Tag Archives: Islamic State (IS)

Prospects for Stability & Development in Libya – Libya Special Intelligence Report

This report was written by: Akshita Aggarwal – MAX Security’s Associate Director of Intelligence, Middle East & North Africa

And reviewed by: Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from the Israeli intelligence community

Oded Berkowitz – MAX Security’s Deputy Chief Intelligence Officer

Executive Summary

Control over territory in Libya remains contested between the House of Representatives (HoR), the Government of National Accord (GNA), and tribal militias. As neither of these entities are willing to compromise upon their interests, the current political landscape in Libya will remain unstable.

Multiple militias with rival territorial, economic, political, and ideological interests operate in the country. As there is often no clear demarcation between their respective areas of influence, sporadic armed clashes between these groups will continue over the coming months.

Militant groups continue to take advantage of the lack of a unified security apparatus to operate across Libya. Although these groups currently do not have the ability to regain territorial control in the country, the sophistication and scale of their attacks will increase over the coming months.

The Libyan economy is largely dependent upon the oil industry. The ongoing political and security instability will continue to deprive the government of the ability to invest in development and infrastructure, as well as protect oil facilities from potential militant attacks.

Overall, the security environment in Libya remains extremely volatile and is set to further deteriorate in the foreseeable future.

Download the 2019 Global Travel Risk Map now.


Multiple political and armed actors are currently operating across Libya. In many cases, there is no clear territorial demarcation between their respective spheres of influence, and therefore, at times these tend to overlap. The fringes of these territories also provide a conducive environment for the proliferation of militant groups, such as the Islamic State (IS), as well as local and foreign criminal militias. Moreover, internal divisions exist even within seemingly cohesive political factions and armed units, due to differing interests and ideologies, which contribute to the already volatile security environment in the country.

The overarching geographical areas of control are as follows:

Western Libya: Largely under the control of militias aligned with the UN-backed Government of National Accord (GNA). However, the majority of these militias have rival economic and territorial interests, which often lead to hostilities between them.

Eastern Libya: Largely controlled by the House of Representatives (HoR) and its allied Libyan National Army (LNA).

Southern Libya: Largely ungoverned territory, with rival tribal militias in control of isolated towns and production facilities. Although the LNA managed to recently extend its influence over parts of southern Libya, tribal militias in control of the town hold shifting allegiances.

Main Actors & Interests

The Government of National Accord (GNA): The GNA is based out of the Tripoli Naval Base and is a product of the Libyan Political Agreement (LPA), signed in Skhirat, Morocco in December 2015. The LPA allows for the transition of the House of Representatives (HoR) and the General National Congress (GNC) into the GNA’s legislative body and advisory State Council, respectively. However, this transition was to be ratified by a special majority vote of the HoR within a period of one year, which was renewable only once. The HoR is yet to convene the needed quorum for this vote. On December 17, 2017, the Libyan National Army (LNA) Field Marshal Khalifa Haftar declared that “All bodies resulting from this agreement [LPA] automatically lose their legitimacy, which has been contested from the first day they took office.” Regardless, the GNA continues to be considered the “internationally recognized” government and enjoys the support of the UN. Its sphere of influence extends through western Libya, particularly in greater Tripoli and Misrata.

House of Representatives (HoR): The previously “internationally recognized” government, the HoR’s parliament is based in Tobruk and the executive branch in al-Bayda. Its sphere of influence is generally in eastern Libya, with some pockets of support in the west, particularly southwest of Tripoli. The HoR is currently supported politically, militarily, and economically by several countries, most prominent of whom are France, the United Arab Emirates (UAE), and Egypt. While these countries generally recognize and support the LPA, they capitalize on the fact that the HoR has not ratified the agreement as a pretext to consider it as non-valid at this time, in order to continue supporting the HoR and not the GNA.

Other groups: Both the ungoverned and the governed areas of Libya are dominated by politics based on tribal, clan, and ethnic backgrounds, as well as place of residence and origin. It is not uncommon for cities that both support the same political body to be at odds due to historical or other rivalries among their residents. Similarly, militias from the same city who support the same political organ may have a strife over tribal or other rivalries.

Armed Groups

The GNA is currently almost completely reliant on local armed militias to exert influence over its territories. The most prominent GNA-linked militia are the Misrata forces, based out of the northwestern town of Misrata. Misrata forces also maintain their own air force, which was initially formed in 2015 as the Libya Dawn Air Force (LDAF), and later in 2016, aligned itself with the GNA. Misrata has very few operational pilots and aircraft, which were most recently operationally used in 2016 in hostilities against the LNA and the Islamic State (IS). Several other militias, like the al-Radaa Special Deterrence Forces, the Abu Salim Battalion, and the Tripoli Revolutionaries’ Brigade, are formally under the command of the GNA’s Ministry of Defense (MoD), and hold territorial control over different parts of Tripoli.

The Libyan National Army (LNA) and its allied militias are led by Supreme Commander Field Marshal Khalifa Haftar. The LNA is allied with the HoR, based out of Tobruk. It has a clearer command and control structure, with several commanders in charge of different battalions and areas of LNA-controlled territories. Although the majority of LNA forces are anti-Islamist, certain factions within the forces hold a Salafist ideology. Presently, the LNA’s main area of operations is in and around the Oil Crescent, Jufra District, Fezzan Region, Kufra District, Benghazi, Derna, and Tobruk. It also has some influence in areas southwest of Tripoli through their association with Zintan-based militias. The LNA also maintains an air force, the Libyan Air Force (LAF). LAF aircraft are used primarily to conduct aerial reconnaissance and airstrikes against militant and militia convoys in the Sirte Basin and Fezzan Region.

Tribal militias, mostly consisting of either Tebu or Tuareg ethnic tribes, control most of southern Libya, including Sebha. These tribes are at times supported by fellow tribesman from neighboring countries, such as Chad and Sudan. They hold shifting allegiances towards the various players in the country.

Islamist militant groups, such as the Islamic State (IS) as well as the al-Qaeda-linked Revolutionary Shura Council of Benghazi (RSCB), Derna Protection of Force (DPF), and Saraya Defend Benghazi (SDB), continue to operate across Libya. The IS and the SDB are currently the most prominent of these groups.

Political Stability

The efforts of the Head of the UN Special Mission to Libya (UNSMIL), Ghassan Salame, over the past year have at least partly prompted the HoR and the GNA to work towards unification of all institutions in the country and end the ongoing political stalemate. The HoR approved the referendum law on September 14, which allows for a referendum on Libya’s draft constitution. Subsequently, in November, the HoR successfully voted on a constitutional amendment, which legally validates the referendum law. It also divides the country into three constituencies – Tripolitania, Cyrenaica, and Fezzan. According to the amendment, the approval of the draft constitution would require an absolute majority vote in each region as well as a two-thirds majority vote nationwide. At the same time, the HoR approved the restructuring of the Presidential Council (PC), whose membership will now reduce from nine to three. It will now be consist of a President and two deputies, and a separate Prime Minister as the Head of the government.

Assessments & Forecast: Recent measures aimed at unifying political institutions unlikely to lead to nationwide elections

While on paper, the aforementioned developments portray that the GNA and the HoR have made substantial progress towards a nationwide election process and the unification of political institutions in the country, these measures have substantially tilted the scales in favor of the latter. Members of the GNA had previously opposed the amendment of Article 6 of the LPA, which divides Libya into three distinct constituencies as well as the restructuring of the PC. If the constitutional referendum does not pass, the current law assigns Cyrenaica with a veto power, which would essentially allow the HoR to activate an article of the referendum law that would pass on the responsibility of drafting the new constitution to the HoR, thus allowing the eastern-based government to alter Article 8 of the LPA.

Article 8 of the LPA has been a highly controversial point between the GNA and the HoR. This article excludes anyone with dual citizenship from holding either a political or military post in the country. LNA Field Marshal Khalifa Haftar holds both US and Libyan citizenship, and therefore, this will exclude him from Libya’s future political landscape. The HoR’s insistence on amending this article stems from the fact that it currently extends territorial influence over eastern Libya due to its alliance with the LNA. Moreover, the LNA is in control of much of Libya’s oil infrastructure, which has gained Haftar increasingly international legitimacy over the past year, as underlined by his inclusion in both the Paris Conference in May and the Palermo Conference in November.
FORECAST: These conditions provide the HoR with an upper hand in negotiations, and therefore, it is unlikely to concede to the GNA on any key issues pertaining to the country’s future. Such a scenario will provide France with significant influence over Libyan politics vis-a-vis its regional rival, Italy. Therefore, both countries will attempt to intervene in Libya in order to ensure a more favorable outcome for themselves. This, in conjunction with the lack of electoral infrastructure, will further delay the slated March 2019 nationwide election process. If and when elections do take place, the turnouts will be very low due to the inability of either the GNA or the HoR to provide the required security to secure electoral booths from the threat of militancy. Moreover, as Libya is based on tribal culture, with a council of elders responsible for governing each town, any federally constituted government will face resistance on the local level.

Threat of Militancy

Islamic State (IS): Although IS does not control any territory in Libya as of December 2016, it has managed to rebuild some of its capabilities in the country over the past year. Initially, the majority of IS attacks were directed against LNA checkpoints in the Sirte Basin and Jufra District, which mainly utilized vehicle-borne IEDs (VBIEDs). Gradually, IS shifted towards conducting more sophisticated multi-pronged attacks against government infrastructure in western Libya. For example, IS claimed multi-pronged attacks against the Misrata Courts Complex on October 4, 2017, against the Tripoli Electoral Commission on May 2, 2018, and the National Oil Corporation (NOC) Headquarters in Tripoli on September 10, 2018. And finally, IS militants launched two large-scale attacks against the towns of al-Fuqaha, Jufra District, and Tazirbu, Kufra District, on October 28 and November 23, respectively.

Saraya Defend Benghazi (SDB): In June 2017, the SDB indicated its willingness to disband after Misrata forces refused to provide them refuge in the city of Misrata, following the former’s loss all its territories in the Jufra District to the LNA. While reports did indicate that SDB fighters were still operating in parts of western and southern Libya, the group remained dormant for approximately a year. However, in June 2018, SDB fighters, led by the former Petroleum Facilities’ Guard (PFG) commander Ibrahim al-Jathran, launched a large-scale attack against the Ras Lanuf and Sidra oil terminals, located in the Oil Crescent. However, following the LNA’s recapturing of the Oil Crescent, the group has again gone dormant and not launched any significant attacks in Libya.

Assessments & Forecast: Although militant groups unlikely to regain territorial control in Libya, the sophistication of their attacks is likely to increase

Several factors have allowed militant groups to regain part of their ranks and capabilities in Libya over the past year. First, militants either planning to go fight for IS in Syria or Iraq, or fleeing the group’s territorial losses in these countries, view Libya as an alternative arena for their activity, and therefore have bolstered the ranks of the Sunni jihadist militant group in the country. Second, the LNA’s preoccupation in hostilities in other parts of the country, such as in Benghazi, Sebha, Derna, and the Sirte Basin, over the past year likely allowed militants to regroup in southern Libya, which remains largely controlled by tribal militias, without being detected by security forces. Third, widespread cross-border smuggling of weapons and fighters across Libya’s southern borders with Sudan and Chad, likely allowed both IS and the SDB to reinforce their offensive capabilities.

While both groups continue to remain interested in destabilizing the security environment in the country, neither of the groups currently maintain the ability to regain a territorial foothold in Libya. However, they do have the capability to launch attacks against more high-value targets, such as government offices, oil, and other infrastructure, in Libya. The lack of sufficient security protocols around these facilities allows the groups’ fighters to circumvent existing measures to gain access to their interiors. Such attacks allow militant groups to not only project their heightened capabilities to attract support and recruits, but also deprive the authorities of the necessary revenues to invest in their counter-militancy campaign. Aside from this, IS’s particularly increased focus on attacking towns in southern Libya are part of an attempt by the group intimidate locals and gain ransom from kidnappings at the same time. Overall, all these efforts are directed towards further destabilizing the security environment in the country, with the ultimate aim of expanding influence and re-establishing a territorial foothold.
FORECAST: Despite efforts by both the LNA and GNA-linked militias to dislodge militancy from the country, both IS and the SDB will continue to utilize the vast desert terrain of southern Libya as well as the fringes between GNA and LNA-held territories to regroup and rebuild their capabilities. They will the use these bases as launchpads for further attacks against government and security installations. The sophistication of these attacks may gradually increase as the militant groups attempt to launch more symbolic operations. The lack of a unified security apparatus, combined with insufficient military equipment and training, will overstretch the LNA and local militias, which will continue to hinder their ability to effectively combat this threat of rising militancy in Libya.

Economic Stability

The Libyan economy is largely dependent upon the export of oil. Oil production facilities are operated by foreign companies, with permission from the National Oil Corporation (NOC), based in Tripoli. The oil revenues then accrue to the Central Bank of Libya (CBL), based in Tripoli, which then distributes the revenue to the GNA, the HoR, the LNA, and GNA-aligned militias.

Assessments & Forecast: Political divisions, security volatility, global oil prices unlikely to significantly increase government revenues

Tensions have persisted between the GNA and the HoR regarding control have over Libya’s monetary policy and revenues, which prompted both parties to form parallel central banks based in Tripoli and al-Bayda in 2014. After retaking control of the Ras Lanuf and Sidra oil terminals from the SDB in June 2018, Haftar decided to hand over control of revenue from these oil terminals to the eastern-based NOC. However, in 2017, when PFG commander Ibrahim al-Jadhran temporarily took control of the Oil Crescent and attempted to directly sell the oil from these facilities on the international market, European countries imposed an embargo on this oil. They further stated that only oil bought from the Tripoli-based NOC would be considered as legal. Therefore, Haftar’s decision was likely prompted by an attempt to not undermine the Tripoli-based NOC, whose head Mustafa Sanalla, is popular both among the GNA and the HoR, but rather to force the GNA to replace the CBL head, Sadiq al-Kabir, whom the LNA considers as corrupt and illegitimate. This is supported by the fact that Haftar eventually agreed to hand over control of revenue from the oil terminals back to the Tripoli-based NOC on July 10. The underlines the divisions instability arising from the bipolarity between the country’s economic institutions.The widespread threat of militancy, as well as militia activity, poses a further threat to oil infrastructure in the country. The majority of these facilities are secured by local militias who have their own interests in mind.

Therefore, they often utilize these facilities as bargaining chips in their negotiations with the GNA. For example, in recent weeks, a movement under the name “Anger of Fezzan” threatened the Sharara Oil Field if their demands for development in southern Libya were not met. Moreover, the militiamen who are in charge of securing oil fields are neither well-equipped nor well-trained, and therefore are usually incapable of protecting these facilities from a well-executed attack. Oil pipelines in the country tend to run across territories held by different militias with rival interests which pose a further threat to business continuity. This, combined with the instability of global oil prices, makes Libya’s economy highly unpredictable and unstable for the foreseeable future.
FORECAST: As the aforementioned political and security issues will persist for the foreseeable future, Libya’s economy is unlikely to witness any form of stability. This will adversely impact the GNA’s already declining popularity in the country. July witnessed widespread anti-GNA protests in Tripoli and its surroundings over the UN-backed government’s inability to provide locals with water and electricity. These eventually provided local militias with conditions conducive to launch an assault against each other in order to advance their personal territorial interests, thereby sparking large-scale inter-militia hostilities in the designated capital. Therefore, an unstable economy will lead to civil unrest in the future, which, in turn, will increase the threat posed by militant groups and armed militias.

Infrastructure & Development

Political, security, and economic stability have a direct impact on the prospects for infrastructure and development.

Assessments & Forecast: Economic, political, security instability to prevent the government from investing in development, infrastructure

The lack of sufficient revenue has denied the GNA and the LNA with the ability to invest in development and infrastructure. Airports in Libya are generally controlled by local militia groups, who are under-trained and under-equipped to employ proper security protocols for air travel. This includes the lack of a secure perimeter around airports, which allows militias and militant groups to use weapons of relatively lower sophistication to target these facilities. This is highlighted by the frequent mortar shelling of the Mitiga International Airport as a result of inter-militia hostilities in Tripoli. The GNA has also been unable to reopen the Tripoli International Airport as militias frequently attempt to take control of the facility from their rivals. Aside from attacks, service disruptions at airports remain frequent due to staff strikes, particularly over unpaid salaries. This is due to the lack of sufficient funds under the control of the GNA, as it depends largely on the country’s oil reserves.

Commercial ports are also susceptible to attacks, as underscored by the temporary shut down of the Tripoli Seaport on October 17, 2017, due to clashes between GNA-linked militias near the facility. The majority of the country’s seaports are located in northwestern Libya. The Libyan Coastguard has frequently intercepted foreign vessels off the coast of northwest Libya on suspicions of illegal smuggling activity, as local militias in the area have been known to disguise as GNA officials to sell oil and fund their operations. With regards to seaports in eastern Libya, the LNA has been unable to fully operationalize the Benghazi and Derna ports following their capture from militants in June 2017 and May 2018, respectively. Moreover, the LNA Navy has designated Libyan territorial waters off the coast of Benghazi as a “no-sail” zone (until al-Tamimi, 280 km east of Benghazi), and therefore entering it requires prior authorization. This is particularly important as vessels that do not obtain such authorization and escort from the LNA Navy are automatically suspected of carrying support for militants, and may be intercepted or even targeted by airstrikes.
FORECAST: The lack of revenues will prevent the GNA and the LNA from substantially raising security protocols at infrastructural facilities in Libya. This will make such facilities an easy target for attacks by militant groups as well as militias. Militias operating in Tripoli and its environs will continue to attempt to seize control of vital airports and seaports in order to increase their negotiating power vis-a-vis their rivals. This will have an adverse impact upon operations at these facilities, even when militias try not to directly target them.


It is advised to defer all travel to Tripoli and Benghazi at this time due to ongoing violence, threats against foreigners, and the risk of a broad deterioration of security conditions. We advise at this time that those remaining in Tripoli and Benghazi should initiate contingency and emergency evacuation plans due to deterioration in the security situation. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support plans.

For those remaining in Tripoli, we advise avoiding nonessential travel to the outskirts of the city, particularly the Janzour and Tajoura neighborhoods, as well as to the Mitiga and Tripoli International Airports, given that these are focal points of ground clashes in the city.

Avoid all nighttime travel, including to and from the airport, due to the elevated risk for militant attacks, clashes, and acts of unrest during this time.

Travel to Misrata and Tobruk should be for essential purposes only while adhering to all security precautions regarding civil unrest and militancy. We advise against all travel to outlying areas of the country, due to the threat of militancy, kidnapping, and general lawlessness in such areas.

Avoid entering Libyan territorial waters in the area between Benghazi and al-Tamimi without prior authorization, as a no-sail zone is currently in effect in this area and several naval vessels had been intercepted or attacked due to not following proper procedures.

Those planning to conduct air travel to, from and inside Libya should avoid entering the area between Marsa al-Brega, Sirte and Sebha, as it was declared a no-fly zone by the Libyan National Army (LNA).
We further advise against all travel to Libya’s border areas at this time due to persistent violence and lawlessness in these regions.

For those operating in or conducting business with oil facilities, it is advised to consult with us for itinerary-based travel recommendations and ground support options.

Avoid the immediate vicinity of government buildings, police stations, media outlet offices, and political party and militia headquarters, given that these locales have been targeted by militia groups in the past and recently by militants, and thus remain at increased risk for violence and unrest.

Westerners, particularly US citizens, operating in Libya are advised to maintain a low profile and exercise heightened vigilance in light of prevailing anti-Western sentiment and increasing attacks against foreigners.

Nationwide, take precautions to mitigate the risk of being targeted for kidnapping. Refrain from travelling in luxury vehicles and maintain a generally low profile. Routinely alter travel routes and refrain from divulging sensitive itinerary information to strangers.


Learn More About Our Intelligence Services

Special Report: The growing potential for militant chemical attacks, and how you can prepare

Executive Summary

In light of the recent events in Syria, where on April 4 the Assad regime is alleged to have used sarin gas to attack a rebel-controlled town in the Idlib Province, killing nearly 100 people and wounding hundreds more, it is necessary to review the possibility of chemical attacks by militant groups or individuals in non-conflict zones.
While being considered a “red line” in the past, use of chemical weapons in recent years did not result in significant ramifications, prompting more widespread use.
Growing media coverage amidst lack of response likely fueled this process, despite negative public opinion.
Militant groups likely to expand use of crude chemical weapons in near future, mostly for psychological effects, while attempting to deploy military grade weapons in non-conflict regions.
With this in mind, as a security manager, it is necessary to review protocols for dealing with such incidents to ensure that your offices and employees are as prepared as possible.

Historical Use and Normalization of Chemical Weapons

Following the conclusion of the World War II, the use of chemical warfare, along with biological warfare, was perceived as a “red line” by most of the countries worldwide, and second in severity only to the deployment of nuclear weapons. However, despite this perception, such weapons were at periods used without significant ramifications to the parties responsible, with the most notable example being the deployment of chemical weapons by the Iraqi government during the war with Iran, and most prominently the 1988 Halbaja attack, which reportedly saw the use of blister, nerve and possibly blood agents.
This fact led to a waning of the perception of possible consequences as a result of initiating a chemical attack, prompting various actors who maintained, or obtained large stockpiles of weapon-grade chemical weapons to being less constrained in their use. Furthermore, western militaries made legal use of chemical weapons in conventional warfare, mainly of white phosphorus to conceal movement, which at times nonetheless had lethal effects in the area of deployment.
As the media continually developed over time, these incidents received more coverage than in the past, however despite of the overall negative public attention such incidents typically did not result in significant negative implications. Instead, the increased media attention, along with general lack of accountability likely prompted a growing number of actors to employ chemical warfare due to the high lethality rates, cost effectiveness and psychological effects. These developments led to an almost normalization and acceptance of the use of such unconventional weapons, which is best exemplified by indications that the Islamic State (IS) conducted at least 52 different chemical attacks in Iraq and Syria, as per a report issued in late 2016. The Syrian government also has used chemical weapons on numerous occasions, most recently on April 4 in a rebel-controlled area of the Idlib Province, with nearly 100 people killed and 200 wounded.

Potential Applications by Militant Groups, Individuals

While thus far most of the applications of chemical warfare were in conflict areas, they are not strictly limited to there. There are precedents of militants attempting to or making successful use of chemical agents in attacks, mostly in an unsophisticated capacity, with the most prominent example being two successful attack in 1994-1995 in Japan using Sarin nerve agents. Furthermore, there were attempts to integrate chemical and biological agents into suicide bombings, mostly by Palestinian militants during the Second Intifada in 2000-2005.
As components needed to construct crude chemical weapons, mainly of the relatively less effective choking agents such as chlorine, can be extracted from everyday materials, it is likely that militants will continue pursuing implementing such elements in their attacks. As these are liable to be mostly crude, they will not necessarily cause attacks to be more lethal in their immediate effect. However militants will seek to capitalize on the psychological effects associated with the use of such weapons, especially as these are considered unconventional and attract significant more public attention given the perception of chemical weapons being more dangerous than conventional weapons.
Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security
Nonetheless, the growing battlefield application vis-a-vis instability of regimes that had chemical weapons stockpiles, particularly in the Middle East, increases the potential that militant groups will be able to deploy military grade weapons in an attack removed from current battlefields. If such an attack will materialize, its effects and lethality will be significantly larger than the crude devices mentioned before, however given the high profile and complexity of delivering and using a military grade weapon, such an attack remains at a lower likelihood.
Additionally, IS in particular is known to have capabilities for self-manufacturing of chemical weapons, leading to two additional threats. First, the possibility that rockets with chemical warheads will be fired at areas adjacent to IS-controlled territory in Iraq and Syria and other conflict zones, given proliferations of those means. Furthermore, and posing a higher risk, is the possibility that one of the experts employed in IS’s chemical warfare program will return to his home state, where he will implement his knowledge and expertise to conduct a domestic large scale chemical attack.
As the use of chemical warfare remains rare, all countries facing this risk are either under-skilled or not prepared at all in the prevention, mitigation and treatment. While given the increase in the threat of application of chemical weapons resources may be invested into improving capabilities, this process may be prolonged and not fully effective even when completed, thus contributing the larger potential effects.

Implications for Security Managers

Chemical attacks can bring about a large amount of casualties, although the chances and likelihood for an attack of such scale remain low. That being said, you still must be able to instruct your employees on the best ways to react in various scenarios. In this context, there are a number of measures that both individuals and firms can take to prepare for a possible chemical attack, and to equip employees with the best possible information and behavioral recommendations.

To best prepare your employees and office, it is advised to:

  1. Create a procedure and plan for employee behavior in case of a chemical attack, and instruct employees on such procedures.
  2. Mention the possibility of such a scenario during your periodic employees’ awareness training in order to mentally prepare them.
  3. Ensure supply of sufficient first aid tools in the office, including first aid kits with surgical masks and atropine syringes.

If a chemical attack takes place in your vicinity, it is recommended to do several things, and employees should be instructed in such protocol:

  1. Identify the location of the attack and remove yourself from that area as quickly as possible, avoiding the contaminated area if feasible and moving upwind of the site. If it is not possible to avoid the impacted area, shelter in place, moving to a higher floor.
  2. Cover your nose and mouth, using a surgical mask or handkerchief if a gas mask is not available. Additionally attempt to cover exposed skin on the arms and legs. If you do become exposed to an agent, once in a safe area, remove any impacted clothing and wash yourself thoroughly with soap.
  3. If you are outside, it is advised find clean air, either by removing yourself from the area or going inside a nearby building.
  4. If you are in a building in the vicinity of an attack, it is advised to close all windows and doors and shut all ventilation, including central heating or air conditioning systems, while seeking shelter in an internal room and sealing the room with plastic and duct tape.
  5. Remain cognizant of authorities’ warnings and instructions.

MAX Security provides awareness training and crisis contingency planning.

Notable Chemical Weapons Developments Worldwide

Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security

Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security

Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security

Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security

Special Report: The growing potential for militant chemical attacks, and how you can prepare | MAX Security

Why fresh wave of attacks is likely spurred by calls from Islamic State – Bangladesh Analysis

Current Situation: Bangladesh Islamist militants

The Islamic State (IS) affiliate al-Furat Media released a video on March 14 featuring a Bangladeshi man who identified himself with his Islamic name, Abu Maruam al-Bengali. In the video, al-Bengali calls upon his Muslim countrymen to carry out domestic lone-wolf attacks throughout the South Asian country. Meanwhile, there have been reported a series of attacks by Bangladesh Islamist militants linked to groups such as the Neo Jamaatul Mujahideen Bangladesh (Neo-JMB) in the month of March. Additionally, several encounters between security forces and members of these groups have been reported during nationwide operations to dismantle their cells, particularly in the peripheral border divisions of the country.


On July 1, there was a hostage crisis and multiple murders at the Holey Artisan Bakery in Gulshan, Dhaka. IS claimed this attack that left 22 civilians dead, many of whom were foreign workers in the country’s garment industry. Following the attack, Bangladeshi security forces began an increased concerted effort to combat militancy. The government continued to deny any direct IS presence in Bangladesh, instead blaming “homegrown outfits”,  and Jamaat-ul-Mujahideen (JMB) and the Neo-JMB, domestic militant groups. Such operations continued at a consistent pace, with March alone witnessing the arrest of at least 50 suspected militants

Why fresh wave of attacks is likely spurred by calls from Islamic State - Bangladesh Analysis | MAX Security

Assessments & Forecast

Direct IS operational presence continues to remain questionable but fresh wave of attacks indicates the group is capable of rallying domestic groups to carry out its strategic agendas

The raids on Islamist militant cells and training facilities in areas like Chittagong and Sylhet Divisions indicate that these groups appear to have been in the process of upgrading their operational capabilities in terms of explosives. This has been evident in the recoveries of explosives material such as hydrogen peroxide and acid, typically used to make the more volatile IEDs involving triacetone triperoxide (TATP). Additionally, the cells functioning as production units for these explosives appear to have developed covert distribution channels to funnel them to militants across their division as well as those in Dhaka Division.

In response to these attempts to upgrade operations and stage more attacks, IS is likely to increase its recognition of local cells’ efforts in the form of claims and the reporting of these incidents through their media, similar to what was witnessed in the aftermath of attacks in Dhaka on March 17 and 24, and Sylhet on March 25. Further, the release of the video, specifically calling for lone-wolf attacks, suggests that IS has not yet developed a consolidated, formal presence on the ground, as the need to call for such attacks suggests that they are unable to set up more elaborate networks. Therefore, while IS may not have an established a physical presence in Bangladesh, its high command appears closely aware of Islamist militant incidents in the country, as a part of its pivot to new territories outside the Middle East. Additionally, IS will likely continue to rally domestic militants to carry out its strategic agendas through the validation it provides in its media for these operatives’ local attacks.

Given the publicizing of the two most recent operations, overlapping in their occurrence, the frequency of counter-militancy raids is likely to visibly increase in the coming weeks, both to stymie the new wave of attacks and as a means to project a proactive, offensive posture. While such raids may take place in peripheral areas across the country, a number of areas are of particular concern. Northern, outlying regions of the country remain under elevated threat of attack and counter-militancy operations, given the presence of minority groups and a perceived high adherence to conservative Islam within local communities. The threat is especially pronounced in places of recent incidents like Sylhet, as well as areas where a number of attacks took place during previous waves of violence like Rajshahi, and Rangpur.

Further, in light of the hideouts in Chittagong, which were the most fortified and well-equipped dens uncovered in the recent past, it remains likely that JMB and other militant groups have developed a number of sophisticated hubs in the region, whose hilly geography would provide ample cover for planning activities. As such, additional operations in Chittagong are likely to take place in nearby areas where other similar groups may be planning activities, including Cox’s Bazar, Rangamati, Bandarban, and Khagrachhari.

Why fresh wave of attacks is likely spurred by calls from Islamic State - Bangladesh Analysis | MAX Security


Government’s continued denial of IS presence in Bangladesh likely an attempt to assure foreign investors, allow for broad crackdowns on domestic groups

Despite increasing evidence that IS maintains some degree of involvement in Bangladesh, the government is likely concerned that admitting it would have a negative impact on the country’s economy, especially on the garment industry, which accounts for a staggering 80 percent of total exports. These concerns were similar following the Gulshan attack when a number of multinational garment companies operating in Bangladesh voiced their concerns over the volatile security out of Bangladesh entirely. By posing the issue as a homegrown, domestic issue, it denotes a lower level threat compared to that of transnational militancy.

Additionally, the presence of Neo-JMB and even non-militant Islamist groups like Jamaat-e-Islami (JeI) serves as an adequate enough pretext to crackdown on any suspected Islamists, regardless of their actual affiliation. Security operations in March highlight this focus, with the majority of the militants, arrested reportedly members of Neo-JMB. This serves to the benefit of the current administration, as such groups are largely comprised of former opposition activists, vehemently against the Awami League-led government. While the labeling of such groups is relatively semantic, under the current narrative the government can place the blame squarely on domestic militant groups it often conflates with mainstream political organizations. While the majority were from JMB, at least 2,100 were reportedly leaders and activists from the Bangladesh Nationalist Party (BNP), the Awami League’s main political opposition.

While in the short-term playing down transnational militancy may serve to appease foreign investors and improve the political standing of the current administration, in the long-run, it may also have unintended consequences, particularly as the links between IS and domestic groups become increasingly more difficult to deny. Firstly, the denial may serve to corrode the government’s credibility in defining the current narrative. As international media outlets and independent analysis increasingly highlight alleged links between transnational groups and domestic Bangladeshi militants, even supporters of the Awami League may begin to doubt the plausibility of the government’s stance.

Further, Bangladeshi society has a multitude of Islamist camps, which maintain varying degrees of sympathy for the groups that are often targeted by the government during crackdowns. Perceptions of unmerited mass arrests against such organizations would likely serve to alienate conservative and even moderate Muslims that maintain pro-Islamist sentiments. Ultimately, this would serve to improve militant recruitment in the country and encourage additional lone-wolf style attacks, further actualizing the Islamic State’s original March 14 call.


Travel to Dhaka and Chittagong may continue at this time while adhering to stringent security protocols given the threat of militancy, crime, and reports of violence from political rivalries. Those operating or residing throughout northern and southern areas of Bangladesh are advised to maintain heightened vigilance, especially in the aforementioned areas of Chittagong, Rajshahi, Rangpur, Sylhet, and Chittagong , given the elevated threat of both sophisticated and unsophisticated attacks, as well as an uptick in counter-militancy raids, which often result in civilian casualties. Given the continued threat of militant attacks against foreign nationals and interests in Bangladesh, foreign nationals, and especially Westerns, are advised to maintain a low profile, avoid travel if possible at night, review security procedures, and maintain heightened vigilance throughout the country.


Read more reports in Max security blog

Analysis of February wave of militant attacks in Pakistan

Current Situation: Wave of militant attacks in February

On February 10, an offshoot of the Tehreek-e-Taliban Pakistan (TTP), Jamaat ul Ahrar (TTP-JA), announced by video the commencement of a new militant operation in the country titled “Operation Ghazi”. The TTP-JA defined the operation to be conducted largely against their traditional targets of government and security installations, as well as other symbols of the rule of law, including members of the judiciary.

In the weeks that followed, at least 140 people were killed in separate attacks across the country, claimed by a number of different groups. Some of the most high-profile attacks include a suicide bombing in Lahore on February 13, which was later claimed by the TTP-JA; a suicide bombing in Peshawar on February 15, which was claimed by the TTP; a suicide bombing against a Sufi shrine on February 16 that killed upwards of 90 and was claimed by the Islamic State (IS); and a combined suicide and shooting attack that killed seven civilians on February 23 outside of Peshawar, which was also claimed by the TTP-JA. The February 13 and 16 attacks involved individuals walking into crowded areas and detonating explosive vests, whereas the February 15 attacker most likely detonated explosives carried by his motorcycle. The February 23 attack also involved the individuals using gunfire in an attempt to enter a government building before detonating.

In response to the recent wave of attacks, the Pakistan Armed Forces announced the counter-militancy operation Radd-ul-Fassad (“Elimination of Discord”), on February 22. Under the new operation, military and paramilitary forces have authority to “indiscriminately” pursue militant suspects, continue augmenting or assuming functions of local law enforcement and intelligence operations, and expand into the Punjab province. The Pakistan Rangers, who had been conducting extensive operations in Sindh, extended into the Punjab on February 24, in a reversal of local government concerns over giving the military more influence in a ruling Pakistan Muslim League (Nawaz)(PML-N) party stronghold. Whereas the military were previously given limited operational authority in the province in 2016 despite government objections and lengthy negotiations, this new operation was approved relatively quickly by local authorities and grants the Rangers a much wider operational berth in terms of locale and targets. At least 100 suspected militants were reportedly killed by security forces in the first 24 hours of the operations, and hundreds more have been killed or captured to date.

The operation has also been under domestic scrutiny by civil society groups, with scattered reports from the ground indicating that political critics and opposition figures have also been arrested, in addition to protests being held by groups alleging mistreatment of ethnic Pashtuns in Punjab under the Radd-ul-Fasaad banner. Pakistan is home to the largest Pashtun community in the world, with an estimated population of 30 out of 200 million in Pakistan. Despite infrequent high-profile outliers, the Pakistani security apparatus views the peripheral Pashtun population with suspicion due to perceived ethnic ties to Afghanistan, a primary regional adversary and well-known militant incubator.

Analysis of February wave of militant attacks in Pakistan | MAX SecurityAssessments & Forecast

Claims and methods of attacks suggest nexus between membership of different militant groups in Pakistan, increased operational capacities.

Despite the fact that the abovementioned attacks were subsequently claimed by several groups, the modus operandi and precedence set by attacks before those in February suggest a level of coordination between groups. This is further bolstered by previous assessments of IS using proxies in Pakistan and their lack of a significant operational presence. For example, the February 16 suicide bombing that was claimed by IS was likely actually perpetrated by Lashkar-e-Jhangvi Al Alami (LeJ-A), which boasts an established history of similar attacks against religious minority gatherings and places of worship, as well as having previously coordinated with IS over the October 24, 2016, suicide attack on a Quetta police station. Additionally, the August 8, 2016, suicide bombing attack on a hospital in Quetta was eventually claimed by IS and the TTP-JA. High-profile attacks with multiple claims, or singular claims that referenced other groups, were a relatively common phenomenon throughout the second half of 2016.

This history of convergence highlights continued operational overlap between these groups in the context of the unusually high rate of use of suicide bombings in February, which require a relatively higher level of operational capacity. Whereas groups have usually relied on less sophisticated methods for attacks involving singular claims, the uptick in the use of suicide bombings across the board for attacks with singular claims suggests that inter-group overlap continues in Pakistan with the onset of Operation Ghazi.

FORECAST: Nevertheless, ongoing efforts against organized militant outfits will likely focus on limiting their capacity for such high-casualty attacks, at least in the near future. Consequently, groups such as the TTP are liable to augment current operations with lower intensity methodologies, including targeted sectarian killings in urban areas, or motorcycle-borne gunman ambushes and IED attacks against security forces in the periphery. Such waves of multiple high-casualty attacks, such as that witnessed in February, are normally interceded by relative lulls, which may be marked by more infrequent attacks taking on forms as described above. As previously mentioned, likely targets include police patrols, military checkpoints, protest rallies due to the high civilian presence, and minority institutions and events.

Operation Radd-ul-Fassad has expanded the influence of the military, although their efficacy is questionable.

While the focus of Radd-ul-Fassad is ostensibly in the tribal border areas where the militant density is thought to be highest, the military has also been able to increase its authority in areas such as Punjab, an area where it normally saw resistance from the PML-N. Furthermore, the military appears to be using Radd-ul-Fassad, at least in part, as a pretext for a crackdown on dissenters and the Pashtun minority, which relates more to longstanding positions held by the military that precede the operation.

FORECAST: Pushback against the perceived excesses of the operation are likely to result in fresh demonstrations from groups who see themselves as being marginalized, including political opposition groups and Pashtun organizations. Protests of this nature have already materialized in Karachi and can be further expected in tribal provinces with high Pashtun densities such as the Federally Administered Tribal Area (FATA), Khyber Pakhtunkhwa and northern Balochistan, as well as Sindh and Punjab. The high numbers of militant deaths and arrests may lead to a temporary lull in militant attacks and may be used by the military to justify their operations.

However, the military’s new nationwide operations are likely not to have a marked effect on long-term militant operations in the country, and may actually serve to exacerbate longstanding political and ethnic tensions, while increasing recruitment to these groups from Pashtun and the Islamist religious demographic.


We advise against all nonessential travel to Pakistan given the heightened threat of militant attacks, criminality, kidnappings and sectarian tensions throughout the country. As a general precaution, maintain heightened vigilance in the vicinity of security detachments, government buildings, public areas, diplomatic installations, news stations, military bases, restaurants, high-value soft targets like schools, shopping centers, and religious centers including mosques as they remain potential targets for militant attacks.

Finally, foreigners, particularly Westerners, conducting essential travel in Pakistan are additionally advised to maintain a low profile, exercise heightened vigilance, and avoid if possible locales frequented by foreign, particularly Western nationals. To mitigate the risk of attacks or abductions, ensure that places of stay are equipped with sufficient perimeter security details, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.

West Africa Analysis: Islamic State recognizes ISGS as West African affiliate following increased attacks in recent months, despite 17 month silence

Executive Summary:

  • The Islamic State-linked Amaq News Agency issued a statement on October 30, recognizing Islamic State in the Greater Sahara’s (ISGS) pledge of allegiance to Islamic State (IS) following 17 months of silence after the group’s initial pledge in May 2015. The initial silence, which is not characteristic of IS, appears to illustrate lack of coordination between ISGS leader, Abu Walid al-Sahraoui, and IS, as well as doubts in ISGS’s capabilities.
  • Islamic State’s decision to accept ISGS was likely influenced by recent spate of ISGS attacks in border area between Niger and Burkina Faso, through which the latter illustrated some level of capabilities, whereas this was previously in question. The acceptance of ISGS was also connected to Islamic State losses in other theaters, such as Libya, Iraq, and Syria, and the need for the organization to illustrate continued strength and expanding geographical scope.
  • IS’s recognition will likely bolster ISGS’s standing in region, likely enhancing recruitment capabilities. ISGS to carry out further attacks in coming months, in effort to build regional status, both along Burkina Faso-Niger-Mali border areas. Furthermore, while their capabilities remain to be seen, they may seek to carry out more high-profile attacks in West Africa for similar purposes. However, ISGS is not likely to emerge as considerable rival to al-Qaeda linked groups in the area due to latter’s entrenchment.
  • Those operating in or traveling to the West Africa region are advised to contact us for itinerary-based consultations and ground support options.
Islamic State acknowledgement of ISGS and accompanying video of al-Sahraoui pledging allegiance
Islamic State acknowledgement of ISGS and accompanying video of al-Sahraoui pledging allegiance

Current Situation:

  • Islamic State (IS)-linked Amaq News Agency released a statement on October 30, in which they acknowledge the pledge of allegiance from Adnan Abu Walid al-Sahraoui and his Islamic State in the Greater Sahara (ISGS) militant group. Amaq also published an accompanying video, dated to October 30, in which al-Sahraoui and his men  pledge their allegiance to IS and leader Abu Bakr al-Baghdadi. Al-Sahraoui previously pledged allegiance to IS in May 2015 on behalf of al-Mourabitoun, when he was the disputed leader of the group, which was a merger between Mokhtar Belmokhtar’s al-Mulathameen Brigade and Movement for Oneness [Tawhid] and Jihad in West Africa (MUJAO), where al-Sahraoui was previously a spokesperson.
  • The 2015 statement by al-Sahraoui was denied by Belmokhtar, who reaffirmed al-Mourabitoun’s allegiance to al-Qaeda and leader Ayman al-Zawahiri. Belmokhtar emphasized that al-Sahraoui was speaking on his own behalf. This led to infighting between supporters of the rival factions of al-Mourabitoun, during which al-Sahraoui and his supporters lost considerably, with reports that al-Sahraoui was severely wounded, and afterwards, the group was inactive.
  • While not being active following their May 2015 pledge, ISGS has claimed responsibility for a handful of attacks in Burkina Faso and Niger in recent months. ISGS first claimed responsibility for an attack on a border post in the Oudalan Province of Burkina Faso that killed two during the overnight hours of September 1-2. Later on, the group claimed responsibility for attacking a security outpost in the town of Intagom, Burkina Faso, 5 km from the Malian border on October 12, killing three policemen. Furthermore, on October 17, the group claimed responsibility for an attempted prison break attack on the Koutoukale Prison in Niger, located 50 km northwest of Niamey. The Koutoukale Prison is a high-security prison that holds many suspected Boko Haram members, as well as jihadist militants of other groups. Additionally, there have been numerous attacks that have went unclaimed in Burkina Faso and Niger, which may have been conducted by ISGS.

Attacks in Tri-Border Area


Click here to see map legend

Assessments & Forecast:

  1. The nature of Islamic State’s acknowledgement of ISGS is notable due to numerous factors. For one, the extended silence by IS is not characteristic of the group, which is often quick to acknowledge pledges of allegiance even from smaller groups, similar to ISGS, often devoting considerable coverage to such affiliations, such as the Skikda Brigade and Jund al-Khilafah in Algeria, and al-Mumin’s al-Shabaab breakaway in Somalia. It was also presented in a much vaguer and low profile manner when compared to other groups pledging allegiance to IS in the past. Previous claims are also often preceded by “teaser” publications stating that an important announcement is coming soon. We assess that the silence was indicative of a lack of communication between al-Sahraoui and official IS networks, whereas pledges were often made following a period of direct communication with IS leadership. Additionally, IS likely had doubts regarding the capabilities of al-Sahraoui and his faction, especially following the fighting with Belmokhtar’s men. Al-Sahraoui’s credibility may have also been a source of concern for IS in light of the fact that his pledge, made on behalf of al-Mourabitoun, was rejected soon after by Belmokhtar.
  2. In this context, recent months have seen several attacks claimed by al-Sahraoui via al-Akhbar, a Mauritanian news outlet, while other attacks suspected to have been carried out by ISGS have gone unclaimed. The timing of the spate of attacks ahead of the announcement leads us to assess that this was either done to prove to IS that ISGS is a capable group, or because IS demanded such actions ahead of the acceptance of the pledge as a means to draw greater attention to the announcement. Additionally, the statement comes amid considerable IS territorial losses in the Middle East, including the almost complete loss of its strongholds in Libya, the loss of the symbolic city of Dabiq in Syria, the namesake of their monthly magazine, and  the ongoing battle being waged by various armed forces to recapture  Mosul, Iraq from IS.  With this in mind, the affirmation of an affiliate group in the western Sahel, especially one that has been carrying out more attacks in recent months, is likely an attempt by IS to bolster perceptions of its strength and global reach in an effort to maintain relevance and appeal.
  3. FORECAST: Going forward, we assess that the affiliation is likely to bolster ISGS’ status in the region, possibly assisting in their recruitment efforts. Additionally, ISGS will be able to claim responsibility through official IS and IS-linked publications, giving them wider recognition, under a larger umbrella, rather than through al-Akhbar, as was the case in the past. Regarding its operations, ISGS will likely continue carrying out attacks along the Mali-Niger-Burkina Faso borders in coming months, with an expected focus on security forces. The majority of these attacks will likely continue to be small-scale ones, but ones such as the attempted Koutoukale Prison break are also anticipated. At the same time, the group may also attempt a more high profile attack, in urban centers within these countries, and possibly others in West Africa, in order to announce their presence in the region in a “louder” manner.
  4. FORECAST: Nevertheless, al Qaeda and its regional affiliates, such as al-Qaeda in the Islamic Maghreb (AQIM) and Ansar Dine are expected to remain the prominent jihadist militant groups in the western Sahel, and are deeply entrenched and influential in the region, in part due to the local and popular focus of their activities and messaging. ISGS remains a small group, with limited resources and capabilities, which is unlikely to see an exceptional shift at this time, even after the official affiliation to IS.
  5. This is due to al-Qaeda’s strength in the region, as well as the fact that IS is currently struggling in the Middle East, and at this stage it appears that the group has limited resources to disperse to its affiliates such as ISGS. FORECAST: Instead, IS will likely seek to divert efforts to other more established and priority locations, such as Libya and even, to a lesser extent Nigeria. This was highlighted by recent the recent statement from Abu Bakr al-Baghdadi for IS supporters who can not reach Syria or Iraq to instead go to Libya. At the same time, with IS losses in Libya, there is a distinct possibility for some militants from there, especially ones from West Africa, to join ISGS.


Those operating in or traveling to the West Africa region are advised to contact us for itinerary-based consultations and ground support options.

Security awareness for business continuity management

Security awareness training: a building block for business continuity management against extremist threats

Who ever thought that a day at the office would have to be a day spent thinking about the possibility of terrorism, in addition to the normal demands of business?

Probably not most employees of Multinational Corporations doing business in far-flung corners of the globe. While MNCs have always maintained operations in volatile countries and regions, it’s simply an inescapable reality today that the potential for violent extremism has never been greater – and few targets are as appealing to a terrorist as an MNC. That means that employees can never let their guard down, and neither can the companies responsible for both employee safety and security, and business continuity management.

The situation in Kenya is one case in point

While the country’s Jubilee Alliance of thirteen smaller political factions represents a sweeping effort to unite the often fractious nation and consolidate President Kenyatta’s power, it shows little chance of ending violent political and tribal opposition anytime soon. For the many MNCs doing business in Kenya, typically headquartered in Nairobi or Mombasa but with operations throughout the country, safety and business continuity threats ranging from militancy to crime, civil unrest, and other disruptions are an ongoing concern. Both al-Shabaab, the notorious perpetrators of the 2013 mass killings at Kenya’s upscale Westgate Mall, and IS remain active in recruiting and training Kenyan youths for extremist violence, and the threat of future attacks persists.

Knowing that is a first step in guarding against potentially catastrophic disruptions, of course. But MNCs in Kenya, or any hotspot on the globe, also need to prepare in advance for any potential business continuity risks. That means equipping employees with the training they need both to recognize a threat before it evolves into a crisis and to respond appropriately when an emergency actually does unfold, according to Mr. Ital Dar, Chief Consulting Officer at MAX, where employee security training is seen as a cornerstone of crisis prevention and response for MNCs. “Once a large-scale incident or an emergency scenario hits an organization, the main task is to go back to normal as soon as possible,” he said, “and security managers must ask themselves: what are the required measures we need to take in order to so?”

The caveat is, they need to ask the question and find the answers not only in the thick of crisis, but also well before.

Employee security awareness training is key to minimizing risks

You can’t really separate the issue of employee safety from business continuity, or vice versa. The one depends on the other, and the only way to ensure that they are both adequately safeguarded is to provide comprehensive employee security awareness training. Typically for MNCs, that entails enlisting the expertise of knowledgeable consultants, who then tailor employee training sessions to the specific site and circumstances of each office in order to localize the training around specific risks and the most likely business continuity scenarios.

The training is site-specific and classroom-based, and is augmented by not only movies, PowerPoint presentations, discussions and lectures, but also by classroom drills and simulations to provide experiential learning as well as academic context.

Quality employee security awareness training covers a lot of ground

Experts such as MAX Security’s Mr. Ital Dar emphasize that such realistic simulations are critically important in preparing employees to know how and when to respond to a perceived threatening situation. By definition, and by their very nature, terror attacks come quickly and unexpectedly, but it is still possible – in fact necessary – to prepare employees with the tools and experience to assess even the most fluid situation as it happens and make level-headed decisions based on their prior training and planning.

While the particulars of a training regimen should always be tailored to each company and location, a broad outline of topics that need to be addressed can apply to MNCs operating in any location that a heightened terror threat is present. These include delving into relevant threat scenarios, assessing the location of an attack and reacting accordingly to minimize loss, and using the facility itself as a defensive resource, as when a shooting is occurring in one part of the building.

Additionally, and again at an experiential level, training should focus heavily on how to plan for an attack or other threat before it occurs. In such a training module, employees work toward devising a response plan that incorporates clearly defined crisis management and emergency response goals and roles, and then they effectively deconstruct and reconstruct the plan in a tabletop exercise in which they identify and rectify any gaps and missteps in the original plan.

Whatever other topics are covered in the training sessions of any particular MNC, the issue of business continuity management remains central, of course. For that reason, no security awareness training is complete if it doesn’t look to post-event issues and actions, as well as pre-event planning and training on how to respond in the moment. As soon as an event subsides, the aim of any business has to be to return to normal operations as soon as possible. Advance training, planning, and role-playing is an essential tool for meeting those challenges as well, including hands-on exercises that help to identify possible snags and anticipate optimal solutions for if and when they arise.

Business continuity risk assessment begins with training

It’s an unfortunate fact of life that no business – certainly no MNC operating in a volatile land – can take security for granted. Not in the 21st century. And not in a country like Kenya, where deep-seated political rivalries, tribal and ethnic divisions, persistent war and terrorism in neighboring states, and the unwelcome presence of some of the most destructive terror groups in the world today, make threats to business operations a very real and present danger.

Against that backdrop, MNCs are likely to conclude that high-quality employee security awareness training is one of the best tools they have at hand to reduce the always-present threat to business continuity.


Read more posts like this in our Security Blog.

Philippines Special Analysis Report: 90 days after Duterte’s inauguration, crime rate lowers, militancy persists, international relations waver

This report was written by:

Oliver Wiltshire – MAX Security’s Senior Analyst on the Philippines

And reviewed by:

Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from the Israeli intelligence community
Lihi Hayon – MAX Security’s Regional Director of Intelligence, Asia

Executive Summary

• Duterte’s first months in office have shown unprecedented, domestic support for policies such as anti-crime and anti-drug campaigns while putting serious strains on much of the country’s foreign relations.
• The anti-crime and anti-drug campaigns are likely to continue in the coming months, despite internal and external criticism of the methods of execution.
• Militancy will persist in the Philippines with an elevated risk of attacks in major northern cities; Abu Sayyaf likely to be driven out of Sulu stronghold.
• Finally, the unpredictability of Duterte’s policy could deter foreign investment over worries about financial security, having a negative effect on the country’s markets and economic situation.
• Travel to Metro Manila may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest.

President Duterete's offical Facebook page during 2016 election campaign
President Duterete’s offical Facebook page during 2016 election campaign

Current Situation

  • On June 30, Rodrigo Duterte was inaugurated to become the Philippines’ 16th president, becoming the first Premier to come from the restive island of Mindanao. Running mainly on a campaign of strong anti-crime and corruption policies, a vote for former Davao Mayor Duterte was widely seen as an act of protest against the perceived stagnant and corrupt politics of the longstanding Manila elite, as well as a symbol of frustration over the country’s continuing problems with rampant crime and drug addiction.
  • Duterte’s campaign promised a number of bold and popular governing strategies, at the core of which was his pledge to end crime in the country within six months, primarily by attacking the drug market, most notably based around ‘Shabu’, a local name for crude Methamphetamines. Duterte’s promise to end all crime was considered substantiated by his claims that, under his command, the city of Davao had become the safest city in the country, with a substantially depressed crime rate. Additionally, Duterte positioned himself as a strong symbol of national pride, promising to stamp out militancy in the Islamic State-supported Abu Sayyaf stronghold of Sulu, and refusing to be perceived as placating to international powers who criticize his policies, particularly the US.

Assessments & Forecast

Anti-militancy Campaign
  • Duterte’s anti-militancy push began with a campaign focused on making peace with communist insurgents in the south, and rebuilding Autonomous Region of Muslim Mindanao (ARMM), while working on completing the peace process with a number of moderate Muslim groups in the region initiated by previous President Benigno Aquino III. However, following the failure of Manila’s unilateral ceasefire on July 25 with the communist rebels after just one day, and continuing Abu Sayyaf activity in the south, Duterte began to increase his commitment to military activity to end militancy in the region.
  • The threat of such operations was fairly successful in coaxing the communist groups Communist Party of the Philippines-New People’s Army-National Democratic Front (CPP–NPA–NDF) to the negotiating table, however, have led to an increase in Abu Sayyaf  militancy in the south. Particularly, Armed Forces of the Philippines (AFP) pushes against Abu Sayyaf held territory on the islands of Basilan and Jolo were cited as one of the reasons for the September 2, Davao City bombing.

Continuing counterinsurgency operations in Sulu, as well as increased Islamic State focus on the Philippines, likely to spur additional attacks in urban centers

  1. The Davao attack on September 2 was one of the most significant to occur in the Philippines in recent years for a number of reasons. Firstly, the attack occurred in an urban center and one of the Philippines most developed and important urban areas, the city of Davao; secondly, the attack happened amid increasingly and ostensibly successful counterinsurgency operations on the Abu Sayyaf stronghold of Sulu; finally, the attack, one of the bloodiest in a number of years, occurred under the watch of one of the Philippines’ more security focused presidents.
  2. The significance of the attack taking place in a major city and coming amid the increasing AFP operations in the Sulu Archipelago are closely linked to the motive of Abu Sayyaf in carrying out the attack. The tactic of attacking civilian centers when losing territory formerly held by the group has become a relatively common modus operandi for the Islamic State and groups affiliated with the global jihadist organization. Such a tactic serves two purposes; first of all, it projects high levels of operational capabilities toward the government and public, illustrating the militants’ ability to conduct attacks in civilian hubs, not just in the often sparsely populated territories held by many IS affiliated groups. Secondly, it succeeds in panicking the public and encouraging fear of the militant group, which subsequently increases instability in the country as a whole, as questions over competent leadership emerge, and divisions grow over the correct way to handle the attacks. While the Philippines have been involved in an internal conflict with Muslim Moro rebels in the south for decades, they have seen very few attacks in major Catholic cities, outside the island of Mindanao. With this in mind, a shift by Abu Sayyaf to start frequently targeting major cities and tourist hubs, particularly Manila, would likely cause high levels of panic across the country, and a crisis of confidence in the President, the military, and the operations in the South. Furthermore, we assess that additional Abu Sayyaf attacks are possible in major cities in the coming months as the group attempts to further capitalize on the aforementioned sentiments.
  3. Additionally, the possibility of increasing attacks on major urban centers in the Philippines has the potential to seriously hinder Duterte’s support among the public. While Duterte remains extremely popular, his controversial governing technique remains tied to his ability to achieve results in a way that helps the lower socioeconomic classes he campaigned on serving. In the event that his contentious criminal campaigns and novel relationship with the constitutional law are unable to guarantee the safety of the people or perhaps even contribute to the deterioration of the country’s security situation, his constituents will be far less likely to accept such turbulent policies as he has put forward in his anti-drug campaigns. A string of future urban attacks, particularly targeting Manila, would likely bring into question whether or not Duterte’s municipal governing technique applied to the city of Davao is adaptable to a national level, with so many more groups with unique interests and dynamic aspirations. This was already illustrated on a smaller scale by the President’s misjudging of the complexities of the communist insurgency when he declared a unilateral ceasefire with the CPP–NPA–NDF, which was promptly followed by a communist attack on AFP personnel. The handling of the militant situation in the country’s south will stand as the first and most important test of Duterte’s leadership to date.
  4. FORECAST: Duterte’s campaign against Abu Sayyaf is not likely to succeed totally, just as former President Joseph Estrada’s campaign was unsuccessful in totally eliminating the threat from the IS aligned group. Additionally, considering IS instructions to carry out attacks across Asia and the increasing militant recruits who will join following an IS call for followers to travel to the Philippines, more attacks can be expected. These attacks will take place primarily around the southern island of Mindanao, with additional instances targeting major cities in the northern island groups of Luzon and Visayas, particularly targeting areas such as Cebu and Metro Manila, as well as popular international tourist locales such as Boracay and Palawan. This is especially the case as Abu Sayyaf militants flee the fighting in the Sulu Archipelago and begin to regroup elsewhere, on the Philippine island of Mindanao, as well as the Malaysian island of Sabah.
Anti-drug Campaign
  1. The methods through which Duterte has pursued his policies of strong anti-crime and anti-militancy campaigns have mostly manifested in a relentless commitment to seemingly pragmatic, ends-justify-the-means strategies, which often circumvent traditional governing and policing practices, as well as checks and balances, in place of populist, common-sense offensives. These methods involve awarding sweeping powers to police and military forces, and by-passing political and judicial checks. In terms of the drug campaign, this has manifested in a police carte blanche to shoot-on-sight anyone suspected of being involved in the narcotics trade.
  2. The controversial decision to encourage the extra-judicial killing of individuals linked to the narcotics trade, particularly drug dealers and drug addicts, has subsequently brought about a dramatic increase in reported killings in major cities across the country. Although the numbers cannot be independently verified, official police statistics indicate that around 3,000 people have been killed in the drug operations since Duterte took office on June 30, both by police and civilians, while an additional 5,400 were arrested and 565,805 dealers and users surrendered to police, to date. At least half of the killings are believed to have been carried out by civilians. Nonetheless, the Director-General of the Philippine National Police, Ronald dela Rosa, stated that crime rates had fallen by 49% since the President took office.
Death Toll from Anti-Drug Campaign July-sept 2016
Death Toll from Anti-Drug Campaign July-sept 2016

Duterte’s drug policy, although initially successful, may decrease trust in police forces, encourage environment of fear; lack of oversight could spill over into other areas

  1. Duterte’s unique and harsh approach to the drug problem in the Philippines, although highly controversial on the international stage, appears to be, for the most part, successful when judged against its own objectives and intentions. Many have looked at the number of arrests and surrenders, as well as the incumbent government’s willingness to expose members of the establishment who were involved in the drug trade, and argued that in the short term the policies seem to be working. While it remains impossible to determine how many of the between roughly 3,000 dead were indeed involved in the drug trade, due to the lack of judicial proceedings, initial reports do suggest that the availability of drugs on the streets of Manila has notably decreased.
  2. That said, although such policies may seem pragmatic and necessary by Duterte’s supporters, given the scope of the problem in the country, it could be argued that they are in fact, short-sighted and detrimental to the country’s long-term stability. While the initial fear of the killings may help to decrease the number of drug dealers willing to risk their lives, and thus lessen the impact of narcotics in the short term, the overarching powers given to the police will have a harmful effect on the ability of the Philippines’ judicial system to properly function. Reports have already begun to emerge of police misusing their newly gained power for personal gains or to deal with interpersonal disputes, actions which will stand to lower the general public trust in legal authorities. Furthermore, although the de facto legal capacities of the security forces have increased, their salaries have remained the same, as of the time of writing, which remains one of the primary causes of corruption. Considering that the power of the police has increased, the oversight has decreased, and their compensation has remained static, we can expect that abuses of power are likely to increase, especially in the peripheral areas of Manila and major cities, where local police officers wield significantly more power. Such an increase in corruption by a police force which growingly views itself as immune to prosecution is liable to be very damaging for the general state of law and order in the country.
  3. Additionally, the current success of the anti-narcotics campaign is likely to encourage the executive to direct, and the public to support, the suspension or circumvention of legal statutes in other parts of governance in favor of policies which are deemed pragmatic and forthright in dealing with major issues. This culture of nonconformist governing has the potential to continually erode the rule of law in the Philippines, to be replaced with the cursory will of the country’s President to dictate as he sees fit, in the name of the nation. The consequences of such a governing style have already been hinted at by President Duterte, who, on a number of occasions, has threatened to disband congress if they disagree with his plans for the country, particularly with regards to law and order. Such a lack of consideration for the laws of the land, likely stemming from Duterte’s former work as a prosecutor in Davao, in which he became somewhat disillusioned with the corrupt and inefficient workings of the Philippine justice system, indicates a favor for authoritarian over constitutional rule.
  4. Duterte’s disregard for legal consistency and favor for diminishing oversight of security forces also increases the instability of the country for foreign investors and travelers. Without the insurance and security that is guaranteed through the ability to fall back on the rule of law to aid international businesses to interact smoothly with the government and private companies in the Philippines, the reliability of contracts and safety of investments cannot be dependable, vastly increasing the risk to international businesses. Moreover, the political culture of ignoring legal statutes and disregard for foreign partners, as has been shown by Duterte, has the potential to, on some level, be adopted as a model of international interaction by both public and private figures in the country. Lastly, increasing police corruption would further hinder the possibility of operations in the country, especially when the threat of drug accusations can be so easily used as an attempt to strong arm civilians by authorities. An issue which is further illustrated by the death of a British national on September 10, who was killed due to purported drug links and whose murder has yet to be investigated by authorities.
  5. FORECAST: Considering the centrality of such policy to Duterte’s campaign, we assess that the drug campaign will not relent, and on the contrary, is likely to increase in intensity with a possibility that the death toll will reach the high thousands by the year’s end. Furthermore, it is likely that police and non-government personnel will become decreasingly weary on who is targeted, possibly leading to significant numbers of dead without a trial. While the policy is currently popular and is likely to remain so, we assess that protests may occur if particularly controversial killings start to be reported on a regular basis, especially if political rivals of Duterte believe they can use such killings as leverage in their own campaigns. Furthermore, we believe that additional reports of foreign nationals being killed in the anti-drug campaign will arise, further distancing the Philippines from many of their allies.
Residents accused of narcotic trade pledge to not use or sell "Shabu" (Meth) again after surrendering to the police and government in Makati, metro Manila
Residents accused of narcotic trade pledge to not use or sell “Shabu” (Meth) again after surrendering to the police and government in Makati, metro Manila
Foreign Relations Controversies
  • The Philippines’ international relations have taken a significant turn since President Duterte’s inauguration, with a number of statements on both bilateral and multilateral relations causing considerable tensions. During his electoral campaign, Duterte became well known for his outbursts of candid and often crude opinions, particularly on sensitive issues and directed at prominent public figures. The President was widely criticized for insulting the Pope and telling him not to visit the Philippines anymore.
  • In the same vein, on September 6, a meeting between Duterte and US President Barack Obama at the ASEAN conference in Laos was canceled after the Philippines’ President used offensive language against the US President in a speech criticizing Obama’s plans to confront the issue of extrajudicial killings led by Duterte. Furthermore, the President has made a series of statements outlining his intentions to downplay the Philippine-US relationship and foster relations with China and Russia. After this, many prominent financial analytics groups reported significant drops in foreign investment in the Philippine Stock Exchange Index, which fell 4.48% between August 15 and September 16.

Duterte’s unorthodox governing style, controversial rhetoric increases domestic support among rural poor while distancing country from key international players

  1. Duterte’s policies with regards to foreign leaders are likely to become increasingly problematic in the future, assuming he retains his outspoken and blunt speaking and governing style. A cooling of relations between the Philippines and its top military and diplomatic ally, the US, could prove detrimental for the archipelago country, currently in the midst of a major island dispute with the People’s Republic of China. The US has given the Philippine government over 500 million USD in military aid since 2002, 79 million USD of which came in 2015 amid the ongoing South China Sea dispute. While Duterte’s comments are often enjoyed by his supporters, there also remains a major public support for policies which balance China’s attempts to build on the Spratly Islands and Scarborough Shoal. Any instances which are seen to hurt the Philippines’ position in the South China Sea, such as a reduction of US involvement, is likely to be received negatively by the electorate, especially if it plays into China’s advantage. Furthermore, polls show that the Filipino public has shown around 90% favorability towards both the US and Obama, further indicating that the distancing between the two countries would negatively impact the incumbent government’s popularity.
  2. Finally, Duterte’s uncompromising positions and unorthodox rhetoric have the potential to not only cause damage to the Philippines’ political relations but also to its global economic connections. Duterte’s comments characterize an unpredictable leader, who has little respect for a convention in either the governmental or international arena. This is likely to have a further direct effect on the markets, as was already witnessed in the aftermath of the comments about President Obama and the US. If investors start to believe that the policies of Duterte are erratic and that the Philippines no longer remains a stable environment for foreign investment, the economy could begin to stagnate or dip. In this regard, it could be argued that while previous Presidents looked to retain the status quo, while not addressing some of the country’s domestic issues, the current president is focused on domestic issues, in a way that could threaten the country’s foreign relations, both in the political and economic sectors. The further distancing of the Philippines from the West has the potential to push the country towards other major regional players, such as China and Russia, who Duterte has expressed a willingness to open up to, a move that would likely seriously affect trade with both the US and Japan, the country’s two main trading partners.
  3. FORECAST: In terms of the Philippines perception abroad and the country’s relations with the US, aside from any major shift in policy from the international community, Duterte’s government is likely to continue to attempt to downplay its connection to the US and warm relations with China. This may see significant negotiations taking place in the South China Sea, economic and trade deals, or diplomatic moves in an attempt to shift Manila’s allegiances towards Beijing. While the Philippines is unlikely to make any major moves to break its relations with the US, continuing comments by the Philippine President will occur, highlighting his strained relationship with the Asian archipelago’s former colonial power. Finally, such issues will further deteriorate trust in the Philippine economy abroad, having detrimental effects on its foreign investments and general economic development.


  1. Travel to Metro Manila may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest.
  2. Those operating or residing in the Philippines should minimize contact with police and security authorities, due to the prevalence of corruption increasingly wide range of powers given to police officers and lack of due process with regards to criminal procedure. When possible it is advised to seek private security while traveling throughout the country.
  3. Avoid all travel to the western part of the island of Mindanao, as well as the Sulu Archipelago and avoid nonessential travel to the island, including Davao City, given the risk of militant attacks.
  4. Minimize travel to known touristic sites throughout the country, as well as government installations and prominent national symbols, given the elevated risk of militant attacks targeting Western nationals.

DISCLAIMER: Please note that any views and/or opinions and/or assessment and/or recommendations presented in this text are solely those of Max Security. If you are not the named addressee you should not disseminate, distribute or copy this text. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Max Security Solutions accepts no liability for (i) the contents of this text/report being correct, complete or up to date; (ii) consequences of any actions taken or not taken as a result and/or on the basis of such contents.  Copyright – 2016 Max Security

Libya Special Intelligence Report – Projections on Stabilization and the Challenges Ahead – August 2016

This report was written by:

Oded Berkowitz – MAX Security’s Associate Director of Intelligence, Middle East & North Africa

And reviewed by:

Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from the Israeli intelligence community
Roshanna Lawrence – MAX Security’s Regional Director of Intelligence, Middle East & North Africa

Executive Summary

Several prominent political actors, supported by various foreign countries, are currently active in Libya in various spheres of influence, some of which overlap. Despite attempts made towards unification including the announcement of a “unity government”, political rifts have deepened in recent weeks. In this context, the political instability of the country is expected to continue, both in a dichotomy of two governments competing for hegemony, as well as in internal rivalries within the various political layers.
Similarly, numerous armed factions operate throughout Libya, some supported by foreign actors (including such that are present on the ground), and hold conflicting or overlapping sets of ideologies and interests with each other. Despite taking measures towards the elimination of militancy, mostly that posed by the Islamic State (IS), the continued political stalemate and deteriorating economic situation, mostly related to the inability to produce and export oil in sufficient quantities, poses a risk of escalation in armed conflict. Overall, a resumption of large scale hostilities between rival armed factions remains possible.

As a result of these factors, the potential for a significant stabilization in Libya over the coming months remains low at this time.

Current Situation

Several prominent political actors, supported by various foreign countries, are currently active in Libya in various spheres of influence, some of which overlap. Despite appearing generally cohesive, there are divided influences and presence of opposing groups not only within the broader geographic areas, but even within certain cities that are seemingly under the control of a certain group. With this in mind, general control of Libya’s major geographic areas can be broken down as follows:

  • Eastern Libya: Generally under the control of the House of Representatives (HoR)/Libyan National Army (LNA), with Islamist militant pockets of control.
  • Central Libya: Convergence of control by LNA, Petroleum Facility Guards (PFG) and pro-Government of National Accord (GNA)/General National Congress (GNC) forces, with Islamist militant pockets of control.
  • Western Libya: Presence of forces that support the GNA and others that support the GNC, with a pocket of LNA control.
  • Southern Libya: Generally ungoverned territory with heavy presence of tribal militias who hold shifting alliances.

See below, “Actors and Interests”, for a more in-depth discussion of the major players.

Rivalries and Alliances in Libya

Forecast: Militancy and Fighting

Eastern Libya: Status quo likely to continue

  • Despite its unprecedented recent successes, the LNA has suffered some local setbacks, namely the inability to hold areas that it “liberated” in Ajdabiya in March-April, as is manifested by the renewed militant territorial presence and operational capabilities in and around the city. These are likely the result of the LNA’s need to engage in several active fronts that are also physically distant from each other at the same time, thus forcing the LNA to overstretch its resources. Moreover, the LNA’s airpower, one of its main leverages, is inconsistent in its operations due to faulty maintenance (as a result of lack of proper resources) and overuse. Moreover, in Benghazi, the primary area of operations for the LNA currently, the LNA faces persistent challenges in operating in a dense urban area and among civilians, a weakness often successfully exploited by militant groups that battle the LNA.
  • Lastly, the recent exposure of the French military presence in Libya prompted widespread local opposition, mainly from (but not exclusive to) civilians in Misrata and Tripoli, as well as the Grand Mufti, and is expected to cause opposition from the local population, as well as political complications. In the long term, that may mean that France will have to scale back its missions in Libya, or possibly entirely withdraw from the country, which will have particularly adverse effect on the LNA, France’s main beneficiary in Libya. These factors combined will likely result in a general status-quo of fighting in the east in the coming period, with the LNA making advances in certain areas, however at the expense of losing grounds or influence in other areas.

Central Libya: Misrata forces likely to eventually seize control of Sirte; factional fighting possible over coming months

  • As opposed to the east, in the Sirte Basin, pro-GNA forces (mostly in the form of militia groups from Misrata) were largely not required to fight in several different, far-removed focal points.  As a result of this, along with an at least temporary alliance struck with the PFG in the east of the basin, pro-GNA forces were therefore able to focus their forces to the maximum effect against IS and achieve far-reaching results. Given that IS’s main fighting forces have mostly been contained to a small area, which is besieged from all sides, we do not assess that it currently has the capabilities to break the encirclement and reverse Misrata’s achievements. The latter will likely opt to generally maintain the siege for the coming period in order to avoid high casualty tolls that are attributed to fighting in urban terrain, and will likely mostly bombard the city with air and artillery forces. With this in mind, unless something unexpected – such as premature renewed fighting with the LNA or PFG occurs, we assess that Misrata’s capabilities in ultimately capturing Sirte will remain high.
  • However, it is important to mention that while IS’s capturing and expansion of territory in the Sirte Basin since February 2015 served to temporarily mitigate hostilities between the LNA and the then-Libya Dawn, whose main focal point of fighting prior was the control over oil facilities in the Sirte Basin, and mainly the oil terminals along the coast. In this context, the eventual removal of IS as a major threat may in fact reignite fighting (depending also on the political situation at the time) between the LNA, Misrata, and the PFG over the control of the numerous valuable energy resources in the area.
  • Indications of this were already apparent in early May, when forces from Misrata and the LNA, maneuvering to positions prior to launching an offensive against IS, briefly but intensely clashed with each other near Zillah and its nearby oil fields.   This is particularly likely since oil and gas, which are abundant in the Sirte Basin, are Libya’s main exports, even at the significantly reduced current output, and are therefore a key factor of income, thus rendering the control of energy facilities instrumental for any actor seeking influence in Libya.
Islamic State photos of fighting with Misrata during siege of Sirte, July 2016
Islamic State photos of fighting with Misrata during siege of Sirte, July 2016


Western Libya: Outbreak of fighting between rival militias possible over coming months

  • Despite the GNA’s arrival in Tripoli and the subsequent large support base they were able to rally among local militia, the fractioned nature of the “military” structure in the west, which also characterized the previous Libya Dawn coalition of militia forces, persists. This results in occasional, intense, fighting between militia groups both in Tripoli and its surrounding areas, including between those that seemingly operate under the same group, over a variety of issues including control and patronage of areas, dominance over smuggling routes, as well as over local disputes, in addition to fighting that occurs between militias of rival political affiliation, namely the GNA and GNC loyalists. This situation is underscored by the most recent fighting in Garaboulli, 60 km east of Tripoli, on June and 21 which resulted in at least 29 deaths and dozens of wounded.
  • Moreover, fighting intermittently occurs between militia groups that support the LNA and the HoR, and those that support the rival factions, along the “border” west and southwest of Tripoli. The presence of pro-LNA forces in such relatively close proximity to Tripoli, in addition to the fragility of the political situation, runs the risk of an expansion in hostilities over the coming six months, particularly since multiple LNA commanders have announced in the past that their “ultimate goal is Tripoli”. This risks will be significantly heightened should hostilities between the LNA and pro-GNA forces in the Sirte Basin be resumed, potentially resulting in a spiral effect that will renew a nationwide state of hostilities such as the one that was prevalent in Libya approximately one year ago.

Countrywide Militancy: IS losses may lead to more high-profile attacks by group, while regional competition with AQIM may lead latter to exploit such losses

  • Despite the proliferation of militant groups in Libya, these organizations are mostly invested in maintaining their activity around their current areas of operations, namely in and around Derna, Benghazi and Ajdabiya. An exception to these is IS, who has both the interest and the proven capabilities to operate across Libya, and has in fact conducted attacks across the country in recent months. While IS’s loss of territory, material, and personnel first in Sabratha (west of Tripoli) in March, then in Derna in April, and finally in the Sirte Basin since June, has significantly impaired their resources base and operational capabilities, this exact same process may lead the group to conducting more high-profile attacks. This is in order to maintain the group’s diminishing prestige and project an image that it is still relevant despite its losses, both regionally and globally, due to its setbacks in Libya, as well as in Syria and Iraq.
  • Moreover, al-Qaeda in the Islamic Maghreb (AQIM), who is a regional competitor of IS and draws from similar recruitment and funding pools, also has an operational presence in the country and may seek to take advantage of IS’s current setback to increase their own influence in the country, which will be manifested by militant attacks. In this context, while the frequency of militant attacks has declined in recent weeks, in the long term, the increased motivation and remaining capabilities of the numerous militant factions serve as indications that attacks may occur nonetheless. In light of precedent and the global jihadi groups’ strategies, such attacks are likely to prioritize strategic locales such as the energy sector (as noted before), as well as foreign companies and diplomatic missions, to further damage the economy, aggravate the instability of the state, and capitalize on the resultant void that allows militants to prosper.
UAV footage of Islamic State SVBIED attack in Benghazi, July 29, 2016
UAV footage of Islamic State SVBIED attack in Benghazi, July 29, 2016


Forecast: Political Stability

Political competition likely to persist between rival governments, increasing fractured nature of country

  • Since its arrival in Tripoli, the Presidency Council of the GNA has successfully expanded their sphere of influence in western Libya. That said, their influence was generally unsuccessful in breaching into the east of the country, which is still mostly under the auspices of the HoR. Furthermore, there is a common perception by locals of the GNA as being foreign installed and directed, which was likely aggravated by the “invitation” of US airstrikes and foreign intervention in Libya. This image significantly impairs the GNA’s domestic credibility, despite being presented as the unity government of Libya.
  • The rift between the GNA and HoR is aggravated by the continued inability of the HoR to hold a vote to ratify the GNA, which is perceived by the latter as an intentional move to diminish its legitimacy. Additionally, the fact that the GNA continues its own implementation despite not being vetted by the HoR is perceived by the latter as an act of marginalization of the body, which is set to be the legislative authority of the unity government. Most recently, political rivalries peaked when, following an agreement in late July between the GNA and PFG to reopen the major oil terminals in central Libya in late July, the HoR threatened to attack vessels entering Libyan territorial waters without the latter’s authorization.
  • In this context, the HoR will likely continue to fail meeting voting deadlines on the ratification of the GNA, as it postpones the latter’s full implementation without outright rejecting it. This, in turn, blocks what some of the HoR members perceive as a challenge to their aspirations of sovereignty, without attracting the negative international attention and potential ramifications that will accompany an official vote against what at least the UN perceives as a unity government. Should this process persist, it is liable to prompt the Presidency Council to continue to construct the GNA without ratification, which in turn will further discredit its domestic status and sanction political opposition to it. This will likely eventually lead to the GNA establishing their primacy in the west, but remaining a second government in Tripoli and western Libya vis-a-vis the HoR, mostly in the east.
  • That being said, it cannot be ruled out that the HoR will eventually ratify the GNA. However, even without the political branch’s dichotomy, Libya’s institutions, and more importantly its various fighting groups, still hold many conflicting interests and ideologies, along with personal animosities between leaders of these groups, which will significantly challenge the implementation of a full unification of Libya. Taken as a whole, the most stabilizing potential outcome for Libya, and the one that seems least likely at the time of writing, will see a single domestically and internationally recognized government which struggles to exert its full control over Libya, in which various competing groups will still clash with each other to maintain their respective interests. However the most likely track at this time, which will maintain and possibly exacerbate Libya’s instability, is one in which the GNA continues to compete with the HoR, and to a lesser degree with the GNC, over full control of Libya, in effect resulting in a fractured state.

Actors and Interests

Political Actors

  • Government of National Accord (GNA): Currently based at the Tripoli Naval Base, the GNA is intended to be a unity government and is a product of the Libyan Political Agreement (LPA) signed in December 2015. The LPA allows for the transition of the House of Representatives (HoR) and General National Congress (GNC) into the GNA’s legislative body and advisory State Council, respectively. However, this transition must be ratified of a vote of a special majority by the HoR, which so far has not been able to convene the needed quorum for such a vote. During this continued transition period, the GNA is currently considered the “internationally recognized” government and enjoys the support and the backing of the UN. Its sphere of influence is fractioned mainly throughout western Libya, particularly in greater Tripoli and Misrata.
  • House of Representatives (HoR): The previously “internationally recognized” government, the HoR’s parliament is based in Tobruk and executive branch in al-Bayda. Its sphere of influence is generally in eastern Libya, with some pockets of support in the west, particularly southwest of Tripoli. The HoR is currently supported politically, militarily, and economically by several countries, most prominent the United Arab Emirates (UAE) and Egypt. While these countries generally recognize and support the LPA, they capitalize on the fact that the HoR has not ratified the agreement as pretext to consider it non-valid at this time, in order to continue supporting the HoR and not the GNA.
  • General National Congress (GNC): The GNC previously controlled the majority of western Libya and is now mostly defunct, mainly since some of its members unilaterally broke away in early April and started fulfilling the role of the State Council, despite the GNC leadership’s opposition. While the GNC currently has very little political power, it still enjoys support from various militias, as well as from Grand Mufti al-Ghariani, thus retaining a partial sphere of influence in the west, particularly in Tripoli and its surrounding areas. Both Turkey and Qatar originally supported the GNC, but this support has diminished since the start of the GNA’s implementation.
  • Other groups: Both the ungoverned and the governed areas of Libya are dominated by politics based on tribal, clan, and ethnic backgrounds, as well as place of residence and origin. In this sense, it is not uncommon for cities that both support the same political body, to be at odds due to historical or other rivalries among their residents. Similarly, militias from the same city who support the same political organ may have a strife over tribal or other rivalries.

Militia and Militant Groups

Dozens of militia and militant groups currently operate in Libya, each with its own ideologies, interests, and political allegiances. Very broadly, these groups are categorized into six different competing factions, with rivalries persisting even within some.

  • Militia groups that support the Libyan National Army (LNA), which is commanded by Lieutenant General Khalifa Haftar and holds patronage relations with the anti-Islamist House of Representatives (HoR). Mainly fighting in the east of the country, with pockets of support in the west. Their main areas of operations currently are around the city of Derna, in Benghazi, in and around Ajdabiya, as well as the area between Benghazi and Ajdabiya.
  • Militia groups supporting the UN-backed Government of National Accord (GNA), based at Tripoli Naval Base. Currently engaged in an ongoing campaign to remove the Islamic State (IS) from the city of Sirte (represented primarily by forces from Misrata), as well as taking part in intermittent inter-militia fighting in western Libya.
  • Militia groups, formerly known as the Libya Dawn coalition, supporting the pro-Islamist General National Congress (GNC), based in Tripoli. While mostly defunct, they still retain some fighting capabilities which are mostly invested in fighting rival militias, mainly those that support the GNA, in Tripoli and other areas in western Libya.
  • Petroleum Facility Guards (PFG), an independent faction that holds shifting alliances (currently allied with pro-GNA forces), however ultimately strives for its own goal of a federalist Libya. Currently is seldom fighting and mostly retaining its forces. Was briefly involved in operations against IS east of Sirte in cooperation with Misrata.
  • Islamist jihadist groups such as the Islamic State (IS), as well as additional ones that hold varying levels of connections to al-Qaeda, the GNC and/or the Grand Mufti of LibyaSadeq al-Ghariani, including Ansar al-Sharia, Revolutionary Shura Council of Benghazi (RSCB), Mujahideen Shura Council of Derna (MSCD), and others. Hold territory and operational capabilities mainly in and around Derna, Benghazi, Ajdabiya and Sirte.
  • Tribal militias, mostly consisting of either Tebu or Tuareg ethnic tribes, who may be at times supported by fellow tribesman from neighboring countries, and hold shifting allegiances towards the various players. Operate mainly in the ungoverned territories in southern Libya, in proximity to the border with Egypt, Sudan, Chad, Niger and Algeria.

International Actors (Non-Regional)

Numerous international actors have either confirmed their military presence on the ground in Libya in support of either of the factions, or have indications pointing to such activity by them without official confirmation at this time. This is in addition to indirect actions such as the ongoing Operation Sophia to counter illegal immigration, an actions by regional actors such as Egypt, UAE, Turkey and Qatar which will be mentioned in the political stability section. The main international actors are:

  • The United States: On July 19, Chairman of the Joint Chiefs of Staff General Joseph Dunford confirmed that the US has routine and ongoing operations in Libya that are coordinated with the GNA, as well as other operations that are not coordinated with them, without specifying their nature. Later, on August 1, the US Department of Defense (DoD) announced that US aircraft targeted IS positions in Sirte on August 1, at the request of GNA leadership. In addition, the DoD stated that further airstrikes targeting IS in Sirte would be conducted in support of “GNA ground operations”. There are many indications of US ground and aerial operations in areas both under GNA (and previously GNC) control as well as in HoR territory. The most prominent evidence of US ground presence in Libya emerged as early as December 16, 2015, when a Special Operation Forces (SOF) team sent to advise the LNA was expelled from al-Watiyah Airbase by local militias, compelling the DoD to confirm that the US military is dispatching “advisors” toLibya.
US Special Operations Forces team at Libya's al-Wattiyya Airbase, December 2015
US Special Operations Forces team at Libya’s al-Wattiyya Airbase, December 2015


  • Italy: Provides frequent and overt logistical support primarily to the city of Misrata, most often in the form of medical evacuation of both civilians and combatants wounded by IS actions. There are local reports of regular presence of Italian SOF teams providing training, advising and liaison with locals, however these remain unconfirmed at the time of writing.
  • France: On July 17, an Islamist militant group claimed to have shot down an LNA helicopter carrying Libyan, French and Jordanian nationals. While there are conflictingreports regarding the type of helicopter and the reasons for which it crashed, on July 20 French President Francois Hollande confirmed that three French operators were present aboard a helicopter that crashed due to technical reasons in Libya; reports additionally indicate that the three were Directorate-General for External Security (DGSE) agents. This announcement accounts for the first official and public admission of direct French operations in Libya, while local reports regarding relatively large scale French presence and operations in Benghazi circulated since February.
Wreckage of helicopter likely carrying French operators, al-Muqrin, July 2016
Wreckage of helicopter likely carrying French operators, al-Muqrin, July 2016


  • United Kingdom: There are various local reports regarding direct British involvement in assisting Misrata forces in their campaign against IS in Sirte. While unconfirmed reports suggest that UK forces directly engaged IS forces in certain instances during May-June, both on the ground and with use of airstrikes, Misrata’s military spokesmen stated that the UK is only providing intelligence support, including by operating tactical unmanned aerial vehicles (UAVs), as well as in advising local forces.
  • Russia: On May 1, the LNA’s official spokesman announced that the LNA’s operations are assisted by Egypt, the UAE and Russia. This accounted for the first official recognition of Russian involvement in Libya. While there is little open source information regarding potential Russian operations in Libya, on January 31, a Russian Orlan-10 tactical UAV crashed near Ajdabiya, an incident that remained unexplained since and may serve as an indication for such ground operations.
Photo of Orlan-10 tactical UAV after crash east of Ajdabiya, January 2016
Photo of Orlan-10 tactical UAV after crash east of Ajdabiya, January 2016


DISCLAIMER: Please note that any views and/or opinions and/or assessment and/or recommendations presented in this text are solely those of Max Security. If you are not the named addressee you should not disseminate, distribute or copy this text. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Max Security Solutions accepts no liability for (i) the contents of this text/report being correct, complete or up to date; (ii) consequences of any actions taken or not taken as a result and/or on the basis of such contents.  Copyright – 2016 Max Security

Islamic State calls for vehicular attacks against crowded areas, celebratory events, hinting at Thanksgiving celebrations

Executive Summary:

  • In their November publication of Rumiyah Magazine, Islamic State (IS) dedicated an entire article encouraging lone-wolf vehicular attacks via load-bearing trucks, similar to the Bastille Day attack in Nice, which killed 86 and injured hundreds.
  • The article proves practical information on choosing the appropriate vehicle and target, specifically crowded areas and celebratory events, while the graphics used suggest the annual Macy’s Thanksgiving Day Parade in New York City on November 24 as an ideal target.
  • Overall, given the symbolic nature of Thanksgiving as well as the fact that it provides numerous such targets for attacks, we assess that there is a credible risk for an IS-inspired lone-wolf attack on this day. This may take the form of a vehicular attack, but other methods, such as shootings and stabbings are also possible. While the famous and well-attended parade in New York City is an exceptionally desirable target for a successful attack, other smaller celebrations in cities and towns throughout USA face a similar risk.
  • Those operating or residing in the USA are advised to maintain heightened vigilance in the vicinity of large crowds and celebratory events related to Thanksgiving, while being cognizant of suspicious packages, individuals, or movement.
Title page for article in Rumiyah magazine encouraging lone-wolf vehicular attacks, alluding to Macy's Thanksgiving Day Parade as an ideal target

Title page for article in Rumiyah magazine encouraging lone-wolf vehicular attacks, alluding to Macy’s Thanksgiving Day Parade as an ideal target

Please be advised:

  • In their November publication of Rumiyah Magazine, the magazine’s third and latest publication, Islamic State (IS) dedicated an entire article to encouraging followers and supporters to carry out lone-wolf vehicular attacks, specifically referencing such an attack conducted in Nice on Bastille Day in July of this year, killing 86 and injuring 434.
  • In the article, titled “Just Terror Tactics – Part 2”, the writer elucidates on the type of vehicle to use, the types to avoid, as well as ideal targets, and advice for planning such an attack. In this context, the article repeatedly advises the use of a large, but controllable, load-bearing truck, with adequate speed, and double-wheeled “giving victims less of a chance to escape being crushed”. The author also advises a metal outer frame, and a raised chassis to allow for “mounting of sidewalks or the breaching of barriers”, among other specifications.
  • Regarding targets, the article suggests “large outdoor conventions and celebrations”, “pedestrian-congested streets”, outdoor markets, festivals, parades, and political rallies, while featuring pictures of the annual Macy’s Thanksgiving Day parade in New York City.
  • In addition, the article provides advice on preparation and planning for such an attack, namely “mapping out the route of the attack” and “surveying the route” for possible obstacles, cautioning that “more obstacles might be set up on the day of a targeted event”. The “Preparation and Planning” section also suggests attaining a secondary weapon if possible.
  • Finally, the article concludes with a reminder, seen in previous such publications, that the assailant should find a way to announce his/her allegiance to Islamic State, such as by writing such statements on pieces of paper, and throwing them from the window of the vehicle during the attack.

Assessments & Forecast:

  • Third Consecutive Rumiyah Magazine with article on lone-wolf attacks: The aforementioned publication is notable for several reasons. For one, this is third consecutive issue of Rumiyah magazine that deals extensively with the issue of lone-wolf attacks. The first such article, titled “The Kafir’s Blood is Halal for You. So Shed it” dealt extensively with the theological justification for carrying out attacks against any non-Muslim, even innocent civilians. The second article is very similar to “Just Terror Tactics – Part 2”, but gives guidance on carrying out stabbing attacks as opposed to vehicular ones.
Title pages for previous articles in Islamic State's Rumiyah magazines encouraging lone-wolf attacks in the West
Title pages for previous articles in Islamic State’s Rumiyah magazines encouraging lone-wolf attacks in the West
  • An Easier Path to ‘Martyrdom’: Overall, the fact that three issues of Rumiyah feature articles encouraging lone-wolf attacks highlights the shift started by IS and previously observed by MAX in our special report on lone-wolf attacks, specifically the relative ease by which an individual can attain “martyrdom” status. Compared with the past, this was a lengthy process, requiring patience, vetting, and more direct connections with Islamist networks. It should be noted that many “lone-wolf attacks” over the past year were not entirely lone-wolf, as attackers were in contact with members of IS via different messaging platforms through which he would declare his allegiance to IS and send a video of himself doing so. The “Just Terror Tactics” articles make things even easier by explaining how one can pledge allegiance to IS without needing to make any connections or even have to navigate the often complicated web of chat groups in these messaging platforms.
  • Evolution of the Message: Furthermore, through these “Just Terror Tactics” publications, IS has illustrated its adaptability, evolution, and learning from their successes and failures. In this context, the first article included a lengthy religious justification for attacks in order to dispel concerns among some potential supporters that such assaults are not permissible in Islam. The following two articles focus on specific advice for carrying out these attacks and illustrate the group’s efforts to evolve what was once an open, unspecific call for attacks against whom they consider non-Muslims, to more specific instructions on how to do so in order to have the greatest impact.
  • Thinly-Veiled Threat for Thanksgiving Day: Finally, it is noteworthy that the article featured two images from the annual Macy’s Thanksgiving Day Parade, while calling for attacks against celebratory events and parades and referencing the attack on crowds celebrating Bastille Day earlier this year. While the article at no point mentions the parade in particular, the details of an ideal target, and the graphics depicting the event appear to encourage followers to attempt an attack against the parade. This is further highlighted by the advice on how to survey a site prior to attack, and taking note of security barriers. Much like Bastille Day is symbolic for France, Thanksgiving Day and the associated parades are also very symbolic for the US.
  • Forecast: While Islamic State’s general and standing call for attacks in the West has gained some level of adherence, with numerous lone-wolf attacks and attempted attacks being carried out over the past year, there has not been a direct correlation in time between these calls and the conducting of attacks. With this in mind, we assess that in addition to the standing threat of lone-wolf attacks worldwide, there is a further credible risk of such attacks in the US on Thanksgiving. Although the the Macy’s Thanksgiving Day Parade is an especially symbolic target, any parade or celebration faces a risk, even in small towns and cities across the country, as proximity and ease appear to be equally, if not more, influential aspects of a potential target. Furthermore, while the most recent publication calls for vehicular attacks and advises on how to attain a vehicle, should an attack transpire, a stabbing or shooting modus operandi is still a high probability given the added simplicity. Finally, it should be noted that while security forces will likely set up a perimeter around main events, an assailant need not reach this target in order to achieve the desired affect, and the security lines to enter a given event are equally probably to be targeted, given the sizeable crowds that result from them.


Those operating or residing in the USA are advised to maintain heightened vigilance in the vicinity of large crowds and celebratory events related to Thanksgiving, while being cognizant of suspicious packages, individuals, or movement.


For more security blog posts click here

Turkey Analysis: 41 killed in New Year’s shooting at Istanbul’s Reina nightclub

Current Situation: Islamic State (IS) claims responsibility for New Year’s shooting in Istanbul

Reports indicate that 41 people were killed and 69 more were wounded in a New Year’s shooting attack at the Reina nightclub in Istanbul’s Besiktas district during the overnight hours of December 31-January 1. Furthermore, 24 of those killed were reportedly foreign nationals. The incident transpired as an assailant armed with an assault rifle stormed the locale and opened fire at the crowd celebrating New Year’s Eve. Further reports indicate that the crowd at the club numbered in the mid to high hundreds. Following the incident, the assailant was able to escape the club. Turkish security forces have launched a search operation to locate and arrest the assailant; at the time of writing, he is still at large.

Turkey Analysis: 41 killed in New Year's shooting at Istanbul’s Reina nightclub | MAX Security

Turkey Analysis: 41 killed in New Year's shooting at Istanbul’s Reina nightclub | MAX Security

Click here to see Map Legend


  1. While the situation at the nightclub itself has been contained following the New Year’s shooting, given that the assailant remains at large and is still likely armed, heightened security measures can be anticipated in the vicinity of the night club, along the waterfront, and throughout central Istanbul. Locales likely to be affected include Yildiz Park, located near the nightclub, and more central locales such as those along Istiklal Caddesi, like Taksim Square.
  2. Moreover, the active New Year’s shooting attack comes amidst an escalated threat of militancy in major Turkish cities, as highlighted by the December 10 twin bombing attacks carried out by the Kurdish Freedom Falcons (TAK), near Istanbul’s Vodafone arena, which resulted in the deaths of at least 38 people. In this context, the IS claim of the attack is highly notable, as the militant group has rarely taken responsibility for such incidents in Turkey. Moreover, the attack remains more comparable to incidents carried out by IS sympathizers in Europe and the Americas, such as the June 12 active shooting attack targeting a gay nightclub in Orlando, Florida, thus increasing the likelihood that the shooter was inspired by IS ideology, and therefore, carried out the attack in the militant group’s name.
  3. In addition, it is important to note that the attack comes amidst recent calls by the jihadist group’s linked media to conduct attacks during the holiday period. For instance, in late December, a pro-IS media outlet issued a call for the group’s supporters to carry out worldwide acts of militancy against New Year’s Eve celebrations in crowded public spaces such as clubs, markets, theaters, cinemas, and malls. In light of these calls, with regards to Turkey, by encouraging such attacks, the Sunni jihadist militant group likely seeks to retaliate against Turkey’s ongoing operations in northern Syria against its fighters. Moreover, the fact that a nightclub frequented by foreign nationals was targeted may serve the jihadist group’s likely long-term strategy of deterring foreigners from traveling or investing in Turkey, thus potentially damaging the country’s national economy.
  4. Forecast: With this in mind, heightened security measures are likely to be recorded throughout Istanbul’s Besiktas District over the coming hours and days, in an attempt to detect and arrest the shooter. These are liable to include checkpoints, arrest raids, and heightened security presence in the vicinity of areas which are frequented by foreigners. Furthermore, there remains a potential that upon the detection of the assailant, an exchange of gunfire between security forces and the attacker will be recorded, thus potentially constituting a collateral threat to bystanders.


  1. Travel to Istanbul and Ankara may continue, although travelers are advised to maintain heightened vigilance in central areas due to the threat of militancy, as well as regular anti-government protests and occasional incidents of unrest in these locales. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support options.
  2. Avoid nonessential travel to the immediate vicinity of government buildings, police stations, political party offices, popular public places and shopping centers, as well as Western institutions and places frequented by Westerners, and places of worship due to the threat of militancy.
  3. Avoid nonessential travel to Turkey’s southern and eastern provinces, while also avoiding all travel to border areas with Syria and Iraq, given the increased risk of militancy and spillover violence.
  4. Additionally, it is advised to maintain heightened vigilance throughout Istanbul’s Besiktas District over the coming hours and days, given that the assailant is still at large, as well as the currently increased security measures in this area aimed at locating the perpetrator.