PTX6_A1_Nesser_Stenersen_Oftedal

Articles

Jihadi Terrorism in Europe: The IS-Effect

by Petter Nesser, Anne Stenersen and Emilie Oftedal

Abstract

The article examines the extent to which Islamic State (IS) has affected jihadi terrorism in Europe. We look at the scope of attack activity, perpetrators and their networks, modus operandi and funding. For all the talk of a new threat we argue that, apart from scope, less is new than most assume. IS wants largely the same as al-Qaida did by attacking Europe. Their tactics are similar and their networks overlap in time and space. The core dynamics of the threat endure. It is premature to talk of a new paradigm in recruitment, but more terrorists are instructed online than before. Patterns in funding remain relatively stable, but there is an increase in plots financed from abroad. Despite military setbacks, IS remains a formidable terrorist actor, with territorial control, economic muscle and thousands of Europeans in its ranks. These things, combined with the group’s skillful social media usage, are exhausting European security services’ capacities. So is the refugee situation, which is exploited by IS to transfer personnel. If IS’s territorial control persists, we foresee attempts at large-scale operations, including attempts at using improvised chemical or radiological devices. If IS continues to lose ground, small-scale attacks by single actors will become even more frequent.

Keywords: Terrorism; jihadism; militant Islamism; Islamic State; al-Qaida; foreign fighters

Introduction

Europe is facing an escalating threat from jihadi terrorism.[1] There has never been higher numbers of attack plots per year than in 2014-16. An increasing proportion of plots goes undetected and result in deadly attacks. More people have been killed by jihadi violence in Western Europe in 2014-2016 (273 people) than in all previous years combined (267 people). This is due to a small number of highly deadly incidents: The Paris attack on 13 November 2015 (130 killed), the Brussels bombing in March 2016 (32 killed) and the Nice truck attack in July 2016 (84 killed). The period also saw the first example of two mass casualty attacks being launched successfully in a row, namely those in Paris and Brussels.

Beginning in the winter 2013-14, the vast majority of plots involve links to the Islamic State (IS).[2] These links range from cells trained and directed by the group, to individuals answering calls from IS spokesmen to execute attacks on their own. The elevated threat is covered extensively in international media.[3] There are several reports by think tanks and governmental agencies, as well as academic studies of IS’s international operations.[4] However, there exists no systematic analysis of the extent to which IS has changed the threat to Europe, which is what we offer here.

Each IS attack in Europe has generated talk of new trends in modus operandi, perpetrator profiles and radicalization. It is beyond the scope of this article to go into the many debates. We stick to presenting solid data and more anecdotal evidence on what has changed, and what has not. We caution against making generalizations based on the latest attack. We highlight the value added of including historical data and perspective when analyzing IS’s terrorism in Europe.

This empirical article first addresses the scope of terrorist plotting in Europe since the turn of 2013, specifying how much can be attributed to IS. It then goes on to probing possible reasons why IS attacks in Europe, as reflected in the group’s official statements and propaganda. After that we discuss network dynamics and perpetrator profiles. We then examine modus operandi, comparing and contrasting plots in 2014-16 with trends in 1994-2013. Last, we discuss continuity and discontinuity in financing, before concluding by forecasting what could happen next.

In the analyses we compare data from a new chronology of plots and attacks by jihadis in Europe in 2014-16 (Appendix 1)[5], with findings from three previous studies by FFI’s Terrorism Research Group: a book on the history of European jihadism by Nesser (2015), an article on the modus operandi of European jihadis by Nesser and Stenersen (2014) and a report on the financing of jihadi terrorist cells by Oftedal (2015).[6] We employ the same methodology that was used in those studies. It implies that we seek to extract as much information we can from foiled plots in addition to executed attacks, to create a broader basis for the analyses. A focus on executed attacks only – which has been the norm, especially in quantitative research – will neither sufficiently grasp the threat level nor trends in terrorist cell formation, tactics and targeting.

Starting Point and Scope

We contend it makes sense to talk about an “IS-effect” on jihadi terrorism in Europe from the turn of 2013. From that point onward the majority of plots are linked to IS, and much fewer ones to al-Qaida.[7] So how does the IS-effect in 2014-16 compare to attack plotting in Europe over time? Overall, we have registered 135 well-documented plots in Europe from 1994 to 1 November 2016, which makes an average of six plots per year (see figure 1).[8] In 2014-16 alone we have registered 42 well-documented plots: 9 in 2014, 17 in 2015 and 16 so far in 2016. Jihadis have launched 50 attacks in Europe in total since 1994. One-third of those attacks have been launched in 2014-16: 2 in 2014, 6 in 2015 and 10 so far in 2016.

Of the 42 well-documented plots in 2014-16, 38 are reported to involve some kind of IS-link. In four cases we found no information of IS-links, but there were links to, or inspiration from al-Qaida-affiliated actors. In one case, the 2015 Charlie Hebdo attack, there were links both to al-Qaida and IS. And, as we shall come back to, many people involved in IS-related terrorism in Europe, have been part of al-Qaida affiliated networks until recently.

Figure 1: Number of Well-Documented Jihadi Terrorist Plots per Year in Western Europe

What IS Says About Its Campaign in Europe

The first statement announcing IS’s intention to target Europe was given in September 2014 by spokesman and purported leader of international operations, Abu Muhammad al-Adnani. It came two months after the establishment of the ‘Caliphate’ in June 2014, and seven days after the announcement of the French-led coalition against IS. The statement vowed that IS would retaliate against aggression, and called upon followers in the West and Europe to strike.[9] The message has been reiterated by al-Adnani three times since, in January 2015, in March 2015 and in May 2016, with increasingly specific instructions for attacks.[10] There were three ISIS/IS-related attack plots in Europe in 2014 before al-Adnani’s speech in September.[11] Because ISIS/IS had been evasive about attacking the West until then, there was initially uncertainty as to whether these plots could be attributed to the group, or if they were initiated by the perpetrators on their own. It has since been surmised that they marked the beginning of an attack offensive in Europe.[12] After al-Adnani had spelt out what should happen, the threat intensified and a spate of plots ensued. A few were merely inspired by IS, but most were directed, either by the organization or members of its networks. As we shall come back to, the plots varied in scope and modus operandi, from knife attacks to massive, “Mumbai-style” operations with mobile attack teams and combinations of bombs and firearms. Some plots were foiled or failed, but more and more resulted in deadly attacks (for an overview of all registered plots, see appendix 1[13]).

While IS has not claimed all operations attributed to the group, it has increasingly done so in 2015-16, especially when attackers have died, or escaped counter-terrorism operations. IS’s media has claimed both large, lethal attacks such as those in Paris, Brussels and Nice, as well as smaller ones, like in Charleroi, Ansbach and Normandy.[14] In addition, several IS-films have praised the attacks in Paris and Brussels, echoing al-Adnani’s message of revenge, threatening new attacks and displaying preparations for future operations.[15] These films also praise attacks that were not claimed by IS at first, such as Amedy Coulibaly’s role in the 2015 Charlie Hebdo attack.

As for IS’s English-language Dabiq magazine, it does not refer to Europe until the October 2014 issue, which published excerpts of al-Adnani’s September speech.[16] In the February 2015 issue, Coulibaly was praised again, and it was indicated that he, after swearing allegiance to IS, “sat in wait for instructions” without going to Syria.[17] It is also stated that he supplied the Kouachi brothers, who attacked Charlie Hebdo on behalf of al-Qaida on the Arabian Peninsula (AQAP), with money and weapons. Moreover, the February 2015 issue presented an interview with Belgian-Moroccan Abdelhamid Abaaoud, a central coordinator within IS’s international operations network, linked to multiple IS-related attack plots in Europe in 2014-16. From February 2015 to July 2016, Dabiq contained praise for operations conducted in the name of IS in Europe, both plots known to have involved instructions from the group as well as plots in which interaction seems absent. Quotes from al-Adnani were reiterated throughout, and in Dabiq’s July 2016 issue, his call for attacks by people prevented from reaching Islamic State is stressed.[18]

Seen in light of the investigations of IS-related plots in Europe, the official statements and propaganda leave little doubt that the group is leading an organized terrorist campaign of retribution and deterrence against its European adversaries, primarily motivated by European countries’ participation in the war against IS in Iraq and Syria. While many think of the IS-threat in Europe as new and different, involving new networks and new types of terrorists, the real reason why IS has been so effective is that the group builds upon pre-existing networks and capacities that were already in place.

Network Dynamics and Perpetrators

The latest wave of attacks in Europe has generated ideas of a new kind of threat. Several of these ideas are reflected elsewhere in this special issue. As shown by Basra and Neumann, there is a striking presence of criminals in IS’s European attack networks.[19] As indicated by Hegghammer, the refugee situation may create a broader recruitment pool for jihadi networks in Europe, as the region faces challenges of integrating immigrants to society and job markets.[20] Coinciding with growth among European extremist networks as result of the Syrian jihad, this could influence future trends in radicalization. Much attention to the profile of the Islamized criminal and the refugee crisis has led to renewed focus on the role of European societies in producing terrorists, and notions that IS-terrorism in Europe is driven more by failed integration and social grievances than ideology and foreign policy. Also, because France and Belgium have experienced a spate of plots, it has been suggested that the IS-threat is confined to Francophone Europe and fueled by the French political culture of secularism.[21]

There is no doubt that failed integration and segregated suburbs create hospitable conditions for terrorist recruitment. And, the Islamized criminal has been a common character in the history of jihadism in Europe ever since the phenomenon emerged in the 1990s. Also, there is no doubt that Francophone Europe faces a higher threat for now than other parts of the region.

At the same time, structural aspects of European societies tell us little about when and where terrorists strike in the region, and there has never been one single profile among European jihadis, not historically and not today. Also, the threat to Francophone Europe has many, and the way we see it, more important explanations beyond French secularism.

We caution against overstating the newness of the threat. A preliminary review of plots in 2014-16 indicates a striking continuity regarding who the terrorists are, and what drives them. The IS-terrorists operating in Europe are not so different from al-Qaida’s. In fact, many were agents of al-Qaida networks until recently. Moreover, the IS-threat to Europe does not only involve criminals from segregated suburbs, but also people described as resourceful, who hardly joined militancy for lack of options, but out of political motives and ideological fervor. Last, the threat it is not confined to Francophone Europe. Rather, we are facing a genuinely transnational threat with strong links to armed conflicts raging across the Muslim world.

In order to understand why and how IS-plots occur in Europe, and how to reduce the threat, we need to acknowledge that the main drivers lie outside Europe, in Middle Eastern conflict zones, and pertain to Western interference in those conflict zones. We also need to pay special attention to network dynamics: the interplay between local European extremist networks and armed groups in war zones – facilitated through foreign fighting. Last, we need to acknowledge that while a majority of European militants are disenfranchised migrants, a smaller number of entrepreneurs–resourceful and ideologically motivated terrorist cell builders–play a crucial role in formation of terrorist cells. The entrepreneurs operate on behalf of armed groups in conflict zones, making the threat more ideological, strategic and organized than many assume. Entrepreneurs tend to be veterans of jihadi activism within Europe and through foreign fighting, and there has been a “veteran effect” in European jihadism, which also applies to the IS-threat.

The Veteran Effect

As highlighted by several contributions to this Special Issue of Perspectives on Terrorism there is a generational dynamic of European jihadism in the form of experienced veterans in the networks acting as leaders for new generations of recruits.[22] Therefore one finds that jihadi terrorist plots in Europe are linked over time through the people involved. This “veteran effect” is considerable in the way that militants who were in charge of networks and cells operating in Europe in the 1990s and 2000s continue to reappear in terrorism investigations today.

There are three main phases of jihadi terrorist plotting in Europe; and comparing what we know about dynamics over time, this might shed light on the current threat. The first phase was when the Algerian Armed Islamic Group (GIA) targeted France in the mid-1990s. The second was when al-Qaida plotted attacks across Europe in the 2000s, and the third is today’s IS-threat. The three phases are interconnected in that key members of GIA’s networks in the 1990s joined al-Qaida’s networks in the 2000s, and played a crucial part in recruiting and socializing a new generation of militants in Europe in the wake of the 2003 invasion of Iraq. This new generation organized overtly in semi-militant movements such as the Islam4/Sharia4 phenomenon, or in covert support networks for al-Qaida, under the guidance of jihad veterans. Over time most of the veterans have gone in and out of prisons either for supporting terrorism, or for involvement in attack plotting. However, because of their status–derived from experience and ideological knowledge–they have been able to continue mobilizing behind bars.

The pattern is best exemplified with the Algerian militant Djamel Beghal who operated on behalf of GIA in the 1990s and was captured when running a terrorist cell for al-Qaida in 2001. He is known to have radicalized numerous individuals in jail who have become involved in terrorist plots, including Amedy Coulibaly who launched the attack on a Jewish Kosher deli on behalf of IS in January 2015, and Mehdi Nemmouche who attacked the Jewish Museum in Brussels on behalf of IS in March 2014. Boubaker el-Hakim, addressed in Filiu’s article in this Special Issue, is another intriguing example of this dynamic. A recruiter among French jihadis in the mid-2000s he is now thought to hold a central position within IS’s section for international operations.[23]

The generational dimension makes it hard to distinguish between al-Qaida and IS in Europe. European groups and networks, such as Anjem Choudary’s Islam4UK and its offspring: Sharia4Belgium, Fursan Alizza (France), Millatu Ibrahim (Germany), The Prophet’s Ummah (Norway),–or more secretive jihadi support-webs such as The Zerkani Network (Belgium) and the Artigat Network (France) stood for much of the recruitment of Europeans to the Syrian jihad. All of these emerged before the establishment of IS, and were set up by people who had been loyal to al-Qaida. The cooperation between Coulibaly working for IS and the Kouachi brothers who attacked Charlie Hebdo for al-Qaida on the Arabian Peninsula (AQAP) illustrates the blurry boundaries between the groups in a European context. Seeing how networks and plots overlap in time and space, one may think of the threat, in the past and now, as emanating largely from one and the same transnational network, evolving and expanding within Europe over time, and serving successive groups in conflict zones: GIA first, then al-Qaida and then IS.

Cell Dynamics

Not only do terrorist plots in Europe involve links to the same transnational networks; the cell dynamics are also consistent over time. Attack cells are built by entrepreneurs. This type of terrorist has reoccurred in the history of jihadi terrorism in Europe, linking European extremists with armed groups overseas and making them act as international terrorists on behalf of those groups.

Entrepreneurs reach out to what we refer to as misfits and drifters among their social networks, with a view to recruiting them for violent jihad.[24] The entrepreneurs are typically resourceful, politicized and activist-minded, and they serve as a link with groups in conflict zones. The entrepreneurs socialize, politicize and manipulate the misfits and drifters that commonly involve criminals and socially deprived people, and turn them into tools for terrorist groups. This notion of entrepreneurs explains why seemingly non-political and non-ideological people (such as petty criminals) end up engaging in political violence in accordance with the ideology of al-Qaida and IS. This pattern seems consistent over time. The main difference now is that more of the interaction between entrepreneurs and the other types happens online.

We only know the contours of the networks behind the latest wave of IS-terrorism in Europe, but we recognize the pattern: mostly misfits and drifters as foot soldiers, while entrepreneurs are in coordinating roles, both within attack cells and surrounding networks.

For example, several members of Abdelhamid Abaaoud’s network (hereafter referred to as the Abaaoud-network[25]), such as the El-Bakraoui brothers, were misfits known for criminal activity, and many of them did not appear to be particularly religious (e.g. smoking and drinking, doing drugs or keeping girlfriends out of marriage). Many hailed from segregated suburbs or working class areas, had low education and survived on odd jobs.

At the same time, there are reports that members of the network radicalized intensively and became fiercely religious after connecting with militants in prison or underground mosques. Also, several central plotters were students, some of them described as intelligent and resourceful, and the coordinator (or entrepreneur), Abaaoud, hailed from a relatively privileged background. Another IS-cell uncovered in the UK (2014 Surgeon plot) also involved well-educated and resourceful individuals, underlining how IS also appeals to such types. The involvement of a small, yet significant, number of converts and women in plots further complicates the picture of trying to establish a single profile.

A deconstruction of types of recruits to IS-cells according to roles they play in plots helps to gain a differentiated understanding of pathways to terrorism. This is important, because what characterizes the majority of recruits (the misfits and drifters) does not necessarily give clues as to why the militants behave as they do, when ideologically motivated entrepreneurs are the ones who shape the actions of terrorist cells, the movers and shakers.

The notion of the entrepreneur might also shed light on temporal patterns within IS’s targeting in Europe. Historically, attack activity in certain European countries has risen when groups in conflict zones have managed to recruit a critical mass of entrepreneurs from those countries.[26] This pattern was seen when al-Qaida recruited among British-Pakistanis for attacks in the mid-2000s, or when the al-Qaida affiliated Islamic Jihad Union (IJU) enlisted German Turks and converts towards the end of the 2000s. Also, it is symptomatic that Sweden experienced its first suicide bombing after Swedish foreign fighters climbed the ranks of IS’s forerunner al-Qaida in Iraq (AQI).

It is beyond doubt that France and Belgium face the highest threat from IS today. Both countries are long-time enemies of jihadis. France mainly because of its interference in Muslim countries (e.g. Algeria and Mali) and Belgium for supporting France in disrupting important jihadi support networks spanning the two countries ever since the 1990s. The intensity of the threat to these two countries today is clearly affected by their large foreign fighter contingents in Syria and Iraq. Moreover, there is evidence that especially French foreign fighters have taken on a special role within IS’s section for international operations. A Frenchman is believed to have become overall director of IS’s European operations, and several Frenchmen and Belgians appear to be in coordinating roles as entrepreneurs down the chain of command.[27]

The Plots and the Networks

Based on the sources at hand, we have not been able to conduct any full network analysis of the plots linked to IS in Europe in 2014-16. Neither do we, at this point, dare to categorize the cases according to Hegghammer’s and Nesser’s 2015 typology, as continuously emerging information swiftly makes our categorizations change.[28] We have rather tried to group the plots in clusters, partly according to geography and partly according to what is known by now about their linkage to IS, as shown in Appendix 2.[29]

What we can say with certainty is that although many think of the IS-threat to Europe in terms of inspired, so-called “lone wolf” attacks, a minority of the cases, six plots, seemed based on inspiration only–and no contact with IS’s networks. That did not mean, however, that these IS-inspired plotters were totally detached from other militants. They usually had contacts in extremist circles, albeit not IS-related. The possible exception is that of the London subway stabbing by Muhaydin M. in 2015, who, as far as we know, had no such links, and may have been a genuine “lone wolf”.

Twelve plots can with a high degree of certainty be linked to IS’s section for international operations and the Abaaoud-network. Nearly all of them involve returning foreign fighters and all but two target France or Belgium (the last ones appear to have targeted public sites in Spain and the UK).

Another nineteen plots in France, Germany, the UK, Spain and Austria, cannot, based on the available information, be linked directly to IS’s section for international operations and the Abaaoud-network with a similar degree of certainty, but all cases involve online instruction from members of IS’s networks. These handlers may, or may not operate under IS’s international operations section. In at least three of these nineteen cases, plotters had foreign fighter experience, but we cannot say for sure at this point whether they were trained and dispersed by IS on missions, or contacted online and “activated” after returning for other reasons.

What can be read from the chronology of plots in Appendix 1, however, is that the vast majority of incidents include links both to local extremist networks in Europe and foreign fighters linked to IS in Syria and Iraq. In tune with assertions that French and Belgian fighters have taken on a special role in taking IS’s terrorism to Europe, many of the plotters instructed online have received directions from French and Belgian fighters (such as Rachid Kassim or Fabien Clain). However, foreign fighters from other countries have also acted as handlers from Syria (e.g. Junaid Hussain in the 2015 Junead Khan serviceman plot).

The attack activity is not confined to France and Belgium. IS-plots have occurred in at least eight different European countries where the group has capacity to strike. Moreover, if one takes a closer look at the cases, there is commonly cross-border interaction between network members within Europe. Examples include a visit to the UK by a key figure in the Abaaoud-network, to meet with British extremists before the 2015 November Paris attacks, and links between the purported terrorist cell that was uncovered in Germany in September 2016, and the Abaaoud-network.[30] Transnational interactions between network nodes and operational cells within Europe on one hand, and militant groups in conflict zones on the other, are not new. Rather, they are frequent and typical in the history of European jihadism–the 2004 Madrid attacks being one case in point.[31] However, while there is continuity in the actor landscape and core network dynamics endure, the European IS-threat does involve some new facets of terrorist cell formation.

Changing Facets of Terrorist Cell Formation

The IS-threat to Europe entails two main changes when it comes to network dynamics and terrorist cell formation. The first is an increase in the use of social media to recruit and instruct terrorist operatives and the second is the use of refugee streams to transfer operatives and recruitment efforts aimed at refugees.

The ways in which attackers are instructed via encrypted social media are unprecedented. There have been plots in Europe in the past where al-Qaida instructed terrorists via draft messages on shared email accounts, or by sending encrypted files. However, with plotters directed instantly via apps such as Telegram (see Prucha’s contribution in this Special Issue)[32], sometime real time during attacks, IS has taken online instruction to another level. There also appear to be several examples of plotters having been recruited online before receiving a mission, for example the 2014 Vienna teenager bombing plot. In other words, IS-entrepreneurs can build cells online in a way never seen before. This opens up possibilities for a more volatile threat situation involving attackers with no prior connections to the network, even genuine “lone wolves”, who have so far largely been a myth in European jihadism. Notably, the increased use of online instructions by IS coincides with a downturn in plots involving foreign fighters. In the period 2001-2007, 75% of all well-documented plots involved one or more cell members with foreign fighter experience. In 2014-2016 this proportion has decreased to 45% (see Figure 2). The increased use of online instruction also coincides with a continued increase in single-actor terrorism in Europe, although this development started well before IS’s rise to prominence (see Figure 3).

Figure 2: Presence of Foreign Fighters in Well-Documented Terrorist plots in Western Europe

The reason for the increased use of online instruction is probably the combined effect of new technology making online recruitment and instruction easier, and an increased focus by security services on returning foreign fighters.

Another new aspect of plot dynamics is the use of refugee streams to transfer personnel. At least six well-documented attack plots in 2014-16 involve people with refugee status. In many instances plotters have instructed foreign fighters to pose as refugees upon their return to Europe. In other cases IS-plots have involved foreign nationals, perhaps also actual refugees, recruited in transit or after arrival in Europe.

In the data material reviewed for this study, the number of militants coming to Europe as refugees in well-documented plots adds up to at least nineteen individuals (twelve in the Paris and Brussels attacks, six in German plots, and one in a case linked both to Germany and France). However, many more refugee links are seen in the vague plots. Already in April 2016 European security officials interviewed by the Washington Post, said “more than three dozen” people linked to plots had posed as refugees.[33] It should be noted, however, that these new features of terrorist cell dynamics stem from adaptation to security regimes and exploitation of new technology and should not be seen as something unique to IS.

Turning to modus operandi, there is also much continuity in the way IS operates in Europe. IS-linked terrorist cells use attack methods previously established by al-Qaida and other jihadis. However, IS has displayed greater capacity to avoid detection and successfully launch attacks, and its operators have added their own twists and turns to terrorist plotting. This is further explored in the next section.

Modus Operandi

In midst of the latest wave of IS-inspired terrorism in Western Europe, many observers appeared to believe that the nature of the threat had fundamentally changed. Gone was the single-actor terrorism of 2008-2013 and the tendency to attack specific and highly symbolic targets. The attacks in Paris in 2015 and Brussels in 2016 were both carried out by groups, and they were both simultaneous attacks targeting random crowds of people. Although firearms were introduced in the Paris attack as a supplementary weapon to bombs, the attacks were reminiscent of al-Qaida’s targeting of random crowds in the Madrid and London attacks in 2004 and 2005.

Again, we caution about making generalizations based on a few, very recent events. Put in historical perspective, and by analyzing all jihadi terrorist plots in Europe over time (including the foiled and failed ones (see Appendix 3[34]), we see that there is indeed a small tendency towards more random targeting, compared to the previous period, but discriminate targeting still comprises about 40% of all plots. Moreover, single-actor terrorism has by no means become irrelevant as single actors still comprise about 55% of all terrorist plots (see Figures 3 and 4).

The cases from 2014-2016 paint a complex picture of the threat. In our study of trends in the modus operandi of European jihadism which was published in 2014, we found that weapons and tactics were becoming more diversified while targeting was becoming more discriminate.[35] Overall, this is still very much the case although the trend towards discriminate targeting is less clear than before. It shows, again, that jihadi terrorism in Europe cannot be reduced to either-or dichotomies but that we have to expect a full spectrum of threats in the years ahead.

Weapons

There are two significant developments regarding European jihadis’ preferred choice of weapon. For the first time in history firearms have become more common than bombs. And, for the first time in history a vehicle has been used to conduct a mass killing. Both these trends – more use of handguns, and the use of vehicles as weapons – were predicted in our 2014 analysis.[36]

Prior to 2014, bombs was the weapon most often preferred by the terrorists, and after 2008 there was a development towards more home-made explosives (HME), and more variety in the types of HME used, or planned used. In 2014-2016, bombs were used, or planned to be used, in 33% of all well-documented plots. This is a significant decrease from the interval 2008-13, when bombs were present in 65% of the plots.[37] On the other hand it would be premature to dismiss bombs as a threat in the future. Bombs were indeed used in two of the most deadly attacks in 2014-16 – the Paris attacks on 13 November 2015 and the Brussels attacks on 22 April 2016. In the Paris attacks, only one of the 130 victims was actually killed by the suicide bombers attacking Stade de France, while the rest of the victims were killed with handguns in other parts of the city – but the number of victims at Stade de France could easily have been higher.[38] In the Brussels attacks, all 32 victims were killed by bombs.

With regards to trends in the use of explosives, HME are still the preferred form of explosive. Peroxide-based explosives are most common, followed by fertilizer-based ones. There have been no significant innovations within HME production over the past three years. This may be viewed as somewhat surprising, given the large number of Europeans who have attended training camps in Syria/Iraq – and presumably been trained by professional bomb-makers – in this period. The lack of innovation may be attributed to the fact that so far, IS has not been particularity obsessed with attacking airplanes, or other targets associated with stringent security measures. As we highlighted in our article from 2014, al-Qaida bomb-makers in Pakistan and Yemen made certain innovations in HME after 2001. These bombs were specifically designed to be smuggled onboard airplanes in Europe.[39] As for now, IS and IS-inspired terrorists in Europe have preferred «soft» targets, like crowds of people in public areas, where the access control is typically less strict. It must be underscored, however, that measures taken in Europe to prevent proliferation of common HME precursors have so far not obliterated the threat from HME.

The use of a truck to conduct mass killing was another, striking development in 2014-16. Eighty-four people were killed and hundreds were wounded when the Tunisian-French Mohamed Lahouaiej-Bouhlel drove a 19-ton cargo truck into crowds celebrating the French National Day on 14 July 2016. While the scale of the attack was unprecedented, the modus operandi of using cars for an attack was not entirely new. The method of using vehicles as weapons was described in the propaganda magazine of al-Qaida on the Arabian Peninsula (AQAP), Inspire, in 2010. Vehicles have previously been used by jihadi-inspired terrorists both in the UK, Canada and France. In 2013, two perpetrators rammed their car into a UK soldier on the street in Woolwich, UK, before slaying him with a meat cleaver.[40] In October 2014, a perpetrator rammed his car into two soldiers in Ottawa, Canada, resulting in the death of one of them.[41] In December 2014 there was a lesser-known car attack in France when a man rammed his car into pedestrians in the city of Dijon, France, injuring eleven, although the degree to which the attack had a jihadi motive remains unclear.[42] Finally, in June 2015, a French IS-supporter of North African descent attempted to cause explosions by ramming his car into installations at a gas factory in Lyon.[43]

In addition to car attacks, there has indeed been a rise in knife-plots. In 2014-2016, knives were used, or planned used in 31% of the plots, compared to 13% of the plots in 2008-2013. The use of cars as weapons, and the increasing use of knives, is in line with tactical advice given by IS spokesman Abu Muhammad al-Adnani. In an audiotape released in January 2015, al-Adnani encouraged attacks with simple means, including “an explosive device, a bullet, a knife, a car, a rock, or even a boot or a fist.”[44]

The trend towards simpler weapons that require little time for preparation – cars, knives, handguns – is coupled with an absence of plots involving technologically sophisticated weapons. So far in 2014-2016 we have not registered any plots to use chemical, biological, radiological or nuclear agents (CBRN) and high-end weaponry, such as missiles. However, this observation needs certain modifications. The 2014-2016 period saw the first appearance of a rocket launcher in a jihadi plot in Europe (the launcher was apparently not used) and the first, successful «Mumbai-style» attack – namely, the attack in Paris in November 2015.[45] Moreover, after the Brussels attacks, investigations revealed that the cell possessed a 10-hour surveillance video of a Belgian nuclear scientist, giving rise to fears that the cell may have planned a CBRN-related attack.[46] So far there have not been any successful attacks by jihadis in Europe in 2014-16 involving drones, although IS are believed to have already used small, commercial drones in Iraq to drop bombs on targets.[47] Overall, terrorists operating in Europe over the past two years have demonstrated that they are adept at using modern technologies for communication and encryption. Terrorist plotting using CBRN, drones or other technologically advanced weapons and attack methods should therefore not be ruled out in the future.

Tactics

As the terrorists’ preferred weapons have shifted from bombs towards handguns and knives, armed assaults have become the most common attack type. It should be noted that in three cases, armed assaults were combined with hostage taking: the Charlie Hebdo attack in January 2015, the Paris attacks in November 2015 and the attack on a church in Normandy in 2016 where a priest was beheaded and several nuns were taken hostage.[48] However, none of these cases involved negotiations over the fate of the hostages. It thus appears as if the purpose of hostage taking was to use the hostages as human shields, making it more complicated for anti-terrorism police to tackle the event.

None of the plots in 2014-2016 involved targets at sea or in the air – not even among vaguely documented cases. This corresponds with previous trends which indicated that terrorists are less and less interested in targeting airplanes. Sea-based targets have never been the focus of jihadi terrorists in Europe, with only one well-documented and one vaguely documented plot in the whole period studied (in 2002 and 2005, respectively).[49]

There are no indications so far that terrorists are planning to build bigger bombs than before. There were no confirmed plots involving car or truck bombs in the period studied – only plots involving bombs placed in bags or suitcases, or strapped to the attacker’s body.

As we predicted in 2014, terrorists continue to use hand-held cameras (GoPro or phone camera) during attacks. In at least one case – the killing of a policeman and his wife at their home in Paris on 13 June 2016 – the perpetrator managed to upload the video to Facebook in real-time.[50]

In 2008-2013 we detected a trend towards more single-actor terrorism. After 2013 the relative increase in single-actor plots has continued albeit not as drastically as before. Single-actor plots are now almost equally common as group plots (See Figure 3).

Figure 3: Single Actor Terrorism

Out of eighteen launched attacks in 2014-16, thirteen were conducted by single actors while only five were conducted by groups.[51] This confirms the previously observed trend that single actors are harder to detect by security services than groups. Single-actor terrorists go undetected in 57% of the cases while groups go undetected in only 26% of the cases. Yet, the deadliest attack in Europe in this period, the 13 November Paris attack, was conducted by a group of eight terrorists, showing that even large groups of terrorists occasionally slip through the surveillance network of European security services.

It is also worth noting, as discussed by Ellis in this Special Issue [52], that the distinction between single-actor and group plots is becoming less and less clear-cut. Based on currently available information, it appears that only 6 out of 23 single actors in our dataset acted solely based on online inspiration.[53] The rest were connected to known networks in one form or another; or had received instruction from IS-handlers online, as addressed previously.

Targets

The geographical distribution of plots has changed to some extent, with a sharp increase in plots in France, followed by a rather constant number of plots in the UK and Germany. The number of plots in Scandinavia, however, has decreased drastically compared to previous years.

It thus appears as if the wave of terrorist plots in Scandinavia, which was witnessed especially in 2008-2011 and motivated to a large extent by the publication of the Mohammed Cartoons by the Danish Newspaper Jyllands-Posten, has abated. Instead, there is an upsurge of jihadi terrorist plotting in France, likely motivated by France’s active role in interventions in the Muslim world – both in Mali from 2013 onwards and against the Islamic State from 2014. As for the two other countries most exposed to jihadi terrorist plotting – the UK and Germany – the number of plots since 2001 has been largely constant with zero to four well-documented plots per year since 2004. There appears to be a slight increase of plots in Germany, with five plots so far in 2016 (as of 1 November), but it is too early to say if this trend will continue.

With regards to target types, the most significant change from the previous period is that attack plans against public figures have decreased while there is a small increase in plots against public transportation. Apart from that, the dominant target types are public areas, in addition to military and police installations and personnel. There is yet no increase in targeting of Shia Muslims in Europe. In 2014-2016 there are two cases targeting churches, three cases (including one vaguely documented) targeting synagogues and two vaguely documented cases targeting a Shia mosque and a Sikh temple, respectively.

The clearest trend when it comes to targeting in 2014-2016 appears to be a renewed interest in targeting random crowds of people, as opposed to more specific targets with high symbolic value, such as police and military officers, Jews and cartoonists who allegedly insulted the Prophet Muhammed (see Figure 4).

Figure 4: Discriminate versus Random Targeting

The attack on Charlie Hebdo in January 2015 is a well-known exception from this trend. Notably, the perpetrators behind that attack were connected to al-Qaida on the Arabian Peninsula (AQAP), and cooperated with a single actor who shot a jogger and a police woman and took hostages at a Jewish kosher deli on behalf of IS. We argued in our previous study of attack trends that a relative increase in symbolic targeting in Europe was connected to al-Qaida Central’s need to appeal to an increasingly heterogeneous audience. This hypothesis has later been strengthened as al-Qaida’s internal communications (the «Abbottabad documents» found in bin Laden’s compound in 2011) have been released to the public.[54]

However, the recent wave of IS-related terrorism in Europe has made the trend towards discriminate targeting less clear. Prior to 2014, discriminate targeting was twice as common as random targeting while now, discriminate and random targeting are about equally common. The period has been characterized by three large attacks targeting random crowds of people, namely, the Paris, Brussels and Nice attacks. This is not to say that IS-inspired terrorism only targets random crowds of people. There are several examples of IS-inspired terrorists targeting selectively, including the targeting of a priest, Jews, military installations, and law enforcement.

Having discussed trends in weapons, tactics and targeting, we now turn to another aspect of the modus operandi of jihadi terrorism in Europe, namely, funding. How do plotters fund their activities and has this changed with the rise of IS?

Funding

Legal Funding Methods Remain Most Common

The analysis of patterns in funding was based on 36 cases from Appendix 1 registered before 1 September 2016 (i.e. plots after this date are not included). The trends seen in 2014-16 are compared with trends in 1994-2013, as identified in Oftedal (2015). [55]

Income sources, transfer methods and expenses for attack plots in 2014-16 largely follow the same patterns as for earlier ones. Legal income sources are still the most common method for financing plots. In 73% of the plots in Europe in 2014-16, the terrorists generated at least part of their income from legal sources such as salaries, welfare benefits, sale of property and loans.[56] This is the same proportion as for plots in 1994-2013.

In small and simple attacks conducted by one or two attackers, legal income is frequently the only source of funding. In these plots, attackers often use inexpensive weapons such as knives or a handgun, and have minimal expenses. For instance, the small amount of money needed by the perpetrator of the July 2016 Paris policeman home attack (three knives, a computer, a cell phone), was easily covered by income from the food delivery company he operated, “Dr. Food”.[57] Other examples of simple plots funded with legal income sources include the 2015 Germany bike race plot by militants who appeared to be linked to al-Qaida’s network rather than IS (they used their welfare benefits as funding), the 2015 Lyon gas factory attack (the perpetrator worked as a truck driver), and the 2015 London 7/7 anniversary bombing plot, also by an al-Qaida-inspired cell (funded by loans and salary).[58] Larger and more complex operations often combine legal income with other types of funding. A good example is the 2015 Charlie Hebdo attack, which was funded by the proceeds of the sale of a used car; a 6,000 euro consumer loan obtained with forged documents; and the sale of counterfeit goods. In addition, al-Qaida in the Arabian Peninsula (AQAP) said they financed the operation, and investigators believe Cherif Kouachi left Yemen in 2011 with $20,000 from AQAP to carry out attacks.[59] Finally, Amedy Coulibaly may have provided the Kouachi brothers with weapons and money on behalf of IS. He reportedly bought weapons for both himself and the Kouachi brothers from a Belgian arms dealer. In his video, Coulibaly said he gave the Kouachi brothers “a few thousand euros” to supplement what they had raised to prepare for the newspaper attack. He did not, however, specify himself whether or not it was IS that gave him the money.[60]

Almost half the plots (43%) are entirely self-financed, meaning there is no evidence that they received external support (for now). Such cells are almost impossible to detect through their financial activity, especially when plotters rely on legal income sources only. They have no economic ties to established terrorist organizations, and few of their financial activities are in themselves suspicious. Self-financing was becoming gradually more common throughout 1994-2013. In 1994-2001, none of the plots were entirely self-financed. In 2002-2007, 44% were entirely self-financed, whereas in 2008-2013, 61% of the plots were entirely self-financed.[61] Since 2014, this tendency has apparently been reversed. This follows logically from the fact that international funding (from IS) has become more common in the same period. We address why and how this may have happened below.

Contrary to widespread notions of a crime-terrorism-nexus, criminal activities are not a very common source of funding for attack plots in Europe of late.[62] Only 23% of the plots in 2014-2016 were financed wholly or partly by money from crime. In comparison, 38% of the plots in 1994-2013 were financed at least partly from criminal activities. One likely explanation for this decrease is that funds from IS has lessened the need for attackers to engage in crime to fund plots. Another possibility is that criminal activities are under-reported in recent plots (2014-2016). Criminal activities are by nature covert, and it may take longer for information on such funding sources to surface. Finally, there has been considerable variation in funding from criminal activity from year to year historically, in other words, the apparent decrease could just be natural variability. In any case, there is little evidence of an increasing integration between criminal networks and terrorists in the area of attack financing.[63]

Turning from funding sources to transfer methods, we find that cash still is the most common way to move money for a plot. In 90% of the cases with known transfers, cash was the chosen method, although it should be noted that there is limited information on money transfers in many cases. Like in 1994-2013, there is no evidence that new digital currencies like BitCoin have been used.[64] In one instance, the Paris attacks of November 2015, the Abaaoud-network used hawala to transfer money to the attackers.[65] This is the first known example that an attack cell in Europe received money through hawala transfers. Part of the explanation could be that such transfers are difficult to trace and therefore under-reported. In addition, people seldom use the hawala system for transfers to Europe. The flow of remittances generally goes the opposite direction, from workers in the West to their families in the developing world. It is probable that this general trend of hawala use is reflected among jihadis, so that hawala is used more often by support networks that send money to terrorist organizations abroad, than for attack plotting within Europe.[66] Finally, in many instances there is no need for money transfers from abroad – whether through hawala or other methods – simply because attacks are so inexpensive.

We estimate that 83% of the plots in 2014-16 cost less than $10,000.[67] In 1994-2013, 76% of the plots were estimated to less than $10,000.[68] In other words, there is no evidence that IS, with its deep war chests, has led to more expensive attacks on average. This reflects the broad range of attack types linked to the group. Many of the plots by IS-supporters who never made it to the war zone cost almost nothing, because they involved single actors with no expenses for travel or training, and simple weapons such as a knife or an axe. At the other end of the spectrum, the plots that were planned and prepared by the organization abroad were much more expensive and flex IS’s financial muscles. Of the six plots estimated to have cost more than $10,000, five have been linked to the IS’s section for international operations and the Abaaoud-network. These are the 2015 Verviers plot, the 2015 Sid Ahmed Ghlam church bomb plot, the November 2015 Paris attacks, the 2016 Brussels attacks and the 2016 Reda Kriket plot.[69] The high costs of these attacks are mainly due to the large number of weapons involved, and the expenses related to extensive travel to and from Syria, and within Europe. All of these plots were funded at least partly by IS, and form part of the recent increase in funding from international terrorist networks to cells in Europe.

Increased Funding from Abroad

In 2014-16, funding from international terrorist organizations (mainly IS) applies to at least 35% of the plots (9 plots), an increase from 25% in the period 1994-2013. In fact, the increase is even more pronounced if we exclude all incidents in the 2000s (when al-Qaida’s section for international operations was most active in plotting attacks in Europe). For instance, between 2010 and 2013, no cells appear to have received funding from international terrorist networks.[70]

The increase in funding from international terrorist networks likely stems from a combination of factors. First, since at least 2014, IS has pursued a strategy of conducting centrally directed attacks in the West through its section for international operations.[71] This entails that the organization has been prioritizing attacks in Europe. Second, IS has more capacity to act on this strategy than al-Qaida and like-minded actors that share the same intention. IS has – or at least had – more money at its hands than al-Qaida ever did.[72] In addition, the unprecedented influx of European foreign fighters to Syria and Iraq has provided IS with large numbers of potential operatives that can be instructed, trained and funded in Syria, before being dispatched to Europe.

All of the attack cells that received money from IS in 2014-16 involved perpetrators who had been to Syria. This aligns with the analysis of plots in 1994-2013, which found that cells composed of at least one foreign fighter were more likely to receive funding from international terrorist networks. This is arguably because a would-be-attacker’s presence in a jihadi conflict theater fulfils several functions relevant to economic support. It helps establishing contacts and trust, and functions as vetting processes to convince leaders that recipients are sufficiently competent. In addition, it facilitates the transfer of money, which can be provided directly to the attacker in cash.[73]

The analysis of plot financing in 1994-2013 also found that funding from international terrorist organizations decreased gradually after 2001, and attributed this in part to increased counter-measures against financing that made it more difficult for al-Qaida and affiliates to transfer money to attack cells.[74] It is possible that the recent increase in funding from IS reflects that it has again become easier to move money to attack cells in Europe. The large number of foreign fighters in Syria reduces the need to wire money from the conflict zone to Europe. Instead, IS’s section for international operations can give cash directly to the attackers in Syria, before they depart back home. This is how it was done in most of the plots attributed to the Abaaoud-network.[75]

Looking at the plots attributed to this entity, we can identify a characteristic modus operandi. IS typically provides operatives with several thousand euro in cash before they leave Syria.[76] In addition to cash, operatives sometimes also receive forged documents, and IS-affiliated facilitators or human smugglers help arrange their travel.[77] It is possible that IS transfers additional funds as needed to the operatives en route, but this is poorly documented.

Examples include the November 2015 Paris attacks and 2016 Brussels attack, the 2015 Reda Hame French concert hall plot, the 2015 Verviers plot and the 2014 Riviera plot. In the Verviers plot, one of those involved, Mohammed Hamza Arshad, used money from IS in Syria to provide crucial logistical support. He had travelled from Belgium to Syria to join IS in September 2014. After a three-week stay, he left Syria with 10,000 euro from IS, a number of photos to create forged identity papers, and a mission to find housing outside Brussels in Belgium. After Arshad returned to Europe, he stayed in regular contact with Abdelhamid Abaaoud. Abaaoud instructed him to buy arms and get hold of forged documents. Arshad bought three assault rifles, four handguns, police uniforms, walkie-talkies, material to produce explosives and rented a safe house in Verviers. He also collected two jihadi fighters in France and Germany, before the plot was disrupted by Belgian police in January 2015.[78]

Interestingly, there seems to be substantial geographical variation in the extent of funding from international terrorist networks in 2014-16. 40% of the plots in France received such funding, compared to only 17% in the UK. In 1994-2013, there were similar geographical variations, with France distinguishing itself as the country with most plots financed by terrorist networks. Looking at the UK, France and Scandinavia, the three countries/regions with most plots in 1994-2013, terrorists operating in France had received funding from international terrorist networks more often (50%) than in Scandinavia (29%) and UK (15%).[79] One possible explanation for the variation between France and the UK is the latter’s position as an island, which makes it harder to smuggle cash into the country, in much the same way as it is more difficult to smuggle weapons. Another reason is probably that jihadi networks in France and the UK have historically been involved in different types of activities. Both countries have extensive and well-established jihadi networks, but their functions have differed. Whereas networks in France and Belgium have long been involved in sending people, weapons and money to conflict zones, UK-based networks have typically been more focused on ideology, radicalization and recruitment.[80]

Money from IS Can Backfire

An increasing number of plots go undetected and result in attacks. Does the increase result from increased funding? One could assume that attackers who are financially backed by IS have better chances of success because they can pay off suspicious border guards, buy high-quality forged documents and large numbers of weapons. Our data suggest that this is not necessarily the case. In fact, in 2014-16, we find that plots funded by IS are the least likely to result in attacks. Only 29% of the plots known to have been funded by IS were launched, compared to those that were financed through legal funding (53%) and crime (67%).[81]

There is, however, little evidence that the low launch-rate for IS-funded plots is caused by the financing as such. Rather, receiving funding from IS appears correlated with other plot characteristics that lead to higher risk of detection or failure. Compared to attacks that are self-financed, IS-funded plots tend to be more expensive, more complicated and involve larger cells. More people and higher attack complexity present more opportunities for errors and increase the risk of detection. Furthermore, cells with foreign fighters are overrepresented among the cells that receive funding from IS. Participation of foreign fighters in itself increases the risk of detection, since they are more likely to be known to security services or connected to networks under surveillance. A case in point is the Verviers plot that was foiled in January 2015. It was uncovered not because of funding from IS, but because Belgian security services began surveillance of the network after discovering that one of the members had recently returned from a brief stay in Turkey, suggesting he may have gone to Syria.[82]

The increase in funding from IS constitutes the most noteworthy change in financing patterns for plots in 2014-16. It has superseded criminal activity as the second most common source of funding for plots in Europe. Still, the larger picture of plot financing is one of continuity. Legal funding sources are still the most widespread; cash is still the most common transfer method; and the vast majority of attacks still cost less than $10,000.

Future Trends

There are three peaks in jihadi attack plotting in Europe, linked to the GIA, al-Qaida and IS. The first peak was in 1995 when GIA launched a bombing campaign in France to deter the country from supporting the military regime against the Islamists during the civil war. The second peak was in connection with the Iraq war in 2003-2004, when al-Qaida and affiliates staged attacks to deter European countries from contributing militarily in Iraq. The last peak came with the Syrian war and the rise of IS, and aims to deter European countries from participating in the anti-IS coalitions. Deterrence and retribution appear to be the primary drivers all along.

The rise of IS does not appear to have changed the core dynamic of terrorist cell formation in Europe. Plots are hatched in an interplay between European extremists, foreign fighter contingents in the Middle East and IS’s section for international operations. The networks involve a combination of veterans and new recruits, and the al-Qaida-IS-distinction is vague in Europe. We do not know enough about how the overall socio-economic profile of Europeans has been affected by the exodus of foreign fighters to Syria. We do neither have the information to conduct a full scale study of the socio-economic profile of IS-terrorists across Europe in 2014-16. What we can say, however, is that IS’s terrorist cells in Europe (as those of the GIA and al-Qaida), do not only involve criminals and outsiders, but also resourceful people, who could easily have chosen different paths in their lives, had they not come under sway of militant networks. What also is beyond any doubt, however, is that more of the recruitment and instruction of terrorists happen via social media than ever before. If this continues, and there is no reason it should not, terrorist acts by people with very few or no prior connections to known networks is likely to become more frequent than in the past. The generational dimension and veteran effect of European jihadism implies that some of today’s foreign fighters in the Middle East might be tomorrow’s entrepreneurs, and as elaborated on by Hegghammer in this Special Issue, this might profoundly affect future mobilization.

The weapons, tactics and targets of jihadi terrorists in Europe have not changed drastically. The most significant change in recent years is the increase in gun and knife attacks as well as the increase in single-actor terrorism. It is important to emphasize that these plot types have not replaced bomb plots and group plots. They come in addition to the traditional forms of plots; making the threat more heterogeneous and unpredictable than ever before. A bit surprisingly, despite IS’s resources and shrewdness in use of communication technology, the overall picture regarding modus operandi is a tendency towards technologically and tactically simpler attacks.

Similar things can be said about patterns in financing. Despite IS’s impressive capacities, attack plotting in Europe remains quite inexpensive and low-tech, and plotters seek to fund their attacks in ways hard to detect for the law enforcement agencies, relying much in legal funding sources, or cash brought in by foreign fighters posing as refugees. While IS can direct plotters real-time online, there is no evidence yet that they turn to online tools in attack financing, e.g. internet currency BitCoin.

The following forecast is based on the following methods: As a starting point we extrapolate current trends in weapons, tactics and targets among jihadis operating in Europe. But we also take into consideration the interplay between terrorism in Europe and jihadi groups in conflict zones: Which groups will have intentions and capabilities to attack Europe in the next three to five years? What type of capabilities are these groups likely to develop within that time frame? And what strategies are these groups most likely to pursue in Europe?

We surmise that in the next three to five years, IS will remain the dominant jihadi protagonist of attack plotting in Europe despite being currently on the defensive. IS will have a reason to conduct attacks in Europe as long as European countries participate in the coalition against the 'Caliphate'. IS will also have capability to attack Europe, primarily due to the unprecedented number (5,000-6,000) of European foreign fighters. Even if only 1% of these individuals survive the current war and continue to fight for IS, it still constitutes a group of 50-60 hardcore European jihadis who will be able to operate as entrepreneurs and recruit many more through their online and real-life social networks, for many years to come.

IS has developed certain tactics on the ground in Syria that may, or may not be transferred to Europe. The most worrying development is IS’s active interest in, and use of, improvised chemical weapons such as chlorine bombs and mustard gas.[83] If IS decided to use similar weapons in Europe, the biggest challenge would be to smuggle chemical materials or weapons across borders. Historically, jihadi terrorists in Europe have rarely relied on smuggling weaponry from abroad. Instead, they have relied on weapons that are available inside the region as this decreases the likelihood of detection. A more likely scenario is that IS bomb-makers devise a way to make improvised chemical bombs from available materials, and teach these techniques to foreign fighters while they are in Syria or Iraq.

Al-Qaida did something similar in Afghanistan in 2000-2001, and this led to a subsequent increase in CBRN-related terrorist plots in Europe.[84] Al-Qaida’s techniques were not very sophisticated, however, and were hardly suitable for conducting mass-casualty attacks.[85] However, IS’s CBRN capabilities today are likely to be more sophisticated than al-Qaida’s in 2001. Al-Qaida relied on a Malaysian with a B.Sc. to lead its experimental laboratory in Kandahar in 2001, and had to procure basic laboratory equipment from scratch. The situation with IS is quite different. The group is financially far more robust than al-Qaida. It controls modern infrastructure including university laboratories and hospitals, and reportedly managed to recruit weapons engineers from Saddam Hussein’s chemical weapons program.[86]

IS has also used commercially available drones during warfare – both to conduct surveillance and more recently, in attempts to drop bombs onto targets. There is serious concern among Western security services that commercial drones may be used by terrorists in Europe to conduct attacks.[87] However, we caution against over-estimating the drone-threat. IS’s modus operandi has so far been to carry out mass-casualty shooting and bomb attacks against civilians in Europe. Given the abundance of possible targets, such attacks can easily be carried out by one or several operatives on foot or by car. The use of a drone, in such cases, would only complicate the operation with no obvious value added, as commercial drones can only carry small amounts of explosives. If IS wants to escalate its terrorist campaign against Europe, it is more likely the escalation will take the form of more bomb and shooting attacks – or attacks with improvised CBRN.

In the next three to five years we contend that shooting attacks will continue to be most common, or shooting attacks in combination with bombs, arson or car attacks. Hostage taking and «urban sieges» will probably become more frequent as a result of guns becoming the preferred choice of weapon. Single-actor terrorism will continue at an elevated level, and because of better opportunities to recruit and instruct via social media, a higher proportion of individual attackers than before may be little-, or un-known to the security services.

Targeting of crowds will continue, as will targeting of, and assassination plots aimed at, specific segments in society such as public figures, military personnel, police, and members of other religious sects, e.g. Shia Muslims. Targeting of symbols of «Western immorality» in general, and sexual minorities in particular, could emerge as a new trend. There has only been one example of this in Europe so far (the 2016 Swingers club plot in France), but on 12 June 2016, there was a large attack on a gay nightclub in Orlando, Florida, during which a single gunman shot and killed 49 people. Moreover, IS has repeatedly issued anti-gay propaganda and engaged in executions of homosexuals in areas under its control.[88]

The most surprising trend in recent years is perhaps the absence of CBRN terrorism. We argue that the threat cannot be ruled out in the future, for the reasons stated earlier. It is worth noting that the cell connected to the Paris attack in November 2015 had conducted surveillance of a nuclear scientist, indicating a possible, renewed interest among IS-inspired terrorists for unconventional weapons – in this case a possible penetration of a nuclear power plant.

Overall, if IS’s territorial control persists, we foresee attempts at large-scale operations (not excluding new “Mumbai-style” attacks, or attempts at using improvised CBRN). If IS continues to lose ground, small-scale attacks by single actors receiving online direction will become even more frequent.

About the authors: Petter Nesser is Senior Research Fellow at the Norwegian Defence Research Establishment (FFI). Anne Stenersen is Senior Research Fellow at FFI. Emilie Oftedal works for the Norwegian Armed Forces and is a former Research Fellow with the FFI.

Notes

[1] “Europe” here refers to Western Europe, excluding Turkey and former Eastern Bloc states. The term “jihadi” refers to individuals, groups, networks and ideologies emanating from the Arab-based foreign fighter movement of the 1980s Afghan jihad: primarily al-Qaida and spin-offs (including IS).

[2] IS in this context refers both to the Islamic State (IS), declared in June 2014, and IS’s predecessor, the Islamic State in Iraq and Syria (ISIS/ISIL).

[3] For informative journalistic works, see e.g. “Inside Europe’s Terror Attacks,” BBC, 25 August 2016; URL: http://www.bbc.co.uk/programmes/b07598xc and articles by Rukmini Callimachi such as, “How ISIS Built the Machinery of Terror Under Europe’s Gaze,” New York Times, 29 March 2016; URL: http://www.nytimes.com/2016/03/29/world/europe/isis-attacks-paris-brussels.html

[4] See for example “Changes in Modus Operandi of Islamic State Terrorist Attacks” (The Hague: Europol, January 18, 2016); URL: https://www.europol.europa.eu/publications-documents/changes-in-modus-operandi-of-islamic-state-terrorist-attacks; Robin Simcox, “The Threat of Islamist Terrorism in Europe and How the U.S. Should Respond” (The Heritage Foundation, 1 August, 2016); URL: http://www.heritage.org/research/reports/2016/08/the-threat-of-islamist-terrorism-in-europe-and-how-the-us-should-respond ; “The ISIS Terror Threat in America,” Homeland Security Committee, August 2016; URL: https://homeland.house.gov/wp-content/uploads/2016/08/August-Terror-Threat-Snaphot.pdf, Pieter van Ostaeyen ,“The Road to Orlando: Jihadist-Inspired Violence in the West, 2012-2016”, CTC Sentinel, Vol 9, No 6 (2016); URL: https://www.ctc.usma.edu/posts/the-road-to-orlando-jihadist-inspired-violence-in-the-west-2012-2016, and Thomas Hegghammer and Petter Nesser, «Assessing the Islamic State’s commitment to attacking the West,» Perspectives on Terrorism, Vol 9, No. 4 (2015): 14–30; URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/440/html

[5] Appendix 1; URL: https://www.dropbox.com/s/z5q13wlocf7y6pn/APPENDIX%201.docx?dl=0

[6] Petter Nesser, Islamist Terrorism in Europe, a History. London: Hurst, 2015, Petter Nesser and Anne Stenersen, “The Modus Operandi of Jihadi Terrorists in Europe,” Perspectives on Terrorism, Vol 8, No 6 (2014); URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/388/html ; Emilie Oftedal, “The Financing of Jihadi Terrorist Cells in Europe” (Kjeller: FFI, 2015); URL: http://www.ffi.no/no/Rapporter/14-02234.pdf

[7] There have been past terrorist plots in Europe involving links to IS’s mother group al-Qaida in Iraq (AQI) (e.g. the Doctors cell in 2007) and the Stockholm suicide bomber in 2010). There have also been plots and attacks involving links to IS’s forerunners Jabhat al-Nusra and ISIS during 2012-13: ‘Cannes-Torcy network’s grenade attack on Kosher supermarket’ (2012), ‘Lars Hedegaard attack’ (2013) and ‘Lyes Darani plot’ (2013) and ‘London “Mumbai” plot’ (2013). See appendix of Nesser, Islamist Terrorism in Europe; URL: http://www.hurstpublishers.com/wp-content/uploads/2015/11/Islamist-Terrorism-in-Europe-Appendix.pdf

[8] Overall, we have registered 192 plots in total since 1994 (the year of the first attacks in Europe by a jihadi actor, the Algerian GIA). 57 of those have been assessed to be “vague plots”, however. “Vague plots” refer to plots where there is uncertainty about jihadi affiliation, evidence of attack plans and target selection. Such cases cannot be used for a full worthy analysis of modus operandi, but they can say something about the geographical distribution of plots for instance. Some vague plots become well-documented after further investigations. There are also a few examples of cases that seemed well-documented at first, and turned out to be vague after investigations.

[9] Translation from the website of Pieter van Ostaeyen: Al-Adnani 22.09.2014 “Indeed Your Lord Is Ever Watchful”; URL: https://pietervanostaeyen.com/2014/09/25/abu-muhammad-al-adnani-ash-shami-indeed-your-lord-is-ever-watchful/

[10] Translations from the website of Pieter van Ostaeyen: Al-Adnani 22.05.2016 “And Those Who Lived (In Faith) Would Live Upon Evidence”; URL: https://pietervanostaeyen.com/2016/05/22/abu-muhammad-al-adnani-as-shami-and-those-who-lived-in-faith-would-live-upon-evidence/; Al-Adnani 12.03.2015 “So They kill and Are Killed”; URL: https://pietervanostaeyen.com/2015/03/13/so-they-kill-and-are-killed-audio-statement-by-abu-muhammad-al-adnani-as-shami/; Al-Adnani 26.01.2015 “Say, Die In Your Rage”; URL: https://pietervanostaeyen.com/2015/01/26/audio-statement-by-is-spokesman-abu-muhammad-al-adnani-as-shami-say-die-in-your-rage/

[11] The Riviera plot in February, the Brussels museum shooting in May, and the Creteil plot in July.

[12] Rukmini Callimachi, “How a Secretive Branch of ISIS Built a Global Network of Killers”,New York Times, 3 August 2016; URL: http://www.nytimes.com/2016/08/04/world/middleeast/isis-german-recruit-interview.html?_r=0

[13] Appendix 1; URL: https://www.dropbox.com/s/z5q13wlocf7y6pn/APPENDIX%201.docx?dl=0

[14] See “IS Claims Paris Attacks, Warns Operation Is “First of the Storm””, Site Intelligence Group Enterprise, 14 November 2015; URL: https://ent.siteintelgroup.com/Statements/is-claims-paris-attacks-warns-operation-is-first-of-the-storm.html; “IS Claims Brussels Attack, Threatens States Participating in Anti-IS Coalition”, Site Intelligence Group Enterprise, 22 March 2016; URL: https://news.siteintelgroup.com/Jihadist-News/is-claims-brussels-attack-threatens-states-participating-in-anti-is-coalition.html; “IS’ ‘Amaq Says Nice Attack Carried Out by IS “Soldier””, Site Intelligence Group Enterprise, 16 July 2016; URL: https://news.siteintelgroup.com/Jihadist-News/is-amaq-says-nice-attack-carried-out-by-is-soldier.html; “IS’ ‘Amaq Reports Charleroi Machete Attack Carried Out by IS “Soldier””, Site Intelligence Group Enterprise, 7 August 2016; URL: https://news.siteintelgroup.com/Jihadist-News/is-amaq-reports-charleroi-machete-attack-carried-out-by-is-soldier.html; “IS’ ‘Amaq News Agency Reports Ansbach Attack Was Carried Out IS “Soldier””, Site Intelligence Group Enterprise, 25 July 2016; URL: https://news.siteintelgroup.com/Jihadist-News/is-amaq-news-agency-reports-ansbach-attack-was-carried-out-is-soldier.html; “IS’ ‘Amaq Reports Normandy Church Attack Carried Out by IS “Soldiers””, Site Intelligence Group Enterprise, 26 July 2016; URL: https://news.siteintelgroup.com/Jihadist-News/is-amaq-reports-normandy-church-attack-carried-out-by-is-soldiers.html

[15] Films about Paris attacks: “Kill Them Wherever You Find Them,” Al-Hayat Media, January 2016; URL: http://heavy.com/news/2016/01/new-isis-islamic-state-news-pictures-videos-kill-them-wherever-you-find-them-et-tuez-les-ou-que-vous-les-rencontriez-french-english-translation-paris-attacks-full-uncensored-youtube/–Video featuring several perpetrators of the Paris attacks in November 2015; “As They Kill You Kill,” Wilayat al-Jazirah, November 2015; URL: http://jihadology.net/2015/11/20/new-video-message-from-the-islamic-state-as-they-kill-you-kill-wilayat-al-jazirah/–Communicating that Paris was revenge for killing of Muslims – title of video resembles al-Adnani’s speech from March 2015; “And Verily Our Soldiers Will Be Victorious,” Wilayat al-Furat, November 2015; URL: http://jihadology.net/2015/11/18/new-video-message-from-the-islamic-state-and-verily-our-soldiers-will-be-victorious-wilayat-al-furat/–Highlighting revenge as motive for Paris. Displays IS-member making an IED and another preparing a sniper rifle for use. Yet another is putting on a suicide vest while images are suggesting it is for an attack in New York: “Here The Revenge Has Come To You;” Wilayat Dimashq, November 2015; URL: http://jihadology.net/2015/11/22/new-video-message-from-the-islamic-state-here-the-revenge-has-come-to-you-wilayat-dimashq/ ; “Paris Has Collapsed,”Wilayat Halab, November 2015; URL: http://jihadology.net/2015/11/20/new-video-message-from-the-islamic-state-paris-has-collapsed-wilayat-%E1%B8%A5alab/–video contains threat against the West from one of al-Adnanis speeches (likely the one from September 2014). Films about Brussels attacks: “And Cast Terror Into Their Hearts,” Wilayat al-Raqqa, March 2016; URL: http://jihadology.net/2016/03/26/new-video-message-from-the-islamic-state-and-cast-terror-into-their-hearts-wilayat-al-raqqah/–features interviews with «civilians» in al-Raqqa; “An Eye For An Eye,” Wilayat al-Furat, March 2016; URL: http://jihadology.net/2016/03/27/new-video-message-from-the-islamic-state-an-eye-for-an-eye-wilayat-al-furat/–features the same excerpt from al-Adnani speech as in the video “Paris Has Collapsed”.

[16] «Excerpts from ‘Indeed your Lord is ever watchful’ by the official spokesman for the Islamic State,» Dabiq issue 4 (October 2014): 6–9. For safe PDF copies of Dabiq, consult the Jihadi Document Repository at the University of Oslo; URL: https://www.hf.uio.no/ikos/english/research/jihadi-document-repository/index.html.

[17] ‘The extinction of the grayzone,’ Dabiq issue 7 (February 2015): 58.

[18] “Words of sincere advice,” Dabiq issue 15 (July 2016): 28.

[19] Rajan Basra and Peter R. Neumann, “Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus,” Perspectives on Terrorism 10, no. 6 (2016).

[20] Thomas Hegghammer, “The Future of Jihadism in Europe: A Pessimistic View,” Perspectives on Terrorism 10, no. 6 (2016).

[21 William McCants and Chris Meserole, “The French Connection,” Foreign Affairs, 24 March 2016; URL: https://www.foreignaffairs.com/articles/2016-03-24/french-connection

[22] See, for example, Jean-Pierre Filiu, “The French « Iraqi Networks » of the 2000s: Matrix of the 2015 Terrorist Attacks?” and Ann-Sophie Hemmingsen, “Plebeian jihadism in Denmark: An individualisation and popularization predating the growth of Islamic State,” Perspectives on Terrorism,10, no. 6 (2016)

[23] See also Kevin Jackson, and Jean-Charles Brisard. “The Islamic State’s External Operations and the French-Belgian Nexus,” CTC Sentinel, Vol 9, No 11 (2016); URL: https://www.ctc.usma.edu/posts/the-islamic-states-external-operations-and-the-french-belgian-nexus.

[24] For an in-depth discussion of these types of terrorists, see Nesser, Islamist Terrorism in Europe, op. cit., pp. 12-18.

[25] For an overview of Abaaoud’s role in coordinating attacks in Europe on behalf of IS, see for example , “IS in Europe: The race to the death”, BBC, 23 March 2016; URL; http://www.bbc.com/news/magazine-35872562; “How Islamic State Infiltrated Europe”, WSJ, 1 April 2016; URL: http://graphics.wsj.com/brussels-terror-network/

[26] Nesser, Islamist Terrorism in Europe; op. cit.

[27] See Jackson and Brisard. “The Islamic State’s External Operations and the French-Belgian Nexus,” and Daveed Gartenstein Ross and Nathaniel Barr, “Recent Attacks Illuminate the Islamic State’s Europe Attack Network,” Terrorism Monitor, 27 April 2016; URL: http://www.jamestown.org/programs/tm/single/?tx_ttnews%5Btt_news%5D=45362&cHash=89f8c723f2eb291f6effb6d9ba332c8b

[28] Thomas Hegghammer and Petter Nesser, «Assessing the Islamic State’s commitment to attacking the West,» Perspectives on Terrorism, Vol 9, No. 4 (2015): 14–30; URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/440/html

[29] Appendix 2; URL: https://www.dropbox.com/s/y7f9u3hria5dyiu/APPENDIX%202.xlsx?dl=0

[30] “UK Terror Cell Linked to Paris and Brussels Attacks ‘Planned to Attack Where Crowds Gather’,” Mail Online, 16 April, 2016; URL: http://www.dailymail.co.uk/news/article-3543179/UK-terror-cell-linked-Paris-Brussles-attacks-planned-attack-crowds-gather.html and “An ISIS ‘Sleeper Cell’ Has Been Nabbed in Germany, Officials Say,” NBC News, 13 September, 2016; URL: http://www.nbcnews.com/storyline/isis-terror/germany-arrests-3-schleswig-holstein-suspected-isis-link-n647271

[31] See Fernando Reinares, ¡Matadlos!. Barcelona: Galaxia Gutenberg, 2014.

[32] Nico Prucha, "IS and the Jihadist Information Highway – Projecting Influence and Religious Identity via Telegram," Perspectives on Terrorism, 10, no. 6 (2016).

[33] “Tracing the Path of Four Terrorists Sent to Europe by the Islamic State,” Washington Post, 22 April; URL: https://www.washingtonpost.com/world/national-security/how-europes-migrant-crisis-became-an-opportunity-for-isis/2016/04/21/ec8a7231-062d-4185-bb27-cc7295d35415_story.html .

[34] Appendix 3; URL: https://www.dropbox.com/s/nihxjes9we59n0k/APPENDIX%203.xlsx?dl=0. The coding of plots and attacks is according to the methodology described in Nesser and Stenersen, “The Modus Operandi of Jihadi Terrorists in Europe,” 5-6.

[35] Ibid.

[36] Ibid., 18-19.

[37] Ibid., 6.

[38] “How combination of solid security at the Stade de France and quick thinking helped save dozens of lives–and why police can’t explain reason attack unfolded as it did,” Mail Online, 17 November 2015; URL: http://www.dailymail.co.uk/news/article-3321531/Solid-security-Stade-France-helped-save-dozens-lives.html

[39] Nesser and Stenersen, “The Modus Operandi of Jihadi Terrorists in Europe,” 11-12.

[40] «Woolwich attack UK soldier» (2013); see appendix of Nesser (2015)

[41] Ian Austen, “Hit-and-Run That Killed Canadian Soldier Is Called Terrorist Attack,” New York Times, 21 October 2014; URL: http://www.nytimes.com/2014/10/22/world/americas/canadian-soldier-run-down-in-what-officials-call-act-of-terror-dies.html?_r=0

[42] “Dijon car attack” (2014). The case was registered in our dataset as vaguely documented (C3); see appendix 1.

[43] “Lyon gas factory attack” (2015).

[44] ”Say, “Die in Your Rage!” An Address by the Spokesman for the Islamic State The Mujāhid Shaykh Abū Muhammad al-‘Adnānī ash-Shāmī,” Al-Hayat, January 2015. Transcript accessed via the blog of Pieter Van Ostaeyen; URL: https://pietervanostaeyen.files.wordpress.com/2015/01/al-adnani-say-die-in-your-rage.pdf (on 29 August 2016).

[45] “Charlie Hebdo attack” (2015), “Friday 13th Paris shooting” (2015) see appendix 1. The weapon used in the Charlie Hebdo attack was apparently a M80 Zolja rocket launcher, probably smuggled in from the Balkans, “How did the Paris terrorists get hold of their weapons?” Telegraph, 17 January 2015; URL: http://www.telegraph.co.uk/news/worldnews/europe/france/11351855/How-did-the-Paris-terrorists-get-hold-of-their-weapons.html

[46] «Isis suspects secretly monitored Belgian nuclear scientist, raising dirty bomb fears,» Independent, 19 February 2016; URL: http://www.independent.co.uk/news/world/europe/isis-dirty-bomb-nuclear-scientists-paris-attacks-a6884146.html

[47] “Islamic State fighters using drones with IEDs and spy cameras, says Pentagon,” Telegraph, 7 July 2016; URL: http://www.telegraph.co.uk/news/2016/07/07/islamic-state-fighters-using-drones-with-ieds-and-spy-cameras-sa/

[48] “2015 Charlie Hebdo attack”, “2015 Friday 13th Paris shooting” and “2016 Normandy priest beheading” see appendix 1.

[49] “European Ferries plot” (2002) and “Bouhrama/GSPC Italy-Norway plot “ (2005), see appendix of Nesser (2015). In the Italy-Norway case, “large-scale” attacks were, according to Italian media, believed to include targeting of a cruise-ship, consult “Terrorism: Another Trail Leads to Florence (in Italian),” Il Giornale (Milan), 24 November 2005, accessed via WNC. See also “’Do You Want to Put a Bomb on the Subway?’ (in Italian),” Il Giornale (Milan), 21 November 2005, accessed via WNC.

[50] “French police chief and partner killed in stabbing claimed by Isis,” Guardian, 14 June 2016; URL: https://www.theguardian.com/world/2016/jun/13/french-policeman-stabbed-death-paris and “France in shock again after Isis murder of priest in Normandy,” Guardian, 26 July 2016; URL: https://www.theguardian.com/world/2016/jul/26/france-shock-second-isis-attack-12-days

[51] The four attacks conducted by groups were: “2015 Charlie Hebdo Attack”, ”2015 Friday 13th Paris shooting”, “2016 Brussels attacks”, and “2016 Normandie priest beheading” see Appendix 1.

[52] Clare Ellis, “With a little help from my friends: an exploration of the tactical use of single-actor terrorism by the Islamic State,” Perspectives on Terrorism 10, no. 6 (2016)

[53] The 6 plots are: ”2014 Ziamani beheading plot”, “2014 Tours knife attack”, “2015 Copenhagen attack”, “2015 London subway stabbing”, “2016 German girl police stabbing”, and “2016 Knife attack police Brussels”.

[54] For example, the Abbottabad documents confirm that al-Qaida intended to recruit and train operatives to carry out an attack on the Danish newspaper Jyllands-Posten, in 2010, but the attack never materialized because the plotters were intercepted and arrested. Consult Office of the Director of National Intelligence, “Bin Laden’s Bookshelf”; URL: https://www.dni.gov/index.php/resources/bin-laden-bookshelf?start=1

[55] In 2015, the FFI published a study of the financing of 40 jihadi cells that plotted attacks in Europe between 1994 and 2013; see: Oftedal, “The Financing of Jihadi Terrorist Cells in Europe”. When comparing the findings from the period 2014-2016 with the findings from the previous report, it is worth noting that there are some differences in methodology. The 2015 study only included the most well-documented plots (C1), whereas for the period 2014-2016, plots that were less well-documented (C2) were also included in order to increase the amount of data on which to base the analysis about how European jihadis work to ensure funding (consult appendix 1 for an explanation of the three-tier classification system of plots according to level of documentation). To rule out that the apparent changes in funding are due to systematic differences between C1 and C2 plots, we repeated the analysis of the most recent period without the C2 plots. This did not significantly alter the results. For example, the proportion of C1 plots that received terrorist funding was 38% (compared to 35% for C1 and C2 plots combined) and legal funding was at 81% (compared to 73% for C1 and C2 plots). Cash was the transfer method used in 90% of the transfers for C1 plots, compared to 86% for C1 and C2 pots combined. The relative consistency in financing between C1 and C2 plots indicates that the changes since 2014 are most likely real, and not simply due to our inclusion of less well-documented plots. Nevertheless, it should be underscored that the findings from the most recent period are more uncertain.

[56] Of the 36 plots studied, six had to be excluded from the analysis of income due to insufficient information and four were excluded because no income was needed for the plot (the plot was disrupted before any costs had incurred). The remaining 26 plots form the basis for the analysis of income sources.

[57] Nadia Sweeny, ”Larossi Aballa, entre livraison de nourriture à domicile et terrorisme”, ZamanFrance.fr, 14 June 2016; URL: https://www.zamanfrance.fr/article/larossi-aballa-entre-livraison-nourriture-a-domicile-terrorisme-22092.html.

[58] Susanne Schröter, “The Rhine-Main Area as a Base of Salafist-Jihadist Operations” (Frankfurt: Frankfurter Forschungszentrum Globaler Islam, May 2015); Philippe Sotto and Lori Hinnant, “Suspect handed preliminary charges over beheading in France”, AP, 30 June 2015; Tom Whitehead, and David Barrett, “Middle class daughter of magistrate who turned to suicide bomb plotter”, Telegraph, 30 December 2015; URL: http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/12073343/Islamist-fanatic-dubbed-Silent-Bomber-and-wife-guilty-of-77-anniversary-terror-plot.html

[59] Magnus Normark and Magnus Ranstorp, “Understanding Terrorist Finance. Modus Operandi and National CTF-Regimes” (Stockholm: Swedish Defence University, December 2015); Catherine E. Shoichet and Josh Levs, “Al Qaeda branch claims Charlie Hebdo attack was years in the making”, CNN, 21 January 2015.

[60 “Emails from Paris Kosher Store Gunman to ‘handler’ Revealed,” France 24, 7 November 2015; URL: http://www.france24.com/en/20151107-emails-paris-kosher-store-gunman-handler-revealed; Jack Moore, “Charlie Hebdo Paris massacre: Belgian arms dealer admits to supplying Kouachi brothers and Amedy Coulibaly”, International Business Times, 14 January 2016; URL: http://www.ibtimes.co.uk/charlie-hebdo-paris-massacre-belgian-arms-dealer-admits-supplying-kouachi-brothers-amedy-1483391; Carol Matlack, “Why France’s Terror Attacks Were Probably Self-Financed”, Bloomberg, 12 January 2015; URL: http://www.bloomberg.com/news/articles/2015-01-12/why-frances-terror-attacks-were-probably-selffinanced

[61 Oftedal, “The financing of jihadi terrorist cells in Europe”, op.cit., p. 19.

[62] On the crime-terrorism nexus, see for example Peng Wang, “The Crime-Terror Nexus: Transformation, Alliance, Convergence”, Asian Social Science, Vol 6, No 6 (2010) and Steven Hutchinson and Pat O’Malley, “A Crime–Terror Nexus? Thinking on Some of the Links between Terrorism and Criminality”, Studies in Conflict & Terrorism, Vol 30, No 12 (2007), see also Basra and Neumann in this special issue of Perspectives on Terrorism.

[63] This finding does not, however, exclude that there is in fact a growing crime-terrorism nexus. There might still be an increasing convergence in other areas, such as recruitment (petty criminals recruited in prison) or weapons (terrorists cooperating with organized crime networks to acquire weapons).

[64] In the wake of the 2015 November Paris attacks, several media outlets published articles claiming that IS militants linked to the attacks had a Bitcoin address with 3 million dollars. These reports were based on an interview with a member of Ghost Security Group, an anti-IS hacking group. However, Ghost Security Group only said that IS in general used crypto-currencies, and that the group had uncovered various Bitcoin addresses used by people affiliated with IS, including one address with 3 million dollars. A representative from Ghost Security reportedly clarified later that the accounts it discovered “are in no way connected to the Paris attack”; see “Bitcoin, Paris and Terrorism: What the Media Got Wrong”, Coindesk.com, 20 November 2015; URL: http://www.coindesk.com/bitcoin-paris-and-terrorism-what-the-media-got-wrong/

[65] Rukmini Callimachi, Alissa J. Rubin and Laure Fourquetmarch, “A View of ISIS’s Evolution in New Details of Paris Attacks”, New York Times, 19 March 2016; URL: http://www.nytimes.com/2016/03/20/world/europe/a-view-of-isiss-evolution-in-new-details-of-paris-attacks.html . Hawala is an alternative remittance channel that exists outside of traditional banking systems. It is a method of transferring money without any actual movement of money, and the system is heavily based on trust, see definition on Investopedia; URL: http://www.investopedia.com/terms/h/hawala.asp#ixzz4Hgbu9tdA)

[66] Oftedal, “The financing of jihadi terrorist cells in Europe,” op. cit., p. 23.

[67] The estimates of expenses are on the low side, since many plots were disrupted in an early phase. The estimates only include expenses accumulated at the time of disruption, and not planned or possible future costs. This is because it is very difficult to predict what costs may have been accumulated if the plots were executed, but suggests that the actual costs would have been higher than our estimates.

[68] Oftedal, “The financing of jihadi terrorist cells in Europe”., op. cit.

[69] The sixth attack estimated at over $10,000 is the 2015 Charlie Hebdo attack, linked to AQAP. Although the attacker at the kosher store pledged allegiance to IS, there is no firm evidence that he received money from IS.

[70] Oftedal, “The financing of jihadi terrorist cells in Europe,” op. cit. p.19.

[71] See for example “How Islamic State Infiltrated Europe”, WSJ, April 1, 2016 and Callimachi, “How a secretive branch of ISIS built a global network of killers”.

[72] See for example Robert Windrem, “ISIS Is the World’s Richest Terror Group, But Spending Money Fast”, NBC News, March 20 2015; URL: http://www.nbcnews.com/storyline/isis-uncovered/isis-richest-terror-group-world-n326781

[73] Oftedal, “The financing of jihadi terrorist cells in Europe,” 21, op. cit.

[74] Ibid, 45.

[75] Examples of plots were attackers received cash from IS while they were in Syria/Iraq/Turkey include the November 2015 Paris attack and the 2016 Brussels attack, the 2015 Reda Hame French concert hall plot, the 2015 Ghlam church bomb plot, the 2015 Verviers plot and the 2014 Riviera plot.

[76] The highest amount reported is from the 2015 Verviers plot, where one of the members left Syria with 10,000 euro. The lowest amount reported was in connection with the 2014 Riviera plot, where Ibrahim Boudina was stopped at the Turkish border returning from Syria with “a mission”. In his luggage, the officers found 1,500 euro and a French document titled “How to Make Artisanal Bombs in the Name of Allah.” See Callimachi, “How ISIS Built the Machinery of Terror Under Europe’s Gaze” and “Arms dealer threw police uniforms into the bargain”, FlandersNews.be, 11 May 2016; URL: http://deredactie.be/cm/vrtnieuws.english/News/1.2652977

[77 See for example Callimachi, Rubin and Fourquetmarch, “A View of ISIS’s Evolution in New Details of Paris Attacks”.

[78] “Arms dealer threw police uniforms into the bargain”; “Cellule terroriste de Verviers–Arshad, l’homme qui avait tout préparé à Verviers à son retour de Syrie (2),” Bruzz.be, 10 May 2016; URL: http://www.bruzz.be/fr/node/121141.

[79] Oftedal, “The financing of jihadi terrorist cells in Europe,” 20.

[80] Nesser, Islamist Terrorism in Europe, op.cit.

[81] For al-Qaida-funded plots the launch rate is 100%, but there is only one case in the sample: the 2015 Charlie Hebdo attack (launched). One of the plots funded by international terrorist organizations had to be excluded from this analysis since we do not know if the funding came from al-Qaida or IS: the 2014 UK possible Khorasan plot (not launched). Media only reported that a British jihadist returned from Syria with a “substantial amount of cash” from unknown militant Islamists. See for instance Duncan Gardham, “Revealed: Briton who was jihadi in Syria and came home to bomb UK streets”, Mail Online, 6 July 2014; URL: http://www.dailymail.co.uk/news/article-2681957/Revealed-Briton-jihadi-Syria-came-home-bomb-UK-streets.html )

[82] “Terror Suspects Go on Trial in Belgium Over Failed Plot”, Wall Street Journal, 9 May 2016; URL: http://www.wsj.com/articles/terror-suspects-go-on-trial-in-belgium-over-failed-plot-1462816512.

[83] “Forgotten Lessons: The Return of Mustard Gas”, Huffington Post, 6 October 2016; URL: http://www.huffingtonpost.com/joseph-v-micallef/forgotten-lessons-the-ret_b_12272666.html.

[84] Nesser and Stenersen “The Modus Operandi of Jihadi Terrorists in Europe” op.cit.

[85] For an in-depth analysis of al-Qaida’s CBRN effort, see Anne Stenersen, Al-Qaida’s quest for Weapons of Mass Destruction: The History behind the Hype (Saarbrucken: VMD Verlag, 2008).

[86] Anne Stenersen, “Toxic Taster: Jihadists’ chemical weapons use remains crude,” Jane’s Intelligence Review (April 2015): 44-49.

[87] See for example, “UK should prepare for use of drones in terrorist attacks, says thinktank,” Guardian, 11 January 2016; URL: https://www.theguardian.com/uk-news/2016/jan/11/drones-terrorist-attacks-security-thinktank

[88] IS has also praised Omar Mateen, the perpetrator behind the Orlando nightclub attack. “Why we hate you and why we fight you,” Dabiq issue 15 (July 2016): 30–33; “The Islamic State’s shocking war on gays,” Washington Post, 13 June 2014; URL: https://www.washingtonpost.com/news/worldviews/wp/2016/06/13/the-islamic-states-shocking-war-on-homosexuals/



Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.

ENHANCING SECURITY THROUGH COLLABORATIVE RESEARCH

Perspectives on Terrorism is  a journal of the Terrorism Research Initiative and the Center for Terrorism and Security Studies

ISSN  2334-3745 (Online)

Disclaimer, Terms and Conditions