This report was written by:
Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from of the Israeli intelligence community
Roshanna Lawrence – MAX Security’s Associate Director of Intelligence, Middle East & North Africa
Garrett Krivicich – MAX Security’s Senior Analyst on Turkey
Asaf Day – MAX Security’s Senior Analyst on the Eastern Mediterranean
Executive Summary
Three suicide bombers of Russian and Central Asian descent launched a well-planned and coordinated attack, detonating themselves at Istanbul’s Ataturk International Airport during the evening hours of June 28 and causing the deaths of 41 people and wounding of 239 others.
While no claim of responsibility has been released at this time, we assess that the Islamic State (IS) is responsible for the attack, given the sophisticated modus operandi of the incident, namely a coordinated attack in three separate locations, including a diversion stage, as well as the target, which is an international hub for foreign nationals.
Current Situation
Description of event
Three suicide bombers detonated themselves at Istanbul’s Ataturk International Airport during the evening hours of June 28. Reports indicate that at approximately 22:00 (local time), the assailants arrived by taxi at the international terminal’s arrivals hall. One militant remained behind in the parking lot and aroused police suspicion; he began shooting at police and then detonated a suicide belt.
As security forces gathered around the scene of the first blast, in the chaos, the two other attackers were able to enter the international terminal: One at the arrivals hall terminal, and the other upstairs to the departure hall.
The second and third explosions reportedly took place at the arrivals and departures halls, where each attacker attempted to pass through security and began shooting, engaging with security forces before separately detonating themselves.
Description of attackers
The attackers were reportedly from Russia’s Dagestan region, as well as from Uzbekistan and Kyrgyzstan, and they were armed with standard AK-47 assault rifles. However, a local knowledgeable source speaking to us stated that one carried a Glock pistol.
Furthermore, the same source stated that one assailant arrived to Turkey one year prior to the attack and then traveled to Syria’s Raqqa Province for training, while the two others joined him several months later. After a period of training, the three returned to Istanbul.
Death tolls
At the time of writing, 41 people have been killed, and 239 others were wounded as a result of the attack. Of these deaths, at least 13 were foreign nationals, including from Ukraine, Iran, Saudi Arabia, Iraq, Tunisia, Uzbekistan, China, and Jordan.
Security operations
Reports indicate that during the overnight hours of June 29-30, Turkish security forces arrested 13 people during counter-militancy operations in Istanbul, include three foreign nationals of unspecified nationality.
Airports update
While airport operations, including all arriving and departing flights, were suspended following the attack, the airport was reportedly reopened for limited traffic at 02:20. Initial flights began arriving and departing at 05:00. Multiple flights had also been redirected to Istanbul’s Sabiha Gokcen International Airport and Izmir’s Adnan Menderes Airport at the time of the incident.
While at this time, Istanbul’s Ataturk International Airport is open to regular air traffic, various delays were reported throughout June 29 due to intensified security measures in and around the airport. This includes additional security force deployments to the airport.
Assessments
Sophistication of multi-pronged attack indicates Islamic State (IS) responsibility
The attack comes amidst an escalated threat of militancy throughout Turkey, with multiple large-scale acts of militancy recorded in central locales since the beginning of the year. Most recently, this includes a suicide car bomb explosion at Istanbul’s Beyazit Square on June 7. That said, the multi-faceted attack at Istanbul’s Ataturk International Airport remains highly notable, given its status as the third largest international airport in Europe, with nearly 42 million people traveling through the airport in 2015, as well as the large number of foreign nationals traveling through this locale. With this in mind, the attack was likely intended to target tourist interests in order to gain more publicity and severely damage Turkey’s economy, which largely thrives on tourism.
While no group has claimed responsibility for the attack as of yet, we assess that it was likely carried out by militants belonging to the Islamic State (IS). In this context, IS, dependent on its image for support and recruitment, likely seeks to conduct spectacular attacks globally at this time due to the setbacks the group is facing in Iraq, Syria, and Libya. The threat of attacks is further elevated at this time due to Ramadan, which marks the anniversary of the founding of the caliphate.
IS’s responsibility for the attack is supported by the sophisticated modus operandi of the incident, namely a coordinated attack in three separate locations, including a diversion stage, as well as the target, which is an international hub for foreign nationals. The attack involved shooting followed by suicide bombings, a common tactic of the jihadist militant group. This assessment is bolstered by the IS attack plot foiled in Istanbul that we reported on June 18, when security forces seized suicide vests and assault rifles in the city’s Pendik and Basaksehir Districts, indicating plans for the use of an identical tactic. In addition, it is important to note the similarities between this attack, and the attack carried out by IS in Brussels on March 22, where three suicide bombers also attacked the city’s airport, as well as opened fire on civilians with assault rifles prior to detonating themselves. This overall strategy, as well as choice of weaponry, continues to highlight the jihadist group’s modus operandi when carrying out such large-scale attacks.
The attack was planned well in advance and followed a long period of intelligence-gathering to include on-ground reconnaissance at the airport. The event further displayed a high level of coordination and sophistication, as militants detonated themselves at three different points at the airport, two inside the terminal and one outside. This was likely an attempt to split security forces’ response and increase the potential that at least one attacker would successfully breach the airport’s security measures. This is further underscored by reports that the attacker in the parking lot detonated first, drawing security forces to the area, as well as creating a bottleneck of people near the entrance to the terminal.
Moreover, after thorough review of video footage and images of the attack, we conclude that the assailants demonstrated a high level of proficiency in use of their assault rifles and were well-trained. This is further exemplified by their reported training in Syria. Also, as seen with the jihadist group’s previously claimed large-scale attacks, namely Brussels and the Paris attacks on November 13, 2015, the assailants’ tactics demonstrate that they were attempting to inflict mass casualties. With this in mind, the incident at the airport demonstrates a repeating modus operandi of high-volume attacks at the entrance halls of airport terminals, which are accessible relative to the heavily guarded sterile areas of airports, additionally highlighting the vulnerability of the long lines caused by security measures to these areas.
The attack comes one week after the arrest of the June 18 IS cell in Istanbul, which included two individuals of Russian descent. This further indicates the existence of a well-established IS infrastructure in the vicinity of the city, well-connected to IS’s central leadership and recruitment network. In this context, the fact that the attackers were from Uzbekistan, Kyrgyzstan, and Russia’s Dagestan area suggests that the individuals were directed by the central organization to establish a cell in Turkey. This further indicates the potentially growing radicalization of Muslim individuals in these countries, particularly in Russia’s predominantly-Muslim populated regions in the Caucasus, which experiences Islamist militant activity.
While suspected IS-linked attacks have been conducted in Istanbul before, including a suicide bombing along Istiklal Caddesi on March 19, and another at Sultanahmet Square on January 12, none of them have been officially claimed by the jihadist group. This was likely in order to avoid a general large-scale conflict with Turkey, and to prevent alienating potential IS sympathizers within the Turkish populace. However, the sophistication of the attack and notability of the target suggests that the jihadist group may claim responsibility for the incident in the near future. Furthermore, the worldwide attention granted to this attack, as well as its spectacular method is likely to serve as an inspiration and role model for additional militant groups in Turkey and worldwide.
Successful attack underscores challenges for Turkish security apparatus; heightened security measures likely to be implemented
The incident underscores difficulties faced by Turkish security forces in mitigating all threats presented by the multitude of militant groups operating within the country, even at locales deemed heavily secured. Security forces face challenges in profiling suspected IS members due to the diverse nationalities comprising the group’s affiliates. It is noteworthy that militants were likely attempting to cross through the first security checkpoint to stage attacks deeper within the airport’s terminal but were prevented by the security forces, preventing a much larger-scale attack from materializing. That said, it is notable that the security personnel were distracted and concentrated their efforts to one area, namely the parking area where the first attacker detonated, more easily allowing the other two attackers to enter the airport. It is further notable that as demonstrated by the attack footage, after one attacker was shot and wounded by a police officer inside the terminal, falling to the ground and dropping his rifle, several seconds passed until he detonated his explosive belt, time during which the officer could have neutralized him.
Following this incident, Turkey’s security apparatus will likely adopt a series of heightened protocols in order to mitigate further threats. This includes intensified security measures in and around Istanbul’s Ataturk International Airport, including checkpoints entering and exiting the airport’s grounds, as well as additional security checks within the facility itself. These security protocols will also likely be extended to other major airports and transportation hubs throughout the country. Finally, security forces will likely enhance security measures in Istanbul and in other centralized locales throughout the country, including Ankara and Izmir. This is likely to include further arrest raids of suspected militant hideouts, and checkpoints to and from these major cities.
With this in mind, Turkish security forces will likely consider more forceful measures in retaliating to the attack and responding to the threat presented by the militant group in general. This will likely include an increase in airstrikes against IS’s positions in northern Syria. Additionally, Turkish authorities may consider conducting cross-border operations between Turkey and Syria to better secure the porous border and prevent IS militants from entering the country. Last, Turkish authorities may reconsider a proposed “safe zone” in northern Syria to further damage IS capabilities in Syria.
Recommendations
- Those operating or residing in Turkey are advised to contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support options.
- Those planning to travel through Turkey’s airports, specifically Ataturk International Airport, should allot for heightened security measures and long lines, extending the time needed for pre-departure.
- Travelers on connecting flights are advised to avoid unnecessary travel outside the secured zones of the airport.
- Avoid unnecessary confrontations with security forces, due to their heightened tensions and alertness across Turkey.
- Allot for checkpoints and heightened security measures nationwide.
Read more posts like this in Max Security Blog
