The Need for Nuance in Protective Intelligence Part 1: Understanding the Islamic State Threat
By TorchStone VP, Scott Stewart
If protective intelligence and corporate security teams are going to be effective in their efforts to protect people, facilities, and intellectual property, they must first possess a solid understanding of the threat actors they are working to counter. This includes an analysis of the threat actors’ ideology, their objectives, the operational model they employ and the tactics they use. A detailed understanding of these factors is extremely useful in developing security programs intended to proactively discover the operations of a threat actor before they can launch an attack, as well as develop security countermeasures to thwart or at least mitigate such an attack.
The importance of knowing the enemy is a principle that dates back to ancient times. In The Art of War, Sun Tzu wrote: “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” This principle is applicable to more than just military leaders. It also has clear application to law enforcement and security professionals.
Unfortunately, a solid understanding of threat actors can sometimes be hard to come by. Over the past week I have read several media reports and analytical products that lack nuance in their explanation of various threat actors, including the Islamic State and the Antifa movement. I’d like to take some time to explain how these haphazard accounts lacked a nuanced understanding and how such accounts can mislead security professionals. Because of length, I am going to break this analysis into multiple parts. Part one will deal with understanding the threat posed by the Islamic State.
The Three Faces of the Islamic State
I have read several recent pieces on the Islamic State that have discussed how the group appears to be making a comeback and how they pose a growing threat in places such as Africa. One of the main complaints I have with these analyses is that they tend to view the Islamic State as a monolithic organization – something it is not. I believe that if one wants to understand the Islamic State movement and the threat it poses to a particular target, it is better to think of it as a broad movement that is comprised of three main components: the core, the franchise provinces and grassroots supporters.
Jihadism is a “glocal” phenomenon – it is both global and local – and if we are going to understand the Islamic State pole of the jihadist movement, we must also take a glocal approach. We thus must assess the various components independently, while at the same time considering them in light of the whole. The components have varying degrees of capabilities, and a nuanced approach is required if one wants to understand the threat that each component poses at a specific time and place.
The Core
The first component of the Islamic State movement is the core organization in Iraq and Syria. It is a hierarchical organization under a unified command structure, and is divided into provinces known by their Arabic name “wilayah.” Since the international coalition launched operations against the Islamic State core in Iraq and Syria in 2014, the group has lost control of the majority of the territory they once controlled, and has switched from conventional and hybrid warfare to insurgent warfare and terrorism. Despite their losses, the Islamic State core remains a potent insurgent and terrorist actor, and maintains a sophisticated intelligence capability, a great deal of weaponry and other resources. The core maintains a unified command structure that is headed by their leader or caliph, Abu Ibrahim al-Hashimi al-Qurashi. Sub-unit leaders and rank and file members of the Islamic State have all made personal pledges of allegiance to Abu Ibrahim while also remaining accountable to the group’s military and ideological hierarchy. The Islamic State’s predecessor group, the Islamic State in Iraq, was able to rebound from significant losses they suffered from 2007-2010. Given the successor core group’s capabilities and resources, there remains the possibility that they can also rebound if the pressure is taken off them.
Franchise Provinces
The second component of the Islamic State movement is the array of foreign insurgents that have pledged allegiance to Abu Ibrahim al-Hashimi al-Qurashi, and that have been recognized as formal wilayah by the Islamic State leadership. The overwhelming majority of these foreign “franchise groups” were existing or factions of insurgent groups that have been subsumed by the Islamic State movement. For example, a large faction of the Egyptian insurgent group Ansar Beit al-Maqdis pledged allegiance to the group in 2014 and is now known as the Islamic State’s Wilayat Sinai. Likewise, the most powerful faction of the Nigerian insurgent group Jamā’at Ahl as-Sunnah lid-Da’wah wa’l-Jihād (more commonly known as Boko Haram) is now known as the Islamic State’s West Africa Province, or “Wilayat Garb Ifrqiya” in Arabic. Some of these franchise groups have been closer to the core leadership in terms of relationships, logistics and ideology than others; for example, the Wilayat Barqa in Eastern Libya (which has been heavily damaged although not complete eradicated) maintained very close links with the Islamic Core organization and closely adhered to the group’s ideology and targeting guidance. At the other extreme, groups such as the Islamic State’s Central Africa Province (which is actually comprised of two unrelated insurgent groups operating independently in the Democratic Republic of Congo and Mozambique) appear to have only limited contact with the core group.
Since these franchise groups were independent before aligning themselves with the Islamic State core, the losses the core has suffered on the battlefield have not heavily impacted them because they had preexisting local command structures and logistics networks. If they had been more closely tied to the core group and dependent upon the core group for logistics or command and control, the collapse of the core’s territory and the constraints they now face in communicating abroad would have impacted these local franchises far more. As it is, local conditions have been very favorable for groups such as the Central Africa Province in Mozambique to grow rapidly and much of the recent growth of the Islamic State movement is occurring by virtue of these African insurgent groups.
Grassroots Jihadists
The third element of the Islamic State movement are the grassroots jihadists, who are inspired by the group. Many of these grassroots jihadists have migrated to join the core or one of the franchise groups. Indeed, the mobilization of these foreign jihadists to Iraq, Syria and Libya was the largest mobilization of foreign fighters in the history of the modern jihadist movement, and involved tens of thousands of men, women and children. Many of these grassroots jihadists died on the battlefield, while others returned home to conduct attacks in places like Paris, and Brussels. But there were still others who remained in their home countries acting as lone attackers or in small cells, conducting attacks in the name of the Islamic State in a wide variety of countries. In fact, most successful attacks in the U.S. since 9/11 have been conducted by grassroots jihadists (some of whom were directed by foreign jihadists) and not by professional terrorist cadres. Examples of Islamic State linked U.S. attacks by grassroots attackers include the 2015 San Bernardino attack, the 2016 Orlando Pulse Nightclub attack and the 2017 Manhattan truck attack. Grassroots jihadists inspired or directed by the Islamic State have also conducted attacks in Australia, Europe, Russia and Canada.
Why Does Nuance Matter?
In the case of the Islamic State, nuance matters a great deal. Jihadism is a global insurgency and effectively combating it will require a global counterinsurgency effort that is truly global and local. This means that the core, the franchises, and the grassroots jihadists must each be addressed separately using appropriate tools in the specific environment in which each is located. Even if a counterinsurgency operation in the Sunni areas in Iraq and Syria was able to completely destroy the Islamic State core organization, the franchise groups would still remain active and continue insurgent and terrorist operations. Each of these insurgencies must be addressed locally and as part of a larger global effort.
Force will certainly be required to keep military pressure on the core and franchises, but it is impossible to kill the jihadist threat by force alone. It is no mistake that jihadist groups are the strongest in areas where there is a vacuum of governance and authority and often in locations where there has been a long-standing insurgency due to a history of ethnic or religious tensions. There are significant social fault lines in every place the Islamic State currently has a franchise group, from Nigeria to the Sulu Archipelago. Indeed, while the Islamic State was initially welcomed by many of the people in Syrian cities such as Raqqa because of the security and governance they were able to provide, the population soon turned on the group when they learned that the stability they longed for came at a steep price.
There is also an important tactical and operational facet to the distinction. Jihadists with the core organization have far higher levels of terrorism tradecraft and insurgent tactics than members of many of the franchise and grassroots jihadists. This tradecraft includes surveillance, bomb making, operational planning, clandestine communications, document forgery, and smuggling of men, weapons, and explosives. They also have access to far more resources, to include money, manpower, sophisticated weapons and explosives. Because of this, they are capable of planning and launching far more sophisticated terrorist operations against more heavily defended targets than other actors, and I expect we are going to see this capability demonstrated in places like Baghdad, Basra and Kirkuk in the next few months. In Syria, where the Islamic State core has more operational freedom, they will also continue to launch significant insurgent attacks designed to seize weapons and other resources.
While some of the franchise groups in Africa have been improving their operational capacity, groups such as the Islamic State Central Africa Province in Mozambique remain far less capable than their counterparts in the core, or even more tactically proficient provinces such as the Wilayat Sinai or Wilayat Khorasan in Afghanistan. The jihadists in Mozambique are improving their insurgent capabilities as far as their ability to conduct hit and run raids and ambushes. However, they have not demonstrated proficiency in terrorist tradecraft skills such surveillance, bomb making, operational planning and conducting covert operations in a hostile environment. This limits their ability to project force outside of their main areas of operation.
Finally, the grassroots jihadists are ripe for counter radicalization programs. They are frequently identified through their online activity or by members of their community who realize that they are becoming radicalized and report them to the authorities. They also lack terrorist tradecraft, and struggle to plan and execute successful attacks. This often leads them to reach out for help to conduct an operation, exposing them to being caught in sting operations. Even in cases where they do launch attacks, their efforts tend to be poorly planned and executed. A good example of such an attack was the May 21 failed attack against the Naval Air Station in Corpus Christi where a jihadist gunman attempted to run the gate and force his way onto the base. The attacker did shoot one of the security personnel manning the gate before being shot dead, but the sailor’s vest saved her from serious injury. While potentially deadly, this poorly planned and executed attack is a far cry from the sophisticated attacks conducted by the Islamic State core in Iraq and Syria.
The threat posed by jihadists affiliated with the Islamic State clearly varies depending on which element of the movement is planning the attack and where the target is located. An understanding of the various elements of the specific group and their capabilities is thus required to properly assess the scope and severity of the threat.