Tag Archives: Islamic State (IS)

Libya Special Intelligence Report – Projections on Stabilization and the Challenges Ahead – August 2016

This report was written by:

Oded Berkowitz – MAX Security’s Associate Director of Intelligence, Middle East & North Africa

And reviewed by:

Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from the Israeli intelligence community
Roshanna Lawrence – MAX Security’s Regional Director of Intelligence, Middle East & North Africa

Executive Summary

Several prominent political actors, supported by various foreign countries, are currently active in Libya in various spheres of influence, some of which overlap. Despite attempts made towards unification including the announcement of a “unity government”, political rifts have deepened in recent weeks. In this context, the political instability of the country is expected to continue, both in a dichotomy of two governments competing for hegemony, as well as in internal rivalries within the various political layers.
Similarly, numerous armed factions operate throughout Libya, some supported by foreign actors (including such that are present on the ground), and hold conflicting or overlapping sets of ideologies and interests with each other. Despite taking measures towards the elimination of militancy, mostly that posed by the Islamic State (IS), the continued political stalemate and deteriorating economic situation, mostly related to the inability to produce and export oil in sufficient quantities, poses a risk of escalation in armed conflict. Overall, a resumption of large scale hostilities between rival armed factions remains possible.

As a result of these factors, the potential for a significant stabilization in Libya over the coming months remains low at this time.

Current Situation

Several prominent political actors, supported by various foreign countries, are currently active in Libya in various spheres of influence, some of which overlap. Despite appearing generally cohesive, there are divided influences and presence of opposing groups not only within the broader geographic areas, but even within certain cities that are seemingly under the control of a certain group. With this in mind, general control of Libya’s major geographic areas can be broken down as follows:

  • Eastern Libya: Generally under the control of the House of Representatives (HoR)/Libyan National Army (LNA), with Islamist militant pockets of control.
  • Central Libya: Convergence of control by LNA, Petroleum Facility Guards (PFG) and pro-Government of National Accord (GNA)/General National Congress (GNC) forces, with Islamist militant pockets of control.
  • Western Libya: Presence of forces that support the GNA and others that support the GNC, with a pocket of LNA control.
  • Southern Libya: Generally ungoverned territory with heavy presence of tribal militias who hold shifting alliances.

See below, “Actors and Interests”, for a more in-depth discussion of the major players.

Rivalries and Alliances in Libya

Forecast: Militancy and Fighting

Eastern Libya: Status quo likely to continue

  • Despite its unprecedented recent successes, the LNA has suffered some local setbacks, namely the inability to hold areas that it “liberated” in Ajdabiya in March-April, as is manifested by the renewed militant territorial presence and operational capabilities in and around the city. These are likely the result of the LNA’s need to engage in several active fronts that are also physically distant from each other at the same time, thus forcing the LNA to overstretch its resources. Moreover, the LNA’s airpower, one of its main leverages, is inconsistent in its operations due to faulty maintenance (as a result of lack of proper resources) and overuse. Moreover, in Benghazi, the primary area of operations for the LNA currently, the LNA faces persistent challenges in operating in a dense urban area and among civilians, a weakness often successfully exploited by militant groups that battle the LNA.
  • Lastly, the recent exposure of the French military presence in Libya prompted widespread local opposition, mainly from (but not exclusive to) civilians in Misrata and Tripoli, as well as the Grand Mufti, and is expected to cause opposition from the local population, as well as political complications. In the long term, that may mean that France will have to scale back its missions in Libya, or possibly entirely withdraw from the country, which will have particularly adverse effect on the LNA, France’s main beneficiary in Libya. These factors combined will likely result in a general status-quo of fighting in the east in the coming period, with the LNA making advances in certain areas, however at the expense of losing grounds or influence in other areas.

Central Libya: Misrata forces likely to eventually seize control of Sirte; factional fighting possible over coming months

  • As opposed to the east, in the Sirte Basin, pro-GNA forces (mostly in the form of militia groups from Misrata) were largely not required to fight in several different, far-removed focal points.  As a result of this, along with an at least temporary alliance struck with the PFG in the east of the basin, pro-GNA forces were therefore able to focus their forces to the maximum effect against IS and achieve far-reaching results. Given that IS’s main fighting forces have mostly been contained to a small area, which is besieged from all sides, we do not assess that it currently has the capabilities to break the encirclement and reverse Misrata’s achievements. The latter will likely opt to generally maintain the siege for the coming period in order to avoid high casualty tolls that are attributed to fighting in urban terrain, and will likely mostly bombard the city with air and artillery forces. With this in mind, unless something unexpected – such as premature renewed fighting with the LNA or PFG occurs, we assess that Misrata’s capabilities in ultimately capturing Sirte will remain high.
  • However, it is important to mention that while IS’s capturing and expansion of territory in the Sirte Basin since February 2015 served to temporarily mitigate hostilities between the LNA and the then-Libya Dawn, whose main focal point of fighting prior was the control over oil facilities in the Sirte Basin, and mainly the oil terminals along the coast. In this context, the eventual removal of IS as a major threat may in fact reignite fighting (depending also on the political situation at the time) between the LNA, Misrata, and the PFG over the control of the numerous valuable energy resources in the area.
  • Indications of this were already apparent in early May, when forces from Misrata and the LNA, maneuvering to positions prior to launching an offensive against IS, briefly but intensely clashed with each other near Zillah and its nearby oil fields.   This is particularly likely since oil and gas, which are abundant in the Sirte Basin, are Libya’s main exports, even at the significantly reduced current output, and are therefore a key factor of income, thus rendering the control of energy facilities instrumental for any actor seeking influence in Libya.
Islamic State photos of fighting with Misrata during siege of Sirte, July 2016
Islamic State photos of fighting with Misrata during siege of Sirte, July 2016

 

Western Libya: Outbreak of fighting between rival militias possible over coming months

  • Despite the GNA’s arrival in Tripoli and the subsequent large support base they were able to rally among local militia, the fractioned nature of the “military” structure in the west, which also characterized the previous Libya Dawn coalition of militia forces, persists. This results in occasional, intense, fighting between militia groups both in Tripoli and its surrounding areas, including between those that seemingly operate under the same group, over a variety of issues including control and patronage of areas, dominance over smuggling routes, as well as over local disputes, in addition to fighting that occurs between militias of rival political affiliation, namely the GNA and GNC loyalists. This situation is underscored by the most recent fighting in Garaboulli, 60 km east of Tripoli, on June and 21 which resulted in at least 29 deaths and dozens of wounded.
  • Moreover, fighting intermittently occurs between militia groups that support the LNA and the HoR, and those that support the rival factions, along the “border” west and southwest of Tripoli. The presence of pro-LNA forces in such relatively close proximity to Tripoli, in addition to the fragility of the political situation, runs the risk of an expansion in hostilities over the coming six months, particularly since multiple LNA commanders have announced in the past that their “ultimate goal is Tripoli”. This risks will be significantly heightened should hostilities between the LNA and pro-GNA forces in the Sirte Basin be resumed, potentially resulting in a spiral effect that will renew a nationwide state of hostilities such as the one that was prevalent in Libya approximately one year ago.

Countrywide Militancy: IS losses may lead to more high-profile attacks by group, while regional competition with AQIM may lead latter to exploit such losses

  • Despite the proliferation of militant groups in Libya, these organizations are mostly invested in maintaining their activity around their current areas of operations, namely in and around Derna, Benghazi and Ajdabiya. An exception to these is IS, who has both the interest and the proven capabilities to operate across Libya, and has in fact conducted attacks across the country in recent months. While IS’s loss of territory, material, and personnel first in Sabratha (west of Tripoli) in March, then in Derna in April, and finally in the Sirte Basin since June, has significantly impaired their resources base and operational capabilities, this exact same process may lead the group to conducting more high-profile attacks. This is in order to maintain the group’s diminishing prestige and project an image that it is still relevant despite its losses, both regionally and globally, due to its setbacks in Libya, as well as in Syria and Iraq.
  • Moreover, al-Qaeda in the Islamic Maghreb (AQIM), who is a regional competitor of IS and draws from similar recruitment and funding pools, also has an operational presence in the country and may seek to take advantage of IS’s current setback to increase their own influence in the country, which will be manifested by militant attacks. In this context, while the frequency of militant attacks has declined in recent weeks, in the long term, the increased motivation and remaining capabilities of the numerous militant factions serve as indications that attacks may occur nonetheless. In light of precedent and the global jihadi groups’ strategies, such attacks are likely to prioritize strategic locales such as the energy sector (as noted before), as well as foreign companies and diplomatic missions, to further damage the economy, aggravate the instability of the state, and capitalize on the resultant void that allows militants to prosper.
UAV footage of Islamic State SVBIED attack in Benghazi, July 29, 2016
UAV footage of Islamic State SVBIED attack in Benghazi, July 29, 2016

 

Forecast: Political Stability

Political competition likely to persist between rival governments, increasing fractured nature of country

  • Since its arrival in Tripoli, the Presidency Council of the GNA has successfully expanded their sphere of influence in western Libya. That said, their influence was generally unsuccessful in breaching into the east of the country, which is still mostly under the auspices of the HoR. Furthermore, there is a common perception by locals of the GNA as being foreign installed and directed, which was likely aggravated by the “invitation” of US airstrikes and foreign intervention in Libya. This image significantly impairs the GNA’s domestic credibility, despite being presented as the unity government of Libya.
  • The rift between the GNA and HoR is aggravated by the continued inability of the HoR to hold a vote to ratify the GNA, which is perceived by the latter as an intentional move to diminish its legitimacy. Additionally, the fact that the GNA continues its own implementation despite not being vetted by the HoR is perceived by the latter as an act of marginalization of the body, which is set to be the legislative authority of the unity government. Most recently, political rivalries peaked when, following an agreement in late July between the GNA and PFG to reopen the major oil terminals in central Libya in late July, the HoR threatened to attack vessels entering Libyan territorial waters without the latter’s authorization.
  • In this context, the HoR will likely continue to fail meeting voting deadlines on the ratification of the GNA, as it postpones the latter’s full implementation without outright rejecting it. This, in turn, blocks what some of the HoR members perceive as a challenge to their aspirations of sovereignty, without attracting the negative international attention and potential ramifications that will accompany an official vote against what at least the UN perceives as a unity government. Should this process persist, it is liable to prompt the Presidency Council to continue to construct the GNA without ratification, which in turn will further discredit its domestic status and sanction political opposition to it. This will likely eventually lead to the GNA establishing their primacy in the west, but remaining a second government in Tripoli and western Libya vis-a-vis the HoR, mostly in the east.
  • That being said, it cannot be ruled out that the HoR will eventually ratify the GNA. However, even without the political branch’s dichotomy, Libya’s institutions, and more importantly its various fighting groups, still hold many conflicting interests and ideologies, along with personal animosities between leaders of these groups, which will significantly challenge the implementation of a full unification of Libya. Taken as a whole, the most stabilizing potential outcome for Libya, and the one that seems least likely at the time of writing, will see a single domestically and internationally recognized government which struggles to exert its full control over Libya, in which various competing groups will still clash with each other to maintain their respective interests. However the most likely track at this time, which will maintain and possibly exacerbate Libya’s instability, is one in which the GNA continues to compete with the HoR, and to a lesser degree with the GNC, over full control of Libya, in effect resulting in a fractured state.

Actors and Interests

Political Actors

  • Government of National Accord (GNA): Currently based at the Tripoli Naval Base, the GNA is intended to be a unity government and is a product of the Libyan Political Agreement (LPA) signed in December 2015. The LPA allows for the transition of the House of Representatives (HoR) and General National Congress (GNC) into the GNA’s legislative body and advisory State Council, respectively. However, this transition must be ratified of a vote of a special majority by the HoR, which so far has not been able to convene the needed quorum for such a vote. During this continued transition period, the GNA is currently considered the “internationally recognized” government and enjoys the support and the backing of the UN. Its sphere of influence is fractioned mainly throughout western Libya, particularly in greater Tripoli and Misrata.
  • House of Representatives (HoR): The previously “internationally recognized” government, the HoR’s parliament is based in Tobruk and executive branch in al-Bayda. Its sphere of influence is generally in eastern Libya, with some pockets of support in the west, particularly southwest of Tripoli. The HoR is currently supported politically, militarily, and economically by several countries, most prominent the United Arab Emirates (UAE) and Egypt. While these countries generally recognize and support the LPA, they capitalize on the fact that the HoR has not ratified the agreement as pretext to consider it non-valid at this time, in order to continue supporting the HoR and not the GNA.
  • General National Congress (GNC): The GNC previously controlled the majority of western Libya and is now mostly defunct, mainly since some of its members unilaterally broke away in early April and started fulfilling the role of the State Council, despite the GNC leadership’s opposition. While the GNC currently has very little political power, it still enjoys support from various militias, as well as from Grand Mufti al-Ghariani, thus retaining a partial sphere of influence in the west, particularly in Tripoli and its surrounding areas. Both Turkey and Qatar originally supported the GNC, but this support has diminished since the start of the GNA’s implementation.
  • Other groups: Both the ungoverned and the governed areas of Libya are dominated by politics based on tribal, clan, and ethnic backgrounds, as well as place of residence and origin. In this sense, it is not uncommon for cities that both support the same political body, to be at odds due to historical or other rivalries among their residents. Similarly, militias from the same city who support the same political organ may have a strife over tribal or other rivalries.

Militia and Militant Groups

Dozens of militia and militant groups currently operate in Libya, each with its own ideologies, interests, and political allegiances. Very broadly, these groups are categorized into six different competing factions, with rivalries persisting even within some.

  • Militia groups that support the Libyan National Army (LNA), which is commanded by Lieutenant General Khalifa Haftar and holds patronage relations with the anti-Islamist House of Representatives (HoR). Mainly fighting in the east of the country, with pockets of support in the west. Their main areas of operations currently are around the city of Derna, in Benghazi, in and around Ajdabiya, as well as the area between Benghazi and Ajdabiya.
  • Militia groups supporting the UN-backed Government of National Accord (GNA), based at Tripoli Naval Base. Currently engaged in an ongoing campaign to remove the Islamic State (IS) from the city of Sirte (represented primarily by forces from Misrata), as well as taking part in intermittent inter-militia fighting in western Libya.
  • Militia groups, formerly known as the Libya Dawn coalition, supporting the pro-Islamist General National Congress (GNC), based in Tripoli. While mostly defunct, they still retain some fighting capabilities which are mostly invested in fighting rival militias, mainly those that support the GNA, in Tripoli and other areas in western Libya.
  • Petroleum Facility Guards (PFG), an independent faction that holds shifting alliances (currently allied with pro-GNA forces), however ultimately strives for its own goal of a federalist Libya. Currently is seldom fighting and mostly retaining its forces. Was briefly involved in operations against IS east of Sirte in cooperation with Misrata.
  • Islamist jihadist groups such as the Islamic State (IS), as well as additional ones that hold varying levels of connections to al-Qaeda, the GNC and/or the Grand Mufti of LibyaSadeq al-Ghariani, including Ansar al-Sharia, Revolutionary Shura Council of Benghazi (RSCB), Mujahideen Shura Council of Derna (MSCD), and others. Hold territory and operational capabilities mainly in and around Derna, Benghazi, Ajdabiya and Sirte.
  • Tribal militias, mostly consisting of either Tebu or Tuareg ethnic tribes, who may be at times supported by fellow tribesman from neighboring countries, and hold shifting allegiances towards the various players. Operate mainly in the ungoverned territories in southern Libya, in proximity to the border with Egypt, Sudan, Chad, Niger and Algeria.

International Actors (Non-Regional)

Numerous international actors have either confirmed their military presence on the ground in Libya in support of either of the factions, or have indications pointing to such activity by them without official confirmation at this time. This is in addition to indirect actions such as the ongoing Operation Sophia to counter illegal immigration, an actions by regional actors such as Egypt, UAE, Turkey and Qatar which will be mentioned in the political stability section. The main international actors are:

  • The United States: On July 19, Chairman of the Joint Chiefs of Staff General Joseph Dunford confirmed that the US has routine and ongoing operations in Libya that are coordinated with the GNA, as well as other operations that are not coordinated with them, without specifying their nature. Later, on August 1, the US Department of Defense (DoD) announced that US aircraft targeted IS positions in Sirte on August 1, at the request of GNA leadership. In addition, the DoD stated that further airstrikes targeting IS in Sirte would be conducted in support of “GNA ground operations”. There are many indications of US ground and aerial operations in areas both under GNA (and previously GNC) control as well as in HoR territory. The most prominent evidence of US ground presence in Libya emerged as early as December 16, 2015, when a Special Operation Forces (SOF) team sent to advise the LNA was expelled from al-Watiyah Airbase by local militias, compelling the DoD to confirm that the US military is dispatching “advisors” toLibya.
US Special Operations Forces team at Libya's al-Wattiyya Airbase, December 2015
US Special Operations Forces team at Libya’s al-Wattiyya Airbase, December 2015

 

  • Italy: Provides frequent and overt logistical support primarily to the city of Misrata, most often in the form of medical evacuation of both civilians and combatants wounded by IS actions. There are local reports of regular presence of Italian SOF teams providing training, advising and liaison with locals, however these remain unconfirmed at the time of writing.
  • France: On July 17, an Islamist militant group claimed to have shot down an LNA helicopter carrying Libyan, French and Jordanian nationals. While there are conflictingreports regarding the type of helicopter and the reasons for which it crashed, on July 20 French President Francois Hollande confirmed that three French operators were present aboard a helicopter that crashed due to technical reasons in Libya; reports additionally indicate that the three were Directorate-General for External Security (DGSE) agents. This announcement accounts for the first official and public admission of direct French operations in Libya, while local reports regarding relatively large scale French presence and operations in Benghazi circulated since February.
Wreckage of helicopter likely carrying French operators, al-Muqrin, July 2016
Wreckage of helicopter likely carrying French operators, al-Muqrin, July 2016

 

  • United Kingdom: There are various local reports regarding direct British involvement in assisting Misrata forces in their campaign against IS in Sirte. While unconfirmed reports suggest that UK forces directly engaged IS forces in certain instances during May-June, both on the ground and with use of airstrikes, Misrata’s military spokesmen stated that the UK is only providing intelligence support, including by operating tactical unmanned aerial vehicles (UAVs), as well as in advising local forces.
  • Russia: On May 1, the LNA’s official spokesman announced that the LNA’s operations are assisted by Egypt, the UAE and Russia. This accounted for the first official recognition of Russian involvement in Libya. While there is little open source information regarding potential Russian operations in Libya, on January 31, a Russian Orlan-10 tactical UAV crashed near Ajdabiya, an incident that remained unexplained since and may serve as an indication for such ground operations.
Photo of Orlan-10 tactical UAV after crash east of Ajdabiya, January 2016
Photo of Orlan-10 tactical UAV after crash east of Ajdabiya, January 2016

 

DISCLAIMER: Please note that any views and/or opinions and/or assessment and/or recommendations presented in this text are solely those of Max Security. If you are not the named addressee you should not disseminate, distribute or copy this text. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Max Security Solutions accepts no liability for (i) the contents of this text/report being correct, complete or up to date; (ii) consequences of any actions taken or not taken as a result and/or on the basis of such contents.  Copyright – 2016 Max Security

Is your contingency plan a best-practice model for others?

Or is it an example of how NOT to plan for any contingency?

Here’s a good rule of thumb: The best time to create a contingency plan is not when danger is already at the door and the time has come to operationalize that plan. That applies to any business in any environment. But never more so than for the many Multi-National Corporations (MNCs) that conduct business in countries such as Turkey, for example. There, the threats are fluid and increasingly frequent, and MNCs need to plan carefully for virtually any contingency.

Terrorism and violent extremism are on the rise. They are reaching into major business hubs in Turkish cities, including Ankara and Istanbul. And more and more, extremists are looking at commercial sites as attractive targets. Worse still, it is growing increasingly difficult to pinpoint the dangers, because there is no single terrorist

player in Turkey. The Islamic State (IS), the Kurdistan Freedom Falcons (TAK), and the Kurdistan Workers’ Party (PKK) have all staged sophisticated, large-scale attacks since the year began. And the situation is made even more perilous because the extremists are hostile to one another, as well as to Western interests. Even if they are not direct targets of one extremist group or another, MNCs might find themselves caught in the crossfire, in effect.

And it is likely to get worse before it gets better. An analysis by MAX published in April documented a pattern of increased terrorist activity in Turkey’s urban tourist and commercial sites, including Istanbul, the gateway and hub for many MNCs. The terrorist’s aim? Disrupting investment in the Turkish economy by creating uncertainty.

The risks don’t begin and end with violent extremism. It’s a stark reality. In today’s world, business continuity might depend – at any moment – on a comprehensive contingency plan. And targeted extremist violence is not the only example of potentially disruptive events. Obviously, war in neighboring Syria and Iraq has direct and dramatic repercussions in southeastern Turkey. But businesses anywhere also have to position themselves to successfully manage operations when faced with a natural disaster, an outbreak of disease, a full-scale war, or even operational interruptions caused by political turmoil or corruption.

A solid contingency plan allows them to do that, as MAX Chief Consulting Officer, Mr. Ital Dar, explains:

The contingency plan enables a client to minimize the need to invent decision-making during a stressful time. Instead, it relies on pre-defined protocols that assist in solving the situation efficiently while minimizing damages to the company’s business continuity.

Does the situation call for a business to evacuate temporarily, moving staff to a safe location where it can continue its operations? Or, is the threat so dire that it is necessary to leave the country altogether? And if it is, what is the best way to maintain business functions? Arriving at the answers in advance – and with a cool head – means decision-makers don’t have to improvise solutions at the worst possible time, according to Mr. Ital Dar: “Being fully prepared to evacuate if necessary, and knowing when and how to do it without jeopardizing safety and business continuity unnecessarily, is one good example of what a contingency plan can do”.

And a contingency plan must do plenty more as well It begins with extensive information gathering, and thorough research into potential risks and threats, in order to create customized risk assessments and solutions for each client. That process is a 360-degree exercise. It has to take into account the unique circumstances, operational resources, and objectives of the client, of course. But it also must consider broader cultural, geopolitical, and local dynamics that can affect a sensitive situation, factoring in numerous variables to help the client develop both short- and long-term responses to disruptions. From there, it has to extend into provisions of training for management and employees to ensure that they will be prepared to adhere to and implement the plan in a crisis situation.

And it has to be developed with the understanding that plans can change, because circumstances can change. An effective contingency plan example is one that recognizes that contingency, too. It should provide for continuous situation analysis and create a core team that is able to react quickly to a changing environment without losing sight of essential goals. It needs to identify the full range of security resources that will be needed to put the plan into effect, from custom Intel to logistical support, secure transportation, medical assistance, or other necessary services.

Obviously, the complexities of each tailored contingency plan mean that no one example can spell out all of the considerations. But there is one more consideration that no comprehensive plan can afford to overlook. It has to equip the client to continuously monitor the myriad factors that can hint at trouble.

No plan can help, after all, unless the signs of an impending crisis are recognized in time to set it in motion.

Read more about MAX Physical Security Audit Reports & Risk Assessments

Philippines Alert: Islamic State claims ‘soldiers of caliphate’ killed 40 AFP troops in Basilan while AFP reports one dead; indicates IS Asia pivot

TYPE OF INCIDENT ► Militancy
AFFECTED AREA ► Sulu, Basilan, Philippines
RISK LEVEL & SEVERITY ► EXTREME
STRENGTH OF SOURCE ► Confirmed

MAX.Philippines2.July10_0Focal points in Sulu Archipelago

level_risk
Click here to see Map Legend

Please be advised:

  • The Islamic State (IS) issued a statement on July 9 claiming that 40 soldiers from the Armed Forces of the Philippines (AFP) were killed in clashes with ‘soldiers of the caliphate’ on Basilan Island in the Sulu Archipelago over the past nine days, as the group states that fighting is still ongoing between its affiliate groups and the AFP. The group also claimed to have captured two checkpoints from the AFP. However, according to AFP claims, only one soldier was killed and six others injured as troops engaged in fire with Abu Sayyaf units, comprising of approximately 130 gunmen, near the Sulu town of Patikul.
  • Reports from June 24 indicate the release of an IS video encouraging radicalized Southeast Asians to go to the Philippines. A man identified by Malaysian authorities to be Mohd Rafi Udin, a Malaysian national believed to be in Syria, stated that those who could not reach Syria should take up arms against “worshippers of the cross” in Philippines and resist the “deceptive tactics” of President elect Rodrigo Duterte.
  • Meanwhile on July 8, President Rodrigo Duterte commented that he does not view Abu Sayyaf as a criminals, claiming that they were driven to radicalization by the failed peace process between the Moro Islamist movements in the southern Philippines and the government in Manila. Reports on July 6 indicate that airstrikes and ground operations were launched against Abu Sayyaf and its leader Isnilon Hapilon in Tipo-Tipo, Basilan Province on July 3.

MAX.ISCLAIM.July10Original claim taken from Islamic State media

Assessments

  1. The conflicting numbers claimed by IS and the AFP are indicative of an ongoing propaganda struggle between both sides in the wake of the July 3 offensives against the militant group’s affiliate Abu Sayyaf. While IS claims remain unconfirmed, the recent video calling for radicalized Southeast Asians to join the fight in the Philippines, as a an alternative to joining the IS cadre in Syria, indicates a series pivot towards Southeast Asia by IS high command in the Middle East, using local affiliates. Furthermore, the use of the phrase ‘soldiers of the caliphate’, indicates that IS see Abu Sayyaf members as fighting for the Islamic State to create a global caliphate and not just as an allied group. In line with that objective, the group may likely continue to release controversial media to bolster local participation within its affiliates and increase its operational presence in the region, while continuing to carry out attacks against AFP forces. Moreover, the fighing in Sulu, as well as ongoing reports of Abu Sayyaf kidnappings in the region, serve to illustrate an intensity in the group’s regional operations.
  2. Despite the known operational capabilities of Abu Sayyaf, and the declared IS support for the group, it remains unclear how much direct communication there is on a regualr basis between Sulu and Islamic State high command in Iraq-Syria. Nonetheless, the aforementioned fighting and claim are indicative of a significant Islamist militant threat in the Sulu Archipelago. Furthermore, following AFP’s seeming inability to eradicate Abu Sayyaf in the area as well as Duterte’s comments that indicated some level of empathy for the members of the group, despite IS affiliation, it remains unclear what strategy his administration will adopt towards the group; whether a continuation of the current offensives in Basilan or attempts to negotiate. In that regard, we assess that clashes between the AFP and Abu Sayyaf are likely to continue rendering the areas around the Sulu Archipelago at an extreme risk of militancy.
  3. Finally, given past precedent noted in the Middle East, we can assess that following the IS call for militants not to travel to Syria, but to relocate to the Philippines, in order to help Abu Sayyaf in Southeast Asia, it is likely that there will be a significant influx of foreign fighters to the region over the coming months. This assessment is underscored by increases in foreign fighters in the Sinai and Libya, following IS calls for recruits.

Recommendations

  1. Travel to Metro Manila may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest.
  2. We advise against all travel to the Sulu Archipelago, including the islands of Basilan, Jolo, and Tawi Tawi, over the coming days and weeks, given the high threat of militancy and ongoing clashes between Abu Sayyaf and the AFP.

 

Read more security blog posts

Turkey Special Report: The Attack at Istanbul’s Ataturk International Airport

This report was written by:
Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from of the Israeli intelligence community

Roshanna Lawrence – MAX Security’s Associate Director of Intelligence, Middle East & North Africa

Garrett Krivicich – MAX Security’s Senior Analyst on Turkey

Asaf Day – MAX Security’s Senior Analyst on the Eastern Mediterranean

Executive Summary

Three suicide bombers of Russian and Central Asian descent launched a well-planned and coordinated attack, detonating themselves at Istanbul’s Ataturk International Airport during the evening hours of June 28 and causing the deaths of 41 people and wounding of 239 others.

While no claim of responsibility has been released at this time, we assess that the Islamic State (IS) is responsible for the attack, given the sophisticated modus operandi of the incident, namely a coordinated attack in three separate locations, including a diversion stage, as well as the target, which is an international hub for foreign nationals.

Current Situation

Description of event
Three suicide bombers detonated themselves at Istanbul’s Ataturk International Airport during the evening hours of June 28.  Reports indicate that at approximately 22:00 (local time), the assailants arrived by taxi at the international terminal’s arrivals hall.  One militant remained behind in the parking lot and aroused police suspicion; he began shooting at police and then detonated a suicide belt.

As security forces gathered around the scene of the first blast, in the chaos, the two other attackers were able to enter the international terminal: One at the arrivals hall terminal, and the other upstairs to the departure hall.

The second and third explosions reportedly took place at the arrivals and departures halls, where each attacker attempted to pass through security and began shooting, engaging with security forces before separately detonating themselves.

Coordinated Attack at Istanbul’s Ataturk International Airport

 

Description of attackers
The attackers were reportedly from Russia’s Dagestan region, as well as from Uzbekistan and Kyrgyzstan, and they were armed with standard AK-47 assault rifles.  However, a local knowledgeable source speaking to us stated that one carried a Glock pistol.

Furthermore, the same source stated that one assailant arrived to Turkey one year prior to the attack and then traveled to Syria’s Raqqa Province for training, while the two others joined him several months later. After a period of training, the three returned to Istanbul.

Death tolls
At the time of writing, 41 people have been killed, and 239 others were wounded as a result of the attack. Of these deaths, at least 13 were foreign nationals, including from Ukraine, Iran, Saudi Arabia, Iraq, Tunisia, Uzbekistan, China, and Jordan.

Security operations
Reports indicate that during the overnight hours of June 29-30, Turkish security forces arrested 13 people during counter-militancy operations in Istanbul, include three foreign nationals of unspecified nationality.

Airports update
While airport operations, including all arriving and departing flights, were suspended following the attack, the airport was reportedly reopened for limited traffic at 02:20. Initial flights began arriving and departing at 05:00. Multiple flights had also been redirected to Istanbul’s Sabiha Gokcen International Airport and Izmir’s Adnan Menderes Airport at the time of the incident.

While at this time, Istanbul’s Ataturk International Airport is open to regular air traffic, various delays were reported throughout June 29 due to intensified security measures in and around the airport. This includes additional security force deployments to the airport.

Assessments

Sophistication of multi-pronged attack indicates Islamic State (IS) responsibility
The attack comes amidst an escalated threat of militancy throughout Turkey, with multiple large-scale acts of militancy recorded in central locales since the beginning of the year. Most recently, this includes a suicide car bomb explosion at Istanbul’s Beyazit Square on June 7. That said, the multi-faceted attack at Istanbul’s Ataturk International Airport remains highly notable, given its status as the third largest international airport in Europe, with nearly 42 million people traveling through the airport in 2015, as well as the large number of foreign nationals traveling through this locale. With this in mind, the attack was likely intended to target tourist interests in order to gain more publicity and severely damage Turkey’s economy, which largely thrives on tourism.

While no group has claimed responsibility for the attack as of yet, we assess that it was likely carried out by militants belonging to the Islamic State (IS). In this context, IS, dependent on its image for support and recruitment, likely seeks to conduct spectacular attacks globally at this time due to the setbacks the group is facing in Iraq, Syria, and Libya.  The threat of attacks is further elevated at this time due to Ramadan, which marks the anniversary of the founding of the caliphate.

IS’s responsibility for the attack is supported by the sophisticated modus operandi of the incident, namely a coordinated attack in three separate locations, including a diversion stage, as well as the target, which is an international hub for foreign nationals.  The attack involved shooting followed by suicide bombings, a common tactic of the jihadist militant group. This assessment is bolstered by the IS attack plot foiled in Istanbul that we reported on June 18, when security forces seized suicide vests and assault rifles in the city’s Pendik and Basaksehir Districts, indicating plans for the use of an identical tactic. In addition, it is important to note the similarities between this attack, and the attack carried out by IS in Brussels on March 22, where three suicide bombers also attacked the city’s airport, as well as opened fire on civilians with assault rifles prior to detonating themselves. This overall strategy, as well as choice of weaponry, continues to highlight the jihadist group’s modus operandi when carrying out such large-scale attacks.

The attack was planned well in advance and followed a long period of intelligence-gathering to include on-ground reconnaissance at the airport.  The event further displayed a high level of coordination and sophistication, as militants detonated themselves at three different points at the airport, two inside the terminal and one outside. This was likely an attempt to split security forces’ response and increase the potential that at least one attacker would successfully breach the airport’s security measures. This is further underscored by reports that the attacker in the parking lot detonated first, drawing security forces to the area, as well as creating a bottleneck of people near the entrance to the terminal.

Moreover, after thorough review of video footage and images of the attack, we conclude that the assailants demonstrated a high level of proficiency in use of their assault rifles and were well-trained. This is further exemplified by their reported training in Syria. Also, as seen with the jihadist group’s previously claimed large-scale attacks, namely Brussels and the Paris attacks on November 13, 2015, the assailants’ tactics demonstrate that they were attempting to inflict mass casualties. With this in mind, the incident at the airport demonstrates a repeating modus operandi of high-volume attacks at the entrance halls of airport terminals, which are accessible relative to the heavily guarded sterile areas of airports, additionally highlighting the vulnerability of the long lines caused by security measures to these areas.

The attack comes one week after the arrest of the June 18 IS cell in Istanbul, which included two individuals of Russian descent. This further indicates the existence of a well-established IS infrastructure in the vicinity of the city, well-connected to IS’s central leadership and recruitment network. In this context, the fact that the attackers were from Uzbekistan, Kyrgyzstan, and Russia’s Dagestan area suggests that the individuals were directed by the central organization to establish a cell in Turkey. This further indicates the potentially growing radicalization of Muslim individuals in these countries, particularly in Russia’s predominantly-Muslim populated regions in the Caucasus, which experiences Islamist militant activity.

While suspected IS-linked attacks have been conducted in Istanbul before, including a suicide bombing along Istiklal Caddesi on March 19, and another at Sultanahmet Square on January 12, none of them have been officially claimed by the jihadist group. This was likely in order to avoid a general large-scale conflict with Turkey, and to prevent alienating potential IS sympathizers within the Turkish populace. However, the sophistication of the attack and notability of the target suggests that the jihadist group may claim responsibility for the incident in the near future. Furthermore, the worldwide attention granted to this attack, as well as its spectacular method is likely to serve as an inspiration and role model for additional militant groups in Turkey and worldwide.

Successful attack underscores challenges for Turkish security apparatus; heightened security measures likely to be implemented
The incident underscores difficulties faced by Turkish security forces in mitigating all threats presented by the multitude of militant groups operating within the country, even at locales deemed heavily secured. Security forces face challenges in profiling suspected IS members due to the diverse nationalities comprising the group’s affiliates. It is noteworthy that militants were likely attempting to cross through the first security checkpoint to stage attacks deeper within the airport’s terminal but were prevented by the security forces, preventing a much larger-scale attack from materializing. That said, it is notable that the security personnel were distracted and concentrated their efforts to one area, namely the parking area where the first attacker detonated, more easily allowing the other two attackers to enter the airport.  It is further notable that as demonstrated by the attack footage, after one attacker was shot and wounded by a police officer inside the terminal, falling to the ground and dropping his rifle, several seconds passed until he detonated his explosive belt, time during which the officer could have neutralized him.

Following this incident, Turkey’s security apparatus will likely adopt a series of heightened protocols in order to mitigate further threats. This includes intensified security measures in and around Istanbul’s Ataturk International Airport, including checkpoints entering and exiting the airport’s grounds, as well as additional security checks within the facility itself. These security protocols will also likely be extended to other major airports and transportation hubs throughout the country. Finally, security forces will likely enhance security measures in Istanbul and in other centralized locales throughout the country, including Ankara and Izmir. This is likely to include further arrest raids of suspected militant hideouts, and checkpoints to and from these major cities.

With this in mind, Turkish security forces will likely consider more forceful measures in retaliating to the attack and responding to the threat presented by the militant group in general. This will likely include an increase in airstrikes against IS’s positions in northern Syria. Additionally, Turkish authorities may consider conducting cross-border operations between Turkey and Syria to better secure the porous border and prevent IS militants from entering the country. Last, Turkish authorities may reconsider a proposed “safe zone” in northern Syria to further damage IS capabilities in Syria.

 

Recommendations

  1. Those operating or residing in Turkey are advised to contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support options.
  2. Those planning to travel through Turkey’s airports, specifically Ataturk International Airport, should allot for heightened security measures and long lines, extending the time needed for pre-departure.
  3. Travelers on connecting flights are advised to avoid unnecessary travel outside the secured zones of the airport.
  4. Avoid unnecessary confrontations with security forces, due to their heightened tensions and alertness across Turkey.
  5. Allot for checkpoints and heightened security measures nationwide.

 

Read more posts like this in Max Security Blog

Tunisia: Implications of the Sousse attack, and why Government Countermeasures May Be a Shot in the Foot

By: Oded Berkowitz

 

On June 26, a militant disguised as a tourist came ashore the beach at Sousse’s Port el Kantaoui, drew an assault rifle hidden in a beach umbrella and opened fire, deliberately targeting foreigners. 38 tourists hailing from the UK, Ireland, Germany, Belgium, Russia, and Portugal were killed, while 39 individuals were wounded, including seven local employees. The attack was subsequently claimed by the Islamic State (IS) organization, and seems to indicate the group’s intention to lay the foundations towards an eventual expansion of its operations in Tunisia. Worryingly, IS’s plans may actually benefit from the Tunisian government’s response to the attack, as the emergency measures being undertaken to “defeat terrorism” also alienate the population and may serve to weaken the government’s legitimacy.

 

In the immediate aftermath of the Sousse shooting, Tunisian President Beji Caid Essebsi initiated an emergency plan intended to reduce the threat of militancy in the country. The plan included closing down 80 mosques perceived as “inciting to violence”, offering cash rewards for information that will lead to arrests of “terrorists”, calling up the Tunisian Armed Forces (TAF) reserves to intensify counter-militancy operations in the outlying regions of the country, as well as bolstering the deployment of security forces near prominent tourist attractions and beaches. Moreover, on July 4, Essebsi declared a 30-day state of emergency for the first time since March 2014. The state of emergency allows the government to restrict freedom of movement, freedom of gathering, and grants it the authority to seize goods and to close down places of business. In his speech to the nation, Essebsi justified his decision by stating that Tunisia is in a “state of war” and that “one more attack may cause the state to collapse”, while also criticized demonstrations that disrupt the production of phosphates as helping the militants’ agenda by discouraging foreign companies from investing in the country.

 

The June 26 attack in Sousse represents the second large scale militant attack in Tunisia claimed by IS, following the Bardo Museum attack in Tunis, and the largest one in the country to date. This, in turn, points towards a growing interest by IS in carrying out high-profile attacks in Tunisia, with the aim of deterring tourism and foreign direct investments, in order to destabilize the country’s economic situation. Moreover, given Tunisia’s successful democratic transition following the parliamentary and presidential elections in 2014, it is likely that IS is intentionally attempting to provoke a reaction from the government, much like the state of emergency, that will be perceived by the citizens as infringing on their rights, thus further destabilizing the political and social situations as well. This was already seen in early July when clashes between security forces and local residents manifested as the former attempted to close down a mosque.

 

Should IS be successful in its plan, it will allow the group to broaden its foothold in the country through the outlying regions, where citizens already feel marginalized by the government given the high unemployment rates, poor infrastructure, and lack of government investments in these areas. Such regions are already considered strongholds for militant groups, in light of their favoring terrain and population, as well as proximity to the borders, which allows for cooperation with groups in neighbouring Algeria and Libya, as well as for escape routes in times of attacks.

 

That said, and despite the relative success of the attack in Sousse, it was probably conducted by supporters of IS, who were directed by officials from the organization to target tourists in Tunisia during Ramadan, but were relatively independent in implementation. This is based on the fact that the attack, much like the one in Bardo, was conducted by a single assailant with relatively simple means, and did not involve high grade explosives, a sophisticated and complicated plan, or other advanced capabilities. While such modus operandi is rare for groups that are considered an integral part of IS, it is common for those that aren’t yet accepted by the central organization as an official IS group or “Wilaya” (Province). With this in mind, it is possible that the Bardo and Sousse attacks were also meant as a “show of force” by these local supporters, in preparation for a future  pledge of allegiance to IS’s leader, Abu Bakr al-Baghdadi, and induction into the organization.

 

In this context, despite the likely long-term plans IS has for Tunisia, it is still in preliminary stages and far from commencing, particularly as the group currently views Libya as its top priority in the region. With this in mind, IS will invest more resources to compensate for its recent loss of Derna, the group’s first stronghold in Libya which is also perceived by it as its “capital” in the region, as well as to further expand its territory there, rather than in supporting efforts in neighboring countries like Tunisia. Thus, the Sousse attack was likely part of IS’ attempts to lay the foundations for expansion in Tunisia and further efforts to destabilize the country, which will be implemented by the group when it deems the timing is right.


Overall, while security forces have generally proven their ability to foil plans of attacks against foreign and civilian targets in the past, and that the emergency measures are liable to upgrade their capabilities in the short term,  some of the measures of Essebsi’s emergency plan, as well as in the declared state of emergency, may antagonize the population. This may cause more grievances between it and the government and ultimately make the plan counterproductive, as it may drive some locals to lend more support to the militants in the long-term. However, while only a relatively small portion of the population is expected to actively support the militants, among the remainder of the population, opposition to the government will substantially grow in light of the perceived violations of their civil rights. Thus, Essebsi’s plans may in and of themselves pose additional challenges to the stability of the state. Essentially, the Tunisian government is sacrificing its viability and credibility as the one true success story of the “Arab Spring” for a questionable addition to its immediate security, a move that may turn out to be a shot it the foot.

 

Oded Berkowitz is a senior intelligence analyst at MAX security, specializing in the North African region. Oded holds a B.A in Political Science and Middle Eastern StudIes and is currently pursuing graduate studies in Counter Terrorism and Homeland Security, while also serving as an infantry captain in the Israel Defense Forces. He can be followed on twitter at @Oded121351

MAX Analysis Egypt: January attack by militant group Wilayat Sinai underscores increased capabilities February 24, 2015

Executive Summary

  • The January 29 coordinated and simultaneous attack against multiple targets in northern Sinai, by the militant organization Wilayat Sinai, highlights an ongoing shift in militant tactics, as well as an upgrading of their capabilities and the potential for additional attacks.
  • Meanwhile, renewed accusations that the Muslim Brotherhood was involved in the attack and subsequent crackdowns on the group will likely continue to create a divide in the organization over the use of violence to “retaliate” against alleged police and military brutality.
  • This divide will likely perpetuate near-daily militant attacks across Egypt, while carrying with it the risk of further expanding the operational areas of “Wilayat Sinai” to Muslim Brotherhood strongholds and other regions across the country.
  • We advise against nonessential travel to Cairo and Alexandria at the time due to the persistent risk of militant attacks and civil unrest in major cities. Consult with us for itinerary-based travel recommendations.

Current Events in Egypt
On January 29, the Islamic State (IS) affiliate in Sinai, Wilayat Sinai (formerly known as Ansar Bayt al-Maqdis), carried out multiple coordinated attacks on several targets in Sheikh Zuweid, Rafah, and al-Arish, with the main attack carried out in the latter. In al-Arish, reports indicate that militants attacked the Egyptian Armed Forces’ 101 Battalion headquarters, as well as multiple other targets, including a local hotel, various checkpoints, and the security directorate. Militants used multiple car bombs, in addition to mortars and gunfire to overwhelm local security forces. Reports indicate that at least 32 people were killed and 100 injured. Wilayat Sinai claimed to have used more 100 fighters in the attack, as well as three explosives-laden vehicles, while claiming to have staged the attack during the night hours so as to “minimize” civilian casualties.

  • Additionally Egyptian President Abdel Fattah al-Sisi made a public statement regarding the January 29 attacks and unrest, vowing to defend Egypt’s Sinai against “terror” and stating, “I have said it before and I will say it again, we are fighting the strongest secret organization of the last two centuries,” likely referring to the Muslim Brotherhood. Reports indicate that al-Sisi also created a new military entity to combat militancy in Sinai, following a meeting held by the Supreme Council of the Armed Forces (SCAF). Al-Sisi reportedly named General Osama Roshdy, the current head of the Third Army, as the head of the entity and promoted him to Lieutenant-General.
  • Meanwhile, following the attack in Sinai, the Muslim Brotherhood issued a statement in English declaring, “We unequivocally condemn all acts of violence” and reaffirming the group’s “commitment to peaceful and political civil resistance”. However, the group also released an article on January 27, quoting Muslim Brotherhood founder Hassan al-Banna, urging its supporters to “prepare” for a new phase where “we summon all our strength and evoke the meaning of Jihad”. The statement also refers to the Secret Apparatus, a paramilitary operation created by al-Banna to fight the British mandate in the 1920s. The Muslim Brotherhood distanced itself from the organization on several occasions, and the existence of the organization remains subject to controversy. The Egyptian Ministry of Foreign Affairs released a document using the statement to show the Muslim Brotherhood’s alleged “double speak”.
  • A Turkish-based television channel, affiliated with the Egyptian Muslim Brotherhood movement, aired a statement coming from the “Revolutionary Youth” issuing an ultimatum to all foreign nationals in Egypt during the morning hours of January 31. According to the ultimatum, all foreign citizens should leave Egypt by February 11, all foreign companies operating in Egypt should close down by February 20, and all foreign diplomats should leave and close down their embassies by February 28. In addition, the warning was extended to all tourists planning to visit Egypt, saying they should cancel their plans as they are not welcome. According to the broadcast, whoever chooses to ignore the warning will be targeted.
  • The statement was then condemned by the Muslim Brotherhood in English; however, no such condemnation was issued in Arabic. The Egyptian authorities have reportedly requested that Turkey halt broadcasting the channel; however, unconfirmed reports suggest that no official complaint was lodged in Turkey at this time.

Assessments: Attack in al-Arish underscores heightened militant capabilities, while highlighting possibility for additional attacks in coming months

  • While attacks in the Sinai Peninsula have been carried out on a near-daily basis, the recent attack in al-Arish is notable as it underscores militants’ increased capabilities despite ongoing military operations and the deployment of troops in the Sinai Peninsula. A similar attack was carried out in Sheikh Zuweid on October 24, with militants detonating a car bomb at a heavily protected checkpoint near the city, placing roadside bombs near the site to prevent reinforcements from arriving and then storming the checkpoint with several vehicles and simultaneously firing rocket propelled grenades (RPG). Such attacks underscore militants’ ability to gather intelligence, predict Egyptian military tactics, and carry out multi-stage attacks meant to overwhelm the main military strongholds in the peninsula.
  • In this context, the October 24 and January 29 attacks underscore a shift in militant tactics. Militants had thus far used “hit-and-run” attacks against the Egyptian military, using either car bombs, roadside bombs, localized mortar or rocket attacks, or RPG and shooting attacks. However, the October 24 and January 29 attacks demonstrate  militants’ ability to efficiently use a combination of all of these techniques to maximize casualties. Furthermore, the attack on January 29 underscores militants’ ability to drag the Egyptian military into hours-long ground clashes, as well as their willingness to directly confront the military. Such tactics, which are also riskier for militants, are likely a direct result of the increased militarization of northern Sinai, as militants need to use heavier firepower to attack highly defended military positions. Furthermore, it is possible, in light of the group’s allegiance to IS, that several tactics developed and used in Syria and Iraq were learned by Wilayat Sinai from IS.
  • Despite statements from the military promising a harsh response and claiming the attack was the result of military successes in Sinai, the multi-layered attack likely raised doubts over the efficiency of the Egyptian military’s counterinsurgency campaign in Sinai. In this context, the attack followed a January announcement of the extension of the three-month long state of emergency in Sinai, which was initially declared in the aftermath of the October 24 attack, for an additional three months, as well the launching of the “second phase” in the establishment of a buffer zone with Gaza. With this in mind, the timing of the attack highlights the possibility that militants sought to demonstrate the failure of such measures, while further capitalizing on discontent among locals stemming from these measures. Finally, in light of the main target of the attack, the 101 Battalion headquarters, considered to be one of the most secured and fortified military bases in Sinai, the militants may have sought to “shame” the Egyptian military, and thus heighten the chances for a disproportionate crackdown on the peninsula, and on Islamists in general in the country. Such a crackdown is further likely, in turn, to alienate the local population and legitimize further attacks.
  • Overall, we assess that the militancy threat will likely remain elevated in northern Sinai, in light of the persistent clashes reported after the attack. However, heavy military deployments in this specific area of the Sinai Peninsula, may also encourage militants to relocate and stage attacks in other locations of the peninsula and, to a lesser extent, of the country. In this context, while the positioning of militants in the triangle between al-Arish, Rafah, and Sheikh Zuweid was likely strategic for the group in light of the smuggling of weapons to and from the Gaza Strip, increased military pressure on smuggling activities likely have prompted the group to develop other tactics.
  • These may include, for instance, the use of boats to smuggle weapons and militants, given that despite the maritime blockade on the peninsula, the Egyptian navy’s capacities remain limited when compared to its ground counterpart. The group may thus attempt to develop ties with Bedouin tribes in the southern part of the Sinai Peninsula, while previous upticks in military activities in northern Sinai have also resulted in militants fleeing to other parts of the country. As a result, we assess that in addition to the militancy threat in northern Sinai, the coming months may see an uptick in Wilayat’s Sinai activity in southern Sinai, as well as in the Nile Delta and potentially at the border with Libya.

Assessments:  Sinai attack, resulting crackdowns on Brotherhood likely to perpetuate divide in organization

  • In light of the declarations made by President Abdel Fattah al-Sisi, as well as past attacks in Egypt since the ouster of former President Mohammed Morsi, the crackdown against the Muslim Brotherhood will likely be widened following the attack in Sinai, as has previously been witnessed. In this context, while this trend is not new, the continuing accusation and crackdown has likely created a divide inside the organization between those who continue to advocate for peaceful protests to denounce the regime and those who advocate “self-defense” in light of the security forces’ use of violence to disperse the protesters.
  • In addition, to increase pressure for the group to legitimize “self-defense”, several elements, namely the mass arrest of most of the Brotherhood’s leadership in Egypt, its relocation outside the country, and changes inside the organization, have further intensified this divide. This is further underscored by unconfirmed reports that the Brotherhood held two-month worldwide elections that led to leaders of the youth movement as well as reformist movements assuming a broader role, suggesting that new leaders are seeking to reform the group.
  • Should the group’s leadership in Turkey or in other countries maintain its policy of nonviolence, it bears the risk of being increasingly sidelined and losing its remaining influence over the group’s supporters on the ground. On the other hand, should it  decide to shift its stance and overtly promote violent actions, even those deemed to be “self-defense”, the group will likely face increased pressure both inside and outside Egypt, as the military-backed regime will likely use such statements against it. This likely explains the current ambiguity of the Brotherhood’s statements, and the fact that condemnations of violence have been made in English but not in Arabic. The recent statement on the Brotherhood-affiliated channel as well as the article advocating violence likely stem from this divide. Such a divide may further increase the chances that members of the group will leave if they do not agree with the group’s line, or that they will feel that attacks are justified, in light of recent aforementioned statements.

Assessments: Near-daily militant attacks likely to continue, while IS-affiliated group may take advantage of internal Brotherhood divide to further expand operational areas

  • Overall, we assess the attack in al-Arish will likely prompt an uptick in violence in Egypt, both in Sinai and across the country, as a result of the likely impending crackdown on the Muslim Brotherhood, and, as aforementioned, in light of precedent. Such violence will likely continue to materialize in continued IED attacks against the country’s security forces, infrastructure, and transportation system. However, as indicated by an uptick in attacks and threats against foreign companies, such attacks may increasingly expand to civilian targets deemed to be legitimate if they are deemed as “collaborating” with the regime.
  • Moreover, we assess that low-level militant groups may increasingly serve as a gateway for disenchanted and former members of the organization to join the other more radicalized groups. While prior to the ouster of Mohammed Morsi, the ideological gap between the Muslim Brotherhood and militants groups, such as Ansar Bayt al-Maqdis at the time, was significant, disillusioned members of the organization can now gradually radicalize by passing from group to another, given the wide variety of groups using violence, including local Popular Resistance Committees that often claim IED attacks against security forces, the Ajnad Misr militant group, and finally Wilayat Sinai.
  • Furthermore, as several elements of the Brotherhood may leave it and become increasingly radicalized, the operational areas of Wilayat Sinai in Egypt may expand to officially include a group in mainland Egypt. Regardless, the recruitment of disillusioned former members of the Brotherhood, as well as the fact that several members of the group may flee from Sinai to the Nile Delta, the border with Libya, or Libya itself, may increase the potential for sophisticated attacks to be witnessed in these areas other the coming months, as well as in major cities such as Cairo and Alexandria.

MAX Analysis Saudi Arabia & Iraq: IS attack against Saudi-Iraq border crossing January 6, 2015

Executive Summary

  • An Islamic State-subgroup based in Iraq’s Anbar Province issued a statement on January 5 claiming responsibility for targeting the Iraqi side of Saudi Arabia’s Arar border crossing, which came under attack during the early morning hours of January 5. Three Saudi Border Guards were killed in the attack and two wounded, while four attackers were also killed.
  • Despite an ideological interest in targeting Saudi Arabia, we do not assess that the January 5 incident represents an alteration in the security situation along Saudi Arabia’s border with Iraq, but rather a likely opportunistic attack, while IS in Iraq (formerly ISIS) remains primarily focused on consolidating its territory amidst increasing difficulties connected to, among others, anti-IS coalition airstrikes.
  • We assess that the interest in targeting Saudi Arabia is liable to be primarily pursued by radicalized Saudi citizens, including those that support IS, against which the country continues to crack down upon.
  • In Saudi Arabia, travel to Riyadh, Dammam, and Jeddah can continue as normal while adhering to basic security precautions and adherence to cultural norms.
  • In Iraq, travel to areas outside of Baghdad and Basra should be avoided at this time, particularly to the north and west of the country, including the Anbar, Nineveh, Salahuddin, Kirkuk, and Diyala Governorates due to ongoing combat operations. 

Current Security Situation at the Saudi-Iraq Border
During the evening hours of January 5, the Saudi Ministry of Interior (MOI) security spokesperson provided further details regarding the early morning attack at the Suyef Center border crossing with Iraq in Jadida Arar. The report provided by the country’s official news agency stated that four militants were intercepted attempting to enter Saudi Arabia via the aforementioned border crossing, causing two of the four to open fire. One was killed by retaliatory gunfire from Saudi Border Guards while a second detonated an explosive belt. The remaining two were then killed by gunfire and the detonation of an explosive belt or vest after being pursued by the Border Guards into the Arar Valley.

  • As a result, three members of the Border Guards, including the commander of the Border Guard in the Northern Region, were killed. Two others were injured, with the official news agency reporting their condition as stable.
  • Reports further indicate that an automatic weapon, pistol, grenades, and explosive belts were seized, along with an unspecified amount of cash. As previously noted, reinforcements were reportedly dispatched to the border crossing following the incident.
  • In addition, the Islamic State (IS)-subgroup based in Iraq’s Anbar Province, known as “Wilayat Anbar”, issued a statement on January 5 claiming responsibility for targeting the Iraqi side of the border crossing with Saudi Arabia. In the photos included, at least 12 militants appear to be involved in the attack.

Assessments

  • Even without the statement by IS claiming responsibility for the attack on the Iraqi side of the border, we continue to assess that there are few other parties that would conduct, or have the capabilities to conduct such an operation. This is due to a number of reasons, including the modus operandi of the attack, involving suicide attackers, which is commonly utilized by IS, as well as the targeting of Saudi Arabia itself. In this context, when IS’s self-declared Caliph, Abu Bakr al-Baghdadi, accepted oaths of allegiances from various IS groups in a November 13 audio recording, he stated that the “serpent’s head and the stronghold of the disease” is located in al-Haramayn”, referring to Saudi Arabia. He then listed those that should be targeted, namely, Shiites, the Al-Saud ruling family, and security force. 
  • Moreover, Iraq’s restive Anbar Province, in which the Iraqi side of the Arar border crossing is located, continues to witness ongoing IS activity, with significant areas reported to be under the group’s control. Although the Iraqi government reportedly maintains control of areas immediately along the shared border with Saudi Arabia, reports indicate that IS has a firm presence in al-Nukhayb, located along a road that leads directly to the Iraqi side of the Arar border crossing and is approximately 119 km away. Taking into account the ideology of IS and the fact that the militants were equipped with suicide belts/vests, IS likely did not feel threatened by Iraqi government forces in crossing territory reportedly under their control. In this context, confrontations with Iraqi government forces other than those stationed at the border crossing was likely also perceived as an acceptable battle and, thus, IS may not have been concerned with being intercepted along the way. Meanwhile, the IS claim refers solely to the Iraqi side of the border, suggesting that its aim were Iraqi forces stationed there. This suggests that the four of those involved in the Saudi incident were able to bypass the Iraqi side of the crossing and enter into the Saudi border post, particularly given the proximity of the two. Thus, the January 5 incident would appear more of an opportunistic attack rather than one aimed specifically at Saudi Arabia.
  • However, it cannot be ruled out that IS had other ambitions. This could include testing the capabilities of the Saudi Border Guards, conducting a sensational attack with the aim of increasing its media profile and gaining supporters, and/or creating fear among the country and other anti-IS coalition members. In this context, amidst increasing difficulties faced by the organization in Iraq, including due to coalition airstrikes, IS may be looking for a successful attack to boost morale. Along with the symbolism of a border crossing, Arar is home to an airport. In August, following the landing of the mortars near the city, unconfirmed reports stated that an IS “supporter” described the airport as “within reach of [the group’s] missiles” and would be targeted if it was used as a base for US missions in Iraq. During the 2003 Iraq War, reports that the US utilized Saudi facilities suggest that this airport was one such facility. Moreover, the timing of the attack, that is, coming amidst the dispatch of a Saudi delegation to Iraq to finalize the reopening of an embassy and consulate may be intended as a message to Saudi Arabia that, if it can attack them at their border, it can certainly target them in Iraq.
  • Regardless, we assess that this attack does not represent a substantial shift in the security situation in Saudi Arabia along the Iraqi border. Even if specifically aimed at attempting to infiltrate Saudi Arabia, there are a number of reasons as to why the country remains prepared and capable of defending this border area. In addition to the substantially increased security that has been implemented, including as part of Phase 1 of the “project for border security” inaugurated in September 2014 that involves, among others, a 900 km security fence and additional monitoring towers, the country introduced a 20 km expanded buffer zone in November. Moreover, while three mortars impacted near Arar in July, two incidents over a period of approximately six months does not point to a pattern. There is also no indication that one successful attack means that the Iraqi government has lost some or all of control over certain border areas with Saudi Arabia.
  • In addition, the Saudi Border Guards have demonstrated a capability in preventing attacks from moving past the border areas. In this context, the January 5 incident was contained to the immediate border area, causing the death of three despite the presence of two suicide bombers. Similarly, in July 2014, an attack against the southern Wadia border crossing claimed by the Yemen-based al-Qaeda in the Arabian Peninsula (AQAP) also saw an attack contained to the border crossing area. During this incident, two Saudi Border Guards were reportedly killed and a third was injured, later succumbing to his wounds, while three attackers were also killed and a fourth was wounded and arrested. A fourth Saudi was then killed when the remaining two militants hiding in a building and holding ten individuals hostage detonated the explosives they were wearing. As on January 5, the relatively limited number of non-militants killed despite the presence of at least two suicide attackers demonstrates the Border Guards’ capabilities to prevent deeper infiltrations and reduce casualties.
  • We also continue to assess that IS’s interest in opening a front with Saudi Arabia remains limited at this time. While their ideological desire to target the country certainly exists, as underlined by al-Baghdadi’s speech, the presence of two of Islam’s holiest sites in the country, and Saudi Arabia’s participation in the international anti-IS coalition, it is likely that they will defer to locally-based supporters rather than those operating in Iraq and Syria to further this aim. This is connected to our assessment that one of their primary goals at present is to consolidate territory in Syria and Iraq, particularly given increasing difficulties faced by coalition airstrikes and support offered to anti-IS forces.
  • In this context, we further continue to assess that the primary threat facing Saudi Arabia remains that stemming from radicalized locals and Saudi citizens, including those that have potentially returned from fighting abroad, and that have sympathies to IS or other militant jihadist groups. The presence of such individuals is known and underscored by a number of factors, including an uptick, albeit relative, of attacks conducted by individuals with links or sympathies to IS. This refers to two known incidents, that is, a November 3, 2014 shooting of Shiites in al-Ahsa and a November 22, 2014 shooting of a Danish national in Riyadh. Regarding the former, 77 subsequent arrests announced on November 24 by the MOI stated that the core group involved had “direct links” to IS, while, on December 11, 2014, the official news agency announced that three people, who stressed their strong sympathies to IS, were arrested for the shooting of the Dane. Their presence is also underscored by the significant percentage of Saudis in the recent militancy-related arrests. This includes 109 out of 135 arrests announced on December 7, 2014, 73 out of the aforementioned 77 announced on November 24, 84 out of 88 announced on September 2, 2014, and 59 out of 62 announced on May 6, 2014.
  • That said, despite this threat, we also continue to assess that Saudi Arabia’s counter-militancy capabilities remain high, underlined by the number of arrests, particularly those conducted and announced relatively shortly following attacks. Some of the 77 arrests announced on November 24, 2014, for example, were conducted in operations reported on November 4, one day following the al-Ahsa shooting. Similarly, following the November 22, 2014 shooting of the Danish national, arrests were recorded on December 11. Given Saudi Arabia’s interest in mitigating this threat and maintaining their security situation, including due to the presence of foreign companies operating in the country, we assess that similar arrest campaigns should continue to be recorded. In addition, while reinforcements were sent to the Arar border crossing following the attack, security precautions along the border have been increased to a particularly high level before this incident, underscored by the existing buffer zone. Thus, while a heightened presence may remain specifically at the border point, substantially changed measures along the border with Iraq are unlikely.

MAX Analysis Morocco: Threat of regional militancy and local jihadist presence in Syria, Iraq likely to require bolstered security measures August 24, 2014

Current Situation

Over the past weeks, borange alert oth Moroccan and foreign authorities have increasingly warned of an uptick in militant threats, starting from the announcement of a state of high alert by the Moroccan Interior Ministry on July 9, reportedly in response to the militant threat presented by the Islamic State (IS) against Morocco. As of July 2014, Morocco’s national intelligence agency reportedly estimates that there are about 1,500 Moroccan nationals operating in Iraq and Syria. Of these, an estimated 30 percent are former convicts who served time under anti-terrorism laws.
  • The July 9 decree included an order to regional governors to heighten security measures within their jurisdictions, an expanded security presence at vital installations throughout the country, and the launching of a public relations campaign to warn Moroccans against the potential security threat. Also on July 9, Morocco heightened its security protocols at its international airports following a recommendation from the American government.
  • Additionally, on July 18, an “orange alert” was declared for all American-owned restaurants operating in Morocco in anticipation of a possible militant attack. On July 21, the British Foreign and Commonwealth Office (FCO) updated its travel advice for Morocco, warning of an “increased threat of terrorism.” The FCO cited Moroccan authorities’ warnings of an increased threat connected to Moroccan national militants operating in Syria and Iraq. 

Continue reading MAX Analysis Morocco: Threat of regional militancy and local jihadist presence in Syria, Iraq likely to require bolstered security measures August 24, 2014 →