Barcelona stabbing, one year after La Rambla attack, underscores continuing link between psychological instability and militant style attacks – Spain Analysis
Current Situation
On August 20, around 05:00 (local time), an individual armed with a knife reportedly attempted to enter a police station in Cornella de Llobregat, Barcelona and attack personnel, while shouting “Allahu Akbar”, before being shot dead. Reports indicate that the attacker was of Algerian origin and had lived in the area for several years.
The incident is reportedly being treated as a militant attack by authorities. However, police have claimed that they have no reason to believe that there are any direct links to major militant networks or that the assailant was connected to the cell that carried out the Barcelona attacks one year earlier. In addition, the testimony of his ex-wife indicated that the attacker had recently come out as homosexual, and was reportedly experiencing serious psychological instability and was suicidal due to confusion over how this could fit in with his Muslim faith. Some sources within the investigation have claimed that they do not believe the attack to be linked to jihad.
On August 16, a pro-Islamic State (IS) group published a poster on social media calling for attacks targeting police in Spain in both English and Spanish.
The August 20 attack is the latest in a series of violent or militant-related incidents involving North Africans or individuals of North African origins in south and south-west Europe over the past year.
In addition, on July 22, a 29-year old Canadian national of Pakistani origin, Faisal Hussain, killed two and injured three in a shooting in Greektown, Toronto. Hussain was allegedly also known to have had a history of psychological instability and had reportedly expressed concerns about his employment and financial situation to a friend prior to the incident. On July 25, the Islamic State (IS)-linked media outlet, al Amaq, reported that the attack was carried out by a soldier of the Caliphate in response to their call to target citizens of coalition nations.
Assessments
Attack on police station underscores growing trend of violence copying Islamic State methods among psychologically unstable Muslim males
Despite claims that the attacker had a number of problems in his personal life, the possibility of links to wider militant trends cannot be ruled out. On the contrary, the fact that the attacker shouted “Allahu Akbar” and carried out the attack on the specific target that pro-IS groups had called for four days prior indicates that, even though he was likely not linked to any established militant cell, broader ideas of jihad informed part of his motivation. That is to say, while he may not have been looking to aid the goals of the Islamic State or avenge the deaths of Muslims, it is likely that, within his psychological instability, when thoughts of suicide arose, the concept of carrying out a jihadist attack was seen as a viable method. Possibly copying previous ‘suicide by cop’ attacks, in which the perpetrator intends to be killed by security forces. This assessment is further bolstered by the reports that his confusion over homosexuality was, in part, caused by an uncertainty about how it fit in with Islam.
With this in mind, the incident comes amid a continuing trend of psychologically unstable individuals, most of whom are migrants who adhere to the Muslim faith, carrying out attacks that mimic IS-inspired lone wolf incidents. Such attacks tend to be conducted by young males with mental health issues, who are, in part, influenced by the concept of jihadist militancy as a form of anti-establishment violence that has entered the West’s collective consciousness. Psychologically unstable individuals, and immigrants who perceive themselves to be disenfranchised and socially isolated from their community, whether it’s the Muslim or wider community, are copying IS-methods of attacks. In this sense, the media coverage of the various IS shootings and the general global trend of young men using mass violence as an outlet for frustration and disenfranchisement have merged.
Regardless of the psychological issues of the attacker, the fact that the incident came following the call from pro-IS groups means that online jihadist communities, and even Islamic State-linked media organizations, are likely to attribute the event to part of their ideology and larger plan. This is especially the case given the timing of the incident around the anniversary of the August 2017 attacks in Barcelona and Cambrils. In turn, this will perpetuate the aforementioned trend merging psychological instability and attacks that appear to be militant in nature.
Finally, the August 20 attack in Barcelona constitutes the latest in an ongoing trend of incidents related to violent attacks linked to Islamism from within the local North African community in north-eastern Spain and southern France. IS and IS-linked operatives have put a particular emphasis on recruiting in the region, due to the fertile ground for radicalization born from the feelings of disenfranchisement in both the established North African community and among North African migrants. These sentiments, which come partly due to perceptions of otherness within Spanish society and partly due to pressures put on from the local community, have the potential to lead young men towards violence, sometimes personally and sometimes linked to a militant organization.
Recommendations
Travel to Spain can continue while maintaining vigilance, due to the elevated threat of militancy.
What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security – Spain Analysis
Situation
During the afternoon hours of August 17, Spain experienced its first Islamic State claimed attack as a van plowed 500 meters into a crowd of people on the busy La Rambla street in central Barcelona, leaving 13 people killed and over 100 injured. The incident was subsequently claimed by the Islamic State who wrote that it was carried out by “soldiers of the Caliphate in Spain” and was intended to kill “Crusaders and Jews”.
Afterwards, during the evening hours of August 17, police located a second van in the town of Vic (80 km from Barcelona), which was hired at the same time as the van used in the initial attack, and was suspected to be a getaway vehicle.
At around 01:00 (local time) on August 18, a second car ramming incident took place in the city of Cambrils, around 100km southwest of Barcelona, in which one person was killed and six others injured. The attackers attempted to flee the vehicle on foot, allegedly wearing fake suicide belts before all five were killed by police.
More importantly, however, were the events that took place during the evening hours of August 16, less than 24 hours before the first car ramming incident. At this time, a large explosion was recorded in a small house in Alcanar, 160 km southwest of Barcelona and approximately 300 km from Ripoll. A police report, which was later released indicated that the occupants had been preparing a TATP-based explosive device, despite the blast initially being dismissed as a gas leak. The house was reportedly filled with over 100 canisters of propane and butane. Furthermore, sources indicate that the device being prepared in the house may have been intended to target Barcelona’s famous Sagrada Familia church.
Current reports suggest that the individuals involved in the attack all came from the area around the town of Ripoll, around 90 km north of Barcelona. Particularly, it appears that Abdelbaki Es Satty was the imam in Ripoll and is believed to have been instrumental in the radicalization and encouragement of the other seven younger individuals in carrying out the attack. Es Satty had been the imam since 2015 in Ripoll; however, he allegedly left “abruptly” in June 2017, and is suspected of using the time to start planning a militant attack.
From 2010-2014 Es Satty served a four-year prison sentence in El Castellon, for a series of drug trafficking charges. It was during this time that he met and became friends with Rachid Aglif, who is serving an 18-year sentence for his role in the 2004 Madrid Train Bombings. Es Satty was also implicated in an operation in which he was involved in recruiting five individuals attempting to travel to fight in Iraq in 2006.
Other than Es Satty, the cell itself was built of young men of Moroccan heritage between the ages of 17 and 24-years-old. Reports indicate that all of them were born in Morocco and came to Spain at various times, all spending time or living in the town of Ripoll, where the cell appears to have been formed. Apart from Es Satty, there is no evidence to suggest that the other cell members had criminal records and no reported relations to other known radicals or militant networks. That said, a number of the members were reported posting increasing material on social media which pertained to topics typically associated with Islamism, including posts which spoke about the death of “infidels”, and contained excerpts of anti-Semitism common among radical Muslims.
Assessments & Forecast
Attack underscores emerging threat of homegrown cells in Europe
This attack is notable for numerous reasons, as despite the eventual act seeming to fit within the general pattern of attacks types (i.e. vehicular ramming) witnessed in Europe over the past year, it had the potential to be one of, if not the, deadliest, most damaging, and symbolic militant attacks by any group in Europe in years.
In this context, the incident on La Rambla on August 17 was clearly not the initial plan of attack. The connection between the attackers and Imam Es Satty, who was killed in the Alcanar explosion, as well as the almost immediate action following the explosion paints a clear picture that the explosives in Alcanar were meant to be used by the cell in a spectacular attack, and that the two eventual incidents were taken as a “plan b” method. Indeed, the use of fake explosive belts are indicative of a degree of organizing such a “plan b” approach. Furthermore, it is likely, given the speed with which they were carried out following the explosion on August 16, that the car ramming attacks were expedited in an attempt by the cell to carry out an attack before police investigations into the explosion foiled their plans and led to their arrests.
More telling, however, is the nature of the cell involved and what it says about the evolution and variety of threats from such militants in Europe. Indeed, we have seen that attacks range from Islamic State and copycat-inspired “lone wolf” attacks to much more organized and planned attacks, at times involving instructions from a central organization, such as the case in the Bataclan attack in Paris and the Brussels Airport attack. It is also important to note, that the lone-wolf attacks in and of themselves can range in death toll from one or a few dead from a stabbing, to scores killed in the Orlando night club shooting or Nice vehicular attack, two of the deadliest, yet simpler attacks by IS supporters.
The recent London Bridge and Boroughs Market attack was a new evolution along the range of lone-wolf Jihadist spectrum, as it involved a group of lone wolves cooperating with one another to form a cell. While the structure and formation of the London attack is not entirely clear, it appears that those involved were self-radicalized but connected to one another either by their own volition, namely via Jihadist messaging channels or were introduced to one another through such a channel or otherwise. That said, these individuals do not appear to have been organized by a central body or particularly experienced individual.
The attack in Barcelona, for its part, appears to fall into the category of a “Homegrown Cell”, which has been rare in recent years. The origin of a homegrown cell can vary significantly and can be constructed by one radical and charismatic figure acting alone, such an individual working on behalf of a known group, or by a radical Islamist who has a connection to a known group to one degree or another but was not instructed by them.
In the case of the Barcelona cell, Abdelbaki Es Satty was the likely facilitator and builder of the cell. His recruiting background portrays him as someone with an understanding of the process of identifying targets for potential recruitment and likely having the personality to influence others in such a way. Additionally, he likely developed a greater familiarity with various terrorist techniques and principles during through this relationship with Rachid Aglif. We assess that Aglif and the attack he was involved in, in which 192 people were killed, served as an inspiration for Satty.
Beyond that, it is unclear if he did have guidance or instructions from Islamic State although the speed by which Islamic State released the official claim of the attack, may indicate their prior knowledge of his plans.
Homegrown cells allow for greater reach, more sophisticated, destructive attacks
While the individual “lone wolf” attack has the benefit of being much more challenging to predict and thwart, given that it involves only one individual and minimal planning, they are less likely to have as high of an impact as more organized attacks. Other than rare cases, such as Nice and Orlando, the majority of “lone wolf” attacks only involve a small number of casualties before the attacker is neutralized, even in the case of more advanced lone-wolf attacks, such as in London. On the other hand, while a cell composed of more trained and experienced Jihadists is able to carry out highly effective and destructive attacks, due to their expertise and manpower, the accumulation of many affiliated militants, in one area, alongside their communications and activities, is far more likely to arouse the suspicion of security forces and risk being thwarted.
In that regard, the Ripoll cell is an interesting balance in that it can balance the low-key nature of a lone wolf group with the greater planning and organization of a more advanced Jihadist cell. Islamic State can select known and trusted individuals online, or returning foreign fighters, and instruct them on the formation of a homegrown cell, and in some cases lend them material support or connect them with other experienced or useful individuals.
The Spanish cell was able to plan and almost execute what could have been one of the most significant European attacks, without being thwarted by security, because although they were many in number, their relationships seemed organic enough not to arouse suspicion and the fact that the more suspicious activity they did was conducted in a remote location and not in their home environment. This allowed them to prepare a highly sophisticated attack plan, with multiple layers and back-ups, without outwardly appearing to be a militant cell.
Further attacks from similar cells should be expected across Europe
While the possibility of typical “lone wolf” attacks remains throughout the world, particularly in Europe and the West, the homegrown cell phenomenon is likely to become more common than previously witnessed. Given that IS have penetrated almost every country in Europe and have propaganda and media communications in most major languages it is likely that there are already similarly structured cells across the continent, built of local radicals bound together by online facilitators or one local IS-affiliate or even one individual who has a greater degree of exposure to Islamist methodologies. Additionally, as seen in the past, the “copycat effect” is likely to take hold, with similar cells conducting attacks in the coming months.
Furthermore, IS regularly encourages attacks throughout the continent and adjusts their instructions to the successes of previous attacks. In this context, it is highly likely that Islamic State, whether involved in the Barcelona attack or not, will learn from its successes and failures.
Thus, and as IS continues to lose territory in the Middle East, and tends to want to balance these losses with an appearance of being a global phenomenon, we assess that Islamic State may actively seek to ‘activate’ such cells in Europe. In this way, the organization will likely want to have more control over how, when, and where an attack will take place, and may currently be reaching out to foreign fighters who returned to Europe, or other connections they may have, in order to encourage them to build their own homegrown cells.
Furthermore, Islamic State will likely learn from the failure of being over ambitious. Es Satty likely looked up to Rachid Aglif and his involvement in the deadly Madrid attacks from 2004, and in seeking to match its casualty level, chose to develop an extremely large explosive device by a large number of terrorists rather than launching an attack earlier and at a lower capacity. With this, we expect that IS will encourage smaller attacks by smaller homegrown cells, but ones that have a far greater potential for success.
Recommendations
On the corporate level
We advise raising the awareness of employees and security personnel to unusual activity and behavior of fellow employees. Encourage your employees to report such observations whether at work or in their personal surroundings. Monitor local unusual developments in order to predict emerging threats in the vicinity of your interests, and follow the global terror trends and modi operandi, in order to adapt your security measures and preparations. Conduct surveys to check and evaluate the relevancy of your current security protocols.
On the institutional level
Additionally, identify the social groups and communities in your area that are more susceptible to radicalization, identify the leading individuals, and monitor their activities. Raise the public’s awareness regarding key indicators of unusual activity.
For more information about the terror threat in Europe and what you can do to be prepared, check out our white paper here.
