by Thomas Hegghammer and Petter Nesser
How much of a terrorist threat does the Islamic State (IS) pose to Western countries? This article looks at what IS has said and done with regard to attacks in the West. We examine IS statements and take stock of IS-related attack plots in Western Europe, North America, and Australia from January 2011 through June 2015 using a new dataset of jihadi plots and a new typology of links between organizations and attackers. IS appears to have had a decentralized attack strategy based on encouraging sympathiser attacks while not mounting centrally directed operations of their own. There have also been more plots involving only IS sympathisers than plots involving returned foreign fighters. However, the organization’s formidable resources and verbal hints at future attacks give reason for vigilance.
Keywords: Jihadism, ISIS, strategy, transnationalism, incident data
How much of a terrorist threat does the Islamic State (IS) pose to Western countries? The group’s spectacular growth and anti-Western rhetoric have raised fears that it might carry out major attacks in Europe, North America, or Australia. The question has implications for Western military strategy against IS, because the higher the transnational threat, the larger the incentive to dismantle the group – as opposed to containing it.
This article aims to bring the debate forward through quantification and specification. It makes two main contributions: The first is to take stock of IS-related operations in the West using a new dataset on jihadi plots from early 2011 to mid-2015. The second is to present a typology that disaggregates the notion of “IS-linked plot” and allows for more fine-grained measurement of regional group involvement in international operations.
Our data suggest that IS so far has had a decentralized attack strategy based on encouraging followers to attack while not mounting many leadership-directed plots. That strategy has produced a substantial number of “sympathiser plots” since September 2014, to the point where IS sympathisers now outnumber returning foreign fighters as plot instigators. We do not make predictions about future changes in IS strategy, but the typology can be used by analysts to measure small variations in the group’s commitment to international operations and potentially allow for early detection of strategic shifts.
The purpose of the article is to assess, based on open-source evidence of past declarations and activities, the extent to which IS has invested itself in a strategy of targeting the West. Our motivation is twofold. For one, policymakers naturally worry that IS will “go global” – that is, embark on a campaign of major attacks in the West – and there has been a great deal of speculation about whether and when they might do so. For another, there is confusion about exactly what, however little, IS has done so far in terms of international operations. While most recognized IS specialists agree that the group’s strategic priorities are local and that almost all of its resources go into operations in Syria and Iraq, many media reports have spoken of alleged “IS plots” or “IS-linked plots” in the West over the past year. One recent headline, for example, blared “Islamic State planning sophisticated attacks on the West.” So what exactly has taken place? How many or how few plots are we talking about? What kinds? Is the rate of incidents increasing?
To answer these questions we did three things. First, we looked briefly at what IS has said about attacking in the West. We examined leader statements, Dabiq magazine, a collection of 200 audiovisual productions, and anecdotal statements by IS footsoldiers. Second, we tried to establish how many plots in the West had an IS connection of any kind. To do this we first built a dataset of attacks and attack plots in the West since January 2011 and then looked for reports of IS connections in each case. Third, we tried to assess the degree of involvement by IS as an organization in each alleged “IS-linked” plot. For this we developed a typology of six ideal types of links between regional organizations and international attackers, collected information about each alleged link, and coded each plot according to the link type observed. The many methodological challenges and limitations to each of the procedures are discussed at the beginning of each section below.
The scope of our inquiry is limited to specifying the degree of IS’s past involvement in terrorist activity in the West. We are not seeking to predict whether IS will go more global in the future, much less whether IS could ever carry out a major attack in the West. We believe our data can help inform such debates, but the past can only tell us so much about the future. Empirically, we focus on the period from January 2011 through June 2015, and our main concern is the central Islamic State organization and its predecessors (but not its affiliates or “provinces” [wilayat] in places like Libya or Sinai). By “West” we mean Western Europe, North America, and Australia/New Zealand.
The article has three parts. We look first at declared intentions, then at the number of IS-related plots, and then at the nature of IS’s connection to those plots.
It is not easy to summarize what IS has said about attacking the West, because the group does not speak with one voice, and the number of statements that can be attributed to IS in one way or other is enormous. We chose to compile and manually examine four document samples: 1) English translations of all the statements by IS leader Abu Bakr al-Baghdadi and top spokesman Abu Muhammad al-Adnani between 1 July 2014 and 30 June 2015 (nine statements, about 50 pages of transcribed text); 2) Issues 1-9 of the English-language Dabiq magazine (about 500 pages), 3) all the approximately210 videos and photo montages published on the (now defunct) blog between 30 July 2014 and 30 January 2015, and 4) a collection of anecdotal statements by IS footsoldiers on Twitter and in media interviews.
We chose these particular document types because they were presumably produced by different strata of the organization, namely, the top leadership (sample 1), upper cadres (samples 2 and 3) and lower ranks (sample 4). We sampled primarily the period after the declaration of the caliphate on 30 June 2014, because that was when the organization took its current form. The samples cover slightly different time periods for reasons to do with availability, but all of them cover the autumn of 2014, which is when we should expect to see the most anti-Western rhetoric (this was when the international military campaign against IS escalated). Our methodology is obviously limited by the fact that we only deal with samples and conduct qualitative content analysis. The ideal way to approach this topic would be to combine qualitative analysis of key texts with quantitative or automated content analysis of IS’s entire ideological corpus. We did not do it here, because this article’s main concern is IS’s plotting activity. Our approach should still reveal the broad features of IS’s declared intentions vis-a-vis the West.
To start at the bottom: Several IS footsoldiers have issued very explicit threats to the West. For example, in early 2014 a group of IS-affiliated Britons in Syria posted a series of memes (pictures with captions) threatening attacks in the UK and US. In April 2014, a Canadian IS member appeared in a video saying “This is a message to Canada and all the American tyrants: We are coming and we will destroy you.” In mid-June 2014, a video showed a British IS member saying the black flag would fly over Downing Street and another saying he would embark on a “killing spree” against non-Muslims if he ever returned home. This was before the escalation, in August 2014, of the US-led anti-IS air campaign in Iraq and Syria, and since then such statements have proliferated. This, of course, is anecdotal evidence and we don’t know the proportion of IS fighters who harbor such views, but hundreds of individuals – probably more – demonstrably do. That said, most of these threats are chronologically and tactically unspecified and probably reflect a general intention to harm rather than immediate and concrete plans.
The video collection contains five productions whose main message is a threat to America. In addition, one video praises the January 2015 Paris attacks, and three threaten Japan. Hostile statements almost certainly appear in other videos too, but these were the productions whose main purpose was to issue a threat. Three things are worth noting about the five videos addressed to the US. First, the threats are presented as a form of retaliation and made conditional on America’s future involvement in the Iraqi-Syrian theatre. Second, most of the videos appeared in the autumn of 2014, shortly after the escalation of US-led airstrikes. Third, the videos make up a very small proportion – about one percent – of the collection as a whole. The vast majority of items are devoted to local affairs such as battle exploits and various aspects of rebel governance.
Dabiq magazine contains several calls for attacks and promises of conquest in the West. The most explicit appears in issue 4 (published in mid-October 2014), where one article says, “at this point of the crusade against the Islamic State, it is very important that attacks take place in every country that has entered into the alliance against the Islamic State, especially the US, UK, France, Australia, and Germany.” That same issue also cites, in three different places, a passage from a statement by al-Adnani which includes the phrase “We will conquer your Rome, break your crosses, and enslave your women.” Issues 7, 8 and 9 also include praise for recent attacks in the West and portraits of several of the perpetrators, who are described as IS-affiliated. Issue 9 also eulogizes “the shuhadā’ of the Islamic State including Numan Haider and Man Haron Monis (Australia), Michael Zehaf-Bibeau and Martin Couture-Rouleau (Canada) Zale Thompson, Elton Simpson, and Nadir Soofi (America), Amedy Coulibaly (France), Omar Abdel Hamid el-Hussein (Denmark), and Sofiane Amghar and Khalid Ben Larbi (Belgium).”
However, several mitigating points are worth noting here. First, the call for attacks is exactly that: a call, addressed to sympathisers out there, not a commitment of the organization’s resources to future attacks. Second, in issue 9 the call is qualified as the second best course of action after leaving the West for the Caliphate: “Either one performs hijrah to the wilāyāt of the Khilāfah or, if he is unable to do so, he must attack the crusaders” [our emphasis]. Third, al-Adnani’s promise to conquer Rome is qualified a few sentences down as a long-term strategic milestone: “If we do not reach that time, then our children and grandchildren will reach it.” Fourth, as with the video collection, threats to the West make up a very small proportion of the content of Dabiq magazine, and they receive less column space than the threats to IS’s local enemies.
Al-Baghdadi and al-Adnani
It is in the statements by Abu Muhammad al-Adnani, IS’s lead spokesman, that we find the most significant verbal threats to the West. On 22 September 2014 he issued a landmark call for attacks in the West:
“If you can kill a disbelieving American or European – especially the spiteful and filthy French – or an Australian, or a Canadian, or any other disbeliever from the disbelievers waging war, including the citizens of the countries that entered into a coalition against the Islamic State, then rely upon Allah, and kill him in any manner or way however it may be. Do not ask for anyone’s advice and do not seek anyone’s verdict. Kill the disbeliever whether he is civilian or military, for they have the same ruling.”
In January 2015 he repeated the call, adding an ominous phrase that hints at the possibility of centrally directed plots: “what lies ahead will be worse – with Allah’s permission – and more bitter, for you haven’t seen anything from us just yet” [our emphasis]. Then in March 2015, al-Adnani said, “know that we want Paris – by Allah’s permission – before Rome and before Spain, after we blacken your lives and destroy the White House, the Big Ben, and the Eifel Tower.” These last two statements represent the strongest indication of the possibility of centrally directed IS attacks in the West that we have found in their ideological corpus so far. While we should take them extremely seriously, they are not unequivocal promises of impending terrorist attacks, for they might also be interpreted as a promise of a strategic conquest of the West that will materialize many years down the line.
What about the “caliph” himself? Abu Bakr al-Baghdadi’s five statements since July 2014 contain fewer explicit threats to the West than al-Adnani’s. Al-Bagdhadi mentions the West relatively rarely, and when he does, it is mostly in general terms that declare it as an enemy or warn it of defeat. For example, on 1 July 2014, he said:
“the world today has been divided into two camps … the camp of the Muslims and the mujahidin everywhere, and the camp of the jews, the crusaders, their allies, and with them the rest of the nations and religions of kufr, all being led by America and Russia, and being mobilized by the jews.”
And in November 2014, he said:
“indeed the Crusaders will be defeated. By Allah’s permission, they will be defeated. And indeed the Muslims will be victorious. By Allah’s promise, they will be victorious. And the march of the mujahidin will continue until they reach Rome, by Allah’s permission.”
Al-Baghdadi’s most explicit reference to attacks in the West is a brief repetition, in his May 2015 statement, of the call for sympathiser attacks: “we call upon every Muslim in every place to perform hijrah to the Islamic State or fight in his land wherever that may be.”
What is significant here are all the things the top IS leader is not saying. He is not saying anything that commits the organization to attacks in the West in the short term. He is not providing a carefully constructed set of arguments for why attacks in the West are warranted. And he has not devoted entire statements to addressing America.
All of this Usama bin Ladin did repeatedly before and after 9/11. In 1998, for example, Bin Ladin said,
“We have formed with a large number of our brothers the Global Islamic Front for Jihad against Jews and Crusaders … the work of many of those brothers is going well … we pray to God that He will open the way for them to wreak revenge on the Jews and the Americans. … Some countries… have ordered us to stop attacking America, but we believe these attacks are a duty incumbent upon us.”
In October 2001 Bin Ladin said “I swear by God … that neither America nor anyone who lives there will enjoy safety” (7 Oct 2001), and in a 2004 message addressed to the American people, he said “we have been fighting you … Just as you violate our security, so we violate yours” (29 Oct 2004). These are but snippets from al-Qaida’s long history of promises to attack America.
All of this suggests that, while IS leaders view the West as an eternal enemy and applaud mass-casualty attacks there, they do not seem quite as hell-bent on carrying out attacks on the West as their counterparts in al-Qaida Central. The content, tone, and quantity of IS’s anti-Western rhetoric suggest, thus far, a certain reluctance to commit the organization fully to a terrorism campaign in the West.
At the same time, the group is calling loudly for sympathiser attacks, and there is conceivably a whole spectrum of low-commitment forms of assistance that IS could provide to interested attackers. Besides, an organization this size is bound to suffer from principal-agent problems, in the form of mid-level cadres or footsoldiers taking initiatives that stray from the strategy of the top leaders. There is, in other words, every reason to expect attacks in the West that are linked to IS in some way. As we shall see, there have been several.
The number and features of IS-connected plots
To identify the number of IS-related plots and gauge the relative scale of that phenomenon, we built a dataset of jihadi attacks and serious alleged attack plots in the West from January 2011 through June 2015 and searched for information about any IS connections to those plots. The dataset is an extension of Thomas Hegghammer’s Jihadi Plots in the West dataset (which covered the period 1990-2010) and used the same basic data collection procedure. We collected news reports and other open sources on attacks and plot investigations, generating first a long list of incidents. We included foiled and aborted plots because we wanted to capture the “gross plot production” and not just the net number of attacks that happen to avoid police detection. We then sifted the cases to include only what we call “serious plots”, that is, alleged plots which 1) are cited in more than one media report, 2) involve intent to inflict serious physical harm on people, 3) involve one or more identifiable perpetrators with radical Islamist motivations, 4) were due to occur on Western soil, and 5) contain some evidence of weapons possession and a reasonably defined target. We excluded several plots whose features either conflicted with these criteria or could not be established from the available information.
Next, we sought to identify the core plotters in each case and to compile information about their background, motivations, and connections to militant networks. We then coded the plots for a number of variables (see appended dataset linked at the end of this article), including presence of returnee foreign fighters and presence of an IS connection. An IS connection could be anything from the perpetrators having expressed sympathy with IS to them having received instructions from the top IS leadership.
There are several potential sources of inaccuracies in our data. One is that we work only with open-source information, so we may have missed some plots altogether, excluded some plots that were more serious than reported in the press, or included others that were less serious than reported. We believe the number of significant plots we missed altogether is small, because in Western democracies, terrorist plots should enter the legal system, because the media is hungry for information about terrorism, and because intelligence services have an incentive to reveal serious foiled plots (since it demonstrates effectiveness and/or helps justify increased funding or changes in legislation). We realize that many counterterrorism operations go unreported, but we suspect that this happens most often when suspected plans are foiled at such an early stage that there is insufficient evidence to prosecute, in which case nobody can really know whether the plot would have come to fruition. That said, it is important to realize that security services routinely carry out disruptive operations – often in the form of arrests on charges “lesser” than domestic terrorism, such as fundraising, recruiting, or foreign fighting – which may serve to prevent some potential plots from developing.
Another source of error is that we are dealing with recent incidents, several of which have not been tried in court or been completely investigated yet. We know from experience that the complete picture of a given case often does not emerge until several years after the attack or arrests occurred. The media’s initial description of a given plot can sometimes differ from the final, corroborated version of events. Our coding of IS connections and of the presence of foreign fighters is particularly vulnerable to this problem. To complicate matters, there are biases cutting both ways: on the one hand, the difficulty of establishing a plotter’s communications or travel history can lead to underreporting of IS connections or foreign fighter involvement. On the other hand, the general fear of IS plots and foreign fighters can lead to overreporting as analysts and journalists lean to the more “interesting” interpretation of ambiguous data. We do not know the net effect of these biases; we can only report what the currently available open sources tell us.
A final point to bear in mind is the extensive use of so-called “sting operations” in terrorism investigations in the United States, which we suspect contribute to a certain overreporting of plots there. According to our count, between 11 and 14 of the 25 plots in the United States in this period involved undercover operatives, compared to zero in the European and Australian plots. In many of these cases, the undercover operatives provided the means (in the form of a fake weapon), though not necessarily the intention, for the suspects to reach the advanced stage of preparation that allowed for arrest and prosecution. Entrapment debates aside, it is reasonable to assume that a few of those plots would not have reached a similarly advanced preparation stage without the interference of an undercover operative. We therefore believe that certain types of “proto-plots” that would fizzle out and not get reported in Europe appear as plots in the US data. We do not, however, purport to know how large this effect is.
For this four and a half-year period, we identified a total of 69 plots; 37 in Europe, 25 in North America, and seven in Australia. Of these, 19 (28 %) came to execution; 12 in Europe, five in North America and two in Australia. The total number of plotters involved was about 120 (over 80 for Europe, over 30 in North America and nine in Australia).
We found reports of an IS connection in 30 of the 69 plots. Most of the IS-connected plots occurred in the last 12 months (from July 2014 through June 2015); of a total of 33 plots in this period, 26 (79 %) had an IS connection. As we shall see below, however, the connection in most cases consists of declared support for IS, not meetings or communications with IS cadres. In any case, these numbers suggest that Islamic State has surpassed al-Qaida as the main provider of inspiration for plots in the West.
It is worth noting here that the distinction between IS-linked plots and al-Qaida-linked plots is not always clear. Several plotters appear to have been influenced by both IS and al-Qaida, consuming propaganda from, and expressing support for, both groups. Some were long-standing al-Qaida supporters who only became infatuated with IS a short while before the plot. And in Paris in January 2015, the Kouachi brothers and Amedy Coulibaly even coordinated their respective operations, one in the name of al-Qaida on the Arabian Peninsula (AQAP), the other in the name of IS. The al-Qaida-affiliated Jabhat al-Nusra and IS may be fighting it out in Syria, but in the West many radicals do not seem to think they need to choose sides.
Of the 30 IS-connected plots, 11 (37%) came to execution, which is higher than the rate for non-IS-connected plots (21%). We suspect that this difference reflects the fact that many of the IS-connected plots were small (involving one or two individuals) and low-tech (using stabbings and handguns), making them more difficult to prevent. This is also reflected in the damage they caused: executed IS-connected attacks caused an average of 1.4 deaths compared to 2.9 deaths for executed non-IS-connected attacks (1.7 without the Kouachi brothers attack).
Role of foreign fighters
We can also use the data to examine the role of foreign fighters in Western plots. There has been much concern about a possible terrorism “blowback” from the participation of around 4,000 Western (mostly European) Muslims in the Syria war. We find that 16 of the 69 plots involved at least one foreign fighter. All but one of them occurred in Europe. Of these 16 plots, nine involved foreign fighters (11 individuals) who had been to Syria (the remaining seven plots had links to Afghanistan, Pakistan, and Yemen). Of these nine Syria-linked foreign fighter plots, six included people (eight individuals) who had trained with IS. Of the other three plots, two were linked to Jabhat al-Nusra and one to an unspecified group. Our data thus suggest that the blowback rate – the proportion of outgoing fighters who return and plot attacks against their home country or region – from Syria is thus far very low indeed: 11 plotting returnees from an outgoing contingent of around 4,000 makes for a blowback rate in the order of 1 in 360. Even if our underreporting is very significant – let us say we have missed two thirds of the cases and the real number of plotting Syria returnees is around 30 – the blowback rate is still lower than one in a hundred. It is likely that this rate will increase over time, though not immediately, because the number of outgoing foreign fighters is currently also growing, mathematically offsetting the effect of new plots. Only after the flow of foreign fighters decreases significantly are we likely to see an increase in the blowback rate.
Our count of Syria-related foreign fighter plots is of course strikingly low compared with the blowback anticipated by some analysts and policymakers in recent years. A full discussion of the reasons for the low blowback (thus far) is beyond the scope of this article, but a good start is offered by Daniel Byman, who in a recent article listed six “off-ramps on the road to terrorism” for foreign fighters, namely, 1) death, 2) moving to another conflict, 3) disillusionment, 4) disinterest in attacking the West, 5) lack of attack instructions, and 6) incompetence.
Let us add three additional observations to help make sense of the numbers. The first is that a blowback rate of one in hundreds is by no means uncommon. Several other foreign fighter destinations in the past, such as Somalia or Iraq in the 2000s, had blowback rates in the same order of magnitude; it was Afghanistan and Pakistan in the 1990s and 2000s that pulled up the historical average. As Hegghammer has argued elsewhere, it is primarily those destinations in which there is a group with a concerted strategy of targeting the West that have high blowback rates.
Second, it has long been much easier to go to Syria than to most previous foreign fighter destinations. This has not only led to very high numbers of people going, but also to less selection for ideological commitment than was the case for previous destinations. This has probably led to the foreign fighters in Syria being, as a group, more diverse and less radicalized at the point of departure than those who headed to, say, Waziristan in the 2000s.
Third, the very anticipation of a high foreign fighter blowback from Syria probably triggered more preemptive arrests of Syria returnees than for returnees from previous conflicts, which, in turn, may have decreased the number of foreign fighter plots. Since 2013, tens if not hundreds of returning foreign fighters have been arrested and charged with crimes related to their activities in Syria or with other offences “lesser” than domestic terrorism. It is reasonable to assume that a few of these detained returnees might one day have gone on to plot in their home countries had they not been arrested. Bear in mind that only some returnees were charged on their return (only France appears to have had an “arrest them all” policy), and that the selection of whom to arrest was probably informed in part by intelligence assessments of the returnees’ degree of radicalization. In other words, several of the returnees considered most dangerous were “taken off the street” before they were in a position to plot attacks. It is impossible to say how many plots might have been preempted by such arrests, and it is even harder to say whether the plot reduction effect is permanent, given that many of the returnees convicted on foreign fighter crimes will receive relatively short sentences.
Of the nine Syria-linked foreign fighter plots, only one came to execution, namely, the May 2014 attack on the Jewish Museum in Brussels by Mehdi Nemmouche, who trained with IS. Of the seven non-Syria-related foreign fighter plots, two came to execution: the Merah attacks in March 2012 and the Kouachi brothers’ attack on Charlie Hebdo in January 2015. The execution rate for foreign fighter plots generally is lower (19 %) than for plots without foreign fighters (31 %), which is interesting because it was the other way around in the 1990-2010 period. This may be because intelligence services have tracked foreign fighters particularly closely in recent years and may therefore have become better at detecting their plots. However, the executed foreign fighter plots in our dataset were far more deadly on average (7.3 deaths per attack) than the executed plots without foreign fighters (1.2 deaths per attack).
However, other than indicating that IS has exerted a significant influence on jihadi plotters in the West, especially in the past year, these data do not tell us very much about the commitment of IS as an organization to attacking the West. For this we need to look more closely at what “IS-connected” really means.
The nature of the IS connection
The problem with terms such as “IS-connected”, “–related” or “-linked” is that they can misrepresent the degree to which IS as an organization is implicated. Fifteen years of al-Qaida-influenced terrorism in Europe have taught us that the patterns of interaction between flagship terrorist organizations in the “East” and militants in the West can be very complex indeed. By the mid-2000s, it was clear to most observers that 9/11-style missions, in which the top al-Qaida leadership grooms an attack team and sends it to the West, were rare, and that many plots involved people with a more remote connection to al-Qaida cadres. This led analysts to introduce the distinction between “top-down”- and “bottom-up”-instigated al-Qaida plots, which has long been the dominant way of parsing jihadism in the West. However, as the bitter and inconclusive polemic between Bruce Hoffman and Marc Sageman indicates, this dichotomy is arguably not very fruitful. Many plots were neither clearly top-down nor clearly bottom up, and the lack of a consensus on observable coding criteria led different analysts to interpret the same plot differently. We will have the same problem if we apply a dichotomous categorization framework to what is clearly a spectrum of link types between IS and those who plot in its name.
We therefore propose a new link typology that better reflects the spectrum of link types and has more easily observable coding criteria. We developed it inductively by examining al-Qaida-related plots in Europe in the 2000s and identifying the most common distinct types of links between leaders and attackers. We ended up with six different link types representing points on a spectrum ranging from very low to very high leadership involvement. Each type is associated with a specific kind of interaction that is in principle observable, such as electronic communication or training. The typology assumes a hierarchy of interactions, in which some reflect a stronger leader-attacker connection than others. For example, we assume that training camp attendance produces a closer connection than electronic communication, and that instruction from top leaders is more significant than instruction from mid-level cadres. This need not always be the case, but we think it is in most situations.
The six link types are as follows:
- Training and top-level directives. The attacker trains in the organization’s heartland, is tasked by top leaders to attack in the West, and is supported materially by the organization in the planning and preparation process. The classic historical example is the 9/11 attack.
- Training and mid-level directives. The attacker trains in the organization’s heartland and is encouraged by mid-level cadres to carry out a more or less specified attack in the West, but has little or no interaction with the top leadership and receives little or no material support from the organization. Examples from al-Qaida’s history include the various plots by the Abu Doha network in the early 2000s or the Mohammed Merah attack in 2012.
- Training. The attacker trains in the organization’s heartland, but is not specifically instructed by anyone to attack in the West. Instead, he develops the motivation to attack in the West himself, in the belief that he is doing what the organization wants. A historical example is Mohammed Geele, who trained with al-Shabaab in Somalia, returned to Denmark, and tried to assassinate the cartoonist Kurt Westergaard in 2010.
- Remote contact with directives. The attacker communicates remotely (typically by telephone, email, or social media) and bilaterally with cadres of the organization and receives personal instructions to attack in the West. A good example from al-Qaida history is Rajib Karim, who in 2010 was instructed by Anwar al-Awlaki via encrypted email to attack airline targets in the UK.
- Remote contact without directives. The attacker communicates remotely and bilaterally with members of the organization, but does not receive instructions to attack in the West. An example would be Fort Hood shooter Nidal Malik Hassan, who exchanged emails with Anwar al-Awlaki without discussing operations.
- Sympathy, no contact. The attacker expresses ideological support for the group through his propaganda consumption, written or spoken statements, or some other aspect of his behavior, but does not communicate bilaterally with anyone in the organization. One example is Roshonara Choudhry, who stabbed a British MP in 2010, having been inspired by al-Awlaki’s online lectures.
Plots should be classified according to the “highest” level of leader-attacker interaction observed in the data at hand, and they should only be assigned one value, for a high-level interaction usually also includes the lower ones.
The idea here is that by classifying plots according to link type, we can gain a more fine-grained understanding of a given organization’s involvement in external operations, and we can track minor variations in that involvement over time. We use it here to study IS, but in principle it can be applied to any organization with an international footprint.
If a six-pronged typology offers too much resolution for one’s analytical purposes, it is possible to group the types into larger categories. For example, one might refer to plot types 1-4 as “high-involvement plots” – because the organization is “involved” in the plot through training and/or directives – and plot types 5-6 “low-involvement” plots because there is no training or directive. We apply this simplified typology toward the end of the article.
Coding IS plots
To better understand IS’s involvement in international operations, we coded all the 30 IS-related plots in our dataset according to this typology. For data we used open sources, mostly newspaper reports and legal documents, so all the reliability caveats mentioned earlier apply here too, with a vengeance. Coding for interaction type requires very detailed information, which is scarce – and probably often inaccurate – in open sources. We suspect that many of our coding decisions will have to be revised as more and better information about each case emerges. Still, we believe there is some value in trying our best with the available data, if only to illustrate how the typology can be operationalized.
We believe that the error margin is larger on the upside than on the downside—that is, we think it is more likely that our coding decisions will need to be changed to higher-level link type values than to lower-level ones. One reason is that more details are likely to emerge over time. The other reason is that we coded conservatively, assigning values only based on explicit references to particular interaction types in the sources, even when the circumstantial evidence pointed to another, higher interaction type. For example, in the Creteil plot, media reported that Mohamed Ouaharani, after returning from training with IS in Syria, contacted an IS member in Syria saying he was “ready to work”. We coded this as type 3 (training only) because we do not know for sure whether the IS member responded with directives or whether Ouaharani simply signaled his availability.
The first basic finding is that the IS-connected plots do indeed represent a spectrum of different link types. We identified IS links of all types except type 1 (training and top-level directives). To illustrate what these link types look like in practice, we provide five brief sample descriptions below. Descriptions of all plots are included in appendix 1 (see link at the end of this article).
- Type 2: The Verviers Plot. On 15 January 2015 Belgian police conducted a series of raids in and around the town of Verviers, killing two in a shootout and arresting thirteen. In the apartment of the main suspects, police found bomb-making material, automatic rifles, and police uniforms, which authorities believe were to be used in attacks on police targets. Several of the suspects had recently returned from Syria, where they had trained with IS. After their return they had allegedly communicated, by cellphone and in code, with a Greece- or Syria-based IS member named Abelhamid Abaaoud (of Moroccan-Belgian origin), who investigators believe acted as a middleman between the plotters and IS cadres in Syria. Another suspected middleman between the Belgian cell and IS, an Algerian, was captured in Greece and extradited to Belgium.
- Type 3: The Brussels Museum shooting. On 24 May 2014, the French-Algerian Mehdi Nemmouche shot and killed four people with a Kalashnikov at the entrance of the Jewish Museum in Brussels. Nemmouche, who was later captured in France carrying the assault weapon wrapped in a black ISIS flag, had recently returned from Syria, where he allegedly had been part of an ISIS hostage handling unit. Nemmouche was allegedly inspired by Mohammed Merah’s attacks in Southern France and reportedly wanted to outdo him. No evidence has emerged suggesting Nemmouche was taking orders from anyone in Syria.
- Type 4: The Vienna plot. In October 2014, Austrian authorities arrested a 14-year old Austrian-Turkish boy whom they accused – and later convicted – of planning to bomb Vienna’s Westbahnhof train station. The boy, identified as “Mertkan G.”, had reportedly interacted online with IS members in Syria who had promised him USD 25,000 and a special position within IS if he carried out an attack in Austria. According to Austrian police, he subsequently made “concrete enquiries about buying ingredients” for a bomb similar to the one used in the Boston Marathon attack.
- Type 5: Ceuta plot. On 10 March 2015 Spanish authorities announced the arrest, in the North African Spanish enclave of Ceuta, of two individuals accused of plotting attacks in Spain or in neighboring countries. The suspects were Spaniards of Moroccan origin who had been arrested two months previously possessing guns, munitions, knives, and military uniforms. Authorities said the suspects had been in contact with IS online, but media reports included no indications that the suspects had received instructions.
- Type 6: The Copenhagen attack. On 14 February 2015, Danish-Palestinian Omar Abdel Hamid El-Hussein went on a shooting spree, killing two and injuring five. He first attacked a speaking venue hosting the Swedish artist Lars Vilks (known for his caricatures of the Prophet Muhammad) and then attacked security guards outside a synagogue. El-Hussain appears to have been radicalized in prison less than a year before the attack, and he had been released just two weeks prior to the operation. In those two weeks he expressed support for IS on social media, and he declared allegiance to IS on his Facebook page hours before the attack. No evidence has emerged suggesting he had communicated with an IS member, but he reportedly did share a prison cell with another IS sympathiser at one point.
A second, more significant finding is that the majority of IS-related plots belong in the lower end of the spectrum of organizational involvement (see Table 1). We found no plots of type 1 (training and top-level directives), and only two cases of type 2 (training and mid-level directives). By contrast, we found 17 cases of type 6 (no contact whatsoever) and five of type 5 (remote contact without directives). If we group plot types into high and low-involvement plots as described earlier, then our data suggest low-involvement IS plots outnumber high-involvement ones by a factor or almost three to one (22 vs 8).
1 – Training and top-level directives
2 – Training and mid-level directives
“London Mumbai plot”, Verviers plot
3 – Training
Riviera plot, Brussels museum shooting, Creteil plot, Surgeon plot
4 – Remote contact with directives
Baryalei-Azari plot, Vienna plot
5 – Remote contact, no directives
Cannes-Torcy attack, Remembrance Day plot, Ceuta plot, Catalonia plot, Garland attack
6 – Sympathy, no contact
Brisbane plot, Melbourne stabbing, Quebec car attack, NYC Axe attack, Sydney hostage taking, Tours knife attack, Coulibaly attack, Cornell Capitol plot, Copenhagen attack, Fairfield plot, Anzac Day plot, Velentzas/Siddiqui plot, Fort Riley plot, Greenvale plot; Lyon gas factory attack, Usaamah Rahim plot, NYC aeronautics student plot
Table 1: IS-linked plots, by link type
A third finding is that we see no clear upward or downward trend in the evolution of high-involvement plots (see Figure 1). In other words, our data do not suggest that IS has been investing itself more in external operations over the past year.
Figure 1: Chronological distribution of IS-linked plots in the West, by link type
A fourth finding, clearly illustrated by Figure 1, is that the number of “low-involvement plots” (or sympathiser attacks) has increased significantly in recent months. After two years with zero such plots, we had 21 in the last ten months of our timeframe (September 2014–June 2015). The cut-off date seems to be September 2014, which is exactly when IS spokesman Abu Muhammad al-Adnani issued the first call for sympathiser attacks in the West. The trend is so striking that we strongly suspect al-Adnani’s call contributed to the increase.
A final observation is that some lower-level IS cadres in Syria have been trying to remotely recruit operatives for attacks in the West. In addition to the two “type 4” plots in our dataset, there have been several reports of Western foreign fighters in Syria trying to persuade followers back home to attack. A recent undercover investigation by the British tabloid the Sun documented one such attempt in considerable detail. A journalist posing as a radical Islamist in Britain allegedly entered into contact online with a Syria-based British foreign fighter named Junaid Hussain, who reportedly proceeded to offer detailed operational instructions for a pressure-cooker bomb plot on an Armed Forces Day parade in London in June 2015. It is not clear whether this type of lower-rank plot generation is indicative of a deliberate strategy of plausible deniability by the IS leadership or a principal-agent problem caused by the overzealousness of lower cadres. In any event, it illustrates the highly complex relationship between IS as an organization and those who operate in its name.
This brief analysis suggests that Islamic State does not currently pose the same type of terrorist threat to the West as al-Qaida did in the 2000s. IS has not yet “gone global” in the sense of having committed a substantial proportion of its resources to out-of-area operations. Instead, it has assumed a profoundly ambiguous, hard-to-read posture toward terrorism in the West. In words, its leaders have promised to conquer Rome and called on supporters to carry out international terrorist attacks, but the same leaders have not explicitly promised to devote their organization to major operations in the near future. In deeds, the lower echelons of the organization have been implicated in several plots, but the top leadership appears not yet to have groomed attack teams for major operations in the US or Europe the way Usama Bin Ladin and Ayman al-Zawahiri did. Why they have not done so is a question for further research, but we suspect it has to do with the group’s local state-building ambitions.
At the same time, however, IS appears to have succeeded more than al-Qaida in triggering so-called “individual jihad” operations by unaffiliated sympathisers in the West. Al-Qaida tried to do this in the early 2010s through Inspire magazine and other messages, but the call was only seriously heeded by a limited number of people. By contrast, IS has thus far inspired an average of two sympathiser attacks per month since al-Adnani’s call for individual jihad was issued in September 2014. The difference in the reception of the two calls for individual jihad is illustrated by the case of Australia, where there were no al-Qaida linked sympathiser plots in the 2010-2013 period, but seven IS-linked ones between September 2014 and May 2015. There may of course also be a cumulative effect at play, by which IS is profiting from the ideological groundwork laid by Inspire magazine.
In any case, IS sympathiser plots represent a formidable challenge to Western security agencies. So far, there have been over twice as many IS sympathiser plots (22) as plots involving foreign fighters who returned from Syria (9). IS sympathiser plots admittedly tend to be small in scale, but they have an execution rate of almost 50% (10 of 22) compared to around 20% for other plots in the same period. The implication for counterterrorism professionals is clear: worry not only about the foreign fighters, but also about IS sympathisers who never made it to Syria.
The big question, of course, is whether the IS leadership might change strategy and start mounting major operations in addition to the smaller ones it is already inspiring. We hesitate to make predictions here, because the strategic decision to go global lies in the hands of a small number of individuals with strong ideological convictions. We will suggest, however, that the only thing Western governments can do to influence that decision is to appeal to the leadership’s rational side and make it abundantly clear that going global will cost the organization dearly.
Still, deterrence may not be enough, so Western governments should make strategic plans for a scenario in which IS does go global. This means, among other things, keeping close track of IS support networks in the West and thinking carefully in advance about how to respond – politically, diplomatically, and militarily – to a major IS terrorist campaign. If it happens, it will be one of the most anticipated offensives in terrorist history, and we will have no excuse for being unprepared.