Tag Archives: Islamic State

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir – India Analysis

Current Situation

Between November 22 and December 13, Islamic State (IS) released a series of online messages calling for attacks in India and indicating that the group was soon to develop a presence in the country. Similarly, al-Qaeda in the Indian Subcontinent (AQIS) released anti-India messages and videos during the period, making references to alleged right-wing Hindu violence perpetrated by the state towards its Muslim population.

The messages follow a claim by IS on November 18 for an attack in Srinagar, Kashmir, where one police officer was killed. On November 14, an audio clip purportedly from an Islamic State (IS) operative from Kerala State was circulated online via social media. Police have reportedly identified the speaker as Rashid Abdullah, the leader of a Kerala-based IS cell who is reportedly now in Afghanistan with Islamic State-Khorasan Province (IS-KP). Abdullah calls for truck, knife, and poison attacks against Hindus at major public religious festivals such as the Kumbh Mela and the Thrissur Pooram.

In recent months, AQI has increased the frequency of its propaganda messages directed towards India. In July, the group additionally received a pledge of support from Ansar Ghazwatul Hind (AGH), a Kashmiri militant group that broke away from the Hizbul Mujahideen (HM).

Motivations

The recent trend of increasing messaging by transnational groups IS and AQIS targeting India appears to be driven by an underlying competition between the groups to expand their spheres of influence in the country. Since its formation in 2014, AQIS has been dormant operationally in India, largely due to the movement of most of the group’s operatives towards the Afghanistan-Pakistan region, where they have embedded themselves with local militant groups fighting those respective governments. This revival of propaganda activity directed towards India was likely triggered by the pledge of the Kashmiri militant offshoot, AGH, to the group in July. Islamist militancy in Kashmir state has traditionally been non-aligned with global jihadist groups, and its primary intention has been the pursuit of a political, separatist agenda instead of an overtly religious motivation. Given this historic trend, AGH’s pledge of allegiance is a notable departure. It would appear the growing friction over leadership struggles within the local militant group HM has likely resulted in factions such as the AGH attempting to set up their own interests. To this end, their pledge to AQIS was likely in order to gain credibility for itself during its formative months specifically through association with a major jihadist organization.

Meanwhile, IS interest in the Kashmir conflict, from which it has previously stayed away, is likely based on the growing online interest in the group’s banner in the state. Youth in Kashmir appear increasingly disaffected with traditional militant groups such as HM. This sentiment likely extends towards groups that operate across the India-Pakistan border as well, such as Lashkar-e-Taiba (LeT) and Jaish-e-Mohammed (JeM), who they maintain are driven by political interests and do not represent the true Islamic character of their movement. Specifically, the reported images of the perpetrator with IS insignia prior to the attack likely resulted in their claim of the November attack in Srinagar. The details of the claim were faulty, stating that a Pakistani and not an Indian officer was killed; this throws into question the degree of contact between the perpetrator and IS leadership prior to the attack. However, it is nevertheless reflective of the group’s interests in reaching out to sympathetic locals and existing militant groups in Kashmir. This interest appears to be growing as IS takes increasing losses in Syria and Iraq, and consequently pivots to newer territories.

Apart from Kashmir, a degree of support for IS also appears to be developing across the country, as witnessed in the recent arrests, primarily in states with notable Hindu-Muslim community tensions. For instance, Kerala and Uttar Pradesh states, where a majority of the arrested suspects were originally from, have witnessed a notable increase in conflicts between Hindu and Muslim communities and political groups. This has especially been the case since the growing presence of the perceived right-wing Bharatiya Janata Party (BJP) in these states and its association with pro-Hindu organizations.

Capabilities

At the present time, we assess that the operational capabilities of both IS and AQIS across India’s major cities and central areas remain low. Despite sympathies for IS, local cells have failed to actualize any major attacks across the country, due to their inability to reduce their exposure to security force investigations. While local cells in recent times have previously attempted to build explosives or plan attacks, they have been unsuccessful due to raids and arrests that have foiled their plots. It is worth noting that these cells located until now have largely been isolated from each other and there is no evidence of a coordinated leadership hierarchy to guide recruitment and plot development. These solitary efforts are a likely cause for the inconsistencies in the abilities of these cells, and the overall lack of actionable capabilities. In addition, more established local militant groups such as the Indian Mujahideen, which may have been able to assist these efforts, have largely been neutralized in recent years through targeted operations and the arrests of their leaders. That said, the latent potential for less-sophisticated lone-wolf attacks remain, given the low operational threshold required to plan and carry out these attacks.

In Kashmir however, capabilities for transnational jihadist groups remain more potent. This is due to the established presence of militant groups, and the consequent access to weapons and explosives. To this end, AQIS appears to have an advantage over IS, given its established relationship with an on-ground proxy AGH, which is known to have trained operatives capable of staging ambushes on security force convoys and military camps. IS, on the other hand, has only been loosely linked to the November attack, and their connection to local militant groups remains underdeveloped at the present time.

Probabilities

In the immediate term, we assess that both IS and AQIS are likely to continue their push to increase spheres of influence in India. Their primary focus is likely to be Kashmir, given the marked escalation of civil unrest since 2016 over the continued military presence and the opportunities this presents for recruitment. Meanwhile, both groups will likely seek to capitalize on the increasing factionalism within established local militant groups such as HM and draw disaffected factions towards their banner. AQIS is likely to attempt this through their local affiliate AGH, whose leader Zakir Musa remains popular among locals in southern Kashmir. Meanwhile, IS interests are likely to be coordinated by their affiliate in the Afghanistan-Pakistan region, IS Khorasan Province (ISKP). The group may seek to replicate their model of engagement in Pakistan, which has involved carrying out attacks through local low-level militant groups and claiming them as IS attacks, without any formal pledges of allegiance from their proxies.

For the rest of the country, both groups’ prospects will likely remain lower in the immediate term, given that the Indian military has largely sequestered the Kashmir conflict away from the country’s center. However, recent messages have called for Kashmiri militants to attack Delhi, indicating strong intent to expand beyond the state. Such attempts, while rare, are not unprecedented and security forces will likely remain vigilant for this threat.

Instead, in the country’s major cities and central regions, the more immediate threat stems from potential lone-wolf militancy. There remains a palpable intent among certain radicalized sections of the Muslim community, and sympathizers may increasingly take inspiration from IS’s recent calls for lone wolf attacks in places like Europe and North America. In addition, local cells may also increasingly orient their operations towards these forms of attacks should more sophisticated modus operandi continue to yield limited results. This would likely place Hindu religious targets, such as festivals and temples at a specific risk. Attacks against other targets such as synagogues and Western diplomatic or business interests also remain a possibility, given that local radicalized individuals are equally engaged with global jihadist propaganda, which advocates attacking these targets.

Recommendations

Travel to Delhi and other major Indian cities can continue, while travelers are advised to maintain vigilance for security risks associated with frequent, large demonstrations as well as potential militant threats targeting government buildings, security installations, large crowded public places, or religious sites.

We advise against all travel to Jammu and Kashmir State, with the exception of Jammu and Srinagar cities. Any overland travel west or south of Srinagar, towards areas such as Tral, Baramulla, Sopore, Shopian, and Anantnag is advised against.

Given the continued militant threat in India, maintain heightened vigilance for suspicious individuals and unattended baggage, particularly in public places including major hotels, government installations, transport hubs, markets, restaurants, entertainment venues, and places of worship.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security – Spain Analysis

Situation

During the afternoon hours of August 17, Spain experienced its first Islamic State claimed attack as a van plowed 500 meters into a crowd of people on the busy La Rambla street in central Barcelona, leaving 13 people killed and over 100 injured. The incident was subsequently claimed by the Islamic State who wrote that it was carried out by “soldiers of the Caliphate in Spain” and was intended to kill “Crusaders and Jews”.

Afterwards, during the evening hours of August 17, police located a second van in the town of Vic (80 km from Barcelona), which was hired at the same time as the van used in the initial attack, and was suspected to be a getaway vehicle.

At around 01:00 (local time) on August 18, a second car ramming incident took place in the city of Cambrils, around 100km southwest of Barcelona, in which one person was killed and six others injured. The attackers attempted to flee the vehicle on foot, allegedly wearing fake suicide belts before all five were killed by police.

More importantly, however, were the events that took place during the evening hours of August 16, less than 24 hours before the first car ramming incident. At this time, a large explosion was recorded in a small house in Alcanar, 160 km southwest of Barcelona and approximately 300 km from Ripoll. A police report, which was later released indicated that the occupants had been preparing a TATP-based explosive device, despite the blast initially being dismissed as a gas leak. The house was reportedly filled with over 100 canisters of propane and butane. Furthermore, sources indicate that the device being prepared in the house may have been intended to target Barcelona’s famous Sagrada Familia church.

Click here to see Map Legend

Building the Terror Cell

Current reports suggest that the individuals involved in the attack all came from the area around the town of Ripoll, around 90 km north of Barcelona. Particularly, it appears that Abdelbaki Es Satty was the imam in Ripoll and is believed to have been instrumental in the radicalization and encouragement of the other seven younger individuals in carrying out the attack. Es Satty had been the imam since 2015 in Ripoll; however, he allegedly left “abruptly” in June 2017, and is suspected of using the time to start planning a militant attack.

From 2010-2014 Es Satty served a four-year prison sentence in El Castellon, for a series of drug trafficking charges. It was during this time that he met and became friends with Rachid Aglif, who is serving an 18-year sentence for his role in the 2004 Madrid Train Bombings. Es Satty was also implicated in an operation in which he was involved in recruiting five individuals attempting to travel to fight in Iraq in 2006.

Other than Es Satty, the cell itself was built of young men of Moroccan heritage between the ages of 17 and 24-years-old. Reports indicate that all of them were born in Morocco and came to Spain at various times, all spending time or living in the town of Ripoll, where the cell appears to have been formed. Apart from Es Satty, there is no evidence to suggest that the other cell members had criminal records and no reported relations to other known radicals or militant networks. That said, a number of the members were reported posting increasing material on social media which pertained to topics typically associated with Islamism, including posts which spoke about the death of “infidels”, and contained excerpts of anti-Semitism common among radical Muslims.

Assessments & Forecast

Attack underscores emerging threat of homegrown cells in Europe

This attack is notable for numerous reasons, as despite the eventual act seeming to fit within the general pattern of attacks types (i.e. vehicular ramming) witnessed in Europe over the past year, it had the potential to be one of, if not the, deadliest, most damaging, and symbolic militant attacks by any group in Europe in years.

In this context, the incident on La Rambla on August 17 was clearly not the initial plan of attack. The connection between the attackers and Imam Es Satty, who was killed in the Alcanar explosion, as well as the almost immediate action following the explosion paints a clear picture that the explosives in Alcanar were meant to be used by the cell in a spectacular attack, and that the two eventual incidents were taken as a “plan b” method. Indeed, the use of fake explosive belts are indicative of a degree of organizing such a “plan b” approach. Furthermore, it is likely, given the speed with which they were carried out following the explosion on August 16, that the car ramming attacks were expedited in an attempt by the cell to carry out an attack before police investigations into the explosion foiled their plans and led to their arrests.

More telling, however, is the nature of the cell involved and what it says about the evolution and variety of threats from such militants in Europe. Indeed, we have seen that attacks range from Islamic State and copycat-inspired “lone wolf” attacks to much more organized and planned attacks, at times involving instructions from a central organization, such as the case in the Bataclan attack in Paris and the Brussels Airport attack. It is also important to note, that the lone-wolf attacks in and of themselves can range in death toll from one or a few dead from a stabbing, to scores killed in the Orlando night club shooting or Nice vehicular attack, two of the deadliest, yet simpler attacks by IS supporters.

The recent London Bridge and Boroughs Market attack was a new evolution along the range of lone-wolf Jihadist spectrum, as it involved a group of lone wolves cooperating with one another to form a cell. While the structure and formation of the London attack is not entirely clear, it appears that those involved were self-radicalized but connected to one another either by their own volition, namely via Jihadist messaging channels or were introduced to one another through such a channel or otherwise. That said, these individuals do not appear to have been organized by a central body or particularly experienced individual.

The attack in Barcelona, for its part, appears to fall into the category of a “Homegrown Cell”, which has been rare in recent years. The origin of a homegrown cell can vary significantly and can be constructed by one radical and charismatic figure acting alone, such an individual working on behalf of a known group, or by a radical Islamist who has a connection to a known group to one degree or another but was not instructed by them.

In the case of the Barcelona cell, Abdelbaki Es Satty was the likely facilitator and builder of the cell. His recruiting background portrays him as someone with an understanding of the process of identifying targets for potential recruitment and likely having the personality to influence others in such a way. Additionally, he likely developed a greater familiarity with various terrorist techniques and principles during through this relationship with Rachid Aglif. We assess that Aglif and the attack he was involved in, in which 192 people were killed, served as an inspiration for Satty.

Beyond that, it is unclear if he did have guidance or instructions from Islamic State although the speed by which Islamic State released the official claim of the attack, may indicate their prior knowledge of his plans.

Homegrown cells allow for greater reach, more sophisticated, destructive attacks

While the individual “lone wolf” attack has the benefit of being much more challenging to predict and thwart, given that it involves only one individual and minimal planning, they are less likely to have as high of an impact as more organized attacks. Other than rare cases, such as Nice and Orlando, the majority of “lone wolf” attacks only involve a small number of casualties before the attacker is neutralized, even in the case of more advanced lone-wolf attacks, such as in London. On the other hand, while a cell composed of more trained and experienced Jihadists is able to carry out highly effective and destructive attacks, due to their expertise and manpower, the accumulation of many affiliated militants, in one area, alongside their communications and activities, is far more likely to arouse the suspicion of security forces and risk being thwarted.

In that regard, the Ripoll cell is an interesting balance in that it can balance the low-key nature of a lone wolf group with the greater planning and organization of a more advanced Jihadist cell. Islamic State can select known and trusted individuals online, or returning foreign fighters, and instruct them on the formation of a homegrown cell, and in some cases lend them material support or connect them with other experienced or useful individuals.

The Spanish cell was able to plan and almost execute what could have been one of the most significant European attacks, without being thwarted by security, because although they were many in number, their relationships seemed organic enough not to arouse suspicion and the fact that the more suspicious activity they did was conducted in a remote location and not in their home environment. This allowed them to prepare a highly sophisticated attack plan, with multiple layers and back-ups, without outwardly appearing to be a militant cell.

Further attacks from similar cells should be expected across Europe

While the possibility of typical “lone wolf” attacks remains throughout the world, particularly in Europe and the West, the homegrown cell phenomenon is likely to become more common than previously witnessed. Given that IS have penetrated almost every country in Europe and have propaganda and media communications in most major languages it is likely that there are already similarly structured cells across the continent, built of local radicals bound together by online facilitators or one local IS-affiliate or even one individual who has a greater degree of exposure to Islamist methodologies. Additionally, as seen in the past, the “copycat effect” is likely to take hold, with similar cells conducting attacks in the coming months.

Furthermore, IS regularly encourages attacks throughout the continent and adjusts their instructions to the successes of previous attacks. In this context, it is highly likely that Islamic State, whether involved in the Barcelona attack or not, will learn from its successes and failures.

Thus, and as IS continues to lose territory in the Middle East, and tends to want to balance these losses with an appearance of being a global phenomenon, we assess that Islamic State may actively seek to ‘activate’ such cells in Europe. In this way, the organization will likely want to have more control over how, when, and where an attack will take place, and may currently be reaching out to foreign fighters who returned to Europe, or other connections they may have, in order to encourage them to build their own homegrown cells.

Furthermore, Islamic State will likely learn from the failure of being over ambitious. Es Satty likely looked up to Rachid Aglif and his involvement in the deadly Madrid attacks from 2004, and in seeking to match its casualty level, chose to develop an extremely large explosive device by a large number of terrorists rather than launching an attack earlier and at a lower capacity. With this, we expect that IS will encourage smaller attacks by smaller homegrown cells, but ones that have a far greater potential for success.

Recommendations

On the corporate level

We advise raising the awareness of employees and security personnel to unusual activity and behavior of fellow employees. Encourage your employees to report such observations whether at work or in their personal surroundings. Monitor local unusual developments in order to predict emerging threats in the vicinity of your interests, and follow the global terror trends and modi operandi, in order to adapt your security measures and preparations. Conduct surveys to check and evaluate the relevancy of your current security protocols.

On the institutional level

Additionally, identify the social groups and communities in your area that are more susceptible to radicalization, identify the leading individuals, and monitor their activities. Raise the public’s awareness regarding key indicators of unusual activity.

For more information about the terror threat in Europe and what you can do to be prepared, check out our white paper here.

What does the July 24 Lahore suicide bombing say about the TTP militant group’s changing influence in the city – Pakistan Analysis

Current Situation

The Lahore suicide bombing attack reportedly occurred at 17:30 (local time) along Ferozepur Road, in the vicinity of the Arfa Karim Tower and one kilometer away from the Punjab Province Chief Minister’s house, where he was holding a meeting at the time. At least 26 people were killed and 53 others injured, including police officers and civilians.

Click here to see Map Legend

The city administration declared an emergency in hospitals and appealed for blood donations. Unconfirmed reports indicate that the motorcycle that the attacker used to arrive at the scene was registered to a resident of the Faisal Town area of the city. Approximately one hour after the incident, Tehreek-e-Taliban Pakistan’s central spokesman Mohammad Khurrassani claimed responsibility for the bombing through an email, declaring it a suicide attack.

The attack targeted a group of police officers that were deployed to clear street vendors from the area, which has since been cordoned off by a heavy contingent of security forces and the section of the road sealed. The road serves as the main link between Lahore and Kasur and is a busy thoroughfare, with Lahore’s Metro Bus also passing through.

Earlier on July 24, at least 24 people killed and 42 injured in a suicide car bomb attack in Kabul that was quickly claimed by the Taliban. Meanwhile, on April 5 four security personnel and two civilians were killed in a TTP-claimed suicide attack against census workers and their military escort along Bedian Road, while its splinter group, Jamaatul Ahrar (TTP-JA), claimed a suicide attack outside the Punjab Assembly on February 13 that resulted in the death of 13 people. On July 10, the US State Department and UK Foreign and Commonwealth Office (FCO) both issued advisory warnings of a heightened threat of militant attacks in Lahore has been targeted in a series of blasts over the past year.

Assessments & Forecast

Attack highlights TTP influence in Punjab, possible increased cooperation with Afghanistan Taliban

While groups like the Islamic State continue to operate in more peripheral areas of the country, especially in tribal areas bordering Afghanistan, the TTP and its offshoot TTP-JA remain the only militant groups that have demonstrated the consistent capability to carry out large-scale attacks in Lahore, likely due to the strong influence the group is believed to possess in Islamist schools throughout Punjab, especially in the province’s southern regions. This is evidenced by the fact that the perpetrator of the attack was likely a Lahore native, given that the motorcycle was registered to a local.

Furthermore, the group almost exclusively targets security forces and tends to issue claims of responsibility within hours of attacks, consistent with the victims of today’s attack and the rapid claim of responsibility. In this context, the claim is most likely credible and further highlights the group’s position as the dominant militant group in the Punjab Province.

The TTP is loosely allied with Afghanistan’s Taliban insurgents but focuses primarily on targeting Pakistani government officials. Both groups maintain a modus operandi which seeks to carry out successive attacks in a relatively short time span. The fact that the Lahore attack immediately followed the large-scale bombing in Kabul seems to suggest a degree of coordination and thus increasing cooperation between the two groups. The FCO and US State Department Warnings, issued just two weeks before today’s bombing, suggest that the threat of attack was, in fact, imminent and underscores security forces’ inability to hamper such movements, despite credible intelligence revealed by Western foreign ministries that suggested it would likely take place.

Attack highlights consistent vulnerabilities in security apparatus, likely to compel uptick in anti-militancy raids, protests in coming days

FORECAST: Given reports of a significant shortage of available blood in the hospitals that the victims were sent to, casualties are likely to significantly inflate in the coming hours and days. This is liable to fuel criticism by opposition groups and locals, which may allege that emergency response authorities are not adequately adapting to the growing threat of attacks in the city. Protests are liable to take place throughout the city over the coming days, both in solidarity with the victims and in condemnation of the government’s inability to thwart and adequately respond to the attack, similar to the protests that took place in the day following the February 13 attack.

Security and emergency personnel are already reportedly on the scene, but the extent of damage and cause are yet to be ascertained, meaning that a significantly bolstered security force is liable to remain in the area throughout the evening and into July 25. Keeping in mind the reports of road closures in the vicinity, many local businesses and major roads are likely to remain closed and severe traffic congestion is liable to be reported throughout the area as well as in the adjacent city of Kasur.

FORECAST: Following the recent attack on April 5, security authorities carried out a large-scale, anti-militant operation at the Punjab Housing Society in the city, just 10 days later, on April 15. Given this past precedent and in a likely attempt by the government to project an offensive posture following the most recent blast, an uptick in anti-militant raids in the city targeting Madrasas allegedly sympathetic to TTP is likely to occur. Attacks may also center on Faisal Town, where the owner of the motorcycle used in the attack is believed to reside.

Recommendations

We advise against all nonessential travel to Pakistan given the heightened threat of militant attacks, criminality, kidnappings and sectarian tensions throughout the country. Those operating or residing in Lahore are advised to avoid nonessential travel to the Afra Karim Tower and its environs given the recent attack and reported heavy security deployments. Further, those operating throughout the city are advised to maintain heightened vigilance for the remainder of July 24 given the latent potential for copycat or repeat attacks. If transiting through the city as well as the adjacent, we advise to allot for significant disruption to traffic and business continuity, especially in the vicinity of Ferozepur Road.

Why the July 7 large-scale attack by the Islamic State in North Sinai is likely an effort to challenge regional & local setbacks – Egypt Analysis

Current Situation

A large scale and multi-pronged attack by the Islamic State (IS), involving at least two suicide vehicle-borne IEDs (SVBIED) followed by a ground assault targeted a military checkpoint near the North Sinai village of al-Barth, located approximately 30km south of Rafah, during the morning hours of July 7. According to the Egyptian Armed Forces (EAAF) Spokesperson, 26 casualties were inflicted on the Egyptian military, including the killing of one Colonel, while at least 40 militants from the IS-affiliated Wilayat Sinai were killed and six of their vehicles destroyed in the attack.

Click here to see Map Legend

Assessments & Forecast

While attacks by Wilayat Sinai in North Sinai, particularly the triangle area between al-Arish, Rafah and Sheikh Zuweid which is the group’s main area of operation, are common, this recent attack is highly notable due to its large scale, sophistication, and reports that it resulted in heavy casualties on both sides. This is compared to the more frequent, near-daily attacks in the area that largely include small arms fire and IEDs, have a more limited effect, and result in smaller numbers of casualties. In this context, while Wilayat Sinai continues to conduct offensive operations in North Sinai at a high frequency, the scope and volume of its activities had significantly decreased in recent months. Furthermore, while previously the group had conducted attacks outside of its primary area of operations in North Sinai on a regular basis including several times of a month, the last such attack took place in South Sinai’s Saint Catherine’s Monastery on April 18-19, and before that in Mount Halal on March 23, highlighting a continued decrease.

As such, the reasons for the decline in Wilayat Sinai’s scope and volume of activities is likely the result of regional and local developments relating to the Sunni jihadist group. Regionally, as the central organization is continuing to face defeats in Syria and Iraq, it is likely facing more difficulties in lending an active support for its affiliate in North Sinai. Locally, following the October 14, 2016, Wilayat Sinai’s attack on the Zakdan Checkpoint, Egyptian security forces had changed their strategy regarding counter-militancy operations in North Sinai. This entailed a change of focus away from combating the militant group at its “front lines” in the primary area of operations, which did result in killing militants but not in a substantial effect on the group’s overall capabilities. Instead, the focus was turned to the group’s logistic infrastructure such as tunnels, smuggling routes and hideouts and weapons caches in the Central Sinai mountains, which created a more long-term damage and one that is harder to recover from.

Additionally, the attack comes amidst rapprochement talks between the Egyptian government and the Gaza-based Hamas organization, which also include the creation of a buffer zone between Gaza and North Sinai, thus further challenging cross-border activity which benefits Wilayat Sinai and friendly Gaza based-Salafi organizations which are opposed to Hamas. Furthermore, following April 17 when IS prevented a cigarette smuggling operation by members of the Tarabin Tribe, one of the peninsula’s largest and most powerful tribes, parts of the Tarabin tribe, along with later members of the Sawarka Tribe, initiated operations against the militant group, both in their own independent militias, as well as in support of the EAAF. This has likely caused damage to Wilayat Sinai, as it heavily relies on the local population in the region to ensure its freedom of operation.

As such, while the recent attack serves as an indication that Wilayat Sinai still retains significant capabilities that allows it the mount such a large-scale operation, the attack was likely motivated by the aforementioned hardships the group is facing, regionally and locally, and may be the result of perceived despair. In this context, by conducting such a high-profile attack, the group likely seeks to highlight that it is still a viable threat. Moreover, it likely seeks to hinder and deter further counter-militancy operations in North Sinai, by leveraging the civilian population to pressure the government that the investment in North Sinai is not worth the high numbers of casualties caused by it.

If this strategy succeeds, it may allow Wilayat Sinai to at least partially rehabilitate its lost infrastructure and freedom of operation, however at the time of writing, it has low likelihoods of success. FORECAST: Taken as a whole, additional frequent limited-scale attacks by Wilayat Sinai are liable to occur in the al-Arish-Sheikh Zuweid-Rafah triangle area over the coming days and weeks, along with possible larger scale and higher profile attacks in this and other areas in the Sinai Peninsula, however at a significantly reduced rate. Furthermore, Egyptian authorities will likely increase their operations in North Sinai over the coming hours and days, to retaliate against the attack and portray an image to its citizenry that they were able to significantly damage the militant group, thus offsetting any arguments against operations in the peninsula.

Recommendations

Travel to Cairo and Alexandria may continue while adhering to all security precautions regarding militancy and civil unrest. Consult with us for itinerary-based travel recommendations. Avoid all travel to the North Sinai Governorate and border areas with Libya, Sudan, and Israel due to the persistent risk of militant attacks, kidnappings, and general lawlessness.

We further advise to avoid nonessential travel to the Southern Sinai Peninsula, while maintaining heightened vigilance in the Suez Canal Zone, the Upper Nile area, and the Nile Delta region due to an increased risk of unrest and the heightened risk of militant attacks. Before traveling to Sharm al-Sheikh, confirm that flight operations are continuing and have not been impacted by recent militant threats. As a general security precaution, remain vigilant in areas surrounding and avoid the immediate vicinity of government installations, police stations, and religious centers, particularly churches, as these locations remain under elevated threat of militant attacks. When traveling in central squares, or in areas with persistent police deployments, avoid the immediate vicinity of security forces, particularly fixed traffic booths, as such personnel and facilities have increasingly come under attack by militant elements.

Read more posts like this in Max security blog

What effect will the Islamic State’s territorial setbacks in Iraq have on their strategy in the rest of the country? – Iraq Analysis

Current Situation

Over the past weeks and months, a marked uptick of asymmetric attacks perpetrated by the Islamic State (IS) has been recorded in the Diyala, Salahuddin and central Anbar Provinces. For instance, in Diyala Province, on June 11, the group claimed responsibility for an SVBIED attack targeting the al-Safra checkpoint in the al-Adhim area, north of Baqubah. Five soldiers were killed and three others were wounded according to the group. Furthermore, on June 7, IS carried out an attack on an intelligence headquarters in the city of Baqubah according to IS-linked media. Finally, on May 28, IS claimed a suicide attack targeting a security checkpoint in Baqubah, which resulted in the killing of three people and the wounding of at least 13 more.

Meanwhile, in Salahuddin Province, on July 1, IS carried out an assault on Peshmerga fighters on Highway 55 linking the cities of Tikrit and Tuz Khurmatu. killing one Peshmerga officer. Furthermore, on April 5, IS had carried out a multi-pronged suicide bombing and shooting attack in the city of Tikrit, killing 31 people and wounding over 40. Finally, on May 2, another suicide bombing was staged by the Sunni jihadist militant group at a police checkpoint at the entrance of the city of Samarra, killing two security personnel.

Finally, in Anbar Province, large-scale IS-perpetrated suicide bombings targeting Iraqi Security is Forces (ISF) were recorded on April 3 in Fallujah, on May 3 in Ramadi, and on May 15 in Haditha.

Assessments & Forecast

The uptick of IS attacks in the aforementioned provinces comes amidst persistent territorial setbacks for the Sunni jihadist militant group to pro-government forces across Iraq, and chiefly the ongoing pro-government campaign to capture Mosul, which is liable to be completed over the coming weeks, thus resulting in IS’ loss of their prominent stronghold in Iraq. With this in mind, we assess that the increased number of asymmetric attacks in the aforementioned provinces is likely an effort of the Sunni jihadist militant group to establish a foothold in the Diyala, Salahuddin and central Anbar Provinces instead, as they lose their traditional strongholds, with the ultimate goal of obtaining a territorial control in these areas in the long-term. This is further underscored by reports indicating that IS is currently deploying fighters to villages at the border between the Salahuddin and Diyala Provinces, in a likely effort to capitalize on the low presence of pro-government forces in the area.

We assess that the increase of IS activity in these specific provinces is motivated by their ethnically mixed populaces, which includes a sizable number of Sunni Arabs. The fact that a significant portion of this population suffers from perceived marginalization by the Iraqi government, as well as reported cases of harassment of the local Sunni Arab populations by Shiite Popular Mobilization Units (PMU), makes these segments susceptible to sympathizing with the Sunni jihadist militant group. We further assess that the fact that a significant number of the aforementioned IS attacks have targeted PMU forces is likely an indication of the group’s attempt to further exacerbate sectarian tensions between the abovementioned communities in order to gain and expand support among Sunni Arabs. Such a calculus is likely motivated by the fact that attacks against Shiite targets are often met with acts of reprisal by PMU forces against local Sunni Arabs, such as the torching of Sunni-operated businesses and the targeting of Sunni mosques to a lesser degree. Such developments, in turn, are liable to result in increased support of Sunnis for IS.

Meanwhile, on a tactical level, such IS ambitions have likely been facilitated by the fact that the group has recently been able to renew its activities in the Hamreen Mountain range, which is strategically located between the Kirkuk, Diyala and Salahuddin Provinces and oversees the region. Furthermore, the mountains are located close to Highways 1 and 2 leading to Baghdad and bisecting Diyala and Salahuddin provinces, as well as to the cities of Tuz Khurmatu and Kirkuk, which are marked by frequent ethno-sectarian tensions. With this in mind, should IS be able to consolidate its presence in this mountainous region, this will likely increase their ability to launch asymmetric attacks in the aforementioned provinces and cities, and quickly withdraw to and take cover in the Hamreen Mountains following such acts of militancy. This is due to the fact that the rugged and mountainous terrain is liable to impede counter-militancy operations of pro-government forces launched in response. Additionally, IS may increasingly target Highway 1 and Highway 2, both main traffic arteries connecting Baghdad with northern Iraq, in order to hinder the Iraqi government’s attempts to rebuild and reconstruct the country’s northern regions after their eventual liberation from the Sunni jihadist militant group..

FORECAST: Over the coming months, given that the Diyala and Salahuddin Provinces are entirely held by pro-government forces, with IS lacking any consolidated territorial control at this time, we assess that the Sunni jihadist militant group will likely maintain, and possibly escalate, its high intensity of asymmetric attacks in central government-controlled locations, such as Baghdad and Ramadi. This would constitute an effort to force pro-government troop deployments away from these areas, in order to facilitate IS’ ambitions to gain a foothold in the Diyala and Salahuddin Provinces. Should such a scenario eventually materialize, the group may even capitalize on a broad deterioration of the security situation, thus setting the conditions to attain territorial control over parts of these areas over the long-term.

In light of the uptick in IS attacks in the aforementioned provinces, we assess that ISF forces will likely intensify counter-militancy raids targeting suspected IS militants in these areas over the coming weeks in an effort to mitigate the risk of further attacks by the Sunni jihadist militant group. With that being said, in light of the aforementioned rough terrain in which IS militants operate, the potential for such expected security measures to be successful remains very limited.

FORECAST:Furthermore, over the long-term, it remains possible that Iraqi authorities will attempt to reach out to the Sunni Arab populace, and particularly the local tribesmen, in these provinces by providing funds for development and improvement of infrastructure in order to reduce the appeal of IS in their eyes. Such a step could build on the successful 2007 precedent, when the Iraqi government channelled US-provided funds to Sunni tribes to fight against IS’ predecessor of the Islamic State of Iraq (ISI), which resulted in a significant decrease in the group’s activity across the country throughout 2007-2008. As a consequence, local support for the Iraqi government increased considerably, with the Sunni jihadist group’s influence almost entirely diminished, until US funding was discontinued in conjunction with the US military’s withdrawal from Iraq. That said, a lack of available funds at disposal of the Iraqi government, as well as likely opposition of Shiite PMU forces to such a policy, are liable to impede its feasibility.

Recommendations

It is advised to defer all travel to Baghdad at this time due to the daily threat of militancy in the capital, violence in areas surrounding the city, and the risk of a broad deterioration of security conditions. For those remaining in Baghdad, it is advised to ensure that contingency and emergency evacuation plans are updated. Contact us for itinerary and contingency support options.

We advise against nonessential travel to Basra. If travel is essential, contact us for itinerary-based consultation and on-ground support. Travel to areas outside of Baghdad and Basra should be avoided at this time, particularly to the north and west of the country, including the Anbar, Nineveh, Salahuddin, Kirkuk, and Diyala Provinces due to ongoing combat operations. This is in addition to avoiding the Babil Province, south of Baghdad. Those operating in these regions are advised to contact us for itinerary and contingency support measures, including evacuation options, given the deterioration in the security situation. Consult with us before traveling to Kirkuk City.

Travel to Erbil and Sulaymaniyah may continue at this time while maintaining heightened vigilance and adhering to standard security precautions regarding the threat of militant attacks. Avoid all nonessential travel in the Kurdistan Regional Government outside of Sulaymaniyah and Erbil.

Given the ongoing presence of Islamic State (IS) militants in bordering provinces and subsequent clashes with Kurdish Peshmerga, it is advised to avoid the vicinity of the KRG’s borders, and the disputed areas. Those operating natural gas or oil facilities are advised to obtain security consultation for facilities in outlying areas, specific to the nationalities and operational needs of their employees. As a general precaution, it is advised that any travel, particularly in outlying areas, be conducted in armored vehicles, with proper security escorts and coordination with authorities.

How ongoing fighting in Marawi & international participation in conflict suggest regional militant nexus – Philippines Analysis

Current Situation

On June 23, an AFP spokesperson stated that following the initial rounds of heavy fighting in Marawi that began on May 23, only Bangolo, Marinaut, Raya Madaya and Lilod remain contested. Overall, the AFP estimates that approximately 225 militants and 50 soldiers have been killed since the operation commenced, along with another 26 civilians. A brief eight-hour ceasefire between the AFP and Maute fighters occurred in Marawi on June 25, during which time delegates met to discuss the issue with the remaining hostages in the city, believed to still be numbering at around 150.

Meanwhile, Isnilon Hapilon, a senior figure in the siege and leader of the Islamic State (IS)-linked Abu Sayyaf group, is believed to have fled the city as of June 24. Reports indicating the death of senior commander Omar Maute and chief financier Mahmud bin Ahmad, a Malaysian national, remain unverified. These potential losses, as well as intelligence suggesting infighting and divisions among the remaining leadership, has led the AFP to label the remaining militant force as “crumbling” on June 26, and that victory is “irreversible”.

In addition to the involvement of 21 Malaysian individuals, a leaked Philippine intelligence report from June 24 indicated the presence of 28 Indonesians, 26 Pakistanis, four “Arabs”, three Bangladeshis, one Indian-Singaporean, and one Singaporean during the course of the siege. Reports from June 14 also showed the presence of US forces outside of Marawi, which an AFP spokesman later clarified as serving a non-combat operational assistance role, largely related to reconnaissance. On June 23, further reports surfaced over Australia offering to send more surveillance aircrafts to Mindanao to aid AFP efforts.

Philippine Vice President Leni Robredo visited camps set up outside of Marawi for displaced persons on June 26, with President Rodrigo Duterte remaining in an unknown location or personal state for six days, fueling renewed speculation by the press that he was suffering health problems. On June 17, President Duterte made an appearance after an absence that had also been six days long, reportedly responding with a vulgar joke after reporters asked him about the state of his health.

Click here to see Map Legend

Assessments & Forecast

Despite projected confidence from AFP, no timeline for complete victory has been defined

It continues to remain difficult to gauge overall progress by the AFP in retaking the city. While only four areas remain in contention, fighting has been present there since around the opening days of the offensive. Moreover, the considerable presence of hostages will continue complicating efforts to fully drive out the militants as forces continue to consolidate in these remaining districts. Further compounding these issues, the AFP statements suggesting strong confidence for a dissolving militant hierarchy and an imminent victory appear to rely on unverified information. Although there are no indicators that the AFP will not eventually clear out the city, similar statements of imminence have been previously made regarding Marawi that have yet to be realized, and as such, are not accurate indicators of on-the-ground progress.

Additionally, as the AFP continues to make headway, the risk of infiltration into surrounding territories becomes elevated. The AFP has made a number of statements over the weeks suggesting an acute awareness of this fact, likely meaning that security deployments to the immediate areas around Marawi will continue to be bolstered over the coming weeks. That being said, Hapilon’s reported exfiltration suggests that security gaps nonetheless exist to be exploited.

Meanwhile, President Duterte is known to be an energetic and forceful figure, and his continued absence in the face of this exhaustive crisis remains highly conspicuous. The Palace has remained tight-lipped over President Duterte’s frequent disappearances over the month of June and with Duterte himself offering little information to the press, this may prove to be damaging to his popularity and brand, which has continually emphasized his strongman character. However, the issue of his inconsistent appearances is unlikely to have an impact on military operations in Marawi, as the AFP is relatively compartmentalized from the central government.

Involvement of foreign fighters underscores expansion of regional militant nexus

The involvement of foreign fighters in the siege reconfirms our ongoing assessment of a regional militant nexus of IS sympathizers and fighters using the poorly-policed eastern Malaysian and Indonesian waters to move to and from the Philippines’ Sulu Archipelago. However, the involvement of individuals from as far as Pakistan and Bangladesh suggest that this nexus is more far-reaching than has been initially anticipated. Whereas traveling to fight in Syria and Iraq becomes more dangerous, especially considering the mounting losses that IS faces in the Middle East, it increasingly appears that aspiring militants may choose to instead travel to fight in Southeast Asia, and namely in the Philippines, where a relatively strong infrastructure already exists.

Moreover, the realization of a larger, potentially global militant convergence may be in part responsible for the participation of the US and Australian forces, who are likely eager to limit the growing trend. At this point, the actual extent of the involvement of Australian and US forces is unclear, especially after photographs emerged allegedly depicting unidentified Americans carrying combat gear but wearing civilian clothing. This is likely in line with the government’s desire to control the narrative of the conflict and project capabilities that they may not necessarily possess independently, in line with similar posturing that has been witnessed over the past month.

Recommendations

Travel to Metro Manila may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest. We continue to advise against all travel to Lanao del Sur (including Marawi),the Autonomous Region in Muslim Mindanao (ARMM), Cotabato, Lanao del Norte,, Zamboanga del Norte, Zamboanga Siburgay, Zamboanga del Sur, and the Sulu Archipelago, including the islands of Basilan, Jolo, Tawi Tawi, given the high threat of militancy and the elevated risk of kidnapping of foreign travelers. Avoid nonessential travel to all of Mindanao. If business is essential on the island of Mindanao, we advise to minimize movement in areas outside of major cities and maintain heightened vigilance .

How countries such as Saudi Arabia, Bahrain, UAE, Egypt cutting ties with Qatar is likely to influence the region – Middle East & N. Africa Analysis

Current Situation

During the morning hours of June 5, Saudi Arabia, Bahrain, Egypt, and the UAE announced the cutting of all diplomatic ties with Qatar. The Hadi-led government in Yemen, as well as Libya’s anti-Islamist House of Representatives (HoR) similarly announced the severing of diplomatic ties with Qatar on the same day. The first four countries issued a 48-hour ultimatum to Qatari diplomats to evacuate their respective nations, while similarly issuing an ultimatum to all other Qatari citizens to leave within two weeks. Additionally, Saudi Arabia, Bahrain, Egypt, and the UAE announced that they had closed their airspace for Qatari aircrafts, and that all flights by airliners from these countries to Qatar were suspended. Qatari naval vessels will also not be allowed to use the countries’ seaports to anchor, while land travel between Qatar and Saudi Arabia will be limited to non-Qatari nationals only.

Additional measures implemented against Qatar include the expelling of the country from the Saudi-led coalition in Yemen and its anti-Islamic State (IS) coalition in Syria. These measures were implemented based on accusations that Qatar is “supporting and financing extremist groups” across the region, as well as encouraging sectarianism and subversive elements operating in the abovementioned countries. Meanwhile, Qatar’s Ministry of Foreign Affairs issued a statement that the accusations are “absolute fabrications” and “proves that there are premeditated intentions to cause damage to Qatar”.

How countries such as Saudi Arabia, Bahrain, UAE, Egypt cutting ties with Qatar is likely to influence the region - Middle East & N. Africa Analysis | MAX Security — Map of countries affected by travel restrictions on Qataris

Assessments & Forecast

Severing ties may hurt Qatar economically, push its policy towards more pro-Iranian approach; limited impact on regional conflicts

While the new development is unlikely to have any effect on Qatar’s and any of the other impacted countries’ security conditions in the short term, we assess that this measure may lead to multiple local and regional ramifications over the coming months. For instance, approximately 90 percent of Qatar’s imports of food products are transferred through land from Saudi Arabia. Thus, in light of the border closure between the two countries, Doha will likely be forced to divert a large amount of resources in developing its maritime trade, including in the form of improving its seaport infrastructure, as now its imports via sea are liable to be enhanced significantly. Moreover, given the high-profile nature of the event, there remains a possibility that the turn of events will impact global markets, and particularly the oil sector, as it may be perceived as a source of instability across this oil-rich region.

These new developments may also impact expatriates, including Westerners operating in Qatar and the GCC, particularly given the suspension of flights between the GCC countries and Qatar and the closure of the land border with Saudi Arabia. In light of the likely increase in logistical difficulties in traveling between Qatar and the above-mentioned countries, exacted upon expatriates by the measures, it is likely to damage Qatar’s national economy. Though the impact on GCC residents seeking to enter Qatar is yet to be determined, it cannot be ruled out that Qatar will implement punitive measures and ban GCC citizens and residents from entering the country.

The partial isolation of Qatar may affect several conflicts and political rivalries across the region. With regards to Iran, Doha is liable to improve its bilateral relations and economic ties with Tehran, as now Qatar would be compelled to compensate for its political and economic setback. Moreover, in Yemen, in the short-term, Qatar’s absence from the Saudi-led coalition may slightly reduce the latter’s on-the-ground capabilities in fighting against the Iranian-backed Shiite Houthis. However, given Qatar’s already limited role in the coalition, as well as the aforementioned arms deal with the US, in the medium to long-term the Saudi-led coalitions is unlikely to be significantly impacted by Qatar’s absence from the coalition.

In Syria, in light of the already heightened internal divisions between rebel factions, it remains possible that this new development will further exacerbate tensions between rebel groups supported by Qatar on one side, and factions backed by Saudi Arabia and the UAE on the other. Should the event indeed lead to an economic recession in Qatar, their supported factions on-the ground would suffer from a shortage of resources, thus forcing them to disband or merge into other factions. With this in mind, should scenarios eventually materialize, it would potentially tip the scale towards the pro-government forces in the Syrian conflict.

In Libya, the development may constitute a boost to the HoR and its allied Libyan National Army (LNA), given their conflict with the pro-Islamist General National Congress (GNC) and its affiliated militias, which are partially supported by Qatar. That said, Qatar’s direct involvement in this conflict has significantly waned in recent years, particularly since the March 2016 arrival of the UN-backed Government of National Accord (GNA) to the designated capital of Tripoli, and therefore any implications on the conflict will remain limited.

Cutting ties with Qatar likely linked to global, regional developments involving Iran, new US administration

Today’s development comes amidst years of tensions between Saudi Arabia, Bahrain, UAE, and Egypt on one side, and Qatar on the other, surrounding multiple issues, chiefly the latter’s alleged direct involvement in the internal affairs of countries throughout the region. This is particularly relevant to Qatar’s long-standing support for Muslim Brotherhood-linked political elements across the Middle East and North Africa, as the countries in this Saudi-led alliance view the Islamist organization is a subversive element and a threat to their respective governments. Additional contentious issue include Qatar’s overall positive relations with Iran, as opposed to that of the other Gulf Cooperation Countries (GCC), with the exception of Oman, which remain strong adversaries of Tehran. This is highlighted by numerous past economic agreements between Tehran and Doha in recent years, such as the agreement from February 2014 to create a joint free trade and economic zones between the two countries. A further issue that contributed to the strained relations with Qatar throughout the years is the cooperation of the Qatari-based news outlet al-Jazeera, which had been accused by the aforementioned countries of attempting to undermine their, as well as their regional allies’, governments.

That said, despite these strained relations, Qatar and the other GCC countries’ relations can be characterized over the past several years by intermittent escalation and rapprochement between the sides. For instance, on December 9, 2014, Qatar agreed as part of a GCC summit, to establish a regional police force in order to improve coordination regarding drug trafficking, money laundering, and cybercrime, as well as announced its “full support to al-Sisi-led government in Egypt”. This followed Saudi officials’ March 9, 2014 threats to impose sanctions against Qatar, including in the form of sea blockade, in light of Doha’s persistent support for Muslim Brotherhood-linked elements across the region. However, the complete cutting of diplomatic relations between the aforementioned Saudi-aligned countries is highly notable given its wide scale and scope, as it includes significant restrictions on Qatar and its citizens.

We assess that this escalation is linked to global and regional geo-political developments, largely with regards to Iran and the new Donald Trump administration in the US. With this in mind, in recent years, under the Obama administration, relations between Saudi Arabia and its allies on one side, and Washington on the other, were oftentimes strained due to the US’ perceived efforts to approach Tehran, which was likely viewed by Riyadh as coming at its expense. In light of the aforementioned normal relations between Qatar and Iran, Saudi Arabia and the other GCC countries were likely felt compelled to prevent Qatar from approaching the Islamic Republic too much, as this would have significantly undermined their sense of security and regional interest.

Since President Trump’s inauguration, Washington increased its anti-Iranian rhetoric, while at the same time strengthened its ties with Saudi Arabia. This is highlighted by the May 15 UAE-US defense agreement, as well as the 350 Billion USD agreement between Riyadh and Washington involving an arms deal, and Saudi investments in the US. Thus, there remains a potential that the recent visit of President Trump to Saudi Arabia in late May, as well as the US’ growing support for Saudi Arabia and its allies, motivated the Kingdom to implement these measures, as part of the shared interest with the US in tackling Iran and its allies’ influence throughout the region. With this in mind, given Saudi Arabia’s decreasing need for Qatar’s cooperation on security and political support amidst the ongoing rivalry with Shiite Iran, it is likely that Saudi Arabia assessed that it is no longer obligated to maintain positive bilateral relations with Qatar, prompting this development.

The development comes amidst a diminishing political influence of the Islamist Muslim Brotherhood organization across the Middle East and North Africa over the past two years. In this context, it remains possible that Saudi Arabia no longer felt compelled to maintain good relations with Qatar, following the reduction of the threat stemming from the Muslim Brotherhood, as opposed to previous Saudi attempts to pressure Qatar to abandon their support for the Islamist organization in return for the improvement of relations with the other GCC countries.

Recommendations

Travel to Qatar may continue as normal while adhering to cultural norms and avoiding making any statements critical of the Qatari Emir and government officials, despite the aforementioned new restrictions. That being said, those operating in Qatar over the coming days and weeks are advised to stock up on food and basic products, due to the possibility that these will be in shortage due to the declared measures. Those operating throughout the Middle East and North Africa, and particularly in Saudi Arabia, Bahrain, UAE, and Qatar are advised to remain cognizant of developments and potential effects on travel and business continuity given the current lack of full information regarding the various restrictions that will be in effect. This is particularly relevant for the possibility of unexpected border closures between the relevant countries over the coming days and weeks.

This report was written by:
Asaf Day – MAX Security’s Senior Intelligence Manager, Middle East & North Africa

What are the implications of the Egyptian Air Force conducted airstrikes in Libya following Islamic State attack – Egypt & Libya Analysis

Current Situation

According to statements made by the Egyptian Armed Forces (EAAF) Spokesperson, the Egyptian Air Force (EAF) targeted “terrorist gatherings” in Derna during the overnight hours of May 26-27, and in an unspecified area in Libya during the morning hours of May 27. The airstrikes were conducted after “confirming the targets’ involvement in planning and conducting the May 26 attack in Minya Governorate”. Moreover, the Libyan Air Force (LAF) stated that the airstrikes were coordinated and supported by it. Reports indicate that between six and ten airstrikes targeted locations in Derna, while at the time of writing there are no indications of other locales in Libya that were targeted. Meanwhile, the Islamic State (IS) claimed responsibility for the Minya attack during the afternoon hours of May 27.

Assessments & Forecast

The developments are notable given the rarity of direct Egyptian military intervention in Libya, and more so ones that are publicly announced, with the most recent incident being the airstrikes in Derna following the execution of 21 Egyptian Copts by the Islamic State (IS) in Libya on February 16, 2015. Moreover, it is notable as Derna is currently the stronghold of the Mujahideen Shura Council of Derna (MSCD) after having entirely expelled IS from the area on April 20, 2016. In this context, despite their links to al-Qaeda, the MSCD is mostly a domestically-oriented militant group, and along with their established and long lasting conflict with IS is unlikely to assist the group, and therefore is not likely to have direct links to the Minya attack, particularly as it was claimed by IS.

In this context, these airstrikes were more likely meant as an immediate show of force for the Egyptian populace and the international public opinion in wake of the attack, rather than actual military retaliation for it. This is particularly likely as mounting efforts by Egyptian authorities, chief among these is the nationwide state of emergency enacted in wake of the Palm Sunday attacks on April 9, failed to prevent the recent attack. As such, the Egyptian government likely felt compelled to take what will be perceived as extreme measures in order to project the extent of their efforts to protect its country and citizenry from militant attacks. This is especially aimed towards the Coptic minority which was the target of all four recent large scale IS attacks in Egypt, in an effort to offset IS’s strategy of exacerbating sectarian tensions and turning the religious minority against the government.

With this in mind, Egypt likely chose to attack Derna for several reasons that are unrelated to alleged direct involvement in the Minya attack. It is in relative close proximity to Egypt and thus well within range of Egyptian aircraft without requiring special planning and logistical support. Furthermore, the city is already negatively associated by the Egyptian populace due to the aforementioned February 2015 events. Additionally, it has been a target for the Libyan National Army (LNA) for several years, thus intelligence of locales and personnel that are still related to global jihad elements, even if not to IS, and are therefore considered “legitimate targets” was easily acquired through the established cooperation between the LNA and Egypt.

With this in consideration, it cannot be ruled out that the airstrikes were also meant to serve as direct support for the LNA in their Derna campaign, as the LNA have persistently been unable to allocate sufficient resources to the capturing of the city, due to the need to address several conflict zones that are distant from each other. Furthermore, the MSCD are likely perceived by Egypt both as a destabilizing factor for Libya, as well as a potential long-term threat to Egypt due to the group’s ties to al-Qaeda. As such, strengthening the LNA is within Egypt’s government’s interests due to the alliance between the sides, as well as the fact that a situation in which the LNA fully controls eastern Libya will prevent a spillover of militancy from the country into Egypt. FORECAST: Taken as a whole, it remains possible that Egypt will conduct additional airstrikes in Libya over the coming days and weeks, while it will likely increase its direct support for the LNA in this period. Additionally, it cannot be ruled out that Egypt will initiate a limited scale ground operation in Libya in the coming weeks.

Recommendations

Recommendations Egypt:

Travel to Cairo and Alexandria may continue while adhering to all security precautions regarding militancy and civil unrest. Consult with us for itinerary-based travel recommendations. Avoid all travel to the North Sinai Governorate and border areas with Libya, Sudan, and Israel due to the persistent risk for militant attacks, kidnappings, and general lawlessness.

Recommendations Libya:

It is advised to defer all travel to Tripoli and Benghazi at this time due to ongoing violence, threats against foreigners, and the risk of a broad deterioration of security conditions. We advise at this time that those remaining in Tripoli and Benghazi should initiate contingency and emergency evacuation plans due to deterioration in the security situation. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support plans. We further advise against all travel to Libya’s border areas at this time due to persistent violence and lawlessness in these regions.

How militants arrested in Java raids highlights cooperation between regional militant groups -Indonesia Analysis

Current Situation: Militants Arrested in Java Raids

According to March 24 reports, authorities claim to have arrested eight suspected militants and killed at least one with links to transnational militant group Islamic State (IS) in a series of raids along the outskirts of Jakarta this week, including in Cilegon, Banten on March 23. The most recent raids reportedly took place in Pandeglang, Banten and in Bekasi, West Java, in which a suspected financier of the IS-claimed Jakarta attack in January 2016 was arrested. The man was reportedly linked to militant networks in the southern Philippines.

Police identified the militant shot dead in the March 23 raid as Nanang Kosim; an individual believed to have attended meetings of the Indonesia-based Jamaah Ansharut Daulah (JAD) militant group in Batu, Malang in East Java in November 2016. Authorities claim that Nanang had assisted a militant identified as Abu Asybal to evade police detection following his involvement in the January 2016 attack. Nanang is also believed to have been supplying JAD with assault rifles from the Philippines, and plotting to eventually shift their militant base from Poso, Central Sulawesi to Halmahera in North Maluku. During the arrests, police reportedly seized some explosive-making materials including fertilizers, sulfur and nails.

Furthermore, counter-militancy authorities claim that Indonesian militant Iwan Darmawan, currently sentenced to death for his role in the 2004 bombing of the Australian Embassy in Jakarta, directed the procurement of rifles while incarcerated at the Nusakambangan maximum security prison in Central Java. Darmawan is believed to have directed a JAD militant to make several trips to the southern Philippines to procure weapons and to make contact with Isnilon Hapilon, the leader of the IS-affiliated Abu Sayyaf group in the Philippines, although the time of the directive remains unclear.

Click here to see Map Legend

Assessments & Forecast

FORECAST: While the extent and nature of links between the Abu Sayyaf group and JAD remain unknown, the developments suggest a relatively high degree of coordination, especially in aiding JAD elements in Indonesia. JAD is known to operate using local, independent cells to conduct attacks in and around Jakarta, and for using lesser sophisticated explosives like pressure-cooker bombs. In this context, JAD’s attempts to procure more sophisticated weaponry from Abu Sayyaf suggest a reorientation of their focus toward more ambitious attacks. This was evident in the reported uncovering of explosive material during the aforementioned raid.

The desire for increased cooperation may be a reaction to a notable uptick in counter-militancy raids carried out by Indonesian security forces over past months. In light of growing pressure against militant cells in major urban centers, increased cooperation with Abu Sayyaf would allow JAD to better develop safe havens and supply channels in the restive Celebes Sea, where militant groups operate with far greater impunity. It is likely in this context that JAD was attempting to shift their base of operations to the more peripheral area of North Maluku’s Halmahera area, allowing them direct access to the waters. FORECAST: Further, establishing a more consolidated presence in these areas may compel security forces to divert a significant amount of manpower and resources to these isolated areas in order to dislodge the group. This would likely leave major urban centers more vulnerable, alleviating pressure on local cells and allowing for more space to conduct attacks.

Recommendations

Travel to Jakarta may continue at this time while maintaining heightened vigilance throughout the city given the now increased risk of militancy. Those operating or residing in Jakarta are advised to maintain heightened vigilance in the vicinity of government buildings, transportation hubs, iconic public areas, military bases, restaurants, high-value soft targets, shopping centers, and religious centers including mosques and churches, as they remain potential targets for militant attacks.