#title A text dump on European Union terrorism analysis
#date
#source
#lang en
#pubdate 2022-05-02T15:21:06
#topics
*** Publisher Details
EUROPOL
EUROPEAN UNION TERRORISM SITUATION AND TREND REPORT 2017
PHOTO CREDITS
Europol: page 4, 59 and 61.
European Union Agency for Law Enforcement Cooperation 2017.
Reproduction is authorised provided the source is acknowledged. For any use or reproduction of individual photos, permission must be sought directly from the copyright holders.
This publication and more information on Europol are available on the Internet.
[[http://www.europol.europa.eu][www.europol.europa.eu]]
Shutterstock: pages 9, 14, 17, 25, 27, 28, 31,32, 39, 41,42, 45, 47, 48 and 57.
ISBN 978-92-95200-79-1
DOI 10.2813/237471
QL-AJ-17-001-EN-N
*** FOREWORD OF THE DIRECTOR
Since 1 July 1999 - the date of taking up its activities - Europol has had the authority to deal with terrorist activities. Over recent years the organisation’s involvement in this area has seen a steep increase. The number of Europeans travelling as foreign terrorist fighters (FTFs) to the conflict areas in Syria and Iraq, the intensive use of the internet and social media in propaganda and recruitment activities, and the terrorist attacks in EU Member States directed or inspired by jihadist terrorist organisations, have caused a major increase in the number of cases at Europol concerning “crimes committed or likely to be committed in the course of terrorist activities against life, limb, personal freedom or property” - a development that is not expected to come to a halt soon.
In order to remain up to par in cooperating with Member States in counter-terrorism activities and to improve the quality of Europol’s services where possible, the European Counter Terrorism Centre (ECTC) was established, and started its activities in January 2016. The ECTC is developing into a pan-European centre of counterterrorism expertise and provides direct operational support for ongoing investigations, such as the case of “Taskforce Fraternite”, following the 13 November 2015 Paris attacks. The team consisting of Europol experts and analysts has, along with the French and Belgian investigating teams, processed and analysed more than 14 terabytes (TB) of information, resulting in several investigative leads. Another example of Europol’s operational support is delivered on a daily basis by the EU Internet Referral Unit (EU IRU), to detect and investigate malicious content on the internet and in social media. This not only produces strategic insights into jihadist terrorism, but also provides information for use in criminal investigations. Meanwhile, the ECTC also works to track the flow of terrorist finance and links between terrorist suspects and criminal sources of (illegal) firearms and counterfeit documents.
At the cornerstone of its work Europol provides a well-functioning apparatus for the swift and secure exchange of information. Never before has the need for information sharing become more evident as it has in the past two years, with its unprecedented number of failed, foiled, but also completed jihadist terrorist attacks across Europe. In contrast to ethno-nationalist and separatist terrorism, and most manifestations of both right-wing and left-wing violent extremism, is jihadist terrorism an international issue.
This new edition of the yearly EU
Terrorism Situation and
Trend Report (TE-SAT), which Europol has produced since 2007, provides a concise overview of the nature of terrorism that the EU faced in 2016. In this report you will find information on terrorist attacks that occurred in 2016 and the numbers of arrests and convictions for terrorist offences. Also included is a brief overview of the terrorist situation outside the EU.
I would like to thank all EU Member States and Eurojust for their contributions to the TE-SAT2017. I would also like to express my gratitude to authorities in Switzerland and Turkey for the information they provided.
Finally, I would like to recognise the work of the members of the Advisory Board, consisting of the ‘Troika’ (Presidencies of the Council of the EU; Slovakia, Malta and Estonia), France, Spain, Eurojust, the EU Intelligence Analysis Centre (INTCEN) and the Office of the EU CounterTerrorism Coordinator. Their valuable contributions were indispensable for the production of this 2017 edition of the TE-SAT.
Rob Wainwright
Executive Director of Europol
*** TRENDS
----
The EU is facing a range of terrorist threats and attacks of a violent jihadist nature, from both networked groups and lone actors. The attacks in Brussels, Nice and Berlin in particular, with explosives (Brussels) and vehicles (Nice and Berlin) used to randomly kill and wound as many people as possible, again demonstrated the harm jihadist militants are able and willing to inflict upon EU citizens, legitimised by the interpretation they adopted of selectively sampled religious texts.
----
Attacks can be both carefully prepared and carried out spontaneously. Terrorists acting in the name of IS have proven to be able to plan relatively complex attacks - including those on multiple targets - quickly and effectively.
----
Jihadist actors can be both directed by Islamic State (IS) or merely inspired by IS ideology and rhetoric. Jihadist terrorists have been found to use a range of weapons to include bladed weapons, automatic rifles, explosives and vehicles, and are expected to continue to do so.
----
Jihadist terrorists are expected to continue using mostly low-tech smaller improvised explosive devices (IEDs) and improvised incendiary devices (IIDs) consisting of readily available products.
----
Violent jihadists target individuals, as well as small groups of people who represent values considered by them to be non-Islamic, and large unsuspecting crowds. Individuals or small groups targeted by terrorists can be both hard targets (police, the military) or soft targets (a church, synagogue, mosque). Large unsuspecting crowds, chosen with the intent on causing mass casualties are regarded to be soft targets by definition.
Attacks carried out in locations with international character, such as the metro station in Brussels (close to EU institutions), and Zaventem airport (an international airport), have a multiplier effect with guaranteed worldwide media attention.
----
Perpetrators of terrorist attacks in the EU include both foreigners, of whom a number may have resided in the EU for a long time, and nationals who have grown up in the countries they attacked.
The influx of refugees and migrants to Europe from existing and new conflict zones is expected to continue. IS has already exploited the flow of refugees and migrants to send individuals to Europe to commit acts of terrorism, which became evident in the 2015 Paris attacks. IS and possibly other jihadist terrorist organisations may continue to do so.
----
Terrorist groups continue to exploit the socio-economic grievances of Muslim immigrants to the EU, in order to recruit and incite them to engage in terrorist activities. IS ideology has a certain appeal amongst segments of the Muslim population in the EU, sometimes expressing admiration for “martyrdom”.
Motivations may generally include a belief that Islam is under attack from the West.
Women and young adults, and also children, are playing increasingly operational roles in committing terrorist activities in the EU independently, not only facilitating other operatives in various ways, but in the (attempted) execution of terrorist attacks themselves. Female militant jihadists in the West perceive fewer obstacles to playing an operative role in a terrorist attack than men, and successful or prevented attacks carried out by women in western countries may act as an inspiration to others.
----
There is a decrease in the numbers of individuals travelling to the conflict zones in Syria/ Iraq to join the jihadist terrorist groups as foreign terrorist fighters. The number of returnees is expected to rise, if IS, as seems likely, is defeated militarily or collapses. An increasing number of returnees will likely strengthen domestic jihadist movements and consequently magnify the threat
In overall terms the level of activity in the EU attributed to jihadist terrorism remains high, with indications of it continuing to rise. 718 arrests related to jihadist terrorism were made in 2016, a number that has sharply increased in each of the last three years.
they pose to the EU.
----
Refugees and ethnic minorities in the EU are facing increased violence. These crimes are arguably intended to seriously intimidate sections of the population however, despite showing some similarities, do not qualify as terrorism or violent extremism and are therefore not reported by Member States and consequently not included in the figures.
The deadly attack on a Labour Party MP in the UK in June 2016 demonstrated once again the threat coming also from lone actors who might be inspired by right-wing ideology but do not necessarily have a close connection with extremist groups. Based on this attack and various physical assaults against politicians that happened across the EU in 2016[1], public figures, political parties, civic action groups and media that take a critical view of right-wing extremism, or advocate promigration policies, have to be considered as potential targets of right-wing extremist agitation. Anarchist and left-wing extremists, on the other hand, take advantage of peaceful demonstrations to carry out attacks on government property and law enforcement personnel.
* 1. GENERAL OVERVIEW
** 1.1. TERRORIST ATTACKS AND SUSPECTS ARRESTED
Member States reported that 142 victims died in terrorist attacks and 379 people were injured.
In 2016, a total of 142 failed, foiled and completed attacks were reported.
In 2016 a total of 142 failed, foiled and completed attacks were reported by eight Member States. More than half (76) of them were by the UK[2]. France reported 23 attacks, Italy 17, Spain 10, Greece 6, Germany 5, Belgium 4 and Netherlands 1. Of the 142 attacks, less than half (47) were completed. Member States reported that 142 victims died as a result of terrorist attacks and 379 people were injured.
Nearly all reported fatalities[3] and most of the casualties were the result ofjihadist terrorist attacks.
The total number of 142 attacks is a continuation of a downward trend that started in 2014 when there were 226 attacks, followed by 211 in 2015.
The largest number of attacks in which the terrorist affiliation could be identified were carried out by ethno-nationalist and separatist extremists (99). Attacks carried out by left-wing violent extremists have been on the rise since 2014; they reached a total of 27 in 2016, of which most (16) were reported by Italy. The number of jihadist terrorist attacks decreased from 17 in 2015 to 13 in 2016, of which 6 were linked to the so-called Islamic State (IS). However, a precise ranking amongst and within terrorist affiliations across the EU cannot be established because the UK does not provide disaggregated data on attacks.
Explosives were used in 40% of the attacks, with similar numbers to 2015. The use of firearms dropped considerably from 57 in 2015 to 6 in 2016.
Apart from jihadist, ethno-nationalist and left-wing extremist attacks, an increasing stream of violent assaults by right-wing extremist individuals and groups was noted across Europe, in particular over the past two years, targeting asylum seekers and ethnic minorities in general[4]. These assaults however do not generally qualify as terrorism[5] and are therefore not included in the numbers of terrorist attacks being reported by Member States, with only one exception in 2016, reported by the Netherlands.
The number of arrests for terrorist offences in 2016 (1002) is lower than that of 2015 (1077). Most arrests were related to jihadist terrorism, for which the numbers rose for the third consecutive year: 395 in 2014, 687 in 2015 and 718 in 2016. Numbers of arrests for left-wing and separatist terrorist offences dropped to half of what they were in 2015 (from 67 and 168 in 2015 to 31 and 84 in 2016 respectively). Numbers of arrests for rightwing terrorism remained low at 12 in 2016 compared to 11 in 2015.
France is the only Member State in which the overall numbers of arrests continue to increase: from 238 in 2014, to 424 in 2015 and to 456 in 2016.
Almost one-third of arrestees (291) were 25 years old or younger. Only one in ten arrestees (9%) in 2016 was older than 40 years.
Arrests for terrorist activities (preparing, financing, assisting, attempting or executing attacks) decreased from 209 in 2015 to 169 in 2016. Arrests for travelling to conflict zones for terrorist purposes also decreased: from 141 in 2015 to 77 in 2016. This was similar to the decrease in numbers of arrests of people returning from the conflict zones in Syria and Iraq: from 41 in 2015 to 22 in 2016.
FIGURE 1
FIGURE 2
Attacks and arrests by EU Member State in 2016.
ATTACKS
ARRESTS
** 1.2. TERRORIST AND VIOLENT EXTREMIST ACTIVITIES
*** Financing of terrorism
Recent EU terrorist attacks have been funded by an opportunistic mix of licit and illicit sources. Up to 40% of terrorist plots in Europe are believed to be at least partly financed through crime, especially drug dealing, theft, robberies, the sale of counterfeit goods, loan fraud, and burglaries. Using funds raised through criminality is regarded an ideologically correct and legitimate way of financing ‘jihad’ in the ‘lands of war’[6].
Terrorists in 2016 were agile in the diversity of their funding mechanisms, both from legal and illegal sources. The young ages of a large proportion of jihadists, the majority of whom are computer literate, has caused an increase in the use of modern technological financial services. These financial services and applications, including financial low transfer apps, are fluid, encrypted and partially anonymised, allowing a desirable financial conduit for terrorists who seek a borderless, reliable and shielded financial mechanism, optimised and readily accessible for real-time small value transfers.
2016 has seen lower amounts of funds moved regularly through the financial sector. These small denomination values sent by supporters and family members are transferred to support FTFs and their organisational expenses[7].
*** Travel for terrorist purposes
More than 5000 individuals emanating from the EU are believed to have travelled to conflict areas in Syria and Iraq. As was observed in 2015, individuals from Belgium, France, Germany and the UK account for the majority of this total. On a per capita basis, Belgium appears to have the highest numbers. In addition, more than 800 persons are believed to have travelled to Syria and Iraq from the Western Balkan countries, predominantly joining IS. There is also likely to be a ‘dark number’ of travellers to and from Syria and Iraq that have not yet been detected. Turkey reported that, as of November 2016, it had approximately 7670 individuals from EU MS on a suspected FTF no-entry list. A number of countries, including the Netherlands, France, Denmark, Sweden, Austria, Germany and Switzerland reported that, since the beginning of 2016, the flow of jihadists travelling to conflict zones abroad - especially Syria and Iraq - has apparently continued to decline. Nonetheless, Germany and Italy for example, maintain that the level of departures remains high or constant.
The sustained pressure facing IS in Syria and Iraq due to the air strikes and ground offensive of the anti-IS coalition is likely to be the main reason for the general decline in outgoing travellers. The air assaults have also targeted IS’s financial structures, which has led to decreased incomes for FTFs. Moreover, it has become increasingly difficult to cross the Turkish border to Syria. Neighbouring countries have improved their border security and, since IS does not control the border area anymore, it is now more difficult to reach the territory it does control. Furthermore, IS leadership and messaging has indicated that their sympathisers should no longer go to Syria and Iraq, but should instead join IS branches in other countries or focus on attacks in their homelands.
Attack planning against the EU and the West in general continues in Syria and Iraq. Groups including IS and al-Qaeda have both the intent and capability to mount complex, mass-casualty attacks. It is believed that there is not a lack of volunteers for such operations. The 2016 attacks in Brussels in March, then in Istanbul in June, appeared to demonstrate the ongoing effectiveness of IS’s external operations capability. The Paris and Brussels attacks again showed that terrorist networks directed from Syria can rely on the help of sympathisers in Europe who have never been to Syria themselves.
According to the Netherlands for example, it is possible that there are still dozens of IS operatives (attackers sent by IS, and their accomplices) in Europe. Italy reported concerns of potential sleeper cells from the external operations unit of IS or al-Qaeda operatives and affiliated organisations inspired by jihadist ideology.
Germany asserted that there is no doubt about the firm determination of all internationally focused jihadist groups to seize every opportunity to carry out an attack in a Western country, but that despite this determination, in recent years, the planning and execution of such attacks has shifted mainly to lone actors or small groups without direct links to an organisation - modifying the threat situation accordingly. Furthermore, Germany assessed that individuals who have either been prevented from travelling abroad or failed to travel for other reasons should be regarded as particularly dangerous in view of the fact that their ideological delusion and propensity for violence are strongest at the time of the planned departure.
Ongoing contact on social media between combatants in Syria/Iraq and ‘stay-at-home jihadists’ fuels the enduring potential threat posed by jihadist networks; now that leaving the country to take part in jihad has become more difficult, would-be attackers may indeed shift their focus to their countries of residence. IS also supports the interactions between some of its fighters in the region and individuals recruited back in the EU (for example, in the jihadist milieu in France) in order to carry out violent actions on home soil. These recruitments are made via encrypted social networks such as Telegram.
Several countries, including Italy and Switzerland, stated that one of the greatest risks to their domestic security is posed by lone actors or small groups, be they self-radicalised individuals or returning FTFs.
**** TRAVELLING OF WOMEN AND CHILDREN RETURNING FIGHTERS
The UK were amongst countries that reported an increase in the number of women, families and minors engaging in the conflict in Syria/Iraq, although they remain a small proportion of overall travellers. They also reported that the average age at time of travel of those engaging in the conflict has reduced significantly; nearly half of those travelling aged 18 and under have departed since the declaration of IS’s ‘caliphate’ in July 2014. Poland stated that its citizens who travelled are all less than 22 years old. Although overall figures for the EU are not available, of further concern is that by the end of 2016 the Netherlands recorded a total of over 40 children (age 0-12 years) that have travelled to Syria or Iraq with their parents. Austria noted that women, including minors, leave or want to leave for the conflict zones and that some women married FTFs in Syria under Islamic law, partly via social media.
Denmark stipulated that only very few persons departed in 2016. The vast majority of these travellers were young women. In general, women account for nearly one eighth of the total number of travellers from Denmark. They also noted that more women play an active and independent role within jihadist circles in Denmark, and may consequently have an increasingly radicalising effect on their associates and families.
Belgium reported that returning women (and children) are of concern, due to the apparent involvement of female activists in the preparation of attacks. Some may also have received military training. In addition, IS propaganda has repeatedly depicted the training and indoctrination of minors.
However, Spain reported a decrease in the number of women arrested in 2016, and that only one was willing to travel to the conflict zone. The average age of arrestees in Spain was 31 (an increase of 2 years from the previous reporting period). A minor was taken into care due to his parents’ arrest, after they attempted to travel to the conflict zone.
**** RETURNING FIGHTERS
Most of the FTFs appear to return to Europe through the same route they used for their outbound travel, i.e. mainly taking indirect flights from Turkey and through other European countries. Portugal, for example, reported that those on their way to the conflict areas used not only Lisbon airport, but also more recently the airport in Porto (taking advantage of the new connection to Istanbul). Travel also occurred via the so-called Balkan route. Hungary and Poland reported that they were used as transit countries for FTFs travelling to or from Syria/Iraq. Romania was transited by a limited number of FTFs on their way to and from the conflict areas, the country not being positioned on the route most often used by them. Cases of individuals transiting through Switzerland were also reported, highlighting the risk of Switzerland serving as a logistical base to prepare attacks elsewhere.
Facilitation activity continued in 2016. In Italy for example, investigations led to the arrest of 19 people involved in recruitment for IS and facilitating the movement of FTFs to combat zones. In Switzerland, police operations led to the discovery of a recruiting cell composed of a number of individuals involved in facilitating the travel of Swiss and Italian residents to Syria. This cell also benefited from the logistical support of associates located in Turkey; the main suspect in this case was a Swiss-Turkish dual citizen who supported the ideology of Jabhat Fath al-Sham (former al-Qaeda affiliate Jabhat al-Nusra). Denmark reported that recruitment, radicalisation and facilitation of people and resources to the conflict zone takes place in circles that are less visible and organised than previously observed.
It appears to have become increasingly harder to leave IS territory. Italy reported only one returnee to Europe in 2016 and Denmark reported that the number of returnees from Syria/ Iraq has been declining since mid-2014. The Netherlands also stated that there have been only a few new returnees in the past two years (four in 2016), but that there have recently been indications that a number of Dutch men and women would like to leave Syria.
It is important to emphasise that a particularly strong security threat is posed by individuals who have received prolonged ideological indoctrination, military training in the use of weapons and explosives, or have gained combat experience during their stay in a conflict region. They may also have established links to other FTFs abroad and become part of capable transnational networks. These returning fighters will have increased proficiency in terms of carrying out attacks, either under direction or independently. In addition it is assessed that individuals who have joined terrorist groups like IS will be more brutalised and prone to violence; the influence being greater if their stay was lengthy. They may also have developed a high degree of security awareness. Moreover, some returnees will perpetuate the terrorist threat to the EU through radicalising, fundraising and facilitation activities.
The first groups of returnees were often disappointed with their situation in the ‘caliphate’. The motivations of the more recent ones are not yet entirely clear. The subsequent activities of the returnees from the conflict regions are reported to be diverse. They range from followers, who reduce their involvement in the jihadist milieu (even to the point where such activities are no longer noticeable), to persons prone to violence. However, it has been suggested (by Germany for example) that a disposition to jihadist ideology is likely to prevail, which, under certain conditions, allows the subject’s mobilisation at short notice. Denmark also noted that the threat from returning fighters may become apparent within a very short time frame, but may remain dormant and not appear until a triggering event.
As reported in the 2016 TE-SAT, the irregular migrant flow was exploited in order to dispatch terrorist operatives clandestinely to Europe (in regards to the November 2015 Paris attacks). The procurement and use of high quality false administrative documents was also successfully applied by terrorist operatives (for example by those involved in the March 2016 Brussels attacks). Over this reporting period, the Netherlands stated that in some cases IS operatives have applied for asylum in European countries.
A case in Switzerland involved three suspects purporting to be Syrian refugees and asylum-seekers. Two of them arrived in Switzerland with humanitarian visas and at the time of writing were being investigated as potential IS members.
Italy also stated they have had cases of refugees with previous jihadist backgrounds; and Austria reported it had several cases of individuals suspected of terrorism among the migrants staying in, or travelling through, its territory.
*** Explosives
Even though terrorists use a wide range of readily available weapons, explosive devices continue to be used in terrorist attacks, due to their high impact and symbolic power.
In 2016, the transfer of terrorist tactics, techniques and procedures (TTPs) from the current conflict zones and illicit spread of bomb-making knowledge and instructions has been observed. The availability of explosive precursors has facilitated the use of Home-Made Explosives (HMEs). Of particular concern are improvised explosive device (IED) attacks on soft targets and the use of suicide person-borne IEDs (PBIEDs).
**** IMPROVISED EXPLOSIVE DEVICES (IEDS)
Jihadist terrorist IED attacks generally aimed at soft targets, with the main intention of causing a large number of civilian casualties. In recent years, targets included air and rail transport facilities, commercial premises and major sports events.
Two distinct trends have been observed with regards to jihadist terrorists’ use of IEDs in the EU. Firstly, IEDs have been reported to show similarities in design and construction with IEDs used in conflict zones. Some elements of these IEDs appeared to have been modified based on available resources and circumstances in the EU. For example, HMEs and improvised components were used in place of military components that are difficult to procure. Such devices have been more prevalent in attacks by terrorist groups and lone-actors directed by IS. These incidents commonly required additional logistical support and specific knowledge in the manufacturing of larger amounts of HMEs. Nonetheless, these IEDs were not particularly sophisticated but relatively reliable and simple to use. Bomb-making knowledge, in some cases, was transferred to the attackers through direct contact and experience (facilitated by foreign terrorist fighters and returnees). In other cases, knowledge and guided instructions have been transferred via ‘remote assistance’ using various social media and online communication channels.
Secondly, more rudimentary IEDs have been used by jihadist terrorists recently. These mostly consisted of readily available explosive components, such as gas cylinders, pyrotechnic articles and ammonium nitrate-based products. Such IEDs can be constructed without any specific expertise, preparation, extensive planning or logistical support. They have been primarily used by small terrorist groups or self-radicalised lone-actor terrorists inspired by IS. It is also notable that IS has started to promote the use of readily available flammable products to construct basic improvised incendiary devices (IIDs) and commit arson attacks - a new simple terrorist tactic recommended for lone-actors.
Regarding the potential use of alternative and more sophisticated types of IEDs, the current trend in using weaponised unmanned aerial vehicles (UAVs) in the Syria/Iraq conflict zone might also inspire other jihadist supporters and expand the use of this kind of tactic outside this area of operation.
Additionally, as seen in recent attacks in Egypt and Somalia, threats posed to civil aviation by IED attacks are still present. Main threats emanate from the use of concealed and hardly detectable IEDs and facilitation by affiliates working as airport employees to bypass security checks.
Groups and individuals belonging to the extreme right-wing scene maintained their affinity to weapons and explosives. This was illustrated by the significant increase in the number of incidents involving arson and explosives, as well as seized explosive devices. In addition to common types of IIDs/IEDs such as Molotov cocktails and improvised pipe bombs, these groups tend to use military-grade explosive devices.
Left-wing and anarchist groups have predominantly carried out arson attacks using flammable liquids and IIDs, such as Molotov cocktails and gas cylinders. Nevertheless, an increase has been noted in the number of terrorist attacks in which perpetrators constructed and delivered postal IEDs/IIDs filled with incendiary or low-explosive charges, such as gunpowder. In general, all devices have been constructed from improvised material readily available on the open market.
The attack methodologies and capabilities used by Dissident Republican (DR) groups in Northern Ireland (UK) varied across groups. Many attacks involved firearms or small IEDs such as pipe bombs but they have also employed larger and/or potentially more destructive devices such as vehicle-borne IEDs (VBIEDs) and explosively formed projectiles (EFPs). There have been four DR IED attacks in 2016 including a fatal IED attack on a prison officer. All groups retain access to a range of firearms and explosives and there is an ever-present threat of under-vehicle IED attacks.
**** HOME-MADE EXPLOSIVES
HMEs have been the most common type of explosive used in recent terrorist IED attacks. The explosive used in most of the attacks was triacetone triperoxide (TATP), a home-made explosive that remains the explosive of choice for terrorists. The internet continues to be a crucial resource for lone-actor terrorists to gain bomb-making skills. Internet websites, forums, social networks and the Darknet facilitate access to bomb-making knowledge and information.
**** MILITARY EXPLOSIVES
The availability of explosives in current and former conflict areas such as the Western Balkans and Ukraine, and the illicit trafficking of explosives into the EU, is believed to present a significant threat. Terrorists are known to have acquired hand grenades, rocket launchers and high-grade plastic explosives and detonators from organised crime groups (OCGs).
In addition to trafficking explosives, other methods of obtaining military explosive ordnance include thefts from military explosives storage facilities and the illegal collection of explosive remnants of war (ERW) and unexploded ordnance (UXO) from former battle zones.
**** COMMERCIAL EXPLOSIVES
Commercial pyrotechnic articles and gunpowder continue to be misused for terrorist purposes as a source of explosive compounds for constructing IEDs. These pyrotechnics are widely available, and the use of pyrotechnic mixtures in lEDs is promoted in jihadist terrorist publications. This threat might increase in the future.
Misuse of pyrotechnics has been observed in most EU countries. The pyrotechnic articles have been used in various forms: in the original state; modified; or by extracting the pyrotechnic mixture and utilising it in IEDs. Pyrotechnics have largely been used in small-scale bomb attacks. The most frequently used types have been the categories F3 and F2, which are sold to the general public. However, it appears that the misuse of professional category F4 flash bangers has increased in the recent period.
*** Chemical, biological, radiological, nuclear (CBRN)
To date, no large-scale CBRN attacks in the EU by any terrorist group have been reported. However, IS has significantly improved its capacity to produce explosives and improvised explosive devices through the adaptation of existing military ordnance stolen or retrieved from abandoned or conquered military facilities. There is concern that they have also accumulated knowledge to develop CBRN weapons that could later be used in attacks. In territories under its control, IS might have gained control of CBRN facilities (abandoned military and industrial facilities, laboratories or stockpiles) allowing access to chemical agents. In addition, the group might have recruited, voluntarily or by force, scientists previously working in the chemical, biological or radio-nuclear sectors. The Organisation for the Prohibition of Chemical Weapons-United Nations (OPCW-UN) Joint Investigative Mechanism confirmed that IS has used chemical weapons in Syria.
Furthermore, in 2016, CBRN-related topics continued to appear in terrorist propaganda. Various jihadist media outlets used social media channels, in particular Telegram, to express intentions to commit CBRN attacks, share possible tactics for attacks and suggest targets. For example, in May 2016, a jihadist tutorial on ricin toxin extraction, addressing lone actors, was published online.
*** Food contamination threats
Threats to intentionally contaminate food or water occurred in 2016, both in criminal and extremist contexts. In two cases, anarchists threatened to use toxic chemicals. In June, Italian anarchists threatened to poison foodstuff in supermarkets in Lombardy using herbicide. The campaign aimed to protest against the use of toxic chemicals in the agriculture, engineering and food production industries. Those anarchists posted a technical description of the methods to be used and a list of potential targets on their website. In December, Greek anarchists published a warning claiming that they had contaminated several food and drink products of multinational companies. Their operation, “Green Nemesis #2”, was planned to take place between Christmas and New Year in Athens, Greece. The warning message posted on the anarchist website explained how to introduce chlorine and hydrochloric acid into products while leaving packaging intact. Similar threats to contaminate beverages were also expressed in December 2013.
*** Use of radioactive materials
In November 2016, several Slovak institutions including the Ministry of Justice, district courts and a regional police office, received suspicious envelopes containing anonymous letters. The letters expressed dissatisfaction with the judicial system and mentioned a lost court trial. One letter referred to radioactive contamination and incidents in 2015 and 2016 when employees of various judicial institutions were exposed to radioactive material emitting alpha-particles. Further laboratory expertise confirmed the presence of small amounts of radioactive Americium-241 in the envelopes. The case was investigated by the Slovak authorities as an act of terrorism. This incident demonstrated that certain CBRN materials that are commonly used in various civilian applications, in particular radioactive substances, can be acquired by criminals or terrorists due to inadequate security measures.
** 1.3. COURT PROCEEDINGS, VERDICTS AND IndIvIDUals IN CONCLUDED COURT PROCEEDINGS
In 2016, 17 EU Member States reported to have concluded a total of 275 court proceedings in relation to terrorism[* 8]. The concluded court proceedings concerned 580 individuals, 53 of which were female[9].
In 2016, Spain reported the highest number of concluded court proceedings and the highest number of individuals convicted or acquitted of terrorist offences. Among those, three individuals appeared before the court twice in 2016 in different criminal proceedings. In Belgium, the cases against two individuals were annulled on the basis of the ne bis in idem principle, as the court ruled the two had been convicted of the same facts earlier in 2015 and 2016. In France, two individuals appeared before the juvenile court and the criminal court. As a result, the total number of verdicts pronounced for terrorism-related offences in 2016 was 587.
Some of the verdicts reported in 2016 are final while others are pending judicial remedy, as appeals have been submitted.[10] A number of defendants in Belgium, France and the Netherlands did not appear before the court and were sentenced in absentia.
[8] Eurojust received contributions containing information on terrorism-related court decisions in 2016 from the following Member States: Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Lithuania, the Netherlands, Portugal, Slovenia, Spain, Sweden and the United Kingdom. As in 2014 and 2015, the UK contribution for 2016 covers England, Scotland, Wales and Northern Ireland. The UK contribution includes proceedings on offences under antiterrorism legislation, as well as other offences assessed to be terrorism related. Similar to 2014 and 2015, the UK data for 2016 refers only to convictions.
In case a verdict pronounced in 2016 was appealed and the appeal was concluded before the end of the year, Eurojust counted the proceeding as one and reported only on the latest/final verdict.
[9] Please refer to Annex III for additional information and clarification on the numbers mentioned in this section.
[10] According to Council Decision 2005/671/JHA, the information to be submitted to Eurojust is in relation to final convictions. Due to the specifics of reporting, Member States submit information on both final and not final decisions. Therefore, reference is also made to those decisions pending judicial remedy and they are included in the reported numbers.
The data provided by the United Kingdom did not distinguish between final verdicts and verdicts pending judicial remedy. As reported, all convictions in the United Kingdom are effective from the moment of their being pronounced, even if an appeal is made.
FIGURE 3
Number of individuals in concluded court proceedings for terrorist offences in 2014, 2015 and 2016, as reported to Eurojust*.
**** INDIVIDUALS TRIED
* The data for the previous years corresponds to the data reported in the respective TE-SAT reports.
*** Type of terrorism
The vast majority of verdicts in the Member States in 2016 were pronounced in relation to jihadist terrorism.[11] This confirms the findings in 2015 when, for the first time since 2008, the concluded court proceedings in the EU resulted in a higher number of verdicts for jihadist terrorism offences than for separatist terrorist offences.
As evidenced in the past couple of years, the majority of the verdicts for jihadist terrorism concerned offences related to the conflict in Syria and Iraq. They involved persons who had prepared to leave for or have returned from the conflict zone, as well as persons who have recruited, indoctrinated, financed or facilitated others to travel to Syria and/or Iraq to join the terrorist groups fighting there. Individuals and cells preparing attacks in Europe and beyond were also brought before courts.
Similar to 2015, courts in Belgium rendered the highest number of verdicts concerning jihadist terrorism in 2016 (138). A large number of such verdicts were also rendered in Germany and the Netherlands. In Belgium, as well as in seven other Member States, only verdicts concerning jihadist terrorism were pronounced in 2016. Those include Austria, Estonia, Finland, France, Italy, Portugal and Sweden.
The Brussels Criminal Court, for example, sentenced 15 men - with nine in absentia - to prison sentences of up to 15 years for membership in a terrorist organisation and planning of terrorist attacks. The defendants formed the so-called Verviers cell, which had ties with persons involved in the November 2015 terrorist attacks in Paris. Three of the defendants present at trial were considered to be the leaders of the cell, each receiving a 16 year sentence. The court found that one of them had travelled to Syria to receive instructions on targets, while the others had been responsible for arranging the logistics, including securing a safe house in Verviers and obtaining weapons and chemicals needed for the planned attacks. Another defendant received a sentence of 30 months in prison for helping a radicalised family member to travel to Syria in order to fight for IS. Similarly, another cell member received a 3 year sentence on probation for having attempted to join IS in Syria. The defendants convicted in absentia received sentences of 5 to 7 years in prison. Most are considered foreign terrorist fighters who left for Syria to fight in the ranks of IS.
Also in Belgium, the Court of Appeal of Brussels confirmed the guilty verdict pronounced in July 2015 by the Court of First Instance of Brussels against a leader of a terrorist group that had recruited and sent fighters to Syria. The Court of Appeal handed down a 15 year prison sentence, which is 3 years longer than the one given in first instance. The same sentence of 15 years was ordered for another person, who had received a penalty of 8 years’ imprisonment in July 2015. The prison terms of two other group members were also increased. All four were part of an organised network that had recruited, indoctrinated and facilitated the travel to Syria of potential fighters. One of the group members sentenced in absentia is believed to have played a major role in the attacks that took place in Paris on 13 November 2015. He was reported dead following a police action in the aftermath of the attacks. Another one, also sentenced in absentia and suspected to have been plotting terrorist acts, was arrested in March 2016 in France.
In France, seven men including the brother of one of the 13 November 2015 Paris attackers, were convicted by the Paris Criminal Court on 6 July 2016 to sentences of 6 to 9 years for participating in a criminal conspiracy to carry out terrorist attacks. They had travelled to Syria, where they had been trained by IS and fought in the ranks of the terrorist organisation. The men were part of a larger group that had travelled to Syria at the end of 2013. After two of the initial members had been killed, the rest - except one of the 13 November attackers - returned to France in April 2014, to be arrested a month later. The prosecutor in this case used wiretaps and various jihadi-inspired materials taken from the defendants’ devices as evidence. However, this conviction is not final as the public prosecutor has appealed.
In another case against a terrorist group with international ties in Italy, four members of the Merano cell of the Rawti Shax group were convicted by the Court of Assizes in Trento of planning terrorist attacks throughout Europe. The leader of the group was sentenced to 6 years in prison, while the other three members of the cell to 4 years respectively.
The defendants had as their stated aim the establishment of a theocratic state and the overthrow of the government of Kurdistan. The prosecution built its case on intercepted communications which showed that, despite the transnational nature of the Rawti Shax group, the Merano cell operated to a large extent independently. Its members were able to engage in fundraising and were theoretically capable of carrying out the attacks referred to in their communications. The Merano cell members were arrested as part of a big multinational operation coordinated by Eurojust in November 2015.
With regards to evidence, an interesting precedent was set by the District Court of Glostrup in Denmark, which was the first court in Europe to refer to a questionnaire/form used by IS. The form offered the possibility to indicate one’s role for IS and was made available by foreign authorities. It contained information on a Danish citizen charged with terrorist offences. In the form, he had been registered as a fighter. Reference to the form was made when questioning the accused about his role within the terrorist organisation. The court held that his statement about his tasks, mainly cooking and serving food, was not reliable. Based on this and other evidence, the accused was found guilty, amongst other charges, of joining a terrorist organisation and sentenced to 6 years’ imprisonment.
The intense propaganda, recruitment and indoctrination strategy applied by jihadist terrorist groups is also evident in the verdicts pronounced in the EU. In Spain, for example, the Audiencia Nacional found seven Spanish and Moroccan nationals guilty of terrorist indoctrination. Directed by IS, the seven had formed a terrorist cell that managed a number of social media accounts used to disseminate terrorist propaganda, glorify the jihad and praise IS. The accounts were also used to recruit persons who would later join IS in Syria and Iraq or commit terrorist acts in Spain. The accounts attracted a lot of followers who sympathised with IS and its terrorist activities. Some of those followers were selected as ‘most suitable’ and were brought in contact with a cell member located in Turkey who would help them reach Syria or Iraq or collaborate with IS in another manner. All seven cell members were handed down prison sentences of 3% to 7% years. In another case, one defendant was sentenced to 3% years’ imprisonment after the court found him guilty of self-indoctrination.
Further to verdicts concerning jihadist terrorism, Spanish courts dealt with the highest number of separatist terrorism cases in the EU in 2016. The vast majority of those cases concerned the terrorist organisation ETA. Individuals charged with offences related to other separatist terrorist groups (e.g. the PKK and LTTE) were tried in Denmark, Germany and the Netherlands. Greece was the only Member State that reported verdicts for left-wing terrorist offences, while courts in Hungary, the Netherlands and Spain also tried right-wing terrorism cases. The highest number of female defendants in the concluded proceedings in 2016 were tried for separatist terrorist offences (22) and for jihadist terrorist offences (also 22).
*** Convictions and acquittals
In 2016, Austria, Estonia, France, Germany, Greece and Hungary reported successful prosecutions resulting in no acquittals for terrorist offences[12]. Germany remains the only Member State where prosecutions for terrorist offences led to guilty verdicts and no acquittals in the period 2010-2016.
The year 2016 registered a record high conviction rate in the concluded court proceedings (89%). The acquittal rate of 11% is significantly lower than that in 2015 (21%) and in 2014 (24%) and continues the downward trend compared to the years before[13]. In some cases, defendants were acquitted of terrorist offences but convicted of other offences such as illegal possession of firearms, document forgery, preparing an armed robbery, manufacturing drugs, inciting racial hatred, etc[14].
All prosecutions for left-wing and right-wing terrorist offences resulted in convictions in 2016. The concluded jihadist terrorism cases also had a very high conviction rate (92%), similar to that in 2015 (94%). The acquittal rate among the verdicts related to separatist terrorism decreased significantly in 2016 (18%), compared to 2015 (47%)[15].
*** Penalties
The guilty verdicts pronounced by courts in the EU in 2016 resulted in various penalties including imprisonment, fines, treatment in mental health care facilities, community service and restraining orders. In some cases the court also imposed restrictions on civil rights and bans on entering the national territory on completion of the prison term, or revoked the citizenship of those convicted of terrorist offences.
FIGURE 4
Average sentences (excluding non-prison penalties) per Member State in 2016, as reported to Eurojust.
**** Average sentence in years 28 28
The prison sentences ordered by the courts in 2016 ranged between 6 weeks and 397 years. In some cases (part of) the sentence was suspended or made conditional for a certain period of time. In other cases guilty verdicts were handed down but no penalty was yet ordered at the time of reporting.
In several cases in Greece, Sweden and the United Kingdom the court ordered life sentences. In another case in the Netherlands the court pronounced a guilty verdict but imposed no penalty based on Article 9a of the Criminal Code. The court considered the defendant’s acts as a onetime misstep and recognised the efforts he had made to re-integrate into Dutch society.
The average prison sentence for terrorist offences in the EU in 2016 was 5 years. This is lower than the reported average in 2015 (7 years) and in 2014 (6 years)[16].The majority (67%) of the penalties handed down with the guilty verdicts in 2016 were of up to 5 years’ imprisonment, which is slightly higher than in 2015 (61%) and less than in 2014 (70%). The number of sentences of 10 and more years’ imprisonment decreased to 12%, compared to 20% in 2015.
Similar to 2015, in 2016 the average prison sentence for left-wing terrorist offences was the highest, increasing from 12 to 28 years. Jihadist and separatist terrorist offences were punished with an average prison sentence of 5 years, and right-wing terrorist offences with 4 years[17].
It should, however, be taken into consideration that the severity of the penalty in each case would depend on the respective offence and cannot serve any comparative purposes. Also, in some Member States the average sentence is calculated on the basis of one conviction, while in others it is based on a considerably higher number of convictions.IB
* 2. Jihadist Terrorism
[17] The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the overview.
** 2.1. TERRORIST ATTACKS AND SUSPECTS ARRESTED IN THE EU
135 A
people killed in jihadist terrorist attacks
718 &
people arrested on suspicion of jihadist terrorism related offence
2016, 135 people were killed in jihadist terrorist attacks in the EU. In total 13 terrorist attacks were reported: France 5, Belgium 4 and Germany 4. Out of these 13 attacks, 10 were completed.
A total of 718 people were arrested on suspicion of jihadist terrorism related offences. Numbers of arrests increased in particular in France: from 188 in 2014 and 377 in 2015 to 429 in 2016. There was also an increase in the Netherlands to 36 in 2016 compared to 20 in 2015. In the other Member States the numbers of arrests stayed at approximately the same level, or showed a (slight) decrease. Women have increasingly assumed more operational roles in jihadist terrorism activities, as have minors and young adults, as demonstrated in recent (primarily) failed and foiled attacks in Member States. One in four (26%) of the arrestees in 2016 were women, a significant increase compared to 2015 (18%).
Attack planning against the West continues in Syria and Iraq. Groups including IS and al-Qaeda are believed to have both the intent and capabilities to mount complex, mass casualty attacks. IS is training operatives in Syria/Iraq to carry out terrorist acts in the West and has no shortage of volunteers to be part of teams to be sent abroad for this purpose. Al-Qaeda, despite decreased operational capabilities of its core organisation, has maintained its ambition to carry out large-scale operations against Western targets.
The terrorist threat in the EU in 2016 emanated from remotely directed individuals operating alone or in small groups, and those that may have been inspired by terrorist propaganda, but not directed. The former are receiving direction and personal instruction from, and are possibly being facilitated by, a terrorist organisation. The latter are individual attackers, possibly but not necessarily being helped by family and/ or friends as accomplices. They are inspired by jihadist propaganda and messaging, but not necessarily receiving personal direction or instruction from any group.
On 7 January a man wearing what appeared to be a suicide vest and wielding a meat cleaver outside the Goutte d’Or police station in Paris, was shot and killed as he tried to force his way in. Also in January a Jewish teacher, wearing traditional dress and kippa, was attacked and wounded with a machete in Marseille while walking to work. The attacker was a 15-year-old boy who had arrived in France in 2010.
On 13 June a French police commander and his wife were stabbed to death by a former convict of terrorism-related offences. The police officer was attacked on arriving at his home in Magnanville, near Paris. The attacker subsequently entered the house, where he held the officer’s wife and their 3-year-old son hostage. After the police had ended the siege they found the mother of the child dead. The boy survived. After killing the woman, the attacker broadcast a statement live from the scene via social media in which he pledged allegiance to IS and called for more attacks. The IS related A’maq News Agency posted the video online and a statement that the attack was carried out by an IS fighter.
On 26 July two attackers armed with knives entered the church of Saint-Etienne-du-Rouvray (near Rouen) during morning prayers and murdered an 86-year-old priest and seriously wounded a nun. She was one of five hostages taken by the perpetrators (the others escaped), while the two attackers, both aged 19, filmed themselves in front of the altar. They were shot dead by police as they came out of the church. One of them had tried to travel to Syria twice in 2015.
In the evening of 14 July, a 31-year-old Tunisian, living in France, attacked Bastille Day celebrations in Nice by driving a truck for two kilometres through the crowds of people who had attended a firework display on the Promenade des Anglais. He killed 85 people, including 10 children, and injured 201, a number of them critically. The attacker fired a handgun at police before being shot dead. Evidence from mobile phones and computer records suggest that he may have planned his attack for up to a year. On 16 July, after 36 hours, IS claimed responsibility for the attack, however, at the time of writing no actual links had been confirmed. Vehicles have been used as weapons for attacks in France before, including the one in Valence in January and those in Dijon and Nantes in December 2014. These previous attacks however were relatively small scale compared to the Nice attack.
A similar soft target attack as in Nice took place on 19 December in Berlin, Germany. A truck was driven into a Christmas market in the city centre, killing 12 and injuring 56 people. The incident took place next to the Kaiser Wilhelm Memorial Church, an area heavily frequented by both tourists and locals. IS claimed responsibility for the attack through the A’maq News media outlet one day later, calling the attacker a “soldier”, who “carried out the attack in response to calls to target citizens of the international coalition”. The perpetrator, a 24-year-old Tunisian national, with a criminal record in Tunisia and Italy, had arrived in Europe 5 years earlier on the Italian island of Lampedusa and later travelled to Germany where he applied for political asylum. Prior to the attack, he made a video in which he pledged allegiance to IS and provided it to A’maq News. Three days later, he was shot dead after he attacked a police officer in Sesto San Giovanni, a suburb of Milan (Italy), during a routine check. Prior to that, he had passed the Dutch, Belgian and French borders on his way to Italy.
The attack in Berlin was preceded by a number of other completed, failed and foiled attacks in Germany in 2016. The first incident with a violent jihadist signature occurred on 26 February when a 15-year-old German girl of Moroccan descent stabbed and seriously wounded a police officer with a kitchen knife in Hanover. The incident occurred at the main train station, after two police officers had approached the girl and had asked her to present her identification papers. After her arrest police found that she was also carrying a second - larger - knife. The girl had travelled to the Turkish-Syrian border in November 2015 to join IS, but had returned to Germany on 28 January 2016.
On 18 July a 17-year-old Afghan refugee attacked passengers with an axe and a knife on board a train heading to Wurzburg in southern Germany. Five persons were seriously wounded. The attacker fled the train but was chased by officers who shot him dead. The perpetrator appeared to have travelled to Germany as
FIGURE 6
Number of suspects arrested for religiously inspired/jihadist terrorism in EU Member States in 2016
In June German police arrested three alleged IS members of Syrian nationality, on suspicion of plotting a terror attack in Germany. The three were caught separately in different cities. It was believed that the men had received orders from IS leadership to attack the city of Dusseldorf using suicide vests, explosives and rifles. The plan was allegedly for two men to blow themselves up in central Dusseldorf before other attackers would kill as many people as possible with firearms and explosives.
In 2016 EU citizens were killed in IS attacks outside the EU. On 12 January, 10 German tourists were killed in a suicide bomb attack in Istanbul (Turkey). This was one of seven fatal attacks in Turkey attributed to IS in 2016. On 1 July nine Italian citizens were amongst the victims who lost their lives in Dhaka (Bangladesh) in an attack on a bakery located in an area near embassies, for which IS claimed responsibility (this was later disputed by Bangladesh’s minister of home affairs, who stated that the perpetrators belonged to Jamaat-ul-Mujahideen).
The high numbers of failed, foiled and completed jihadist attacks in 2016, and the equally high numbers of arrests
*** Incitement of lone actor attacks in the West
Since the IS announcement in June 2014 that it had re-established the caliphate, the group claimed that all Muslims were under the religious obligation to join it. It was alleged that, by doing so, they would re-enact the historical migration (Hijrah) of Prophet Muhammad to Medina in 622 AD to evade persecution in Mecca. The group declared that refusal to join it was proof of apostasy from Islam. In 2015 IS insisted that the only excuse for Muslims for not joining the group in the territories under its control was to perpetrate a terrorist attack in their places of residence.
As military pressure on IS increased and measures to prevent potential recruits from reaching IS-controlled territory became more effective, IS adapted its recruitment tactics. It now declared that perpetrating a terrorist attack in the West was even preferable to travelling to join IS. < In a speech released on 21 May 2016, IS spokesman Abu
Muhammad al-Adnani, who was subsequently killed in August 2016 near Aleppo, urged volunteers that were prevented from travelling to join IS to perpetrate attacks in their places of residence. IS supporters, in particular in the United States and Europe, should carry out attacks with any means available during the month of Ramadan (6 June to 5 July 2016). Al-Adnani stressed that even the smallest attack in the West would have a great impact, as it would terrorise the enemy.
The increased efforts to incite IS sympathisers in the West to perpetrate attacks were reflected in practical guidance for lone actor attacks provided in IS publications. The IS multi-language magazine Rumiyah[18] contained a series of articles under the title “Just Terror Tactics”, which suggested terrorist attacks using knives, vehicles or arson, and gave tips on how to maximise the numbers of victims and impact. Perpetrators were admonished to leave some kind of evidence stating the motivation of the attack and allegiance to IS, such as a note attached to the victim’s body or a last will.
In 2016 IS preferred to claim lone actor attacks through its A’maq News Agency[19]. Starting with the 12 June 2016 attack on a nightclub in Orlando, Florida, (US), A’maq News issued short messages labelling the perpetrators of lone actor attacks outside IS-controlled territory as “soldiers of the Islamic State”, generally adding that they acted in response to IS’s calls to attack citizens of anti-IS coalition countries. As a precautionary measure, most of these claims pointed out that the information was received by A’maq News from a “security [read intelligence] source”. The public tribute paid by IS to lone actor terrorists was a way to give incentives to other potential attackers, while placing responsibility for the success of the attack entirely on the perpetrator. A’maq News‘ claims for attacks were mainly released within 24 hours after the attack, except in the case of the 14 July 2016 attack in Nice, when the claim came two days later. It has been speculated that the IS leadership had no prior knowledge of the attack or that the delay was a deliberate strategy to create confusion and maximise media coverage.
In addition to the short statements by A’maq News, in several lone actor attacks in EU Member States in 2016, the perpetrators sent previously recorded video statements in which they justified their attacks and pledged allegiance to IS, which were published on the A’maq News website. The precedent for this strategy was set during the 13 June 2016 murder of a police officer and his wife in Magnanville near Paris. After killing his two victims, the perpetrator broadcast a video message live from the location of the crime through a social media service. The video was later re-published on the A’maq News website. In subsequent attacks, prior to the commission of the crime, the perpetrators recorded videos in which they announced and justified their attacks. These videos were published on A’maq News following the attack as proof of the attackers’ motivation. This strategy was used in the 18 July stabbing attack in a train headed to Wurzburg, Germany; the 24
July bomb attack in Ansbach, Germany; the 26 July murder of a priest in St-Etienne-du-Rouvray, France; and the 19 December 2016 attack on a Christmas market in Berlin.
The increased efforts by IS to directly recruit vulnerable people via social media and incite them to perpetrate terrorist acts in their country of residence, seem to not be limited to male targets. Media reporting suggests that women were also targeted, as in the 26 February knife attack in Hanover by a 15-year-old girl. In addition, in early September, a cell consisting of three women was dismantled in Paris. They were suspected of having planted a car containing five gas bottles and a rudimentary ignition mechanism close to Notre Dame cathedral and planning further attacks. At least one of the suspects was reportedly in contact with a French male IS member thought to be in IS-controlled territory at the time. An attack on a police station by three women in Mombasa, Kenya, on 11 September was claimed by IS. Another cell of 10 women was arrested in Morocco in early October. In all cases, there are reports that the suspects were in contact with IS operatives.
IS ideology, as that of other jihadist groups, exempts women from the obligation to participate in armed action except for self-defence, but does not explicitly prohibit them from engaging in fighting. By implication, women may, if they so wish, carry out attacks on perceived enemies. At first glance, however, self-organised terrorist activities by women seem to be at variance with the strict gender segregation, the conscription of women to the closed circles of the family home and the extremely limited areas of activity outside of it, propagated in IS propaganda[20]. As a result, IS propaganda does not address women directly, but does not explicitly exclude them from the obligation to fight either. The attack in Mombasa was commented upon in an article in the IS Arabic newsletter al-Naba’,[21] which described the attackers as “sisters supporting the Islamic State”, not as “soldiers”. The known cells seem to have consisted only of women, which might be linked to the obligation of gender segregation.
*** Resurgent al-Qaeda
In 2012, already before the emergence of IS, al-Qaeda had redesigned its strategy to ensure its survival under the changed political circumstances following the Arab rebellions: al-Qaeda would merge with the population to the extent possible; cooperate with other Muslim groups based on common interests; and administer territories that fell under its control in a way so as not to alienate the population. The aim was to create safe havens from which al-Qaeda could plan and execute attacks on Western targets. The intransigent behaviour of IS toward local populations made the implementation of this new strategy even more pressing for al-Qaeda in an effort to mark the difference to its opponent.
In 2016, al-Qaeda spent great efforts to refute the legitimacy of IS’s claim to leadership of all Muslims. Al-Qaeda ‘s nominal head, Ayman al-Zawahiri, disputed in several audio and video messages the legitimacy of IS’s declaration of the caliphate. In a May audio speech, he urged Muslims in Syria to unite and build a true caliphate. He asked Muslims and the different fighting factions in Syria to trust its local affiliate Jabhat al-Nusra with the future of
the Levant.[22] He exhorted opposition groups in Syria not to let the country fall into the hands of Shi’is, secularists or IS.
At times, the new rhetoric adopted by al-Qaeda seemed to pick up on demands for representative government formulated during the Arab rebellions. In a video message commemorating the 15th anniversary of the 11 September 2001 attacks, for example, Ayman al-Zawahiri stated that the 2001 attacks were meant to “restore the equilibrium” between Muslims and the West. The attacks were claimed to be a reaction to the West’s alleged crimes in the Muslim world. With al-Qaeda‘s support, he claimed, the Arab revolutions would acquire an Islamic character and form the nucleus of an assembly that would be able to elect a caliph in the future. He said that the Muslim community had the right to choose, hold responsible and depose its leader. At the same time, he rejected negotiations; only armed struggle could bring a solution.
In most of its material published in Arabic language, al-Qaeda tends to downplay its international aspirations. By contrast, al-Qaeda communication targeting audiences in the West contains views and calls for action very similar to those of IS. This is likely to be an attempt to benefit from the gradual decline of IS communication with the aim of again gaining ascendency in the global jihadist movement. Interestingly, in doing so al-Qaeda copied successful propaganda formats developed by IS.
The competition with IS for leadership in the global jihadist movement was apparent in the 2016 publication of a new issue of al-Qaeda in the Arabian Peninsula’s (AQAP) Inspire magazine. The 16th issue of Inspire, released on 12 November, praised three lone actor attacks in the US on 17 September 2016 (one of which was claimed by IS), likening them to the 11 September 2001 attacks. It provided instructions on how to build IEDs, justified lone actor attacks in the West, and incited minorities (African Americans) to act.
In addition to the continuation of the Inspire magazine, AQAP introduced a new format, the Inspire Guides - short commentaries on completed and foiled attacks in the West with recommendations for future attacks. The first such document was released on 23 June 2016 and analysed the 12 June 2016 attack on a nightclub in Orlando, Florida, US. While praising the attack for the good planning and execution, it advised that future attacks should target places mainly frequented by white Anglo-Saxon people, who allegedly hold power in the US, rather than places that are popular with sexual or ethnic minorities. A second edition on 21 July 2016 praised the IS-linked attack in Nice, France, a week earlier. It recommended that the perpetrator should send a message so that the people may know and understand his motives. In a comment on the arrest of a female IS-linked terrorist cell in Paris in early September, Inspire Guide insisted that women be prevented from conducting terrorist attacks. By contrast, with regard to the three 17 September attacks in the US, an article labelled as an Inspire Guide in the November issue of Inspire gave practical instructions on how to maximise the impact of lone actor attacks in the West.
*** EU citizens kidnapped or killed
Terrorist and armed criminal groups continue to consider citizens of the EU and other western countries as high-value targets for kidnapping. This is because ransom money is a significant source of revenue for some groups; the extensive media attention attracted by western hostages can be exploited for propaganda and political pressure; and hostages can be used in prisoner swaps. It is assessed that militant groups do not select individuals of specific nationalities but target their victims opportunistically.
The total number of abducted EU citizens is difficult to estimate due to the fact that not all the kidnapping incidents are reported for reasons related to the security of the hostages. In 2016, the kidnap threat remained very high in and around conflict zones, as well as in areas with little or no governmental control. Incidents involving the kidnapping of westerners occurred in Libya, Mali, Afghanistan and the Philippines. In addition, Syria, Iraq and Yemen remained high-risk countries, although no abductions were reported in their territories in 2016.
Al-Qaeda in the Islamic Maghreb (AQIM) has been very active the regions of Maghreb and the Sahel. In January, AQIM militants abducted a Swiss female missionary in Timbuktu (Mali). Shortly after, the group posted a video online demanding, inter alia, the release of its fighters held in Malian prisons, as well as of a member of Ansar Dine (supporters of the religion), who was at that time standing trial at the International Criminal Court in The Hague. A second video was released in June as proof of life. The hostage was still in the hands of AQIM at the time of writing. AQIM also continued to hold a British-South African and a Swedish hostage, who were kidnapped from a restaurant in Timbuktu in November 2011.
In the same region, a Romanian citizen that was abducted in April 2015 in the border area between Burkina Faso, Mali and Niger, remained in the hands of his captors in 2016. The kidnapping was claimed, in May 2015, by a faction of al-Murabitun, which at the same time pledged allegiance to IS. In October 2016, al-Qaeda in the Islamic Maghreb (AQIM), with which the rest of al-Murabitun had merged in late 2015, posted a video statement online, said to have been recorded in late September, in which the hostage stated that he was in good health and pleaded to the Romanian government to do everything for his release. The release of the video by AQIM coincided with the faction responsible for the kidnapping reiterating its pledge to IS. Thus, the hostage seems to have become an object of dispute in the conflict between IS and al-Qaeda in the region. Romania reported that the Burkina Faso government did not receive a request for ransom.
In Libya, IS and other militant groups continued to take advantage of the instability of the country and carried on with their terrorist and criminal activities. In March 2016, two Italian employees of a construction company were killed in the area of Sabratha, during a fight between Libyan security forces and their captors. They had been abducted by IS in July 2015 near the towns of Zwara and Mellitah, along with two other Italians who were held in a different location and managed to escape, also in March 2016. IS militants still hold an Austrian and a Czech national, who were abducted in March 2015 from an oilfield in Zalla, along with seven more people from Ghana and the Philippines. In Ghat, south-western Libya, a local armed group kidnapped two Italian employees of a construction company in September 2016 and released them in November. No details regarding their abduction or release have been disclosed.
In the Philippines, the terrorist group Abu Sayyaf continued to carry out kidnappings. In April, its members killed a British-Canadian and in June a Canadian hostage. Both men had been abducted in September 2015, along with a Norwegian and a Filipino, from a resort in the southern Philippines. The Norwegian man remained captive at the time of writing, whereas the Filipino was released in June 2016. Abu Sayyaf militants were also behind the kidnapping of a German man and the murder of his wife while they were sailing off the southern Filipino coast in November. They demanded a ransom of PHP 30 million (EUR 565 000) but consequently killed the hostage. In February 2017, a video was posted online that appeared to show the execution. An Italian citizen abducted by Abu Sayyaf militants in October 2015 in the city of Dipolog was released in April 2016. The hostage was held on the island of Jolo, the stronghold of the terrorist group, where he spent his captivity with other hostages.
In Syria in May, Jabhat Fath al-Sham (former Jabhat al-Nusra) released three Spanish journalists that were abducted near Aleppo in July 2015. The group also claimed it freed a German woman and her baby in September 2016, denying it was responsible for her kidnapping. The woman had been abducted in October 2015. These releases are assessed to be part of the group’s attempts to distance itself from IS practices.
A British journalist held hostage by IS since November 2012 continued to appear in propaganda material. He featured in two IS videos released in December 2016.
** 2.2. COMMUNICATIONS
The quantity of
IS propaganda decreased in 2016 due to lower production rates and containment of dissemination
IS messages shifted from the rhetoric of victorious Islam, to calls for retaliation for alleged attacks on Islam
Terrorists have an interest in ensuring that their messages reach the audiences that they want to address. As they perceive themselves to be fighting for a legitimate cause, they need to justify their violent actions to supporters and opponents. Public communication is used to attract potential recruits, procure material and financial support, and intimidate opponents. At present, large volumes of people use online services to communicate. Terrorists are compelled to maintain an online presence and compete for visibility with other actors in public communications, including individuals, civil movements, governments, political opponents, and competing terrorist groups.
In 2016 terrorist groups continued to use online services for communication in targeted and diverse ways. Terrorist propaganda was spread primarily through social media platforms and file sharing sites. Encryption and anonymisation technologies freely available online, and a multitude of platforms, enable terrorists to spread propaganda while maintaining their anonymity. However, measures taken by some social media platforms[23] started to have a disruptive effect, in particular on IS communication, with the volume of messaging gradually decreasing in the course of the year. In 2015 IS had devised a strategy to counter the increased suspension of accounts, which relied on posting identical messages through a multitude of accounts[24]. In 2016 this strategy reached its limits as detection capabilities increased.
At the same time, IS and other terrorist groups increased their use of other encrypted social media platforms, most notably Telegram. IS used the platform for networking and dissemination of information among its community of supporters. Telegram is a closed communication space; its contents are not indexed in search engines. As such, it is not suited for outreach to individuals that are yet to be initiated into terrorist ideology. IS supporters use Telegram as a space for preparation, discussion and collaboration as well as a virtual training camp and Massive Open Online Course (MOOC) platform[25]. However, supporters are enjoined by IS to use it as a starting point to move to platforms that have a stronger impact, in particular Twitter and, to a lesser extent, Facebook. IS praised its supporters on Telegram for being part of its propaganda apparatus.
To reach out to audiences beyond closed circles, IS supporters on Telegram organised coordinated campaigns that aimed to flood Twitter and other major social media platforms with messages within minutes of new propaganda items being released. Before the release, IS supporters were told to create Twitter accounts to advertise the new propaganda production. Once published, the item was spread in a great number of messages. To achieve wide dissemination, the messages contained hashtags referring to current events unrelated to terrorism, such as political rallies or sports matches, in languages of regions of interest, including Europe and other Western countries, but also hashtags used by IS opponents in the Middle East. Simultaneously, the original files were replicated from their original source of publication to a great number of download sites to ensure continued availability despite containment efforts made by online service providers.
In addition to the increased difficulties in dissemination, the volume of IS
propaganda production also experienced a setback in 2016. After a peak in mid-2015, the number of new videos produced by IS slowly decreased. In the second half of 2016, the frequency of new releases dropped even further. This seems to indicate that IS’s propaganda apparatus was severely degraded due to the increased pressure on the group in its areas of activity; leading figures in its propaganda apparatus and media production infrastructure in areas under IS control were targeted. The group struggled to counter the loss of iconic leadership figures, propaganda officials and production capabilities, and to maintain the reach of its messages by adapting its communication strategies to use remaining capacities more efficiently.
These losses notwithstanding, IS’s propaganda apparatus remained highly stratified. Its central media outlets continued to be mainly reserved for messages from the central leadership. Their statements were amplified by a second layer of media outlets named after IS’s purported “provinces”. These “provincial” media offices issued videos but also “urgent” messages, generally in picture format, claiming military victories in their area of operation. Starting in 2015, IS’s Arabic weekly news bulletin al-Naba’ (“the news”) acquired increasing importance in 2016 in IS’s attempt to maintain a continued flow of propaganda messages. Initially unattributed, starting in October 2016, al-Naba’ was labelled as an official production of IS’s central media office. The publication focussed on military successes of IS and contained some moralistic or ideological articles. Its primary audience was IS fighters on the ground, and IS published pictures of al-Naba’ being disseminated to and consumed by these. Its subsequent wide dissemination on the internet is likely to be an attempt to create synergies in order to counter diminishing production capacities.
In addition to the officially acknowledged media outlets, IS had several outlets pretending to be journalistic organs, most prominently the A’maq News Agency and al-Bayan Radio. Within IS’s propaganda machinery, these entities have the role of acting as purportedly independent media entities providing information from IS territory. Al-Bayan Radio is an online radio station that issues daily news bulletins in several languages. The A’maq News Agency was created in 2014 to counter reporting by mainstream media opposed to IS, and broadcasts from the conflict area through short media-style messages and videos proclaiming IS military successes. To maintain the appearance of independence, IS did not acknowledge A’maq News as an official media outlet. Official IS publications referred to it as a source, in an effort to elevate A’maq News to the status of an independent information provider. For example, al-Naba’ articles combined information taken from mainstream media with information spread by A’maq News.
Efforts by IS to reach out to non-Arab audiences continued in 2016. During the first half of the year, the al-Hayat Media Centre, an officially recognised IS media outlet specialising in propaganda in languages other than Arabic, continued to publish glossy magazines in English (Dabiq), French (Dar al-Islam), Turkish (Konstantiniyye) and Russian (Istok). These elaborate publications were produced separately, with contents that specifically targeted the respective language community. In mid-2016, these formats were abandoned and seemingly replaced with a new publication named Rumiyah, in reference to the city of Rome which, according to a Prophetic tradition, would be conquered by Islam after Constantinople. Starting in September, Rumiyah was issued in eight, and later 10, languages including English, French, German, Russian and Turkish, on a monthly basis for the rest of 2016 and into 2017. While the magazine perpetuated the glossy style of its predecessors, Rumiyah‘s texts were for the most part translations of articles published previously in Arabic in al-Naba’. To these are added a small number of articles that occur only in one or a few language versions and that serve to adjust the magazine to particular audiences.
Around this network of propaganda entities acknowledged by IS or acting as purportedly independent news outlets reporting from IS areas of operation, there are a number of IS-supporting entities which are not officially recognised as mouthpieces by IS but are left to represent the base of IS supporters. These translate IS propaganda into different languages and produce additional material in different formats, including videos, graphics and texts, with a view to multiplying the messages of the official IS propaganda entities and creating the impression of a large global following. In 2016, it appeared that these IS-supporting media outlets are not as independent or autonomous as the IS leadership would like the general public to believe; they apparently have access to raw footage from IS’s areas of operation and respond to official releases in a speed that suggests central coordination, for example by publishing a video in support of an official publication within less than a day’s interval. In addition, production from these purportedly independent media outlets decreased in 2016 at the same rate as official IS propaganda. To a significant extent, therefore, these entities are part of the centrally coordinated IS propaganda machinery.
As the volume of IS propaganda diminished, al-Qaeda and its affiliates attempted to take advantage of the situation and increased their efforts to reach new audiences. The nominal head of al-Qaeda, Ayman al-Zawahiri, appeared in several video messages in 2016, trying to position al-Qaeda as a credible alternative to IS. This was supported by a multitude of written material published online. Al-Qaeda and its affiliates published new issues of established English glossy magazines, such as Inspire and Al Risalah, with justifications and practical advice for terrorist attacks. Like IS, al-Qaeda also moved increasingly to Telegram to avoid suspension. Some ideologues effectively restricted their activity to the encrypted chat platform.
*** Jihadist terrorist propaganda
The origins of practically all major jihadist terrorist groups can be traced to regions outside the EU. Consequently, online propaganda is an essential part of their attempts to reach out to audiences in EU Member States, as it enables them to make the link between the grievances of potentially vulnerable people living in the EU with the armed struggle that they conduct in their areas of operation.
Jihadist online propaganda has developed over some two decades. The methods used today are tested and optimised to achieve the greatest possible impact. They have been tailored for specific audiences. This long experience notwithstanding, jihadist propaganda has adapted quickly to new forms of communication and design, most recently incorporating graphical elements and styles copied from youth culture and online gaming, in an attempt to attract younger audiences in particular.
Likewise, the contents of jihadist propaganda vary over time, always aiming to achieve the greatest impact at any given point. Following the claim by IS that it re-established the caliphate, IS propaganda in 2014 and 2015 aimed to create the impression that the group represented victorious Islam. Its main topics were the purported defence of Islam, the creation of an Islamic state under IS leader Abu Bakr al-Baghdadi in his arrogated function of caliph of all Muslims. IS’s claim to success in this endeavour was supported with the display of IS policies that ostensibly guaranteed justice, welfare and services for the population under its control. Videos showed the implementation of social policies, consumer protection, religious education, but also military victories and the execution of enemies.
In 2016 the topics dominating IS propaganda shifted. The most remarkable change was the replacement of the narrative of a victorious Islam, embodied by IS, with one that depicted Sunni Muslims as being under attack by an alleged Western-Jewish-Shi’i alliance that aimed to eradicate Sunni Islam. The IS leadership claims that its fight against its enemies is part of the final battle, detailed in the sources of Islam, in which Islam will prevail on the Day of Judgement. In August 2016, the Dabiq magazine, whose name refers to the location in which Islamic tradition locates the last battle between Good and Evil, claimed that IS was not fighting the West due to its policies but on account of its “unbelief”.
In an effort to suppress and deter any attempt of dissension in territories under its control, IS published a large number of videos showing individuals labelled as traitors and spies for the anti-IS coalition. Other videos showed the killing of members of armed opposition groups fighting against IS. The victims were made to confess deeds that were alleged to be crimes against Muslims and then assassinated, generally by beheading or shooting from a close range. Videos showing these killings used repetition, multiple cameras and slow motion to increase the impact of the killings. In one video published in late 2016, two Turkish soldiers captured by IS in Syria were burnt alive. With regard to the West, IS told its supporters that they were obliged to seek “retributive justice” for attacks perpetrated by the international anti-IS alliance. Muslim scholars opposed to IS were also identified as targets of lone actor attacks. IS also called for the killing of prominent representatives of Sunni Muslims in Europe, including Salafist preachers opposed to it.
In an attempt to restrict access to independent information in areas under its control, in early June 2016 IS conducted a media campaign, including a series of videos, urging people to destroy their satellite dishes and receivers.
IS tried to compensate reports about military setbacks by continuously projecting a propaganda image characterised by a combination of military victories and utopian views of orderly daily life and undisturbed functioning of the administration and services provided under IS rule. That the situation did change, and with it IS’s priorities with regard to recruits, is illustrated by its attitude towards women. In 2016, as in previous years, IS formulated rules for women’s behaviour in areas under its control that aim to give men control over every aspect of their lives. IS expected women to marry IS fighters. They were obliged to obey their husbands, a duty that, IS insisted, also applied to foreign women, who cannot pretend to be privileged because of their travelling to join IS (Hijrah). Women have no right to question their husbands’ decisions in their or their children’s regard. Their principle role under IS is to bear children, keep the household and educate the children to become fighters in line with IS ideology. Women are enjoined to stay at home and not go out without their husbands’ permission. If they do go out, they must cover their body entirely, including face and hands.
Despite this puritanical code of behaviour, IS used the possibility to acquire women as an incentive to attract male fighters. To this end, in 2014 IS declared the re-introduction of slavery, so that IS members could capture or purchase women from the Yazidi community, which had been declared pagans by IS for that purpose. Possibly after the expansion of IS came to a halt in 2015, the supply of women for enslavement decreased. In 2016 IS publications tried to persuade women that polygamy, i.e. the marriage of a man with up to four Muslim women, was the right of men, probably as a means to maintain the sexual stimulus for IS fighters. Another new aspect in IS propaganda targeting women was the request to provide material support to IS from their private property which, contrary to fighting, it described as a form ofjihad that is obligatory for women. In the past, IS had tried to attract recruits with the promise that all their housing and salary needs would be catered for.
Propaganda targeting Western women in principle contained the same messages as for Arab audiences. In addition, however, it tried to give the impression that under IS rule women were able to play more active roles, which is at odds with the proclaimed restrictions on women’s freedom. At the same time, IS propaganda portrayed life in the West as corrupted, denigrating for women and contrary to human nature.
In late 2016, IS added a new topic to its messages to ensure the organisation’s survival: in case of defeat in Syria and Iraq, IS affiliates in other geographical areas should continue the struggle. For example, in a 3 November 2016 speech following the launch of the military campaign to end IS control of Mosul in Iraq, IS leader Abu Bakr al-Baghdadi called upon IS members to be steadfast in the face of the attacks of the anti-IS coalition, describing its members as enemies of Sunni Muslims. He urged IS fighters in areas outside Iraq and Syria to continue the fight, even if the IS leadership was killed, and asked IS sympathisers to move to these regions rather than trying to join the group in Iraq and Syria. In 2016 the most active IS affiliates outside Syria and Iraq with regard to video production were in Libya, Egypt and Afghanistan.
** 2.3. DEVELOPMENTS
IS under increasing military pressure, losing territory that it used to control in Syria and Iraq
Western Balkan countries
Turkey faced a number of large-scale terrorist attacks
Political instability and insecurity in Lybia continued in 2016
AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. Jihadist terrorists also attacked Western citizens in the Middle-East and North-Africa (MENA) region, including in Egypt, Jordan and Lybia
The conflict in Syria has had an enormous resonance in Albania, Bosnia and Herzegovina, Kosovo, the former Yugoslav Republic of Macedonia and Serbia. More than 800 FTFs have so far travelled to Syria to join the armed conflict from the countries of the Western Balkans. In some parts of the Western Balkan region, radical Islamist ideology promoted by radical preachers and/or leaders of some salafist groups, challenging the traditional dominance of moderate Islam in the region, has gained considerable ground. Bosnia and Herzegovina, the so-called Sandzak region (between Serbia and Montenegro), Albanian-speaking territories in Serbia and the former Yugoslav Republic of Macedonia, Kosovo, and Albania until recently were considered the main hotspots for radicalisation, recruitment, and facilitation activities of FTFs destined for Syria. The region has also been a well-established and recognised travel route to and from conflict zones in the Middle East.
Common battle experiences amongst Western-Balkan FTF returnees may cross-cut ethnic and national boundaries after their return home and may pose a significant threat to the region.
The presence of illegal weapons, especially small and light weapons, as well as mines and explosive devices is a significant security issue in the Western Balkans. Available data do not corroborate media reports on the existence of so-called “training camps” in the region similar to those allegedly present in Syria, aimed at providing combat training.
The number of arrests made across the region in recent years attest to the fact that the primary terror threat to the region has been, and will continue to be, jihadist terrorism - represented by both returnees from the conflict zone in Syria and Iraq, and home-grown radicalised and inspired individuals. In November 2016 competent authorities of Albania, Kosovo and the former Yugoslav Republic of Macedonia prevented the occurrence of two terrorist attacks planned to be committed on their territories, with 19 arrests in Kosovo and six in Albania and the former Yugoslav Republic of Macedonia. The attacks, allegedly intended to simultaneously target a football match in Albania (between Albania and Israel) and a target in Kosovo, are believed to have been planned and directed from Syria. TATP, firearms and electronic equipment were seized in police raids.
The level of threat posed by extreme leftwing, anarchist and extreme right-wing terrorism in Western Balkan countries appears to be insignificant compared to religiously motivated terrorism (primary threat) and ethno-nationalist and separatist terrorism (secondary threat) in the region.
*** Caucasus
IS claimed responsibility for several attacks in Dagestan in 2016.
IS Caucasus province tried to persuade people to fight in the Caucasus, rather than travel to Syria.
IS claimed an attack by two individuals on
17 August in Balashikha near Moscow on a Russian traffic police outpost. They had sent a video to A’maq News in which they explained that they were acting on IS orders to strike with whatever means available. They claimed to act in revenge for the killing of Muslims in Syria and Iraq.
*** North America and Australia
The US faced a number of lone actor attacks in 2016. The most severe attack took place on 12 June, when the perpetrator stormed a nightclub in Orlando, Florida, killing 49 people and taking hostages. In telephone calls to the emergency number, the attacker, who was subsequently killed by police, is reported to have pledged allegiance to IS. While questions about his motivations persist, A’maq News described him as an “Islamic State fighter”.
Two other attacks in the USA were claimed by IS. On 17 September, a man stabbed and injured 10 people in a shopping mall in St Cloud, Minnesota. The attack was claimed by IS through A’maq News. On 28 November, an attacker rammed a car into a group of students at Ohio University, Columbus, Ohio, before attacking them with a knife. A total of 13 people were injured. The attack was claimed by IS through A’maq News.
Additional attacks that were not claimed by IS included two bomb attacks on 17 September in Seaside Park, New Jersey, and New York City, respectively. Whereas the first attack did not cause casualties, in the New York attack, 29 people were injured when a pressure cooker bomb exploded in a busy street. Another device was found nearby unexploded. On 18 September, an explosive device found in a train station in Elizabeth, New Jersey, exploded during an attempt to disarm it, causing no injuries. The individual believed to have carried out these attacks was arrested. This series of attacks was not commented on by IS, but it was praised, together with the St Cloud attack, in AQAP’s Inspire magazine, published in November 2016. Another lone actor attack was carried out on
7 January, when a police officer in Philadelphia was shot and injured by an individual pledging allegiance to IS. IS did not claim the attack. In addition to the attacks in the US, on 27 October, a security officer was stabbed outside the US embassy in Nairobi (Kenya). This attack was also claimed by IS through A’maq News.
In Canada, police in Strathroy, Ontario, killed a man planning to carry out a suicide attack using an IED on 10 August.
In November, a prominent Islamic State militant of Australian origin, who was thought to have been killed in an air strike in Iraq, was arrested in Turkey. In December, police arrested five men suspected of planning a terrorist attack in Melbourne on Christmas Day.
*** Syria/Iraq
In 2016 IS came under increasing military pressure, losing territory that it used to control in Syria and Iraq.
In Syria, the city and historic sites of Palmyra (or Tadmur in Arabic), which were captured by IS in 2015, were re-taken by the Syrian regime in March 2016 before briefly being re-captured by IS in December. An IS attack in December at a Crusader castle in the town of Karak in Jordan killed 10 people, including a Canadian tourist.
In Iraq, IS lost strategic towns such as Ramadi in February and al-Falluja in June. The campaign to expel IS from Mosul was launched in October.
Several high-ranking IS leaders and propaganda officials were killed in 2016, including the official IS spokesman Abu Muhammad al-Adnani in August. IS media production infrastructure was reportedly destroyed in Mosul.
Both in Syria and Iraq, IS continued destroying cultural heritage. Further destruction was reported from Palmyra. In June 2016, IS destroyed the 2800-year-old Nabu temple at the archaeological site of Nimrud near Mosul.
In Syria, the civil war entered its sixth year in 2016. Several attempts by the UN and other international actors to reach a lasting ceasefire, all of which excluded IS and Jabhat al-Nusra (“support front”), al-Qaeda’s official affiliate in Syria, were unsuccessful. The regime continued to receive military support from Shi’i militias, Iran and Russia. IS, while on the defensive, continued to fight the regime and armed opposition forces. Thus, the Syrian armed opposition is locked in a two-front war against the regime on one side and IS on the other. Turkey sent troops into Syria in August to push back IS militants and Kurdish-led rebels from a section of the two countries’ border, in cooperation with a number of Arab opposition factions.
Syrian opposition forces consist of a multitude of groups of different orientations with varying degrees of cooperation. The core of the Free Syrian Army (FSA) still seems committed to a secular model of society. It cooperates with groups of Islamist orientation, but rarely with jihadist factions. This notwithstanding, in the course of the escalating conflict, in particular in the wake of Russia’s military intervention in support of the Syrian regime, the armed opposition in general has increasingly referred to Sunni concepts related to jihad and, in light of the support by Iran and Shi’i militias, adopted anti-Shi’i rhetoric.
In late July, Jabhat al-Nusra changed its name to Jabhat Fath al-Sham (“Levant conquest front”), declaring that it was an organisation without ties to any external organisation. This disassociation from al-Qaeda was likely done to eschew being labelled as a proscribed terrorist organisation. In addition, the move was designed to facilitate the group’s cooperation and integration within the Syrian armed opposition. In a speech in late August 2016, the nominal head of al-Qaeda, Ayman al-Zawahiri, promoted the idea of creating a unified council in Syria that would decide disputes among “mujahidin”. A model for such a council was Jaysh al-Fath (“conquest army”), a coalition of fighting groups including the former Jabhat al-Nusra, which took control of Idlib in northern Syria in 2015. In 2016 jihadist ideologues and Jabhat Fath al-Sham promoted, with some success, the creation of Jaysh al-Fath in Aleppo, which acted alongside an FSA alliance in the opposition-controlled sections of the city during the siege by regime forces. In mid-
December, however, regime troops and militias took control of the last sections of the city that had remained under opposition control. The defeat led to new efforts to unite the Syrian armed opposition. The main point of contention was whether a merged opposition force should include Jabhat Fath al-Sham[26].
*** Turkey
Turkey faced a number of large-scale terrorist attacks in 2016, several of them attributed to jihadist groups, thereby continuing a series of attacks that started in mid-2015. On 12 January, a suicide attacker detonated an IED in the central historic district of Istanbul, killing 13 tourists, 12 of them German citizens. Turkish government sources attributed the attack to IS. In March, another suicide attack using an IED in a central shopping street in Istanbul killed four, including three Israeli citizens. In June, three suicide attackers killed 45 people at Istanbul airport. Another attack targeted a wedding in Gaziantep on 20 August, killing at least 50, including many children. The attack was attributed to IS. On 31 December, an attack targeted a nightclub in Istanbul, killing 39. The attack was claimed by IS. The perpetrator, reportedly an ethnic Kyrgyz with links to IS, was arrested.
Following Turkey’s military intervention in Syria in August, IS propaganda increasingly singled out Turkey as a major enemy of Islam and an ally of the West. IS insisted that dominant Muslim currents in Turkey deviated from true Islam and, consequently, have become legitimate attack targets.
Whereas in 2016 IS propaganda activity in the Turkish language faced the same challenges as that in Arabic, several internet sites in Turkish, which acted as news portals, were openly supportive of jihadist groups in Syria, including Jabhat Fath al-Sham, and al-Qaeda in general.
On 19 December, the Russian ambassador to Turkey was murdered by a Turkish national in Ankara. Jabhat Fath al-Sham denied responsibility, saying that the murder was a “natural reaction” to Russia’s interference in the Syrian war.
Other attacks, including a 10 December attack using a car bomb in Istanbul killing 38 people and a November attack by car bomb in Adana killing two, were not claimed or attributed.
*** Egypt
In 2016, IS “Sinai province”, the IS affiliate in Egypt’s Sinai Peninsula, continued perpetrating terrorist attacks mainly targeting Egyptian security forces. In addition, IS tried to expand its area of operation beyond Sinai. For example, in January, a series of small-scale attacks targeted Egypt’s tourism industry. On 7 January a tourist bus was shot at in front of a hotel in Cairo without casualties. The following day, two men armed with knives attacked a tourist hotel in Hurghada, injuring three people. On 9 January, two policemen were killed in Giza. The attacks in Cairo and Giza were claimed by IS.
A suicide attack on a Coptic cathedral in Cairo on 11 December was claimed by an Egypt-based affiliate of IS, however without explicit reference to its Sinai branch. The attack killed 25 people, mainly women and children.
The cause of the crash of an Egyptian aeroplane travelling from Paris to
Cairo with 66 people on board on 19 May remained unknown at the time of writing.
*** Libya
In North Africa the continued instability in Libya and the prospect of a large number of IS fighters of North African origin returning to their home countries remained a source of concern. The region witnessed the competition for dominance between al-Qaeda-linked groups and IS. This was illustrated in a series of videos published simultaneously in January 2016 by “provincial” media outlets, including IS Algeria province which emerged from a splinter group of al-Qaeda in the Islamic Maghreb (AQIM)[27]. In the videos IS tried to specifically attract people from North Africa, with several of the videos targeting al-Qaeda followers in the region, calling on them to pledge allegiance to IS.
In Libya, political instability and insecurity continued in 2016 despite the creation of a joint Presidency Council in the Libyan capital Tripoli in March 2016, which was tasked with forming a unity government comprising the two existing governments in Tripoli in western Libya, and Tobruk and al-Bayda in eastern Libya. In addition, the forces of General Khalifa Haftar, who rejected the agreement, extended the territories under their control beyond Benghazi, seizing much of the oil-rich Gulf of Sirte in September. The competition for control over Libya’s natural resources is expected to continue fuelling tensions between the different competing factions.
Meanwhile, in early December, forces loyal to the unity government took complete control of Sirte. IS had seized the city in early 2015, at one point controlling some 300 km of the Mediterranean coastline. The campaign against IS started in May 2016, supported by US airstrikes starting in August. IS had already lost the eastern Libyan coastal town of Darna in 2015. It was able to maintain a presence in suburbs of Benghazi for much of 2016, before being defeated there by Haftar forces.
[26] In January 2017 this dynamic led to the merger of several fighting factions, including Jabhat Fath al-Sham, into Hay’at Tahrir al-Sham (“Levant liberation committee”).
[27] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 32.
The number of IS fighters in Libya reportedly increased twofold from 2015 to 2016, reaching between 4000 and 6000 by April 2016. However, the forces were described as less successful in seizing territory and apparently comprised very few local fighters. IS carried out several large-scale terrorist attacks in Libya in 2016. These included a lorry bomb attack on 7 January, which killed dozens at a police training centre in Zliten. The attack was claimed by IS Tripoli province. On 21 January IS attacked Ras Lanuf oil terminal, setting oil storage tanks ablaze.
After the decline of its affiliate Ansar al-Shari’a (“shari’a supporters”) in Libya, parts of which had joined IS, al-Qaeda tried to maintain its influence in Libya. For example, in January 2016, al-Qaeda in the Islamic Maghreb (AQIM) released a recording in which it accused Italy of occupying the Libyan capital Tripoli (referring to an Italian general, who is the senior military advisor for UNSMIL in Libya). In an audio statement released on 9 October, AQIM’s leader Abu Mus’ab Abdulwadud called upon Muslims in Libya to unite against secular forces. In particular, he exhorted all Muslims to oppose Khalifa Haftar’s aggression in Benghazi. The group denounced the alliance between local secular groups, including Haftar’s Libyan National Army, and international actors (Egypt and UAE).
The Libyan crisis continued to affect neighbouring countries, in particular Tunisia. On 7 March, a massive attack on Tunisian police and military in Ben Guerdane on the Libyan border killed 45 people, including 28 attackers. IS was suspected to have carried out the attack. Tunisia fears that the return of thousands of foreign fighters from conflict areas, and extraditions from Europe, will have a destabilising effect on the country.
*** Sahel
In late 2015 and 2016, AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. AQIM claimed that the attacks targeted locations used for espionage and conspiracies against Muslims. This string of attacks from north to south in West Africa likely aimed to increase the group’s relevance in the region in the face of the IS challenge. After an attack on a hotel in the Malian capital Bamako on 20 November 2015, which was claimed by al-Murabitun in cooperation with AQIM[28], a similar attack on a hotel took place in Ouagadougou, capital of Burkina Faso, on 16 January 2016. The attack was claimed by AQIM in a 17 January statement. On Telegram, the attack had earlier been attributed to al-Murabitun, which had joined AQIM in December 2015. On 13 March 2016, another group of terrorists attacked a tourist resort near Abidjan, capital of Ivory Coast, killing 19. The attack was claimed by AQIM in a statement issued the same day.
AQIM increased its propaganda output targeting Sahel countries in 2016. It adopted propaganda styles developed by IS. For example, AQIM issued videos showing the killing of alleged spies, accused of working for France, albeit without the same amount of graphic detail.
Its messages to local populations, however, differ notably from those of IS. Rather than threatening Muslims with accusations of unbelief if they fail to join the group, AQIM purported to defend the interests and lives of the Muslim population, while punishing “corrupt” governments for their collusion with foreign powers against Muslims. Western companies were labelled as legitimate targets for their alleged exploitation of the Muslim population and the pollution of Muslim land. For example, in March, AQIM claimed responsibility for a rocket attack on a gas plant in Algeria jointly run by BP and Statoil, saying it was part of its “war on the interests of the Crusaders”. In a May statement, AQIM claimed an attack on the uranium mine in Arlit, Niger, operated by French company Areva. It then reaffirmed its intention to strike French targets.
In Mali, AQIM continued to claim attacks on Malian, French and MINUSMA[29] troops in 2016 and to incite people to fight or support the fight against the Malian government, alleging that the latter brought French troops to the country. In an 8 July audio message, the head of AQIM’s Sahara division called upon Muslims in Mali to fight against France. He referred to the powerful role France still played in its former colonies. Several Western hostages were held by AQIM in Mali in 2016, including a Swedish and a South African citizen and a Swiss woman.
Since late 2015, the enemies of the UN mission in Mali, including AQIM and Ansar al-Din (“supporters of the religion”, Ansar Dine), increased their cooperation, for example by exchanging expertise in IED production and modus operandi. In several attacks in 2016, UN troops and Mauritanian soldiers were killed. These included a joint attack by AQIM, Ansar al-Din and another local group on 21 July on a military post in Nampala near the Mauritanian border, which killed at least 17 Mauritanian soldiers.
The competition between AQIM and IS, which in 2015 led to a split within al-Murabitun[30], continued in 2016. In late October, IS’s A’maq News publicised a repetition of the pledge of allegiance by al-Murabitun’s IS-leaning faction to the IS leadership. As mentioned above, immediately after this, AQIM released a video showing a Romanian hostage supposedly held by the IS faction. Whereas the faction was not officially integrated into IS’s system of “provinces”, several attacks in the Sahel region in the last quarter of 2016 were attributed to this IS branch. In Nigeria, jihadist militia Boko Haram, which had pledged allegiance to IS in March 2015, changing its name into IS’s “West Africa province”[31], split in early August 2016 when IS’s al-Naba’ newsletter introduced Boko Haram’s former spokesman as the new “governor” of
the “province”. The leader of Boko Haram, Abubakar Shekau, rejected the appointment, insisting that he remained in charge. In late December, the Nigerian army claimed having defeated Boko Haram militarily. In a reply, Abubakar Shekau denied that the group had been driven from its stronghold in the Sambisa Forest in north-eastern Nigeria.
Arabian Peninsula comprising local dignitaries. Despite being driven from al-Mukalla in May 2016, AQAP continued its activities in the region, often blending into the local population.
Compared with AQAP, IS has a rather small following in Yemen. Being primarily present in urban areas, in particular Aden which was occupied by Houthi forces in 2015, it claimed a number of attacks on Houthi and Hadi government targets, including several suicide attacks by VBIEDs in Aden in May, June and December 2016.
In Saudi Arabia, IS was accused of being behind a series of bomb attacks in early July. On 4 July a suicide attacker detonated his explosive belt near the US consulate in Jeddah, when approached by police. The affiliation of the individual remained unknown at the time of writing. On the same day, a similar attack took place near the Prophet’s Mosque in Medina, in which the attacker and four security staff were killed. A third bomb attack in the eastern majority Shi’i city of Katif killed only the attacker.
Somalia/Kenya
Harakat al-Shabab al-Mujahidin (HSM, “mujahid youth movement”) continued activities in Somalia and reaching out to Kenya. Although it had previously lost control of urban centres, in 2016 it perpetrated at least seven large-scale terrorist attacks on restaurants, hotels and markets in Mogadishu, several of which combined the explosion of an IED with a subsequent ambush using firearms. Similar attacks were perpetrated in other cities. On 14 January, HSM attacked AMISOM troops in southern Somalia, killing a large number of soldiers. A 27 July HSM suicide attack on the AMISOM headquarters in Mogadishu killed at least seven people. In addition, HSM perpetrated two attacks on residential compounds in Mandera, north-east Kenya on 6 and 15 October, killing 6 and 12 people respectively. In January HSM published a video showing the killing of a Ugandan soldier.
A faction that split from HSM in Somalia in October 2015 and pledged allegiance to IS[32] continued its activities despite attempts by HSM to suppress it. The group, whose numbers probably do not exceed 200, has not been officially recognised by IS. Nevertheless, in late October 2016 it succeeded in taking control of the coastal town of Qandala in Puntland, from which it was expelled in late December. Another split-off from HSM, using the name Jahba East Africa and reportedly consisting of former HSM members from Kenya, Tanzania and Uganda, pledged allegiance to IS in April 2016. The same month, the group attacked an AMISOM convoy in Somalia.
An IED exploded in an aeroplane of a local airline during a flight from Mogadishu to Djibouti on 2 February. The detonation ripped a hole in the skin of the aircraft; the alleged perpetrator died when he was sucked out of the passenger compartment. The pilot managed to perform an emergency landing. Reportedly, the individual was originally booked on a Turkish Airlines flight. The attack was not claimed by any group.
*** South-east Asia
In Afghanistan, since NATO forces withdrew from Afghanistan by the end of 2014, the Taleban have expanded the territory that they control. In 2016, their offensives were focused on the provinces of Baghlan in the north and Helmand and Uruzgan in the south. In March, the Taleban announced that they were preparing to capture major cities in Afghanistan. In mid-April and again in October, they started offensives to retake Kunduz, which they had briefly captured in late September 2015. In late October, they blocked the connection between Kabul and the southern city of Kandahar. In addition, the Taleban claimed a significant number of large-scale terrorist attacks, many of which targeted military and security forces. Several attacks combined the use of VBIEDs with an ambush using firearms. By contrast, the Taleban denied responsibility for the explosion of an
IED hidden in a motorcycle on a market in Badakhshan province on 20 June.
Several attacks on Western targets were claimed by the Taleban. On 20 June, a suicide attack by a PBIED targeted Nepalese security personnel working for the Canadian Embassy in Kabul. The attack, which killed 14 people, was claimed by the Taleban. On 1 August, the Taleban carried out a lorry bomb attack on a hotel in Kabul popular with Western citizens. One policeman and three attackers were killed. On 24 August, the American University of Afghanistan was attacked by several armed fighters, some reportedly wearing suicide vests. Hundreds of students and foreign teachers were taken hostage for 10 hours. Seven students, two university security guards and three policemen were reportedly killed. The attack was attributed to the Taleban but not claimed by the group. On 10 November, the Taleban attacked the German consulate in Mazar-e-Sharif in northern Afghanistan with a VBIED and possibly firearms. The German consulate personnel remained unharmed, but six people were killed and many injured, most of them civilians present at the site. The Taleban claimed the attack, saying that it was revenge for a US attack on Kunduz. On 12 November, a PBIED suicide attack targeted a sports event inside the US military base on Bagram Airfield near Kabul on 12 November.
The attack killed a total of 5 US citizens. The attack was claimed by the Taleban.
In 2016, the IS affiliate in Afghanistan (“Khorasan province”) increased its attacks in particular in the east of the country. On 23 July, two simultaneous IED explosions killed around 100 people in Kabul, mainly of the Shi’i Hazara ethnic minority. The attack was claimed by IS through A’maq News. On 11 October, three armed individuals attacked a Shi’i shrine in Kabul during a religious ceremony, killing 14 people. The attack was attributed to IS. Responsibility for a suicide attack on 19 April, on the headquarters of the Afghan intelligence service in Kabul which killed at least 64 people, was disputed between the Taleban and IS.
Three Australians and one US citizen were kidnapped in Afghanistan in 2016. In April, an Australian charity worker was abducted by unknown militants in Jalalabad and was released 4 months later. In August, the Taleban abducted a US and an Australian citizen in Kabul. The two victims were academics working at the American University of Afghanistan. In November, another Australian, working at a non-governmental organisation, was kidnapped in Kabul. The three hostages remained in captivity at the time of writing.
The Taleban leader was killed in Pakistan’s Baluchistan province in May 2016. A successor was appointed by the Taleban’s Shura Council within days.
Pakistan continued to suffer terrorist attacks in 2016, which targeted universities, security forces and religious minorities. These were carried out by local jihadist groups, Taleban offshoots or alleged IS affiliates. In Bangladesh, 20 people, including 18 foreigners, were killed in an attack on a bakery located near diplomatic representations in Dhaka on 1 July. A claim of responsibility by IS was dismissed by government sources, which attributed the attack to Jamaat-ul-Mujhaideen. Nevertheless, the attack was celebrated by IS in the October issue of Rumiyah. In Indonesia, IS claimed an attack on “a gathering of citizens of the Crusader coalition, which fights the Islamic State” in Jakarta on 14 January. The attack, which was carried out using several simultaneously-detonated IEDs and firearms, killed at least eight people. One Dutch UN employee was injured.
* 3. ETHNO-NATIONALIST AND SEPARATIST TERRORISM
foiled, failed and completed attacks carried out labeled as ethno-nationalist and seperatist terrorism.
*** Dissident Republican groups
In 2016 Dissident Republicans were involved in 76 failed, foiled and completed attacks, of which four were carried out using improvised explosive devices, including one in March in which a prison officer was killed. The police, prison officers and members of the armed forces in North Ireland remain the primary targets.
There are three main violent Dissident Republican groups in Northern Ireland: the Continuity IRA (CIRA), the new IRA and Oglaigh na hEireann (ONH). All mentioned groups retain access to a range of firearms and explosive devices, including undervehicle IEDs. A total of 123 people were arrested in 2016 for terrorism-related offences.
In May 2016, the threat level in the UK for terrorism related to Northern Ireland was raised from ‘moderate’ to ‘substantial’, which means an attack is a strong possibility.
*** PKK (Kongra Gel)/KCK
A number of incidents targeting Turkish institutions, cultural premises and properties occurred in several EU Member States.
Five IED attacks against Turkish government buildings and cultural associations were reported by France. Belgium also reported incidents between Turkish and Kurdish groups involving the use of arson and explosives.
Germany reported various incidents. A significant number occurred in the context of demonstrations for or against the PKK. Turkish properties and institutions were damaged by incendiary devices. In one arson incident, the damage amounted to at least EUR 2 million. In August in Nuremberg, three participants were injured during a fight, in which at least one was stabbed.
Belgium, France, Germany*, Italy, Romania and Switzerland reported that the PKK continued its fundraising, propaganda and recruitment activities. In France it operated a legal front, which includes the Conseil Kurde de France (CDK-F) and the Centre d’information du Kurdistan (CIK); and a clandestine branch aimed at collecting funds, using violence in some cases. In France alone, the fundraising campaign is believed to have yielded EUR 5.3 million. Italy reported recruitment among Kurdish migrants to join Kurdish militia in conflict zones or to become PKK activists in Europe.
In addition, Switzerland stated that the PKK were maybe running a number of ideological training camps for its youth in remote pre-Alpine areas during the second half of 2016.
FIGURE 8
Number of suspects arrested for etno-nationalist and separatist terrorism in EU
Member States in 2016
ARRESTS
ATTACKS