Tag Archives: Islamic State

Prospects for Stability & Development in Libya – Libya Special Intelligence Report

This report was written by: Akshita Aggarwal – MAX Security’s Associate Director of Intelligence, Middle East & North Africa

And reviewed by: Tzahi Shraga – MAX Security’s Chief Intelligence Officer, ret. LTC from the Israeli intelligence community

Oded Berkowitz – MAX Security’s Deputy Chief Intelligence Officer

Executive Summary

Control over territory in Libya remains contested between the House of Representatives (HoR), the Government of National Accord (GNA), and tribal militias. As neither of these entities are willing to compromise upon their interests, the current political landscape in Libya will remain unstable.

Multiple militias with rival territorial, economic, political, and ideological interests operate in the country. As there is often no clear demarcation between their respective areas of influence, sporadic armed clashes between these groups will continue over the coming months.

Militant groups continue to take advantage of the lack of a unified security apparatus to operate across Libya. Although these groups currently do not have the ability to regain territorial control in the country, the sophistication and scale of their attacks will increase over the coming months.

The Libyan economy is largely dependent upon the oil industry. The ongoing political and security instability will continue to deprive the government of the ability to invest in development and infrastructure, as well as protect oil facilities from potential militant attacks.

Overall, the security environment in Libya remains extremely volatile and is set to further deteriorate in the foreseeable future.

Download the 2019 Global Travel Risk Map now.

Background

Multiple political and armed actors are currently operating across Libya. In many cases, there is no clear territorial demarcation between their respective spheres of influence, and therefore, at times these tend to overlap. The fringes of these territories also provide a conducive environment for the proliferation of militant groups, such as the Islamic State (IS), as well as local and foreign criminal militias. Moreover, internal divisions exist even within seemingly cohesive political factions and armed units, due to differing interests and ideologies, which contribute to the already volatile security environment in the country.

The overarching geographical areas of control are as follows:

Western Libya: Largely under the control of militias aligned with the UN-backed Government of National Accord (GNA). However, the majority of these militias have rival economic and territorial interests, which often lead to hostilities between them.

Eastern Libya: Largely controlled by the House of Representatives (HoR) and its allied Libyan National Army (LNA).

Southern Libya: Largely ungoverned territory, with rival tribal militias in control of isolated towns and production facilities. Although the LNA managed to recently extend its influence over parts of southern Libya, tribal militias in control of the town hold shifting allegiances.

Main Actors & Interests

The Government of National Accord (GNA): The GNA is based out of the Tripoli Naval Base and is a product of the Libyan Political Agreement (LPA), signed in Skhirat, Morocco in December 2015. The LPA allows for the transition of the House of Representatives (HoR) and the General National Congress (GNC) into the GNA’s legislative body and advisory State Council, respectively. However, this transition was to be ratified by a special majority vote of the HoR within a period of one year, which was renewable only once. The HoR is yet to convene the needed quorum for this vote. On December 17, 2017, the Libyan National Army (LNA) Field Marshal Khalifa Haftar declared that “All bodies resulting from this agreement [LPA] automatically lose their legitimacy, which has been contested from the first day they took office.” Regardless, the GNA continues to be considered the “internationally recognized” government and enjoys the support of the UN. Its sphere of influence extends through western Libya, particularly in greater Tripoli and Misrata.

House of Representatives (HoR): The previously “internationally recognized” government, the HoR’s parliament is based in Tobruk and the executive branch in al-Bayda. Its sphere of influence is generally in eastern Libya, with some pockets of support in the west, particularly southwest of Tripoli. The HoR is currently supported politically, militarily, and economically by several countries, most prominent of whom are France, the United Arab Emirates (UAE), and Egypt. While these countries generally recognize and support the LPA, they capitalize on the fact that the HoR has not ratified the agreement as a pretext to consider it as non-valid at this time, in order to continue supporting the HoR and not the GNA.

Other groups: Both the ungoverned and the governed areas of Libya are dominated by politics based on tribal, clan, and ethnic backgrounds, as well as place of residence and origin. It is not uncommon for cities that both support the same political body to be at odds due to historical or other rivalries among their residents. Similarly, militias from the same city who support the same political organ may have a strife over tribal or other rivalries.

Armed Groups

The GNA is currently almost completely reliant on local armed militias to exert influence over its territories. The most prominent GNA-linked militia are the Misrata forces, based out of the northwestern town of Misrata. Misrata forces also maintain their own air force, which was initially formed in 2015 as the Libya Dawn Air Force (LDAF), and later in 2016, aligned itself with the GNA. Misrata has very few operational pilots and aircraft, which were most recently operationally used in 2016 in hostilities against the LNA and the Islamic State (IS). Several other militias, like the al-Radaa Special Deterrence Forces, the Abu Salim Battalion, and the Tripoli Revolutionaries’ Brigade, are formally under the command of the GNA’s Ministry of Defense (MoD), and hold territorial control over different parts of Tripoli.

The Libyan National Army (LNA) and its allied militias are led by Supreme Commander Field Marshal Khalifa Haftar. The LNA is allied with the HoR, based out of Tobruk. It has a clearer command and control structure, with several commanders in charge of different battalions and areas of LNA-controlled territories. Although the majority of LNA forces are anti-Islamist, certain factions within the forces hold a Salafist ideology. Presently, the LNA’s main area of operations is in and around the Oil Crescent, Jufra District, Fezzan Region, Kufra District, Benghazi, Derna, and Tobruk. It also has some influence in areas southwest of Tripoli through their association with Zintan-based militias. The LNA also maintains an air force, the Libyan Air Force (LAF). LAF aircraft are used primarily to conduct aerial reconnaissance and airstrikes against militant and militia convoys in the Sirte Basin and Fezzan Region.

Tribal militias, mostly consisting of either Tebu or Tuareg ethnic tribes, control most of southern Libya, including Sebha. These tribes are at times supported by fellow tribesman from neighboring countries, such as Chad and Sudan. They hold shifting allegiances towards the various players in the country.

Islamist militant groups, such as the Islamic State (IS) as well as the al-Qaeda-linked Revolutionary Shura Council of Benghazi (RSCB), Derna Protection of Force (DPF), and Saraya Defend Benghazi (SDB), continue to operate across Libya. The IS and the SDB are currently the most prominent of these groups.

Political Stability

The efforts of the Head of the UN Special Mission to Libya (UNSMIL), Ghassan Salame, over the past year have at least partly prompted the HoR and the GNA to work towards unification of all institutions in the country and end the ongoing political stalemate. The HoR approved the referendum law on September 14, which allows for a referendum on Libya’s draft constitution. Subsequently, in November, the HoR successfully voted on a constitutional amendment, which legally validates the referendum law. It also divides the country into three constituencies – Tripolitania, Cyrenaica, and Fezzan. According to the amendment, the approval of the draft constitution would require an absolute majority vote in each region as well as a two-thirds majority vote nationwide. At the same time, the HoR approved the restructuring of the Presidential Council (PC), whose membership will now reduce from nine to three. It will now be consist of a President and two deputies, and a separate Prime Minister as the Head of the government.

Assessments & Forecast: Recent measures aimed at unifying political institutions unlikely to lead to nationwide elections

While on paper, the aforementioned developments portray that the GNA and the HoR have made substantial progress towards a nationwide election process and the unification of political institutions in the country, these measures have substantially tilted the scales in favor of the latter. Members of the GNA had previously opposed the amendment of Article 6 of the LPA, which divides Libya into three distinct constituencies as well as the restructuring of the PC. If the constitutional referendum does not pass, the current law assigns Cyrenaica with a veto power, which would essentially allow the HoR to activate an article of the referendum law that would pass on the responsibility of drafting the new constitution to the HoR, thus allowing the eastern-based government to alter Article 8 of the LPA.

Article 8 of the LPA has been a highly controversial point between the GNA and the HoR. This article excludes anyone with dual citizenship from holding either a political or military post in the country. LNA Field Marshal Khalifa Haftar holds both US and Libyan citizenship, and therefore, this will exclude him from Libya’s future political landscape. The HoR’s insistence on amending this article stems from the fact that it currently extends territorial influence over eastern Libya due to its alliance with the LNA. Moreover, the LNA is in control of much of Libya’s oil infrastructure, which has gained Haftar increasingly international legitimacy over the past year, as underlined by his inclusion in both the Paris Conference in May and the Palermo Conference in November.
FORECAST: These conditions provide the HoR with an upper hand in negotiations, and therefore, it is unlikely to concede to the GNA on any key issues pertaining to the country’s future. Such a scenario will provide France with significant influence over Libyan politics vis-a-vis its regional rival, Italy. Therefore, both countries will attempt to intervene in Libya in order to ensure a more favorable outcome for themselves. This, in conjunction with the lack of electoral infrastructure, will further delay the slated March 2019 nationwide election process. If and when elections do take place, the turnouts will be very low due to the inability of either the GNA or the HoR to provide the required security to secure electoral booths from the threat of militancy. Moreover, as Libya is based on tribal culture, with a council of elders responsible for governing each town, any federally constituted government will face resistance on the local level.

Threat of Militancy

Islamic State (IS): Although IS does not control any territory in Libya as of December 2016, it has managed to rebuild some of its capabilities in the country over the past year. Initially, the majority of IS attacks were directed against LNA checkpoints in the Sirte Basin and Jufra District, which mainly utilized vehicle-borne IEDs (VBIEDs). Gradually, IS shifted towards conducting more sophisticated multi-pronged attacks against government infrastructure in western Libya. For example, IS claimed multi-pronged attacks against the Misrata Courts Complex on October 4, 2017, against the Tripoli Electoral Commission on May 2, 2018, and the National Oil Corporation (NOC) Headquarters in Tripoli on September 10, 2018. And finally, IS militants launched two large-scale attacks against the towns of al-Fuqaha, Jufra District, and Tazirbu, Kufra District, on October 28 and November 23, respectively.

Saraya Defend Benghazi (SDB): In June 2017, the SDB indicated its willingness to disband after Misrata forces refused to provide them refuge in the city of Misrata, following the former’s loss all its territories in the Jufra District to the LNA. While reports did indicate that SDB fighters were still operating in parts of western and southern Libya, the group remained dormant for approximately a year. However, in June 2018, SDB fighters, led by the former Petroleum Facilities’ Guard (PFG) commander Ibrahim al-Jathran, launched a large-scale attack against the Ras Lanuf and Sidra oil terminals, located in the Oil Crescent. However, following the LNA’s recapturing of the Oil Crescent, the group has again gone dormant and not launched any significant attacks in Libya.

Assessments & Forecast: Although militant groups unlikely to regain territorial control in Libya, the sophistication of their attacks is likely to increase

Several factors have allowed militant groups to regain part of their ranks and capabilities in Libya over the past year. First, militants either planning to go fight for IS in Syria or Iraq, or fleeing the group’s territorial losses in these countries, view Libya as an alternative arena for their activity, and therefore have bolstered the ranks of the Sunni jihadist militant group in the country. Second, the LNA’s preoccupation in hostilities in other parts of the country, such as in Benghazi, Sebha, Derna, and the Sirte Basin, over the past year likely allowed militants to regroup in southern Libya, which remains largely controlled by tribal militias, without being detected by security forces. Third, widespread cross-border smuggling of weapons and fighters across Libya’s southern borders with Sudan and Chad, likely allowed both IS and the SDB to reinforce their offensive capabilities.

While both groups continue to remain interested in destabilizing the security environment in the country, neither of the groups currently maintain the ability to regain a territorial foothold in Libya. However, they do have the capability to launch attacks against more high-value targets, such as government offices, oil, and other infrastructure, in Libya. The lack of sufficient security protocols around these facilities allows the groups’ fighters to circumvent existing measures to gain access to their interiors. Such attacks allow militant groups to not only project their heightened capabilities to attract support and recruits, but also deprive the authorities of the necessary revenues to invest in their counter-militancy campaign. Aside from this, IS’s particularly increased focus on attacking towns in southern Libya are part of an attempt by the group intimidate locals and gain ransom from kidnappings at the same time. Overall, all these efforts are directed towards further destabilizing the security environment in the country, with the ultimate aim of expanding influence and re-establishing a territorial foothold.
FORECAST: Despite efforts by both the LNA and GNA-linked militias to dislodge militancy from the country, both IS and the SDB will continue to utilize the vast desert terrain of southern Libya as well as the fringes between GNA and LNA-held territories to regroup and rebuild their capabilities. They will the use these bases as launchpads for further attacks against government and security installations. The sophistication of these attacks may gradually increase as the militant groups attempt to launch more symbolic operations. The lack of a unified security apparatus, combined with insufficient military equipment and training, will overstretch the LNA and local militias, which will continue to hinder their ability to effectively combat this threat of rising militancy in Libya.

Economic Stability

The Libyan economy is largely dependent upon the export of oil. Oil production facilities are operated by foreign companies, with permission from the National Oil Corporation (NOC), based in Tripoli. The oil revenues then accrue to the Central Bank of Libya (CBL), based in Tripoli, which then distributes the revenue to the GNA, the HoR, the LNA, and GNA-aligned militias.

Assessments & Forecast: Political divisions, security volatility, global oil prices unlikely to significantly increase government revenues

Tensions have persisted between the GNA and the HoR regarding control have over Libya’s monetary policy and revenues, which prompted both parties to form parallel central banks based in Tripoli and al-Bayda in 2014. After retaking control of the Ras Lanuf and Sidra oil terminals from the SDB in June 2018, Haftar decided to hand over control of revenue from these oil terminals to the eastern-based NOC. However, in 2017, when PFG commander Ibrahim al-Jadhran temporarily took control of the Oil Crescent and attempted to directly sell the oil from these facilities on the international market, European countries imposed an embargo on this oil. They further stated that only oil bought from the Tripoli-based NOC would be considered as legal. Therefore, Haftar’s decision was likely prompted by an attempt to not undermine the Tripoli-based NOC, whose head Mustafa Sanalla, is popular both among the GNA and the HoR, but rather to force the GNA to replace the CBL head, Sadiq al-Kabir, whom the LNA considers as corrupt and illegitimate. This is supported by the fact that Haftar eventually agreed to hand over control of revenue from the oil terminals back to the Tripoli-based NOC on July 10. The underlines the divisions instability arising from the bipolarity between the country’s economic institutions.The widespread threat of militancy, as well as militia activity, poses a further threat to oil infrastructure in the country. The majority of these facilities are secured by local militias who have their own interests in mind.

Therefore, they often utilize these facilities as bargaining chips in their negotiations with the GNA. For example, in recent weeks, a movement under the name “Anger of Fezzan” threatened the Sharara Oil Field if their demands for development in southern Libya were not met. Moreover, the militiamen who are in charge of securing oil fields are neither well-equipped nor well-trained, and therefore are usually incapable of protecting these facilities from a well-executed attack. Oil pipelines in the country tend to run across territories held by different militias with rival interests which pose a further threat to business continuity. This, combined with the instability of global oil prices, makes Libya’s economy highly unpredictable and unstable for the foreseeable future.
FORECAST: As the aforementioned political and security issues will persist for the foreseeable future, Libya’s economy is unlikely to witness any form of stability. This will adversely impact the GNA’s already declining popularity in the country. July witnessed widespread anti-GNA protests in Tripoli and its surroundings over the UN-backed government’s inability to provide locals with water and electricity. These eventually provided local militias with conditions conducive to launch an assault against each other in order to advance their personal territorial interests, thereby sparking large-scale inter-militia hostilities in the designated capital. Therefore, an unstable economy will lead to civil unrest in the future, which, in turn, will increase the threat posed by militant groups and armed militias.

Infrastructure & Development

Political, security, and economic stability have a direct impact on the prospects for infrastructure and development.

Assessments & Forecast: Economic, political, security instability to prevent the government from investing in development, infrastructure

The lack of sufficient revenue has denied the GNA and the LNA with the ability to invest in development and infrastructure. Airports in Libya are generally controlled by local militia groups, who are under-trained and under-equipped to employ proper security protocols for air travel. This includes the lack of a secure perimeter around airports, which allows militias and militant groups to use weapons of relatively lower sophistication to target these facilities. This is highlighted by the frequent mortar shelling of the Mitiga International Airport as a result of inter-militia hostilities in Tripoli. The GNA has also been unable to reopen the Tripoli International Airport as militias frequently attempt to take control of the facility from their rivals. Aside from attacks, service disruptions at airports remain frequent due to staff strikes, particularly over unpaid salaries. This is due to the lack of sufficient funds under the control of the GNA, as it depends largely on the country’s oil reserves.

Commercial ports are also susceptible to attacks, as underscored by the temporary shut down of the Tripoli Seaport on October 17, 2017, due to clashes between GNA-linked militias near the facility. The majority of the country’s seaports are located in northwestern Libya. The Libyan Coastguard has frequently intercepted foreign vessels off the coast of northwest Libya on suspicions of illegal smuggling activity, as local militias in the area have been known to disguise as GNA officials to sell oil and fund their operations. With regards to seaports in eastern Libya, the LNA has been unable to fully operationalize the Benghazi and Derna ports following their capture from militants in June 2017 and May 2018, respectively. Moreover, the LNA Navy has designated Libyan territorial waters off the coast of Benghazi as a “no-sail” zone (until al-Tamimi, 280 km east of Benghazi), and therefore entering it requires prior authorization. This is particularly important as vessels that do not obtain such authorization and escort from the LNA Navy are automatically suspected of carrying support for militants, and may be intercepted or even targeted by airstrikes.
FORECAST: The lack of revenues will prevent the GNA and the LNA from substantially raising security protocols at infrastructural facilities in Libya. This will make such facilities an easy target for attacks by militant groups as well as militias. Militias operating in Tripoli and its environs will continue to attempt to seize control of vital airports and seaports in order to increase their negotiating power vis-a-vis their rivals. This will have an adverse impact upon operations at these facilities, even when militias try not to directly target them.

Recommendations

It is advised to defer all travel to Tripoli and Benghazi at this time due to ongoing violence, threats against foreigners, and the risk of a broad deterioration of security conditions. We advise at this time that those remaining in Tripoli and Benghazi should initiate contingency and emergency evacuation plans due to deterioration in the security situation. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support plans.

For those remaining in Tripoli, we advise avoiding nonessential travel to the outskirts of the city, particularly the Janzour and Tajoura neighborhoods, as well as to the Mitiga and Tripoli International Airports, given that these are focal points of ground clashes in the city.

Avoid all nighttime travel, including to and from the airport, due to the elevated risk for militant attacks, clashes, and acts of unrest during this time.

Travel to Misrata and Tobruk should be for essential purposes only while adhering to all security precautions regarding civil unrest and militancy. We advise against all travel to outlying areas of the country, due to the threat of militancy, kidnapping, and general lawlessness in such areas.

Avoid entering Libyan territorial waters in the area between Benghazi and al-Tamimi without prior authorization, as a no-sail zone is currently in effect in this area and several naval vessels had been intercepted or attacked due to not following proper procedures.

Those planning to conduct air travel to, from and inside Libya should avoid entering the area between Marsa al-Brega, Sirte and Sebha, as it was declared a no-fly zone by the Libyan National Army (LNA).
We further advise against all travel to Libya’s border areas at this time due to persistent violence and lawlessness in these regions.

For those operating in or conducting business with oil facilities, it is advised to consult with us for itinerary-based travel recommendations and ground support options.

Avoid the immediate vicinity of government buildings, police stations, media outlet offices, and political party and militia headquarters, given that these locales have been targeted by militia groups in the past and recently by militants, and thus remain at increased risk for violence and unrest.

Westerners, particularly US citizens, operating in Libya are advised to maintain a low profile and exercise heightened vigilance in light of prevailing anti-Western sentiment and increasing attacks against foreigners.

Nationwide, take precautions to mitigate the risk of being targeted for kidnapping. Refrain from travelling in luxury vehicles and maintain a generally low profile. Routinely alter travel routes and refrain from divulging sensitive itinerary information to strangers.

 

Learn More About Our Intelligence Services

IS attack against Tazirbu police station on November 23 indicative of increase in militant group’s ranks, capabilities in Libya – Libya Analysis

Executive Summary

The modus operandi of the November 23 attack against the Tazirbu police station is very similar to the October 28-29 Islamic State (IS)-claimed attack against a police station in al-Fuqaha, Jufra District. The scale of these attacks, combined with the short time span within which they occurred make them highly noteworthy.

This shift in IS strategy from localized small-scale attacks across Libyan territory towards more focused large-scale attacks against towns in southern Libya, which witness lower security presence, indicates that the militant group has to some degree managed to reinforce its ranks as well as rebuild its capabilities over the past year.

Similar to the al-Fuqaha attack, IS militants kidnapped ten people, including government officials and security personnel from Tazirbu. IS’ increased focus on kidnappings can be attributed to its interest in using the abductees as bargaining chips for ransom. This would allow the group to replenish its revenues, purchase supplies and weaponry, and ramp up its operations in Libya.

We advised against all travel to the southern outlying areas of Libya at this time due to the general lack of governance and security protocols in this region, which makes it conducive for militant activity and attractive targets for attacks.

Current Situation

According to reports, suspected IS militants aboard ten armed vehicles launched an attack targeting a police station in Tazirbu, located in the Kufra District, during the night hours of November 23.
At least nine civilians and policemen were killed, and 15 were wounded as a result of the attack.
Reports further indicate that the militants kidnapped at least ten people, including the Mayor of Tazirbu and a member of the municipal council, and fled the scene.
The Libyan National Army (LNA) has diverted forces from other parts of Kufra District towards the town of Tazirbu to secure it.

Assessments & Forecast

The modus operandi, target, and location of the attack suggest that it was carried out by IS militants. The Sunni jihadist militant group recently conducted a very similar attack against the al-Fuqaha police station, located in the Jufra District, during the overnight hours of October 28-29. The scale of these two attacks, along with the short time span within which they occured make them highly noteworthy. In the time period between IS’ complete loss of territories in Libya in December 2016 and October 2018, the majority of the militant group’s attacks had been relatively small-scale as well as spread out over a long period of time and territory. The majority of these attacks utilized suicide vehicle-borne IEDs (SVBIEDs) against security checkpoints or small-scale raids against police stations. For instance, the July 24 raid against the al-Uqaylah police station killed two LNA soldiers and wounded three others, while the June 2 raid against the al-Qunan police station killed one civilian and wounded five others.

Over the past year, IS was likely operating in groups of 10-12 fighters in the country. This allowed its militants to avoid attracting security forces’ attention and move relatively undetected across a larger swathe of territory. The lack of sufficient personnel and weaponry may have compelled IS to operate in this manner, which, in turn, had an impact upon their ability to launch larger-scale attacks. The recent attacks in al-Fuqaha and Tazirbu may indicate that IS has managed to bolster its ranks, partly through militants fleeing the group’s territorial losses in Syria and Iraq and partly through new recruits who now consider Libya as a more attractive arena. This has allowed IS to concentrate its forces towards launching larger-scale attacks against entire towns, rather than just security checkpoints or isolated government infrastructure, for example, in Tripoli in May and September as well as in Misrata in October 2017.

While, on the one hand, this indicates that IS has managed to rebuild its capabilities in Libya to some degree since its loss of territories to Misrata forces in December 2016, the location of the recent attacks suggest that these capabilities are still limited. Although al-Fuqaha and Tazirbu are both located within LNA-held territories, the towns witness relatively lower security presence as compared to areas located further north in the Sirte Basin and the Oil Crescent. The security forces of southern towns are largely comprised of local militias, who maintain small armed fighting units that are neither well-equipped nor well-trained. Therefore, it is possible that IS decided to focus its efforts in southern Libya, as this would increase the militant group’s chances of success.

As witnessed in the attack on the al-Fuqaha police station, the focus on conducting kidnapping of government officials and security forces stands out in the recent incident. Unconfirmed reports from November 10 indicated that IS is seeking to negotiate the release of four out of the ten hostages abducted in the attack on al-Fuqaha. If confirmed, this would suggest that through such kidnappings-for-ransom, the Sunni jihadist militant group is aiming to replenish its revenues, which, in turn, would allow it to purchase supplies and weaponry to ramp up its operations in Libya. This would also explain the recent kidnapping of the Mayor of Tazirbu, who by the prerogative of his position within society would demand a higher ransom. Aside from the ransom, such an abduction allows IS to project the Libyan authorities as incapable of securing its own civilians, thereby allowing the group to showcase its relatively higher capabilities.
FORECAST: IS will claim responsibility for the attack over the coming hours, as its scale will allow the militant group to significantly raise its profile in Libya. Meanwhile, the LNA will divert forces towards Tazirbu in order to secure the town over the coming hours and days. It will increase security protocols in Kufra District, which may include increased security checkpoints along main roads. The LNA may also tighten security along Libya’s southern borders with Sudan and Chad, as the porosity of these borders allows militant organizations to engage in the cross-border movement of fighters, supplies, and weaponry. While this may facilitate LNA forces in gathering vital intelligence and intercepting IS convoys, it will also provide the militant group with additional targets for attacks. On a more strategic level, the UN-backed Government of National Accord (GNA) may utilize this attack to highlight the LNA’s inability to secure its held territories and attempt to leverage this in its political negotiations with the latter.

Recommendations

It is advised to defer all travel to Tripoli and Benghazi at this time due to ongoing violence, threats against foreigners, and the risk of a broad deterioration of security conditions. We advise at this time that those remaining in Tripoli and Benghazi should initiate contingency and emergency evacuation plans due to deterioration in the security situation. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support plans.

For those remaining in Tripoli, we advise to avoid nonessential travel to the outskirts of the city, particularly the Janzour and Tajoura neighborhoods, as well as to the Mitiga and Tripoli International Airports, given that these are focal points of ground clashes in the city.

Avoid the immediate vicinity of government buildings, police stations, media outlet offices, and political party and militia headquarters, given that these locales have been targeted by militia groups in the past and recently by militants, and thus remain at increased risk for violence and unrest.

We advised against all travel to the southern outlying areas of Libya at this time due to the general lack of governance and security protocols in this region, which makes it conducive for militant activity and attractive targets for attacks.

Westerners, particularly US citizens, operating in Libya are advised to maintain a low profile and exercise heightened vigilance in light of prevailing anti-Western sentiment and increasing attacks against foreigners.

Nationwide, take precautions to mitigate the risk of being targeted for kidnapping. Refrain from traveling in luxury vehicles and maintain a generally low profile. Routinely alter travel routes and refrain from divulging sensitive itinerary information to strangers.

Lone-wolf attacks underscore threat from radicals in Europe, despite dwindling connections with militant groups – France Analysis

Executive Summary

The uptick in stabbing and vehicular attacks in France bears a strong resemblance to previous Islamic State (IS)-inspired and linked attacks.

This wave follows the August 22 call to action from IS leader, Abu Bakr al-Baghdadi, who asked supporters to “strike the West” and emphasized vehicular attacks in particular.

IS appears to have been particularly successful in radicalizing young Muslim immigrants in France.

Authorities are likely downplaying the militancy links in order to offset the increasing media attention surrounding such attacks.

Travel to France may continue while remaining cognizant of the increased threat of militant attacks. 

Current Situation

On September 14, a car-ramming attempt was recorded along Rue Racine in Nimes, southern France, during the early morning hours. The assailant reportedly intended to drive his car into pedestrians before being stopped by security barriers at around 01:30 (local time). The suspect was consequently subdued by locals in the area and later arrested by police. Reports quoting local eyewitnesses during the incident stated that the suspect shouted “Allahu Akbar”.

On September 10, an individual was detained for reportedly forcibly driving through multiple barriers and entering the runway of Lyon-Saint-Exupery Airport (LYS) in Lyon. The suspect was subsequently arrested following an extensive police pursuit. The incident caused significant delays and cancellations to flights. Following the arrest, a member of Lyon Prosecutor’s office reportedly stated that the assailant had alluded to a militant motive, claiming he was instructed to carry out the incident by Allah. However, this was later retracted.

The incident followed a September 9 stabbing attack in the 19th Arrondissement of Paris, when an assailant reportedly stabbed and injured at least seven people, including two British tourists, on Quai de Loire Street and Rue Henri Nogueres during the late night hours. The suspect was reportedly an Afghan national.

Authorities appeared reluctant to label all three attacks as being militant-related, calling the Nimes attack a “deliberate homicide”, and saying that the assailant who carried out the September 9 Paris stabbing attack did not appear to have militant motives. All three incidents were carried out by individuals of Muslim backgrounds and all three methods align with modus operandi that has been explicitly and repeatedly called for by the Islamic State jihadist group.

Background

On August 22, the (IS) al-Furqan media released an audio recording of the group’s leader Abu Bakr al-Baghdadi, who called upon the group’s supporters to “strike the West” through stabbings, bombings, and vehicular rammings, particularly emphasizing the last method. Al-Baghdadi then stated that “one such attack equals one thousand attacks in the Middle East and North Africa”.

On August 23, an assailant killed one and injured two in a knife attack in Trappes, Yveline, located 26 km from central Paris. The attacker reportedly shouted ‘Allahu Akbar’ and threatened police officers who arrived at the scene, and was later neutralized. Shortly after, IS-linked media reported that the assailant was a soldier of the Caliphate and conducted the attack in response to the group’s calls to “target the coalition countries”, referring to the US-led coalition of states that orchestrated a number of airstrikes against IS strongholds in 2014. Following the 2014 offensive, an IS spokesman had specifically singled out France as a target for future attacks.

Assessments & Forecast

Series of attacks likely lone-wolf incidents inspired by Islamic State methods and ideology, even if not ordered by IS in Middle East

Despite authorities’ reluctance to label the above-mentioned incidents as being IS-inspired militant attacks, various factors indicate that they may, in fact, have some connection to the group’s ideology and professed methods. In particular, the assailants resorted to stabbing and vehicular attacks in locations with a considerable civilian presence, which, in recent times, have been IS-linked lone-wolf actors’ chosen modus operandi. The assailants also chose to indiscriminately target these civilians and intended to cause widespread harm.

The known profiles of the attackers, who belong to immigrant communities who widely follow Islam, and the chanting of ‘Allahu Akbar’ during the attacks in at least two confirmed cases, is consistent with the details from similar previous IS-linked attacks. This lends credence to the possibility that the attackers’ actions were informed by a religious and ideological motive, in addition, it is equally likely that psychological instability also played a part in their motivations.

The link to IS is also strengthened by Baghdadi’s specific emphasis on the effectiveness of vehicular attacks in the August 22 call to action, which in turn was likely precipitated by the April 2018 airstrikes carried out by France and other countries in Syria, in response to the alleged use of chemical weapons by the state. In this case, the call was rather a wider propaganda piece, which was answered, and there is no evidence to suggest that any of the attackers had specific contact with IS in the Middle East or had been in touch with handlers.

Attacks likely catalyzed by individual feelings of disenfranchisement within community, which benefit IS’ recruitment

Due to the targeted locations being distant from one another, and absence of uncovered network between the suspects, it is likely that the attacks were not related, despite being conducted in quick succession. However, the attacks point to the potential success of IS propaganda and recruiting in France. The group has emerged as a viable outlet for Muslims who feel alienated from the wider community, exploiting feelings of disenfranchisement by offering them an alternative, in terms of belonging to the larger radical Islamist community.

Particularly, feelings of alienation among Muslim immigrants have likely been heightened by government policies such as the 2010 ban on religious face veils and head coverings, seen as being exclusionary, which have consistently prompted a backlash from both minority communities and their supporters, as well as anti-immigrant groups. Domestic factors such as a high unemployment rate and job discrimination against Muslims, religion-based tensions, as well as the general political culture of government criticism, also continue to contribute to making the immigrant population more susceptible to radicalization.

As has been seen in the past, IS also provides a useful narrative to psychologically-disturbed individuals, who then carry out copycat lone-wolf attacks using IS modus operandi, seeking to capitalize on media attention surrounding the IS ideology.

Authorities seeking to minimize impact of attacks through reluctance to make militant connection to avoid further media attention for such groups

Further, it is notable that authorities have not indicated that any of the September attacks were militant-related, despite suggestions, as evidenced above, that the assailants were at least influenced by IS, if not directly linked. This reflects a reluctance to label such lone-wolf attacks as Islamist militancy, possibly to discourage the media narrative against, and resultant disaffection within, Muslim immigrant communities in the country.

This unwillingness to attribute the incidents to militancy could also be a result of a conscious government decision to reduce the inadvertent aiding and abetting of IS’ operations, as the group has been known to use such official statements after attacks to legitimize itself as a threat to the West. Additionally, the government could be seeking to avoid heightened criticism of its security policy, especially amid the current administration’s declining public approval ratings.

FORECAST: IS’ online presence and recruitment methods, in addition to the persistent domestic factors alienating the Muslim community in France, the global trend of young men using mass violence as an outlet for psychological frustration, and IS has tapping into this trend to further its agenda, makes it likely that further such attacks will occur in France over the coming weeks and months. Given the apparent shift in executive security policy towards mitigating the media clout of militant attacks in general, it is likely that authorities will continue miIslamist islamist motives in such attacks.

Recommendations

Travel to France may continue while remaining cognizant of the increased threat of militant attacks.

Barcelona stabbing, one year after La Rambla attack, underscores continuing link between psychological instability and militant style attacks – Spain Analysis

Current Situation

On August 20, around 05:00 (local time), an individual armed with a knife reportedly attempted to enter a police station in Cornella de Llobregat, Barcelona and attack personnel, while shouting “Allahu Akbar”, before being shot dead. Reports indicate that the attacker was of Algerian origin and had lived in the area for several years.

The incident is reportedly being treated as a militant attack by authorities. However, police have claimed that they have no reason to believe that there are any direct links to major militant networks or that the assailant was connected to the cell that carried out the Barcelona attacks one year earlier. In addition, the testimony of his ex-wife indicated that the attacker had recently come out as homosexual, and was reportedly experiencing serious psychological instability and was suicidal due to confusion over how this could fit in with his Muslim faith. Some sources within the investigation have claimed that they do not believe the attack to be linked to jihad.

On August 16, a pro-Islamic State (IS) group published a poster on social media calling for attacks targeting police in Spain in both English and Spanish.

Click here to see Map Legend 

Background

The August 20 attack is the latest in a series of violent or militant-related incidents involving North Africans or individuals of North African origins in south and south-west Europe over the past year.

In addition, on July 22, a 29-year old Canadian national of Pakistani origin, Faisal Hussain, killed two and injured three in a shooting in Greektown, Toronto. Hussain was allegedly also known to have had a history of psychological instability and had reportedly expressed concerns about his employment and financial situation to a friend prior to the incident. On July 25, the Islamic State (IS)-linked media outlet, al Amaq, reported that the attack was carried out by a soldier of the Caliphate in response to their call to target citizens of coalition nations.

Assessments

Attack on police station underscores growing trend of violence copying Islamic State methods among psychologically unstable Muslim males

Despite claims that the attacker had a number of problems in his personal life, the possibility of links to wider militant trends cannot be ruled out. On the contrary, the fact that the attacker shouted “Allahu Akbar” and carried out the attack on the specific target that pro-IS groups had called for four days prior indicates that, even though he was likely not linked to any established militant cell, broader ideas of jihad informed part of his motivation. That is to say, while he may not have been looking to aid the goals of the Islamic State or avenge the deaths of Muslims, it is likely that, within his psychological instability, when thoughts of suicide arose, the concept of carrying out a jihadist attack was seen as a viable method. Possibly copying previous ‘suicide by cop’ attacks, in which the perpetrator intends to be killed by security forces. This assessment is further bolstered by the reports that his confusion over homosexuality was, in part, caused by an uncertainty about how it fit in with Islam.

With this in mind, the incident comes amid a continuing trend of psychologically unstable individuals, most of whom are migrants who adhere to the Muslim faith, carrying out attacks that mimic IS-inspired lone wolf incidents. Such attacks tend to be conducted by young males with mental health issues, who are, in part, influenced by the concept of jihadist militancy as a form of anti-establishment violence that has entered the West’s collective consciousness. Psychologically unstable individuals, and immigrants who perceive themselves to be disenfranchised and socially isolated from their community, whether it’s the Muslim or wider community, are copying IS-methods of attacks. In this sense, the media coverage of the various IS shootings and the general global trend of young men using mass violence as an outlet for frustration and disenfranchisement have merged.

Regardless of the psychological issues of the attacker, the fact that the incident came following the call from pro-IS groups means that online jihadist communities, and even Islamic State-linked media organizations, are likely to attribute the event to part of their ideology and larger plan. This is especially the case given the timing of the incident around the anniversary of the August 2017 attacks in Barcelona and Cambrils. In turn, this will perpetuate the aforementioned trend merging psychological instability and attacks that appear to be militant in nature.

Finally, the August 20 attack in Barcelona constitutes the latest in an ongoing trend of incidents related to violent attacks linked to Islamism from within the local North African community in north-eastern Spain and southern France. IS and IS-linked operatives have put a particular emphasis on recruiting in the region, due to the fertile ground for radicalization born from the feelings of disenfranchisement in both the established North African community and among North African migrants. These sentiments, which come partly due to perceptions of otherness within Spanish society and partly due to pressures put on from the local community, have the potential to lead young men towards violence, sometimes personally and sometimes linked to a militant organization.

Recommendations

Travel to Spain can continue while maintaining vigilance, due to the elevated threat of militancy.

Car Ramming Attack on Parliament Illustrates the Continuing Impact of Declining Islamic State’s Ideology on Disenchanted Migrants – London Alert

Please be advised

At 07:37 (local time) on August 14, an individual drove a vehicle at speed towards a security barrier outside Parliament, Westminster, London. Three people were lightly injured and security forces immediately arrested the individual without further violence. The area was closed to the public for several hours while security forces determined that the vehicle posed no further risk and no weapons were inside.

The Met Police stated later on August 14 that the incident was being considered a militant attack and that the suspect was refusing to cooperate with investigations.

Reports from the morning of August 15 state that the individual is 29-years-old, originally from Sudan, living in Birmingham. Footage from the area reportedly shows the vehicle used in the attack circling Parliament several times before the incident took place.

Security forces reportedly carried out raids on residences in the central UK cities of Birmingham and Nottingham as part of the investigation into a supposed militant attack in London on August 14.

Location of militant incident in London on August 14

Click here to see Map Legend 

Assessments

The suspect’s lack of resistance to being arrested and absence of weapons inside the car differentiate the incident from recent Islamist militant attacks. Therefore, while he may have been inspired by previous vehicular attacks, it remains unlikely that he had direct links with an Islamist group, such as Islamic State (IS). As with previous similar incidents, it is possible that the attacker was suffering from a psychological disorder, which played a role in motivating the attack.

With that, the raids in Birmingham and Nottingham may have been precautionary and do not necessarily indicate the assailants links to an established or well-coordinated militant cell. However, there is a possibility that the individual was part of a small locally radicalized cell of untrained individuals who subscribe to the ideology of IS.

Given the details released about the suspect, the incident reiterates the risk of incitement to commit attacks among migrant populations who perceive themselves to be disenfranchised. This risk is amplified among young males, who are generally far more susceptible to feelings of frustration over such sentiments and are also more likely to become self-radicalized. Furthermore, the incident underscores that, even with the decline of the Islamic State, the aftereffects of their ideology and modus operandi on the collective consciousness of the West, particularly among disenchanted migrants, continues to inspire attacks.

The incident also reflects the popularity of the vehicular method for those intending to carry out indiscriminate attacks, regardless of ideology. The popularity of the method stems from the ease with which attacks can be carried out and the difficulty for security forces to be warned before the incident

Despite the unlikelihood of the suspect being directly linked to an organized group, militant organizations, like IS, may attempt to claim responsibility or connection to the incident in order to increase perceptions of their threat in the UK and Europe in general.

Recommendations

Travel to London may continue while maintaining vigilance for possible militant related activity.

Alert authorities immediately to any suspicious behavior or items.

IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers – Tajikistan Alert

Please be advised

The Islamic State (IS) claimed a car ramming and stabbing attack that resulted in the deaths of four Western tourists in Danghara District, approximately 90 km south of Dushanbe. Meanwhile, Islamic State (IS)-linked Amaq News Agency reported on July 30, that “soldiers of the caliphate” conducted the attack in response to calls to target citizens of coalition countries.

IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers - Tajikistan Alert | MAX Security


IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers - Tajikistan Alert | MAX Security
Click here to see Map Legend 

Assessments

While over 1,000 Tajik citizens are believed to have traveled to Syria and Iraq to join IS, the July 31 claim appears to be the first such acknowledgment by the group of an attack within Tajik boundaries and is therefore notable. The extent to which the operation was guided by the IS leadership in Syria and Iraq remains unclear at this juncture.

At present, it appears more likely that the attack was conducted by radicalized individuals that were inspired by IS rather than trained operatives of the group itself. This is indicated by the reference to targeting Coalition citizens in the Amaq report issued on July 30, which derives from a landmark statement by IS spokesperson Abu Muhammad al-Adnani in 2014, that called for sympathizers to perpetrate low-intensity attacks against individuals in nations comprising the military coalition against the IS.

The IS-linked media’s reference to “soldiers of the caliphate” further suggests that the perpetrators were likely self-radicalized, considering the use of such phrasing in previous attacks by individuals influenced by IS ideologies but possessing no evident links to IS functionaries. This is also consistent with the lack of sophistication of the attack, as well as the reported numbers of extremist sympathizers in the country leading from long-standing anti-Islamist government policies.

Recommendations

Travel to Tajikistan may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest.

Those operating or residing in Dushanbe are advised to maintain heightened vigilance due to the risk of crime and militancy while avoiding unsecured travel to the country’s rural districts such as Danghara.

We advise against nonessential travel to outlying areas in Tajikistan near the country’s borders with Afghanistan, given the threat of militant activity and criminality, including drug smuggling.reat of radicalization in Central Asia, read our in-depth report.

AQIM-OIB claims attack against National Guard patrol in Jendouba Governorate’s Ghardimaou on July 8 – Tunisia Alert

Please be advised

According to the Ministry of Interior (MoI), a group of militants killed six National Guardsmen in an ambush targeting two vehicles patrolling the Tunisian-Algerian border near Ain Soltane village, located in Jendouba Governorate’s Ghardimaou District, during the morning hours of July 8.

The militants reportedly detonated an IED against the patrol, which was then followed by gunfire against the National Guardsmen. The assailants reportedly fled the scene following the attack and are still at large.
The attack was later claimed by al-Qaeda in the Islamic Maghreb (AQIM)-affiliated Okba Ibn Nafaa Brigade (OIB). According to their statement, nine National Guardsmen, including an officer, were killed in the attack. The militants seized eight rifles, a handgun, and a machine gun before fleeing the scene of the attack.

According to reports, a man was arrested in Kairouan Governorate for expressing support for the AQIM-OIB claimed attack on July 9.

In addition, members of the security services of Beja staged a protest in front of the National Guard’s headquarters demanding that the Minister of Interior (MoI) support new legislation meant to protect servicemen on July 9.

Tunisia Alert (UPDATE): AQIM-OIB claims attack against National Guard patrol in Jendouba Governorate’s Ghardimaou on July 8; avoid all travel to area | MAX Security

Assessments & Forecast

The attack is highly notable since it is the largest militant attack on Tunisian soil since March 2016, when Islamic State (IS) militants infiltrated Medenine Governorate’s Ben Guerdane from Libya. This incident highlights the increased risk of militancy near Tunisia’s western borders with Algeria, with the latest attack in the area recorded on May 31, when security forces foiled an AQIM-OIB attack in Kasserine Governorate. Although, AQIM-OIB is known to maintain an operational base along the Tunisian-Algerian border, the majority of its attacks over the past year have been mainly focused in the southwest, namely Kasserine Governorate, rather than in Jendouba, which is located in the northwestern part of the country.

Furthermore, all of these attacks have been of a lower sophistication, mainly involving the use of landmines or shootings. However, the latest attack utilized a relatively more sophisticated modus operandi. The multi-pronged nature of attack highlights the militant group’s resilience to security forces’ ongoing operations in western Tunisia, as well as their fighters’ abilities to regroup in the aftermath of such operations. It is also indicative of their ability to plan and execute coordinated attacks in order to achieve maximum casualties.

The timing of the attack is further significant. It was likely conducted in response to several developments that undermine the group’s interests in the area. These developments include the recent heightened security protocols put in place by Tunisian security forces along the border area in coordination with their Algerian counterparts.

This has led to a decline in the militant group’s abilities to operate along the border area, as witnessed in February, when Tunisian security forces neutralized a leader of AQIM-OIB in Kasserine Governorate based on intelligence from the Algerian intelligence apparatus. The militant had reportedly been sent from Algeria to reorganize the Tunisian affiliate.

Security protocols along the western border have also hindered smuggling operations, which provide militant groups with supplies and revenue, and cement their codependence with local smugglers, as the latter also depends on these operations as a source of income. Mitigating these operations not only damages the militant group’s supply lines, but also erodes their influence over the local population, as its members inevitably seek other sources of income.

Therefore, the attack likely seeks to compel security forces to divert resources away from Kasserine Governorate, which is AQIM-OIB’s primary area of operations in the country, towards Jendouba Governorate. This will overstretch the resources at the disposal of the Tunisian security apparatus, thus allowing militants to operate more freely in the area.

The latest attack follows the June 3 IS-claimed attack against a gas pipeline near Kasserine Governorate’s Sbeitla. In light of the ongoing competition between IS and AQIM over weapons, supplies, and personnel in western Tunisia, it is highly likely that the latest attack was meant to be symbolic in nature. This would project AQIM-OIB as the more prominent Sunni jihadist group in the country, allowing it to attract supporters and recruits at the expense of IS.

FORECAST: In response, the Tunisian Armed Forces (TAF) will launch intensified counter-militancy operations in western Tunisia, including in Jendouba, Kef, and Kasserine governorates. These will likely include increased security patrols as well as artillery shelling against potential militant hideouts in the mountainous regions. Security protocols will also be elevated along the Algerian border in order to prevent militants from crossing into Algeria and evading arrests.

However, this increase in security presence may provide militants with additional targets, leading to further clashes between security personnel and militants. Moreover, the increase in AQIM-OIB activity may prompt IS to heighten operations in the country in the near term. Overall, given the continued entrenchment of militants in western Tunisia’s mountainous areas due to their demonstrated ability to adapt and evolve, further similar sporadic attacks are likely to take place in the coming weeks and months.

Recommendations

Travel to Tunis may continue while adhering to all security precautions regarding militancy and civil unrest. Those operating or residing in Tunisia are advised that we maintain operational capabilities in the country.

Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support options.

Those operating or residing in Jendouba District on July 8 should avoid all travel to the Ghardimaou District in light of the anticipated counter-militancy operations following the attack, as well as the likelihood for further clashes in the area over the coming days.

Avoid all travel to the Kasserine, Kef, and Jendouba Governorates, in addition to all border areas, due to jihadist activity and military closures. Furthermore, avoid all travel to within 50 km from the border with Libya, due to the increased threat of attacks originating from Libya targeting Tunisian interests.

 

Recent spate of coordinated IS-linked attacks, new modus operandi in Surabaya exhibits increased operational capabilities of local cells – Indonesia Analysis

Executive Summary

IS-linked suicide attacks in Surabaya likely stem from active attempts by the JAD to offset leadership setbacks and mobilize sympathizers.

The coordinated nature of the attacks and use of an unprecedented modus operandi indicate increased operational capabilities of local jihadist cells.

Increased visibility of consecutive IS-linked incidents in Java within the same week may spur additional attacks by cells or lone-wolves in urban centers and elsewhere, including Jakarta and Bali.

Those operating or residing across Indonesia are advised to maintain heightened vigilance in the vicinity of government buildings, transportation hubs, iconic public areas, military bases, restaurants, high-value soft targets, shopping centers, and religious centers including mosques and churches, as they remain potential targets for militant attacks.

Indonesia Analysis: Recent spate of coordinated IS-linked attacks, new modus operandi in Surabaya exhibits increased operational capabilities of local cells | MAX Security

Friction Points | MAX Security

Current Situation

On May 14, a family of five individuals, arriving on two motorcycles, detonated their explosives outside the police headquarters in Surabaya, East Java. The attack was claimed by Islamic State (IS)-linked Amaq News Agency. On the same day, six militants part of Jamaah Ansharut Daulah (JAD), a local outfit affiliated to IS, were arrested in Surabaya and nearby Sidoarjo Regency. Two other suspects were killed in the raid, including the second-in-command of the Surabaya cell of the JAD.

A family of six, including three minors, carried out a series of coordinated suicide attacks involving the use of vehicles, at three churches in Surabaya on May 13. Both IS Central and Amaq News Agency claimed the attack. The adult male in the family was later identified as the leader of the JAD Surabaya cell. An explosion was also recorded in Sidoarjo Regency south of the city on the same day. A man, suspected to be a militant, his wife, and their son were found dead at the scene, while two other minors were rescued from the apartment alive.

A riot situation in a military detention center in Depok, which lies 16 km south of the capital city of Jakarta in western Java, was resolved on May 10 after high-risk militant detainees seized firearms from prison guards and killed five security personnel on May 8. IS Central claimed the prison attacks on May 8, while an IS-affiliated media agency released pictures from inside the facility on May 9. The founder of the JAD, Aman Abdurrahman, is incarcerated in the same prison. Two suspected militants of the JAD’s Bandung cell were killed on May 10 while traveling from Bandung to a detention facility in Depok, with the intent to aid rioting prisoners.

Between April 9 and 30, pro-IS social media groups released a host of propagandist material appearing to target Western institutions and practices.

On March 14, IS-linked media sources confirmed the death of Bahrumsyah, a top-ranked militant and recruiter hailing from Indonesia, in a mismanaged suicide attack in Syria on March 13. Meanwhile, on February 13, Abdurrahman was indicted for his role in the 2016 attacks in Jakarta. Zainal Anshori, head of the JAD, was sentenced to seven years in prison on February 12, over his plans to smuggle weapons from the southern Philippines.

Assessments & Forecast

Attacks likely planned ahead of time, tied to leadership setbacks incurred by JAD

We assess that the plots in Surabaya on May 13-14 were informed by a combination of factors. The time period between February and May has seen the indictment of JAD’s founder, the sentencing of its senior-most leader, as well as the death of an influential recruiter in Syria who was known to leverage his contacts within the IS leadership to recruit sympathizers and remotely organize plots through the JAD in Indonesia. Collectively, the developments represent a host of challenges to the senior leadership of the outfit, potentially impacting the morale of its cadre and ability to newly recruit radical elements. Thus, the attacks were likely driven by a desire to signal to authorities the negligible effect of leadership setbacks on the operational capabilities of local cells, to publicly undermine recent counter militancy efforts, and to boost the morale of existing sympathizers.

The attacks also appear to have been organized well ahead of time, a fact that is illustrated by the surge of pro-IS messaging in the month of April. The timing of the attacks, only days prior to Ramadan, further hints at this possibility. There is an observable, general uptick in jihadist plots across the world during this time period over perceptions that the heightened religiosity of Ramadan would offer greater spiritual rewards for those engaging in jihad against non-believers. The difficulty in assembling high-grade triacetone triperoxide (TATP) explosives, which were believed to have been used in the Surabaya church bombings, as well as the time needed to activate JAD sleeper cells without attracting scrutiny suggests the low likelihood of the attacks being organized in an ad-hoc manner.

In terms of planning, it is likely that the attacks were devised with assistance from Indonesian functionaries in Syria. The current incarceration of top JAD leaders within the country and precedent of previous high-profile plots being organized by Indonesian militants fighting in Syria suggests that this may have been the case. The May 13 claim by IS Central, only the second attribution of the kind in three years of IS-linked attacks in Indonesia, is a potential sign of increased overseas involvement in the attacks, as is the comparative high-degree of coordination per local context.

Change in modus operandi, coordinated nature of plots indicates increase in operational capabilities

The most notable feature of all three attacks in and around Surabaya is the unprecedented modus operandi of using cells consisting of whole families, including women and children. While relatives of militants have been known to detonate explosives to avoid being captured during security operations in Syria, and in Bangladesh, this marks the first use of family units to conduct offensive attacks.

This tactical shift, the relative success of which may signal an emerging trend, is likely connected to active efforts to increase the scale and tempo of militant attacks in the country. More specifically, using multiple suicide bombers serves to increase the effect of the planned explosion, while employing members of a family unit helps to avoid the cells from being identified as potential threats and makes security forces more reticent to engage in hostilities. The fact that the JAD sleeper cells remained undetected until after the attacks despite the strict vigilance of counter-militancy units points to the discretion offered by using a family-based suicide squad.

Attacks by local cells, low-intensity plots by sympathizers possible over increased activity, visibility

FORECAST: The developments in Depok, when taken alongside the Surabaya attacks, signal a period of significant activity for local jihadists, compounded by increased visibility aided in view of the IS Central claim for both the church bombings and the prison riot. The ongoing month of Ramadan allows individuals or groups to sustain this exposure by conducting attacks, highlighting the continued risk of militancy across the nation, and especially on Java, where there is a noted presence of JAD cells.

The recent attacks have generated a significant amount of momentum and media coverage for the JAD and other jihadist sympathizers in the country. The perceived successes of recent efforts will embolden militant handlers to maintain a pace of operations in Java for as long as their manpower can sustain. While there have been no reported instances of encounters in the capital as of this report, it is highly likely that militants observed traveling to Depok had been using Jakarta as a transport hub. The ability for such elements to reach the capital in the face of significant police deployments underscores the heightened potential for attacks in Jakarta over the coming days. Whereas the JAD traditionally targeted government installations in the past, the church bombings may indicate that civilian targets have also become desirable. In addition to Jakarta, the tourist hotspot of Bali would also be a high-priority target for the group in this scenario.

Islamic State linked news agency claims May 13,2018 attack | MAX Security

Recommendations

Travel to Jakarta may continue at this time while maintaining heightened vigilance throughout the city given the risk of militancy.

Those operating or residing across Indonesia are advised to maintain heightened vigilance in the vicinity of government buildings, transportation hubs, iconic public areas, military bases, restaurants, high-value soft targets, shopping centers, and religious centers including mosques and churches, as they remain potential targets for militant attacks.

Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.

Immediately alert authorities of any suspicious behavior or items.

Ensure that places of stay are properly secured, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.

AQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ – Africa & MENA Alert

Executive Summary

During the overnight hours of May 8-9, al-Qaeda in the Islamic Maghreb (AQIM) issued a threat against Western, and particularly French, companies that operate in the area “from Libya to Mauritania”.

While the threat is not new but rather a reiteration of an existing and proven one, its release in the lead-up to the holy month of Ramadan is indication of a heightened risk of al-Qaeda attacks against Western companies and interests in North Africa and the Sahel region over the coming weeks.

Please be advised

During the overnight hours of May 8-9, the al-Andalus Foundation, the media wing of al-Qaeda in the Islamic Maghreb (AQIM), published a “Statement for French and Western Companies”.

In the statement, AQIM threatens to attack Western, and particularly French, companies that operate in the area “from Libya to Mauritania”.

The publication further states that “85 percent of the wealth in this region is controlled by the French, while the rest is in the hands of traitors” and that the “French occupation prevents the prosperity of the region and has corrupted society”.

The statement concluded by warning Muslims to stay away from Western companies’ sites for fear of being hurt by collateral damage in an attack.

AQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ - Africa & MENA Alert | MAX SecurityAQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ - Africa & MENA Alert | MAX Security

Assessments & Forecast

AQIM’s statement does not denote a new threat to Western operations and presence in Africa, but is rather a reiteration of its main strategy: driving Western influence away from what AQIM perceive as their areas of influence, with the intention of consolidating its control and later expanding it while facing diminished resistance. AQIM and organizations that are directly affiliated with it, such as Jamaat Nusratal-Islam Wal Muslimeen (JNIM), have conducted several high profile attacks as part of this strategy. These most notably include the March 2 attack against the French Embassy in Ouagadougou, Burkina Faso; the October 25, 2017 attack against a French firm in Soumpi, Mali; and the March 18, 2016 attack against the Krechba gas facility in Algeria that was jointly operated by an Algerian government-owned company, and Norwegian- and British-based companies.

This strategy is also the main reason for AQIM’s threat particularly addressing French companies, as the French-led “Operation Barkhane” in the Sahel in support of the G5 countries (Burkina Faso, Chad, Mali, Mauritania, and Niger) is currently the main threat to AQIM and its direct affiliates’ operations. This threat was recently exemplified by French operations on February 14 in Mali that resulted in the deaths of six JNIM leaders, including that of Hasan al-Ansari, co-founder of JNIM, later confirmed by the group itself. However, as noted in AQIM’s latest statement, the threat extends to all Western companies, all perceived as “crusaders” in AQIM’s narrative, which it would attack given the opportunity, as underscored by the March 2016 Krechba attack that targeted Algerian, Norwegian, and British firms. That most of the attacks thus far have been directed against French interests is largely due to the outsized French presence among potential targets in the region and France’s lead role in regional counter-militancy operations.

The references made to the negative impact of the French presence on the region’s economy and society underscores an inherent part of al-Qaeda’s strategy as a whole, and that of AQIM in particular. AQIM, unlike certain other jihadist groups such as the Islamic State (IS), is willing to be more flexible in the implementation of its religious ideology in order to not only gain the support of, but also embed themselves in the local population. Thus, by appealing to material interests such as the state of the economy and society, AQIM is seeking to create an image of “us against them”, rallying as much of the local population as possible in opposition to foreign influence. While this may boost recruitment for the group, this is not the main goal in this case, as al-Qaeda favors quality over quantity with its fighters. The goal is rather to enhance the group’s freedom of operation within the population, which it will utilize to launch attacks and, later, to go into hiding as well as to facilitate logistical support.

FORECAST: Currently, AQIM and its direct affiliates maintain a presence, either of offensive operations or for logistical support, in parts of Algeria, Tunisia, Libya, Mauritania, Mali, Burkina Faso, and Niger, putting these countries at a high risk, which also corresponds with the message threatening Western companies “from Libya to Mauritania”. Given the current strategy and deployment of the group, as well as precedent, we assess that of these countries Algeria, Mali, and Burkina Faso are at the highest risk. Nonetheless, this foothold could, depending on developments and the dynamics of the situation in the region, be exploited to launch attacks into neighboring countries if needed.

FORECAST: It is important to note that while AQIM’s threat is not new, but rather a reiteration of an existing and proven threat, it does come ahead of the holy month of Ramadan, currently slated to start on May 15. This period of the year historically is when jihadist groups attempt to increase their rate of operations and conduct more high profile and notable attacks, so as to capitalize on the symbolism of the holiday. Accordingly, it is possible that the timing of AQIM’s latest message was similarly motivated, thus highlighting the elevated potential for al-Qaeda attacks against Western interests in North Africa and the Sahel region over the coming weeks.

Recommendations

Western companies operating in the North Africa and Sahel regions are advised to evaluate security procedures pertaining to attacks against installations, and emphasize guideline to their staff.

Examine behavioral patterns of local employees on site to mitigate potential risks arising from influence by Jihadist propaganda.

Monitor MAX Intelligence’s reports, as well as local publications to remain abreast of the dynamics of the threat posed by Jihadist groups in your areas of operations. Potential indications of a change in the level of threat include the rate, scope and rhetoric of Jihadist publications and their attacks, changes in modus operandi, scale and sophistication of attacks, and changes to areas of operations and influence of different groups.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city – Russia Analysis

Please be advised

On May 6, the Islamic State (IS)-linked media group, al-Amaq, claimed that a shooting attack which took place in Nizhny Novgorod, western Russia, was committed by a ‘soldier’ of the Sunni-jihadist group. According to a statement from Russia’s Federal Security Service (FSB) on May 4, an assailant opened fire on police officers during an identity check and barricaded himself inside an apartment in the city. The statement indicated that the perpetrator was later neutralized by security forces.

From 14 June to 15 July 2018, Russia will host the FIFA World Cup in a number of cities, including in Nizhny Novgorod. In the run-up to the tournament, Russian security forces have carried out a large number of raids and arrests, looking to neutralize militant cells made up of both Central Asian migrants, mostly based in major cities, and North Caucasian militants, mostly from the Republics of Chechnya, Dagestan, and Ingushetia.

Since the beginning of 2018, at least 38 militant counter militancy raids have been recorded in Russia, the majority focusing on reportedly IS-linked militants. At least five of the raids occurred in or near World Cup cities, including Moscow, Nizhny Novgorod, and Rostov-on-Don.

On April 17, three suspected IS-linked militants were arrested near Rostov-on-Don by FSB agents. A number of reports suggested the possibility that the militants were embedded in the city to wait until the start of the World Cup and carry out an attack during the tournament.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city - Russia Analysis | MAX Security
Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city | MAX Security

Click here to see Map Legend

Assessments

The claim from IS and the reports from the FSB indicate the first case of a successful attack occurring in a World Cup host city in 2018. The most recent Islamist militant attack in one of the host cities was in St. Petersburg in mid-2017. The incident underscores previous assessments that militants, from both Caucasian and Central Asian origins, are looking to focus their operations on the World Cup, so as to maximize exposure during the tournament. In addition, the developments come following the publication IS’ official newsletter, Al-Naba, on May 4 which called on its supporters to conduct attacks across Russia, underscoring the group’s continued interest in projecting its militant capabilities in the country. This assessment gains further credence considering IS’ repeated threats to the World Cup.

While there is no indication as to the origin of the militant at the time of writing, there are three main possibilities, all of which have been previously recorded in Russia. In the event that the attacker was a lone-wolf Central Asian migrant, who was locally radicalized within Russia through online and on ground Islamist networks, the incident highlights that lone-wolves in major cities are heeding to IS’ demands to carry out attacks on World Cup cities, demonstrating the threat in any city with a significant Central Asian diaspora community. In the event that the militant had links to Caucasian militant cells, it highlights attempts by the Caucasian Emirate pro-IS group to embed radicals within major cities, prior to the tournament, who will then carry out attacks. This is likely designed to occur before security in the North Caucasus becomes overwhelming around the time of the World Cup. The third option is that the militant may have had connections with both Central Asian militant networks and Caucasian cells, which would constitute a significant threat as such an assailant would be able to utilize the covert nature of the loosely linked Central Asian networks and the expertise of the well established Caucasian groups.

Going forward, a significant increase in counter-militancy operations in major cities and the North Caucasus will occur in the run-up to the World Cup. Furthermore, the potential for both minor and major attacks in all host cities remains before and during the tournament, likely looking to specifically target stadiums and locales with international attention, so as to maximize exposure.

Recommendations

Travel to Russia may continue while maintaining vigilant given the elevated risk of militancy and crime, particularly in major cities and World Cup host cities. (Click for our special report on threats to the 2018 World Cup).

Remain cognizant of any suspicious individuals or items that look out of place. Immediately alert authorities if identified.

Avoid all nonessential travel to the North Caucasus region, given the high risk of militancy and kidnapping.