015, Australian police disrupted a cell plotting an attack on Anzac Day, a day of remembrance for armed forces from Australia and New Zealand. The leaders of the cell were in regular contact with ISIL’s Australian virtual planner, Neil Prakash, who reportedly helped to formulate the plot. According to police, both Prakash and the plotters had links to Melbourne’s al-Furqan center, a controversial Islamic center because it is seen as a hub for militancy. After departing for ISIL’s caliphate, Prakash allegedly encouraged some young militants to likewise make their hijra there, while directing others to instead stay behind and carry out attacks.
Sometimes ISIL’s theater commanders function interchangeably as virtual planners. This is the case for Bahrun Naim, one of ISIL’s top Indonesian militants. In September 2016, Indonesian police disrupted a cell in Batam coordinating with Naim to launch a rocket attack on Marina Bay. Authorities said that members of the Batam cell “had been measuring elevation points and the distance from the hill to their target in Singapore,” while Naim planned to deploy technicians thereafter to make explosives and prepare for the attack.
Inspiration vs. Organization
Prior to ISIL’s emergence, al-Qaeda often used its propaganda and public statements to try to inspire lone individuals to carry out attacks. Anwar al-Awlaki, an official and propagandist for al-Qaeda in the Arabian Peninsula (AQAP), became notorious for using the Internet to call for “lone wolf” attacks. Awlaki hoped that lone wolf attackers would complement rather than replace al-Qaeda’s centrally directed plots — some of which, such as Umar Farouk Abdulmutallab’s Christmas Day 2009 underwear bomb plot, Awlaki himself helped to plan.
Through his public statements, particularly his infamous YouTube sermons, Awlaki mobilized a large number of people: According to the Counter Extremism Project, Awlaki’s videos and writings have influenced around 90 known extremists in the United States and Europe — some even after a U.S. airstrike took Awlaki’s life in 2011. Recent plots influenced (at least in part) by Awlaki include the 2013 Boston Marathon bombings and 2015 San Bernardino attack, the 2016 shooting at the Pulse nightclub in Orlando, and the September 2016 bombings in New York and New Jersey. Yet despite his skill as an inspirational figure, all Awlaki could do was put out the call and hope someone would take up arms in response.
ISIL’s virtual planner model is an outgrowth of, and improvement upon, Awlaki’s approach. ISIL’s virtual planners have the potential to cast a wider recruitment net than Awlaki. Awlaki was, of course, a product of the age of mass communication and global interconnectivity, but even his superb oratorical skills could not match the feelings of “remote intimacy” with people halfway across the world that can be fostered through social media, or the volume and two-way nature of communications that medium allows. Indian intelligence officials believe that ISIL’s South Asia virtual planner, Yusuf al-Hindi, was in touch with over 800 Indians through Facebook and WhatsApp. It seems that none of ISIL’s propagandists or virtual planners possess the same kind of raw magnetism that Awlaki has for English speakers, but they have the advantage of exploiting a medium that is simply more engrossing due to the constant contact it allows.
This continuous contact may allow a higher recruitment rate than the essentially one-way communication of video postings. By building an “intimate” relationship with the potential attacker, the virtual planner provides encouragement and validation, addressing the individual’s doubts and hesitations. Virtual planners can replicate the same social pressures that exist in in-person cells. As Peter Weinberger of the University of Maryland’s National Consortium for the Study of Terrorism and Responses to Terrorism put it, “People will get in these chat rooms and they will feel like they have a relationship with someone. That’s where the peer-to-peer contact is drawing them in.” None of this is meant to diminish the importance of in-person recruiting networks, where social pressures are likely more acute than in the online environment. But there isn’t always an in-person network in place that can interact with potential operatives. People can simply wander into searchable online networks, rather than having to be identified and carefully socialized by in-person networks that must act covertly. And unlike physical networks, the virtual planner model does not risk the capture, or even death, of the network’s key operatives.
Individuals inspired by ISIL may directly reach out to virtual planners for guidance and assistance in carrying out attacks. Junaid Hussain, a former British hacker turned terrorist, shows how virtual planners can coach domestic militants. The operative Junead Khan had been on British counterterrorism authorities’ radar since 2014. Originally Khan planned to travel to the caliphate, but in early 2015 he changed his mind and began to focus on carrying out a domestic attack, using his job as a delivery man to scope out U.S. military bases in Britain. In July 2015, Khan exchanged several messages with Junaid Hussain over Surespot, discussing the logistics of various possible plans of attack. At one point, Hussain sent Khan a bomb-making manual, and told him to make and use explosives against police who arrived on the scene of his attack.
Though Khan was arrested before he could strike, this case illustrates how virtual planners can provide all the services that used to be characteristic of only physical cells.
Beyond recruitment and operational guidance, virtual planners can bring disparate individuals and cells together to form larger attack networks. In September 2016, French authorities arrested a group of female terrorists who had carried out the failed plot to set off a car bomb near Paris’s Notre Dame Cathedral. (One of them stabbed a police officer outside the Boussy-Saint-Antoine rail station as authorities made the arrest.) Before the attempted attack, none of the women had had any type of relationship with one another. They were brought together by ISIL’s European virtual planner, Rachid Kassim.
In connecting the women, Kassim merged two different lines of terrorist effort in two different parts of France based on one operative’s reluctance to carry out a particular kind of operation. Sarah Hervouët, a 23-year-old convert to Islam who was planning an attack in the southeastern French commune of Cogolin, had been communicating with Kassim over Telegram. Acting on Kassim’s orders, Hervouët drafted her will, wrote farewell letters to relatives, and made a video proclaiming her allegiance to ISIL. But she lost her appetite for the operation that Kassim envisioned for her, a “suicide-by-police” attack. So Kassim connected her with two other women preparing to carry out an attack in Paris instead.
Though the women failed to carry out the dramatic attack that Kassim hoped for, this case demonstrates the speed and agility with which virtual planners can operate. Kassim not only convinced four women to carry out violent attacks in ISIL’s name, but also rapidly adapted his plans to the preferences of his operatives and merged two deadly projects to increase the likelihood of success.
Looking Ahead
ISIL’s virtual planners allow the group to effectively seize ownership over what would previously have been considered lone wolf attacks. By creating a bridge between potential militants and the organization, virtual planners empower lone actors to fulfill ISIL’s objectives while requiring minimal resources from the organization. Virtual planners transform these individuals into ambassadors for ISIL’s brand, and soldiers who can advance its strategic aims. Each attack showcases ISIL’s global reach. In this way, virtual planners help maximize the psychological and reputational effects of violence committed in ISIL’s name.
The success of the virtual planner model underscores jihadist groups’ ongoing process of organizational learning. Just as we saw an evolution from al-Qaeda’s original calls for lone wolf attacks to the methods employed by Anwar al-Awlaki, ISIL’s approach marks another fundamental shift.
The model, of course, is not without its limitations. The lack of in-person training is a disadvantage, as operatives often lack the expertise to perfectly execute their handler’s commands. And cells directed by virtual planners are at a greater risk of being detected by SIGINT, despite advances in end-to-end encryption.
Nonetheless, the virtual planner approach is a low-cost, high-reward strategy with enormous destructive potential, especially as ISIL and other terrorist groups continue to develop and refine the model. Thus far, adaptations in jihadists’ external operations efforts are outpacing states’ efforts to find effective ways to counter them.
