Tag Archives: jihad

Killing of at least 137 civilians in Tahoua Region on March 21 highlights role of ethnicity, communal conflicts in ongoing insurgency – Niger Analysis

Executive Summary

  • The killing of at least 137 civilians, primarily Tuareg, in Tahoua Region marks the deadliest ever militant attack in Niger. It aligns with a recent trend of high-casualty attacks against civilians in Niger in 2021 and is a notable departure from the Islamic State in Greater Sahara’s (ISGS) usual modus operandi of only small-scale violence against the civilians in Niger.
  • This lends credence to sources indicating that the attacks were perpetrated by local militias affiliated with the ISGS, suggesting that the attack may not have been motivated by jihadist ideology or ordered by central command but rather was conducted independently by the militia in pursuit of personal or communal aims.
  • The precedent of hostilities between the Tuareg and the Fulani communities in the Tahoua Region suggests that a Fulani militia may have been responsible and portends a spate of reprisals and attacks over the coming weeks. This aligns with the broader Sahelian trend of ethnically motivated violence against civilians, with communal militias being a large contributor of insecurity across Mali, Burkina Faso, and Niger.
  • We advise against all travel to Niger’s Tillaberi and Tahoua regions in the west along the borders of Mali and Burkina Faso, with the exception of Niamey, due to the ongoing risk of militancy.

Intel Portal Demo - Try our intelligence package

Please be advised

  • Reports indicate that at least 137 civilians, primarily of Tuareg ethnicity, were killed by armed men on motorbikes who attacked Intazayene, Bakorat, and Wistane in Tillia Department in Niger’s Tahoua region on March 21.
  • Some sources indicate that the attack was perpetrated by militias affiliated with Islamic State in the Greater Sahara (ISGS), with one source stating that the militia responsible for the attack started associating with the ISGS In 2018.
  • Sources from March 23 indicate that Jamaat Nusrat al-Islam waal Muslimeen (JNIM) denied perpetrating the attacks and promised to take revenge on those responsible.

Location of armed attacks in Niger on March 21

Assessments & Forecast

  1. These coordinated raids, with 137 dead and the death toll still likely to rise, mark the deadliest attack on Nigerien soil since the beginning of the jihadist insurgency. It is particularly notable that the attack targeted civilians, primarily ethnic Tuareg, which aligns with the recent trend established by the January 2 attack that killed 100 civilians and the March 16 attack that killed 58, both in Tillaberi Region’s Ouallam Department. While violence against civilians perpetrated by the jihadists has always been prevalent in Niger, predominantly in the form of militant raids and assassinations of local leaders and government collaborators, this violence had largely been small-scale before 2021. The Islamic State in the Greater Sahara (ISGS) was likely oriented toward presenting the group as a viable alternative to state presence to local communities in western Niger. Thus, these recent attacks are a marked departure from the group’s usual modus operandi in Niger.
  2. This lends credence to reports suggesting that the attacks were conducted by local communal militias affiliated with the ISGS. There is an important distinction between ISGS and affiliated militias conducting the attack because it potentially implies that the attack was not ordered by the ISGS leadership, but was rather carried out by the militias autonomously. This highlights a broader theme of local militias affiliated with larger jihadist groups sometimes acting independently from the central command, with their actions motivated by personal and communal grievances and not jihadist ideology or strategy. This potentially explains some of the larger casualty attacks, and even some smaller-scale raids, against civilians that have not been claimed by the jihadist groups over the past years. The leadership of the jihadist groups may tacitly support the militias’ activities since they serve to intimidate the population, making them more susceptible to the jihadists’ overtures of protection. However, the jihadists likely want to maintain some plausible deniability as they recruit from numerous ethnic communities, some of which have long-standing disputes.
  3. Within this context, the latest attack targeting the Tuareg in Niger was likely rooted in communal and local conflicts, possibly over some resource dispute or as a reprisal for some action perpetrated by Tuareg militiamen. The assailants likely belonged to a militia that was ethnically Fulani and the attack was probably a manifestation of the cyclical violence between the Arab and Fulani militias in Tahoua Region, given the precedent of hostilities between the two communities, with multiple attacks and reprisals reported over the past years. The conflict between the two communities has been heightened since 2017 when the Arab Malian militias, sanctioned to operate in the country by the Nigerien government, were perceived to be indiscriminately targeting the Fulani under the guise of fighting militancy. To that point, the attack aligns with the broader Sahelian trend of high-casualty attacks against civilians being ethnically motivated, with communal militias being a large contributor to the ongoing violence and insecurity across Mali, Burkina Faso, and Niger. Militants exploit this dynamic by escalating communal hostilities and engendering perceptions of marginalization to exacerbate insecurity and facilitate recruitment and their entrenchment.
  4. The authorities’ hardline response exacerbates this tension, thereby benefiting the militants by further giving rise to sentiments of disenfranchisement. This was exemplified in Niger when the government authorized Malian ethnic militias to operate in the country in 2017-2018 to combat rising jihadism. These militias, which were largely composed of ethnic Tuareg and Daosahak, engaged in biased targeting, extrajudicial killings, and large-scale violence, primarily against the Fulani, leading to the creation of communal militias and accelerating the militarization of the border. While the government attempted to take a more conciliatory approach towards the border communities following this, the perception that the government-sanctioned the targeting of border communities, particularly the Fulani, had taken root, driving both the recently formed and existing militias to align with the ISGS. In fact, the militia allegedly responsible for the latest attack in Tahoua was reportedly formed in the early 2000s but started being associated by the ISGS in 2018, likely in the aftermath of the Malian militia’s activities.
  5. FORECAST: In line with the constant spate of attacks and retaliation that characterize these ethnic conflicts, the latest attack is liable to elicit a swift reprisal. Arab militias operating in the area are liable to pursue the militia responsible for the attack and may even target civilians, likely Fulanis. Even JNIM may get involved given leader Iyad ag Ghaly’s Tuareg heritage and as suggested by their denial of complicity and promise of revenge. This has the potential to devolve into clashes between JNIM and ISGS, as the latter is likely to take umbrage with JNIM operating within its strongholds. As such, insecurity is likely to persist in the Tchintabaraden Department along the Malian border over the coming weeks.
  6. FORECAST: The government is also likely to intensify operations in Tahoua Region to catch the perpetrators of the attack over the coming weeks. This is especially likely since newly elected President Mohamed Bazoum will likely want to demonstrate his ability to handle the ongoing insurgency. These operations may succeed in temporarily incapacitating the activities of the armed groups operating in the region, however, they are unlikely to be successful in curtailing the groups’ activities in the long-term. This aligns with the limitation of hard-line military response against the jihadists and other armed actors to adequately combat the insurgency since it fails to address the conditions that lead to radicalization and ethnic conflicts.


  1. We advise against all travel to Niger’s Tillaberi and Tahoua regions in the west along the borders of Mali and Burkina Faso, with the exception of Niamey, due to the ongoing risk of militancy.
  2. Avoid all travel to the border region between Mali, Niger, and Burkina Faso, given the extreme risks of militancy, ethnic conflict, and violent crime.
  3. Travel to Niamey can continue while adhering to stringent security precautions regarding crime.

IS pledge video consistent with group’s decentralization into newer territories, will spur state crackdown – Azerbaijan Analysis

Executive Summary

A recent propaganda series from Islamic State (IS) included a pledge video from Azerbaijan to the group’s leader on July 2.

While the capabilities of IS-inspired cells in Azerbaijan are limited, there is a potential that this video may sustain increased online messaging among disaffected Sunni youth, with the latent chance of culminating in lone-wolf attacks by sympathizers.

The government will step up its crackdown on potential radicalization, particularly in the country’s north, on unlicensed Islamic schools nationwide, and step up its monitoring of social media.

Travel to Azerbaijan can continue while maintaining vigilance due to the latent risk of crime and militancy. 

Please be advised

Islamic State (IS) media released a video as part of its “The Best Outcome is for the Righteous” series on July 2. The video features three individuals believed to be from Azerbaijan pledging allegiance to IS leader Abu Bakr al-Baghdadi while calling on Muslims in the country to stage attacks.

In the video, the main speaker is identified as “Shaykh” Abu Yusuf al-Azeri. The individual provides an exposition of selected passages from the Hadith denouncing polytheism and calling for revenge for the alleged killing of Muslims.

In 2017, Azerbaijani State Security indicated that at least 900 citizens had traveled abroad and joined militant groups in Syria and Iraq. At least 250 have returned since, per independent estimates. State security officials also indicated in 2018 that dozens of Azerbaijanis have joined militant groups in the North Caucasus, while the number of those traveling to Afghanistan and Pakistan for the same purpose stands at 300.


Video consistent with IS’ decentralization efforts, utilizing local appeal to push global message

The video gains significance when compared to the low frequency of official IS propaganda released involving Azerbaijan as the group’s on-ground presence in the country has been considerably muted. Given that it is the sixth in an ongoing series from the group’s affiliates across the globe, it stands to reason that this release is part of efforts by IS Central to increase propaganda in newer territories. This trend has grown since the release of a video featuring al-Baghdadi for the first time in five years in April. In Asia, the group’s recent declaration of Wilayats, or provinces, in India and Pakistan is consistent with these decentralization efforts. The media release is further notable as it is the only video in the series thus far which is not dedicated to a Wilayat but to a separate country. This may be an indication of IS’ long term ambitions in Azerbaijan and the South Caucasus as it attempts to further its regional presence.

The video appears to be made by local radicalized individuals with links to IS Central, possibly through networks facilitated by Azerbaijani foreign fighters. In terms of content, the speaker does not make explicit references to President Ilham Aliyev or the perceived local suppression of Muslims, but instead touches on more universal Salafist doctrines and provides general exhortations for attacks against unbelievers. Given that this is one of the first major IS videos on Azerbaijan in recent years, it is likely intended to establish the broad outlines of IS’ creed for possible new audiences in Azerbaijan and serve as an entry point for future propaganda engagement. However, a reference to the government’s cooperation with regimes abroad, particularly Iran, reiterates the close adherence to IS’ sectarian ideology with regards to the Shiite majority state as well as “crusader” Western governments. The overlay of stock images of US forces and of President Aliyev in talks with Russian President Vladimir Putin during the video are intended to underscore this message. It is also notable that the video ends with a bay’ah or pledge in Azeri, as opposed to Arabic. This minimal use of Arabic, apart from subtitles, is also intended to maintain local appeal.

Northern Sunni communities to be target of messaging, may result in increased online activity by disaffected youth

Azerbaijani foreign fighters in Syria have typically come from the country’s conservative Sunni communities in cities such as Sumqayit, Shabran, and Qusar. Police reports have also mentioned Khachmaz, Zaqatala, Qax, Yevlax, Oguz, Quba, and Sheki as notable hotspots for recruitment in the past. Mostly being border areas, radical elements may have crossed over to Russian territories in Dagestan to collaborate with actors who are a part of IS’ Wilayat Kavkaz. That said, the establishment of an active Islamist operational presence locally in Azerbaijan has been limited as a result of close state monitoring and preemptive security operations against suspected cells.

In this context, the recent messaging may presage a revival in messaging and online chatter, particularly among disaffected Sunni youth in the northern districts who may see the video as an encouragement to oppose the Aliyev administration’s crackdown on radical Islamic doctrines. Returning foreign fighters and those who attempted to travel to Syria but failed will likely be key influencers in this trend. This was noted in 2018 when a local named Eldaniz Mammadov was arrested and tried for posting pro-IS propaganda on social media platforms; the suspect is believed to have traveled to Syria at an unspecified previous time.

Past Militancy Recruitment Hotspots in Azerbaijan

State response to focus on potential for radicalization on social media, unauthorized religious schools

It is important to note that at present, identified IS-inspired cells still remain marginal in numbers and have not demonstrated the capability for staging major attacks in the country.  However, the video will raise concerns regarding the risk of lone-wolf attacks by sympathizers. Issues such as the state-controlled introduction of Islam as a subject in schools and universities in April may serve as flashpoints for disaffection as more conservative communities view this as an effort by the government to marginalize doctrines it perceives to be radical while increasing its hold on systems of religious education. As part of its crackdown, the Aliyev administration will likely step up its monitoring of suspected radicalized individuals across the country, making a series of arrests over the coming months.

The focus of the crackdown will include the closures of unauthorized Islamic theological schools and the detentions of Sunni Islamic scholars trained abroad as part of its continued efforts to prevent the influence of perceived external theology in the country. Measures will also include a scale-up of social media monitoring and tighter security along the country’s northern border to prevent the movement of radicalized individuals towards IS-linked interests in the North Caucasus. Tighter scrutiny into the movement of firearms and explosives material, particularly via smuggling networks in the north, is also expected to follow. Areas such as Khachmaz and Qusar Districts will particularly draw the focus on the security apparatus, given the operations of Sunni extremist groups such as the Khachmaz Jamaat.

The government is also liable to step up its coordination with neighboring states on counter-militancy strategies. Typically, the Aliyev administration has used counter-militancy as a means to forge common ground with economic allies, such as Turkey and Russia. The country is also an ally in NATO’s efforts in Afghanistan, providing airspace to cargo transportation for peacekeeping operations. The mention of Iran in the video and IS’ sectarian orientation will raise concerns regarding the possibility for plots targeting the country’s Shiite-majority. Such intentions, while not IS-linked, have been noted among Sunni extremists who have previously sought to target Shiite places of worship, such as the Meshedi Dadash Mosque in Baku. Closer security coordination between Tehran and Baku and a crackdown on smuggling networks along the southern border can also be expected in the foreseeable future.


Travel to Azerbaijan can continue while maintaining vigilance due to the latent risk of crime and militancy.

Avoid posting content that may be perceived as controversial or anti-state when operating or residing in the country due to the risk of prosecution.

Avoid all travel to border areas near the disputed Nagorno-Karabakh region due to continued ceasefire violations and the risk of conflict.

Jihad & the Far-Right: The Dual Terror Threat Facing the West – New Zealand Special Report

Written by Ollie Wiltshire and Ziv Reuben

Executive Summary

Following the deaths of 50 people in the Christchurch Mosque shootings, Islamist groups, including al-Qaeda and Islamic State, called for reprisal attacks on far-right and Christian sites.

The rhetoric of the New Zealand shooter and the publications from the jihadist groups underscore that the two ideologies are catalyzing each other and increasing radicalization and the potential for attacks.

Far-right militants are more likely to be radicalized by the decentralized online community who perpetuate extremist ideologies. They are more likely to attack specific targets with ideological significance.

Jihadist militants are often radicalized by pro-Islamist online messaging groups and are targeted by recruiters to carry out attacks. They are more likely to attack public places in urban areas.

Threats to Global Businesses

This interactive relationship between far-right and jihadist lone-wolves has a number of implications on global businesses:

  1. Potential for attacks will increase around times of heightened tensions between Muslim communities and nationalist communities.
  2. Companies that are deemed by either the far-right groups or jihadists to be opposing one ideology or aiding the other may become specific targets. This threat is particularly relevant with regards to the far-right, who are more likely to attack specific companies.
  3. Those who may be radicalized may not be obviously adhering to extremist ideologies and may be mostly interacting with such groups online. They could be hard to detect and may be working within an organization.
  4. Targets with specific cultural significance are more likely to be attacked. This includes religious sites or overtly religious gatherings.

Christchurch Attack and Aftermath

50 people were killed and 50 others wounded in two consecutive shooting attacks at the Al Noor Mosque and Linwood Islamic Center in Christchurch, New Zealand during the Friday afternoon prayers on March 15. The perpetrator, a 28-year-old Australian identified as Brenton Tarrant, was arrested shortly after; he live-streamed parts of the attack.

The attack was carried out using two assault rifles, two shotguns, and another rifle. These firearms were reportedly bought via an online store. Two undetonated IEDs were found attached to a car in the area.

The suspect released a document detailing his motivations and ideologies, which he also emailed to Prime Minister Jacintha Arden. According to Tarrant, his motivation for the attack was to “crush immigration and deport those invaders already living on our soil”. Tarrant states that he developed his views in 2017, and was influenced by the Stockholm vehicular attack and French elections that year. He claimed that he traveled through Western Europe during this time.

Following the attack, Islamic State (IS) and al-Qaeda (AQ)-linked online groups released a series of messages calling for attacks on churches and Christians as a retaliation for the Christchurch attack.

The media foundations al-Andalus and Az-Zallaqa released a statement on March 18 in response to the attacks on two mosques in Christchurch, New Zealand calling on supporters to attack members of the far-right. Al-Andalus is the media outlet of al-Qaeda-Islamic Maghreb (AQIM), operating in North Africa, while Az-Zallaqa is the media outlet of Jamaat Nusrat al-Islam waal Muslimeen (JNIM), an al-Qaeda coalition operating in sub-Saharan Africa. The statement encourages young Muslims to carry out attacks on members of the far-right for inciting hatred and attacks on Muslims, specifically mentioning those who supported the attack in Christchurch within the media and on social networks.

Relationship between Far-right and Jihadist Radicals

While the New Zealand attack was clearly a part of the ongoing trend of far-right attacks being carried out by individuals radicalized online, the quick and strong response from jihadist groups over the incident is highly notable. It appears that the cycle of violence between the far-right and jihadist groups is escalating, with online communities radicalizing young European individuals to carry out lone-wolf attacks against Muslims and jihadist groups calling on lone-wolf Muslim youth to respond in kind. In this regard, it is important to note that the threat of self-radicalized individuals carrying out attacks now comes from two ends of the extremist ideological spectrum, both far-right and jihadist.

In addition, the rhetoric being used by the far-right and the rhetoric being used by jihadist groups feed into each other, escalating the threat of violence with each attack. That is to say, when a major attack carried by a jihadist militant occurs, far-right online chatter will increase and anti-Muslim sentiment will rise. This has the potential to push certain individuals towards carrying out lone-wolf attacks, which will then increase radicalization among Muslim communities. Although this is likely to happen throughout the world, areas where Muslim communities and communities of European descent meet are likely to be the most affected, including Western Europe, North America, Australia, and New Zealand.


Avoid the vicinity of far-right protests, rallies, or buildings due to the potential for jihadists to target such gatherings.

Maintain vigilance in the vicinity of religious sites, refugee centers, or any institution which may be perceived to be linked to immigration.

Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.

Immediately alert authorities of any suspicious behavior or items.

Public, private, and third sector organizations are advised to increase their awareness of threats on social media through the use of threat monitoring services. Increased awareness of an organization’s political footprint and perceptions from fringe online groups can help uncover potential violent actors and plots before they occur.


The 2019 Geopolitical Predictive Analysis is now available:



Security to continue deteriorating as jihadist groups expand geographically, intensify attacks, increase regional threat – Burkina Faso Special Analysis

Written by Ishita Singh – MAX Security’s Senior Analyst for West & Central Africa

Edited by Rachel Jacob – MAX Security’s Regional Director of Intelligence, Sub-Saharan Africa

Executive Summary

Since September 2018, there has been a dramatic increase in militant attacks in Burkina Faso, now affecting 11 of the 13 regions. The majority of this activity targets security forces, local authorities, and schools.

Militant groups have increasingly targeted the mining sector through theft, extortion, and active control over mines. However, security operations that close mines even temporarily are liable to create resentment and encourage militant recruitment.

Jihadists exploit intercommunal tensions to drive recruitment, especially among the Fulani, instigating retaliatory cycles of violence that can create large death tolls and alienate the population from the government.

As attacks continue to spread throughout the country, there is a growing threat to Burkina Faso’s southern neighbors, which will have to bolster their defensive efforts despite their own political challenges to prevent a spillover of violence.

Avoid nonessential travel to outlying areas of Burkina Faso given the ongoing threat of militancy and violent crime, while avoiding all travel to Sahel, Est, Nord, and Boucle du Mouhoun regions due to the risk of attacks.

Key Points & Forecast

Where previously there were about seven attacks per month in Burkina Faso, between September 2018 and February 2019, militants conducted an average of 34 attacks per month. Most were in Sahel, Est, Nord, and Boucle du Mouhoun regions, but these trends continue to spread toward the west and south, particularly in Centre-Nord, Hauts Bassins, and Cascades regions.

The vast majority of jihadist activity targets security forces, local government authorities, and Western-style schools. This will remain the broad focus of militant groups as they solidify their areas of control in the north and continue to expand their geographical presence.

Jihadist groups increasingly target the mining sector, with theft and extortion expected to remain significant especially in Sahel and Est regions given how profitable these attacks can be. At the same time, military escorts for mining companies have also given militants new opportunities to attack security forces and thus increases risks to civilian travelers.

Foreign nationals have come under attack repeatedly over the past six months, with at least five incidents since September 2018 in which foreigners were abducted or killed. This threat will remain high in all remote areas of Burkina Faso, particularly in the northern and eastern regions, and along the borders of Mali and Niger.

The dual role of “Koglweogo” self-defense militias, with some factions supporting the government while others cooperate with militants, creates another layer of insecurity in outlying regions and will continue to exacerbate the situation.

Security forces have been shown to use violence against civilians both to deter them from collaborating with jihadist groups as well as punish them for doing so. Their heavy-handed measures will alienate the local population and hamper security efforts, as well as further drive jihadist recruitment.

Militancy is expected to continue spreading throughout the rural areas of the country as jihadists grow entrenched in the north and east and mobilize toward the west and south. Moreover, there remains the possibility of a high-profile attack in Ouagadougou, as has been seen periodically.

The spread of militancy has already reached Burkina Faso’s southern borders and has the potential to affect its neighbors Ivory Coast, Ghana, Togo, and Benin, and these countries may not be able to bolster their security sufficiently to prevent the spillover of violence.

Current Situation

In December 2018, the government of Burkina Faso declared a state of emergency in 14 provinces across seven regions, including the Hauts-Bassins, Boucle du Mouhoun, Cascades, Centre-Est, Est, Nord, and Sahel regions.

Over the past year, from February 2018 to February 2019, approximately 270 militant attacks were reported across Burkina Faso.

Between February and August 2018, militants conducted around seven attacks per month. Between September 2018 and February 2019, militants conducted an average of 35 attacks per month.

The Governor of Est Region ordered the temporary closure of mining sites in all provinces on March 20 and called upon stakeholders to clear all mining sites. An official communique stated that this was “in the pursuit of the securitization of the administrative district.”

Militant Groups in Burkina Faso

Ansarul Islam – The first jihadist group to be established in Burkina Faso, it was founded in November 2016 by the now-deceased Ibrahim Malam Dicko. Ansarul Islam remains largely based in the Djibo, Soum Province area, though the group has conducted attacks throughout Sahel and Nord Regions and remains highly active in these areas. Dicko was an ethnic Fulani but Ansarul Islam is not a solely ethnicity-based group, with Dicko using Islam to challenge local dynamics and hierarchies to bring different ethnicities and classes together. Ansarul Islam engages not only in militant attacks against the state and ideological targets but also common banditry. At the same time, it also functions as a self-defense group in certain areas to protect its supporters from banditry and intercommunal violence perpetrated by others.

Jamaat Nusrat al-Islam waal Muslimeen (JNIM) – The al-Qaeda coalition formed in Mali in March 2017 including al-Qaeda in the Islamic Maghreb’s (AQIM) Sahara branch, Ansar Dine, al-Mourabitoun, and Macina Liberation Front under the leadership of Iyad Ag Ghaly. JNIM serves as a united front for its strategic and militant operations based in Mali, where it controls territory and conducts hundreds of attacks each year in the northern and central regions. Additionally, the group has carried out large-scale attacks in the capital cities of Burkina Faso, Mali, and Ivory Coast. Over the past year, JNIM has increasingly expanded its area of operations into Burkina Faso, at least into Sahel, Est, Centre-Est, Centre-Nord, Nord, and Boucle du Mouhoun regions.

Islamic State in the Greater Sahara (ISGS) – Adnan Abu Walid al-Sahraoui pledged allegiance to the Islamic State on behalf of al-Mourabitoun in May 2015, though was subsequently ousted by rival leader Mokhtar Belmokhtar. Al-Sahraoui and ISGS later claimed responsibility for a number of attacks in Burkina Faso and Niger and was acknowledged by the Islamic State central organization in October 2016. ISGS has since expanded its area of operations, focusing on the border of Mali and Niger, particularly in the Ansongo Menaka Partial Wildlife Reserve, as well as along the Niger-Burkina Faso border. However, the group has retained a much smaller profile in terms of propaganda. Their most notable attack was the October 2017 ambush of a US special operations team near Tongo Tongo, Niger.

Assessments & Forecasts

Growth of militancy a result of weakened security apparatus, as similar patterns of jihadist activity spread from northern, eastern regions into central, western regions

Over the past six months, Burkina Faso has seen a dramatic shift in its security as the intensity as well as geographical scale of militant attacks has rapidly expanded. Where there was once several attacks per month, largely concentrated in Sahel and Nord regions, this has grown to an average of 34 security incidents per month being reported in at least 11 of the 13 regions. This threat was long present due to Burkina Faso’s proximity to Mali, in the midst of a civil war and prolonged jihadist insurgency. Former Burkinabe President Blaise Compaore was believed to have forged deals with Malian armed groups to prevent their entering Burkina Faso, though this would have ended with his ouster in 2014. Compaore’s resignation after a popular uprising was followed by a failed coup by the Presidential Security Regiment (RPS) in 2015. This period of political instability, as well as the disbanding of the RPS with other reforms, weakened the security apparatus to the point where criminality and militancy could grow.

Ansarul Islam emerged as Burkina Faso’s first jihadist group when it conducted its earliest known attack against a military outpost in Sahel Region in December 2016. The insurgency continued to grow over the following year, mostly concentrated in Soum and Oudalan provinces. This came alongside a relationship with the Mali-based Jamaat Nusrat al-Islam waal Muslimeen (JNIM) al-Qaeda coalition, with the two groups likely working in tandem for some attacks both in Burkina Faso as well as in Mali. It is probable that this cooperation led to the evolution of Ansarul Islam’s tactics from small arms to the use of IEDs, which began in late 2017 and continued since. With these connections, Burkina Faso’s Sahel and Nord regions could function as an area for Malian jihadists to escape the pressure of local and international military operations inside of Mali while continuing to launch attacks targeting Mali. At the same time, the persistent but less frequent attacks on Burkinabe security forces in late 2017 and early 2018 helped to destabilize the border region, expanding the militants’ influence and allowing greater cross-border movement for jihadists that would come to facilitate JNIM’s movement southward into Burkina Faso by late 2018.

While Ansarul Islam’s earliest attacks solely targeted security forces, this evolved into attacks against government officials, village leaders, religious clerics, and teachers who all represented the Burkinabe state and opposed jihadist ideology. Militants subsequently burned down schools for teaching French or Western-style education and forcibly gathered residents to preach more radical forms of Islam. In some areas, militants have also banned alcohol, prostitution, and smoking. In that sense, Ansarul Islam was able to establish a sufficient level of control over its area of operations to impose its ideology. Moreover, this pattern of influence and violence came to become a model for subsequent efforts in other parts of Burkina Faso, first in Est Region and beyond.

In Est Region, reports of jihadist cells and camps being dismantled in March and April 2018 were early indicators of an expansion of militant activity. Attacks against security forces in Est began in July 2018, which then led to the targeting of local government officials and schools, with at least ten arson incidents against schools being reported and most schools closing down. The number of attacks in Est and as a whole dramatically increased in September 2018, likely due to a concentrated effort by militants when it became clear that Burkinabe security forces were more vulnerable than they first appeared. This can also be seen as militants began this pattern anew in Boucle du Mouhoun Region only one month later, when the number of incidents jumped from five incidents along the border between January and September 2018 to 14 attacks between October and December 2018. In that sense, this strategy has been highly effective in destabilizing fairly large areas of rural Burkina Faso and imposing jihadist ideology.

FORECAST: Using the precedent set first in Sahel and Nord, and then in Est and Boucle du Mouhoun, these patterns are expected to continue farther to the south and west. This has already begun in Centre-Nord, with early attacks against security forces in January, with the number of attacks increase to 12 reported in February and March, including those targeting village leaders and schools. Centre-Nord is thus expected to see an intensified level of jihadist activity in the coming months. At the same time, the early warning signs are likewise being seen in Hauts-Bassins and Cascades regions, which lie on Burkina Faso’s southernmost borders with Mali and Ivory Coast, and further attacks are expected in those regions as well.

Mining industry assets targeted as sources of revenue as jihadists grow further entrenched in local economies

Over the past six months, militant activity has increasingly targeted the mining sector. This is especially important in the north and east where economic activity is mostly tied to mining or pastoralism. With mines in these areas being highly productive, militant groups have not only attacked assets for direct theft but also use violence to extort “protection” payments from facilities. Moreover, there are increasing indications that jihadists have taken control of mining sites. When several miners died in a landslide in Kompienga Province, Est Region in October 2018, the government was unable to access the affected area because the mine was under militant control. With mines creating employment and revenue, militant control over sites also provides them with the opportunity to establish themselves as the local authority, further embedding themselves into local communities and economies.
FORECAST: It is likely that direct control over mines will remain fairly limited given that it would require more resources from the militants and is more likely to attract larger security responses. However, with overall activity targeting mines being highly lucrative for militants, extortion and theft is expected to continue, especially in the Sahel and Est regions.

To some extent, this can also be viewed as an attack on the government, given that about 75 percent of Burkina Faso’s export revenue comes solely from gold mining. The theft of revenue, as well as the effect of the violence on mining companies’ decisions to invest in the country, could be substantially detrimental to the economy. Because of this, the government began providing military escorts for mining convoys. However, this also gave the militants new opportunities to attack security forces, with a number of convoys being targeted with IEDs and ambushes. Although mining employees have reportedly not been harmed in these incidents, this underscores the way in which the militants’ interest in attacking security forces can cause collateral damage to civilians.

Foreign nationals have been specifically targeted in the context of attacks on mining facilities over the past six months. In September 2018, two foreign nationals were abducted after leaving a Ghanaian-owned gold mine in Soum Province, suspected to have been taken into Mali. Separately, in January, a foreign national with a Canadian-owned gold mining company was abducted and killed while visiting a mining site in Yagha Province. It is likely that both abductions were intended for ransom purposes with the latter incident being botched in some way. This is suggestive of the militants’ understanding that foreign-owned mining facilities are likely to have foreign nationals traveling to and from the site who can be kidnapped.
FORECAST: Although both incidents took place in the Sahel Region, which remains the most volatile and least secure region of the country, this is reflective of an increasingly widespread instability that can affect travelers in many remote areas.

Foreign nationals increasingly targeted for ransoms, jihadist violence in remote regions

Beyond the association with the mining industry, foreign nationals have come under attack repeatedly in rural areas of Burkina Faso over the past six months. This has included a Canadian and Italian disappearing in Hauts Bassins Region in December 2018, a Czech national killed in Centre-Est Region’s Koulpelogo Province on January 23, and a Spanish priest being killed by JNIM in Centre-Est’s Boulgou Province on February 15. Moreover, an Italian priest was abducted by ISGS in Niger’s Tillaberi Region only 15 km from the border in September 2018, after which he was taken back into Burkina Faso’s Est Region. Given the lack of uniformity, this has also made it clear that foreign nationals may be targeted with violence for their identity without the involvement of kidnapping. As abductions also serve a financial purpose, this is illustrative of the way in which militants use criminality to support their operations.
FORECAST: It is increasingly clear that militants deliberately target foreign nationals when they become aware of their presence for the purposes of ransoms as well as international attention and propaganda, and these attacks are expected to continue in rural areas in the foreseeable future.

Local self-defense militias complicate security dynamics, while jihadists exploit intercommunal tensions for recruitment, regional goals

Another symptom of the poor presence of the state in many rural areas has been the development of “Koglweogo” self-defense militias, which operate as localized security organizations across the country. At times, they are supported by local authorities, either openly or tacitly, though there are areas in which they operate fully independently from the government. The latter dynamic could be seen during the February 15 JNIM attack on a customs post in Boulgou Province during which Koglweogo militia arrived but were asked to leave by militants and evidently did so because the target of the attack was security personnel and not civilians. That the militants did not engage with the Koglweogo and let them go safely illustrates the clarity of the jihadists’ objectives in attacking security forces, but also suggests that self-defense militias in parts of the country are willing to cooperate with or allow militant operations so long as it targets the government rather than civilians.

As Koglweogo militias operate independently of one another rather than as a unified network, there are other instances of the self-defense groups confronting militants. On January 1, militants assassinated the village chief of Yirgou in Centre-Nord Region’s Sanmatenga Province, a common type of attack against local authorities. In retaliation, the local Koglweogo militia killed at least 47 ethnic Fulanis in Yirgou and its environs. In that sense, the dual role played by self-defense militias adds another layer of instability as additional active armed groups in outlying regions of the country, and ones that not only retaliate against jihadists but can perpetrate abuses against civilians that further drive jihadist recruitment.

That the Koglweogo militia retaliated against the ethnic Fulani population, in that case, is illustrative of another social and ethnic dynamic in the region, one that mirrors the situation in the neighboring Mali’s Mopti Region. Fulani pastoralist communities often conflict with farming communities, with Fulanis viewing themselves as marginalized by the government while other ethnic groups perceive Fulanis to be in collaboration with jihadists as both JNIM and Ansarul Islam have heavily Fulani factions. This intercommunal violence has made Fulanis further susceptible to recruitment by militant groups. In this context, jihadist groups have deliberately instigated attacks against other communities in anticipation of retaliatory attacks against Fulanis, which would then drive Fulanis closer to the militants. As seen by the incident in Yirgou, this can create high death tolls even within a single day.

JNIM’s use of ethnic violence as part of its strategy for recruitment and mobilization has been highlighted in its propaganda as well. In November 2018, JNIM released a video featuring Macina Brigade leader Amadou Kouffa, who was preaching in Pulaar, the language of the Fulani people. This was meant to appeal to the broad Fulani audience across the region, which he made clear by calling upon Fulanis to mobilize for the jihadist cause, not only in Mali but also in Burkina Faso, Ivory Coast, Senegal, Guinea, Ghana, Niger, Nigeria, and Cameroon. To this point, JNIM has sought to capitalize on their successes in recruiting Fulanis amid these intercommunal conflicts. This not only aims to mobilize Fulanis for jihadist effots but speaks to JNIM’s wider regional goals in terms of expanding its influence throughout West Africa.

Increased security response, escalating reports of human rights abuses risks alienating local population from government, while role of international forces likely to grow

As attacks have multiplied across the country, security forces have consequently launched a number of campaigns targeting militants in Sahel, Est, Centre-Est, Nord, and Boucle du Mouhoun regions, with at least 17 operations reported since September 2018. While these may have been effective to some degree, the intensified response has also exposed Burkinabe security forces’ indiscipline and overall lack of capabilities. This was exemplified by the military’s claim to have killed 146 militants in a security operation in Loroum Province, Nord Region and Kossi Province, Boucle du Mouhoun Region on February 4. Human rights organizations later documented evidence that the victims were largely civilians who had been killed while asleep, with no indication that they were linked to militants. This aligns with repeated reports of security forces carrying out extrajudicial killings and arbitrarily detaining locals.

The claim to have killed such a large number of militants was likely meant simply for government propaganda to portray the military as successful. However, reports have shown security forces to use violence against civilians for the purpose of deterring them from collaborating with militants as well as to punish them for supporting any militant groups. Such behavior has the dual effect of alienating local populations, which then hampers security forces’ efforts to collect intelligence or otherwise utilize the cooperation of local residents, as well as further driving jihadist recruitment. This additionally overlaps with existing ethnic dynamics, with security operations in heavily Fulani areas particularly causing resentment and motivating local collaboration with jihadist groups, which portray themselves as defenders of the Fulani. FORECAST: In the absence of accountability for security forces, as well as the continued proliferation of militant attacks like to create similar security responses, this cycle is expected to continue, with further abuses against civilians pushing further cooperation between locals and militants.

Other government efforts also risk alienating the population in separate ways. In recognition of the role that mining facilities can play for jihadists, new measures were launched to conduct security operations in and around these sites. The Governor of Est Region’s March 20 announcement that all mining sites in the entire region would be shut down, followed by the High Commissioner of Yagha Province in Sahel Region announcing the same on March 22, suggests a deliberate effort to clear these crucial economic sites of militants.
FORECAST: However, the full closure of these mines will likely impact the local economy, as they provide a significant amount of employment for thousands of local residents. Removing their source of employment is liable to create resentment toward the government as well as increase the susceptibility of locals to joining jihadist groups over discontent as well as a financial incentive.

In addition, there has been increased French involvement in Burkina Faso in recent months. France has periodically supported Burkinabe security forces in recent years, with the bulk of Operation “Barkhane” focused on combating militancy and crime in Mali but operating throughout the region, including in Niger and Chad. This growing French involvement has largely taken the form of air operations, with French aircraft supporting Burkinabe forces in Est Region in October 2018 and in Sahel Region in January, though there have also been sporadic reports of French ground forces in Burkina Faso close to the border of Mali.
FORECAST: French air support is likely to increase in the coming months, particularly in light of Burkina Faso’s air force having few aircraft and generally inexperienced pilots and crew. More broadly, as militancy continues to spread throughout much of Burkina Faso, including incidents along the borders of Ivory Coast, Ghana, Togo, and Benin, France will likely be additionally motivated to assist in a large-scale effort to prevent the destabilization of the wider region.

Militants to reinforce gains, continue expanding in central, western provinces, while pursuing wider regional vision

As has been seen with JNIM’s activity in Mali, it is likely that militant groups will seek to cement their gains in Burkina Faso while also keeping an eye toward steady expansion. FORECAST: This will mean that the bulk of JNIM and Ansarul Islam’s attacks will remain in Sahel, Nord, and Est regions to solidify their grip on those regions, with individuals or facilities linked to security forces and the government being the primary target. At the same time, the pace of attacks in other areas will likely be continuous if somewhat less frequent, with Boucle du Mouhoun, Centre-Nord, and Centre-Est the most prominent areas of targeted expansion over the coming weeks and months, with Hauts Bassins and Cascades likely to be a longer-term goal. This large geographical focus is somewhat ambitious but is likely to be effective given that Burkinabe security forces lack a comprehensive strategy or the capabilities necessary to secure much of these regions. Even if international forces increase their intervention, it is likely that Burkina Faso will increasingly see a scenario similar to Mali’s, in which some regions of the country are within jihadist areas of control while the government is only able to secure a wider zone in the vicinity of Ouagadougou and Bobo-Dioulasso.

FORECAST: This will necessarily increase the threat against Ouagadougou as well. The capital city has periodically been the target of large-scale militant attacks, with JNIM and its constituent groups conducting attacks against government targets, hotels, and restaurants in Ouagadougou in March 2018, August 2017, and January 2016. Moreover, there have been other intermittent reports of security forces foiling attacks in Ouagadougou, such as in December 2018 and May 2018, suggesting that this aim remains a priority for militants in the region even as the insurgency intensifies in the rural areas of Burkina Faso. There is continued evidence of some militant presence operating in Ouagadougou and an attack against a Western or high-profile target remains possible, even as Burkinabe and French intelligence mobilize particularly to prevent it.

As militant groups strengthen their grip on the outlying regions of Burkina Faso, this will also increasingly affect the security posture of the countries on its borders. In addition to heavy activity by JNIM and ISGS along the border with Niger, JNIM attacks have already been reported along the borders of Ivory Coast, Ghana, Togo, and Benin. Further movement into those countries would adhere to the wider vision of jihadist groups that seek to spread their influence throughout the region. FORECAST: Given the speed with which militancy has spread to the southern border, these neighboring countries are expected to bolster their security presence to the degree that they are able. While all four countries are generally stronger than Burkina Faso at this point, political instability or unrest in countries such as Togo and Ivory Coast may affect their ability to deploy enough forces to secure their northern borders. Accordingly, this heightens the potential for militancy to spill over into these countries, which would likely be in the form of small-scale attacks against security forces relatively close to Burkina Faso. With that said, this is likely to be a much more limited threat and part of a longer-term effort with the focus on Burkina Faso as conditions continue to deteriorate across the country.


Travel to Ouagadougou and Bobo-Dioulasso may continue while adhering to stringent security precautions regarding crime and potential militancy.

Avoid nonessential travel to outlying areas of Burkina Faso given the ongoing threat of militancy and violent crime, while avoiding all travel to Sahel, Est, Nord, and Boucle du Mouhoun regions due to the risk of attacks.

Avoid all travel to areas along the border with Mali and Niger given the threat of cross-border militancy and violent crime, including abductions.

At least 310 killed in nationwide bombings on April 21; indicative of extensive network, potential transnational link – Sri Lanka Analysis

Please be advised

  • At least 310 people have been killed and hundreds injured in multiple suicide bombings that occurred in Colombo, Negombo, and Batticaloa on April 21, Easter Sunday.
  • Authorities indicated that the attacks involved seven suicide bombers. The targets comprised three churches, including the St. Anthony’s Shrine in Kochchikade, Katuwapitiya Church in Negombo, the Zion Church in Batticaloa, as well as the Shangri-La, Cinnamon Grand, and The Kingsbury hotels in Colombo. Two more explosions took place at a guesthouse near the Dehiwala Zoo and a suspected militant hideout in Dematagoda. At least 39 foreigners are believed to have been killed in the attack.
  • On April 23, the Islamic State (IS)-linked Amaq News Agency reported on the incident, but the group has not released an official claim, as of publication.
  • According to reports from April 23, security forces have arrested at least 40 individuals in connection with the blasts, including a Syrian national. According to sources, at least nine of the suspects were remanded until May 6. The country’s defense minister stated on April 23 that the attacks were in retaliation for the killing of Muslims in the attack in Christchurch, New Zealand in March.
  • One individual was reportedly arrested in the Kandana area in north Colombo along with communication devices, per April 22 reports. No specific information on the nature of the devices has been released. Four others were reportedly arrested from Gampola and Katugastota, located in Kandy District.
  • During the evening hours (local time) on April 22, two suspects were arrested during a security operation at a house located in the vicinity of a church on Enderamulla road in the Wattala area of north Colombo. Security forces closed off Colombo Main Road in Welisara area of Wattala following the reported discovery of a suspicious vehicle parked near Nawaloka ground during that time as well. However, no explosives were found on the site. Meanwhile, the police spokesperson announced that a total of 87 detonators were found at a private bus stand in Pettah within the Fort area of Colombo on April 22.
  • During the afternoon hours on April 22, an explosive device was detonated in the vicinity of St. Anthony’s Church in the Kochchikade North area of Colombo 13. Police reportedly attempted to conduct a controlled detonation of the device, which was placed inside a vehicle, with various reports stating the device exploded before they could do so. No casualties were reported as a result of the operation.
  • Alleged IS supporters posted images of three militants allegedly involved in the explosions on April 21. The images were shared through the pro-IS al-Ghuraba media channel. One of the pictures appears to feature Zahran Hashim, the alleged leader of the National Thowheeth Jama’ath (NTJ).
  • On April 21, police also reportedly discovered an alleged safe house in the Panadura area of south Colombo, in which suspected militants are said to have lived for almost three months prior to the explosions. The police of Wellawatta area, located in south Colombo, also seized a vehicle, along with its driver, on suspicion of transporting some suspects related to the explosions.

Assessments and Forecast

Perpetrators suspected to be local, but likely linked to IS or group’s affiliates

  1. While investigations are currently ongoing, based on the target selection, the attack was perpetrated by an organized group of individuals either inspired by jihadist ideology or with links to transnational jihadist groups such as Islamic State (IS) or al Qaeda (AQ) or their affiliates. Based on the modus operandi used, targets, and ideological spheres of influence, it is more likely to be IS-inspired or led than AQ, as further suggested by the Amaq media report. The travel of 32 Sri Lankan nationals to Syria and Iraq to join the IS in 2016 is indicative of this trend in local Islamist radicalization. Given the absence of previous major jihadist attacks in Sri Lanka, as well as the broad scope of the Easter bombings, we assess that the involvement of an external militant actor in helping sympathetic locals scale up their tactics is highly probable. While the government has attributed the attack to the NTJ, an organization with no confirmed external links, it is important to note that the group has splintered in recent years, based on sources of funding for factions. The Easter attack is likely to have been conducted by one of these factions that may have drawn on IS-inspired tactics and target selection.
  2. At the time of writing, it is unclear what level of cooperation, if any, this may have involved. That said, the orientation of the plot towards Christian targets, despite the predominance of inter-community conflicts between hardline Sinhala Buddhists and Muslim minorities, may indicate the influence of global jihadist ideology in target selection. It also represents a prioritization of symbolism in their target choice, given that attacking Christians and hotels frequented by Western nationals and affluent classes were more likely to draw global media attention. The staging of the attack in the capital was also intended to undermine the Sri Lankan government and stir up inter-religious hostilities with the Sinhala Buddhist majority. The choice of attacks on hotels, in addition to churches, may have been intended to maximize casualties at Easter social events known to take place during the morning-afternoon hours. As regards the defense minister’s assertion that the attack was in response to the Christchurch attacks, since the scale of the operations required greater advance planning, his theory appears to be debatable. However, the incident in New Zealand may have reaffirmed the militants’ commitment to the plots and the targeting of Christians.

Emerging reports from investigations indicate close coordination and planning, as well as extensive network of militant cells

  1. There is little confirmed information regarding the explosives material used, or the profiles of the suspects apprehended. However, the recovery of explosives material and detonators from a suspected militant cell in Puttalam in January appears to have been an early warning sign of growing radicalization. The materials seized in January, such as ammonium nitrate and nitric acid, are characteristic of relatively less sophisticated household-manufactured explosives. Should similar materials have been used in the attack, it may explain the relatively inconsistent death tolls and damage caused, which varied from each individual attack. However, casualties appear to have been maximized by the strategic planning, coordination of multiple plots, logistics, and deployment of operatives to successfully stage the attacks. Some of the attacks also indicate the usage of shrapnel, such as ball bearings or nails placed in the backpack of the suicide bomber who was dispatched to the Kochchikade church, in order to increase secondary casualties. The suspects are also likely to have had bases in the capital, as explained by their familiarity with the targets and access to them.
  2. While it remains to be confirmed that all suspects arrested during security operations were linked to the explosions, the large number of detainees underscores the potential for an extensive network involved in the attacks, ranging across more than one province. The arrests of four suspected operatives in Kandy District are also significant given that the area has witnessed substantial inter-religious tensions between the Muslim minority and hardline Sinhalese Buddhists, which escalated into communal violence in March 2018. The arrests in Kandy may lead police to probe the potential involvement of individuals radicalized following the aforementioned Kandy violence.

Recovery of undetonated explosives, anti-militant raids elevates security risks in the capital in the immediate term

  1. The discovery of an IED inside a vehicle on April 22 near St. Anthony’s Church is also notable given its proximity to the site of the first blast on the day prior. While it is currently unclear at what time the vehicle was parked in the area, its location suggests that it may have been intended as a secondary attack targeting rescue operations attending to the initial blast. The discovery of a large number of detonators, along with the pipe bomb found near the international airport, also indicates that additional attacks may have been planned in a similar fashion. It appears likely that more explosive devices may be discovered during ongoing security operations, increasing the need for situational awareness and heightened vigilance if traveling in Colombo.
  2. FORECAST: There is an elevated potential for additional security incidents in the capital over the coming hours. Security forces are expected to continue to conduct raids, arrests, and security operations across Colombo and in the Central Province over the coming hours, while an enhanced deployment of law enforcement will remain in place in the capital city for the foreseeable future. There is also a potential for ad-hoc road closures and evacuations due to heightened public sensitivities at present, evidenced by the security operation in Wattala. Raids also bear the latent risk of collateral damage to those in the vicinity, as raided safehouses may contain explosives, or suspects may use these devices or gunfire in an armed confrontation. This was indicated in the Dematagoda raid. Further, as security forces are on greater alert, evacuations of public spaces may occur with increased frequency over the coming days, based on the identification of suspicious objects. Intermittent curfews are liable to be enforced, based on concerns of further attacks or the potential for inter-religious clashes between Muslims and hardline Sinhala Buddhist groups. As witnessed since the attack, security will remain heightened in neighboring countries that are at risk of copycat attacks, such as the Maldives and India.


  1. Those operating or residing in Colombo on April 23 and in the coming days are advised to avoid nonessential outdoor travel within the capital and avoid any large gatherings.
  2. Avoid the immediate vicinity of all churches, mosques, or Buddhist temples in the country over the coming hours due to the risk of retaliatory attacks/further detonations.
  3. Given the targeting of religious sites, we advise to avoid the display of religious imagery and avoid overt or critical statements of any religious institutions both in public spaces and online, including social media.
  4. If traveling in the city, use only secure methods of transportation with vetted drivers.
  5. We advise allotting for disruptions to travel across Colombo over the coming hours, due to the heightened security measures and the likely establishment of vehicular checks and road blockades following the blasts.
  6. Given the reported heightened security measures implemented at the Bandaranaike International Airport (CMB), we advise allotting for extra-time to travel by air and reconfirm flight itineraries.
  7. Ensure when traveling that you have sufficient means of identification and can evidence if required, exactly where you are going.
  8. Allot for disruptions to communication due to the impact of curfew measures on social media access and messaging platforms.
  9. Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.
  10. Immediately alert authorities of any suspicious behavior or items. Ensure that places of stay are properly secured, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.
  11. Foreigners, particularly Westerners, should maintain a low profile, and exercise heightened vigilance in the vicinity of locales frequented by foreign, particularly Western nationals, including US and Western diplomatic missions and interests, due to the increased potential for militant attacks.
  12. If scheduled to visit the country, delay travel or reconsider nonessential stay until the situation stabilizes.
  13. For contingency plans and on-ground operational support, contact us at [email protected] or +44 20-3540-0434.

Barcelona stabbing, one year after La Rambla attack, underscores continuing link between psychological instability and militant style attacks – Spain Analysis

Current Situation

On August 20, around 05:00 (local time), an individual armed with a knife reportedly attempted to enter a police station in Cornella de Llobregat, Barcelona and attack personnel, while shouting “Allahu Akbar”, before being shot dead. Reports indicate that the attacker was of Algerian origin and had lived in the area for several years.

The incident is reportedly being treated as a militant attack by authorities. However, police have claimed that they have no reason to believe that there are any direct links to major militant networks or that the assailant was connected to the cell that carried out the Barcelona attacks one year earlier. In addition, the testimony of his ex-wife indicated that the attacker had recently come out as homosexual, and was reportedly experiencing serious psychological instability and was suicidal due to confusion over how this could fit in with his Muslim faith. Some sources within the investigation have claimed that they do not believe the attack to be linked to jihad.

On August 16, a pro-Islamic State (IS) group published a poster on social media calling for attacks targeting police in Spain in both English and Spanish.

Click here to see Map Legend 


The August 20 attack is the latest in a series of violent or militant-related incidents involving North Africans or individuals of North African origins in south and south-west Europe over the past year.

In addition, on July 22, a 29-year old Canadian national of Pakistani origin, Faisal Hussain, killed two and injured three in a shooting in Greektown, Toronto. Hussain was allegedly also known to have had a history of psychological instability and had reportedly expressed concerns about his employment and financial situation to a friend prior to the incident. On July 25, the Islamic State (IS)-linked media outlet, al Amaq, reported that the attack was carried out by a soldier of the Caliphate in response to their call to target citizens of coalition nations.


Attack on police station underscores growing trend of violence copying Islamic State methods among psychologically unstable Muslim males

Despite claims that the attacker had a number of problems in his personal life, the possibility of links to wider militant trends cannot be ruled out. On the contrary, the fact that the attacker shouted “Allahu Akbar” and carried out the attack on the specific target that pro-IS groups had called for four days prior indicates that, even though he was likely not linked to any established militant cell, broader ideas of jihad informed part of his motivation. That is to say, while he may not have been looking to aid the goals of the Islamic State or avenge the deaths of Muslims, it is likely that, within his psychological instability, when thoughts of suicide arose, the concept of carrying out a jihadist attack was seen as a viable method. Possibly copying previous ‘suicide by cop’ attacks, in which the perpetrator intends to be killed by security forces. This assessment is further bolstered by the reports that his confusion over homosexuality was, in part, caused by an uncertainty about how it fit in with Islam.

With this in mind, the incident comes amid a continuing trend of psychologically unstable individuals, most of whom are migrants who adhere to the Muslim faith, carrying out attacks that mimic IS-inspired lone wolf incidents. Such attacks tend to be conducted by young males with mental health issues, who are, in part, influenced by the concept of jihadist militancy as a form of anti-establishment violence that has entered the West’s collective consciousness. Psychologically unstable individuals, and immigrants who perceive themselves to be disenfranchised and socially isolated from their community, whether it’s the Muslim or wider community, are copying IS-methods of attacks. In this sense, the media coverage of the various IS shootings and the general global trend of young men using mass violence as an outlet for frustration and disenfranchisement have merged.

Regardless of the psychological issues of the attacker, the fact that the incident came following the call from pro-IS groups means that online jihadist communities, and even Islamic State-linked media organizations, are likely to attribute the event to part of their ideology and larger plan. This is especially the case given the timing of the incident around the anniversary of the August 2017 attacks in Barcelona and Cambrils. In turn, this will perpetuate the aforementioned trend merging psychological instability and attacks that appear to be militant in nature.

Finally, the August 20 attack in Barcelona constitutes the latest in an ongoing trend of incidents related to violent attacks linked to Islamism from within the local North African community in north-eastern Spain and southern France. IS and IS-linked operatives have put a particular emphasis on recruiting in the region, due to the fertile ground for radicalization born from the feelings of disenfranchisement in both the established North African community and among North African migrants. These sentiments, which come partly due to perceptions of otherness within Spanish society and partly due to pressures put on from the local community, have the potential to lead young men towards violence, sometimes personally and sometimes linked to a militant organization.


Travel to Spain can continue while maintaining vigilance, due to the elevated threat of militancy.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city – Russia Analysis

Please be advised

On May 6, the Islamic State (IS)-linked media group, al-Amaq, claimed that a shooting attack which took place in Nizhny Novgorod, western Russia, was committed by a ‘soldier’ of the Sunni-jihadist group. According to a statement from Russia’s Federal Security Service (FSB) on May 4, an assailant opened fire on police officers during an identity check and barricaded himself inside an apartment in the city. The statement indicated that the perpetrator was later neutralized by security forces.

From 14 June to 15 July 2018, Russia will host the FIFA World Cup in a number of cities, including in Nizhny Novgorod. In the run-up to the tournament, Russian security forces have carried out a large number of raids and arrests, looking to neutralize militant cells made up of both Central Asian migrants, mostly based in major cities, and North Caucasian militants, mostly from the Republics of Chechnya, Dagestan, and Ingushetia.

Since the beginning of 2018, at least 38 militant counter militancy raids have been recorded in Russia, the majority focusing on reportedly IS-linked militants. At least five of the raids occurred in or near World Cup cities, including Moscow, Nizhny Novgorod, and Rostov-on-Don.

On April 17, three suspected IS-linked militants were arrested near Rostov-on-Don by FSB agents. A number of reports suggested the possibility that the militants were embedded in the city to wait until the start of the World Cup and carry out an attack during the tournament.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city - Russia Analysis | MAX Security
Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city | MAX Security

Click here to see Map Legend


The claim from IS and the reports from the FSB indicate the first case of a successful attack occurring in a World Cup host city in 2018. The most recent Islamist militant attack in one of the host cities was in St. Petersburg in mid-2017. The incident underscores previous assessments that militants, from both Caucasian and Central Asian origins, are looking to focus their operations on the World Cup, so as to maximize exposure during the tournament. In addition, the developments come following the publication IS’ official newsletter, Al-Naba, on May 4 which called on its supporters to conduct attacks across Russia, underscoring the group’s continued interest in projecting its militant capabilities in the country. This assessment gains further credence considering IS’ repeated threats to the World Cup.

While there is no indication as to the origin of the militant at the time of writing, there are three main possibilities, all of which have been previously recorded in Russia. In the event that the attacker was a lone-wolf Central Asian migrant, who was locally radicalized within Russia through online and on ground Islamist networks, the incident highlights that lone-wolves in major cities are heeding to IS’ demands to carry out attacks on World Cup cities, demonstrating the threat in any city with a significant Central Asian diaspora community. In the event that the militant had links to Caucasian militant cells, it highlights attempts by the Caucasian Emirate pro-IS group to embed radicals within major cities, prior to the tournament, who will then carry out attacks. This is likely designed to occur before security in the North Caucasus becomes overwhelming around the time of the World Cup. The third option is that the militant may have had connections with both Central Asian militant networks and Caucasian cells, which would constitute a significant threat as such an assailant would be able to utilize the covert nature of the loosely linked Central Asian networks and the expertise of the well established Caucasian groups.

Going forward, a significant increase in counter-militancy operations in major cities and the North Caucasus will occur in the run-up to the World Cup. Furthermore, the potential for both minor and major attacks in all host cities remains before and during the tournament, likely looking to specifically target stadiums and locales with international attention, so as to maximize exposure.


Travel to Russia may continue while maintaining vigilant given the elevated risk of militancy and crime, particularly in major cities and World Cup host cities. (Click for our special report on threats to the 2018 World Cup).

Remain cognizant of any suspicious individuals or items that look out of place. Immediately alert authorities if identified.

Avoid all nonessential travel to the North Caucasus region, given the high risk of militancy and kidnapping.

How Egypt’s new militant group will impact the threat landscape – Egypt Analysis

Current Situation

On November 3, a previously unknown militant group, Jamaat Ansar al-Islam, claimed responsibility for an October 20 attack in western Egypt’s Bahariya Oasis, in which reports state at least 55 security forces personnel were killed during a raid operation targeting a militant base.

In its claim of responsibility, the group introduces itself to the Egyptian public, denouncing Egyptian leadership for its treatment of the populace. The group states that the October 20 attack, which it describes in specific detail, marks the commencement of its “jihad” against government and military authorities in Egypt and proclaims itself to be a group that has exercised a “divine patience.”

The organization memorializes one of its leaders, Emad al-Din Ahmed, a former military officer who became a jihadist, who was killed during a counter-militancy operation on October 31, which included ground raids and airstrikes in a mountainous area near al-Wahat Road, west of Fayoum. Ahmed is reported to have been a deputy of Hesham al-Ashmawy, an al-Qaeda member reportedly operating in the eastern Libya city of Derna, who along with Ahmed had been forced from the Egyptian military’s ranks for professing alleged extremist Islamic beliefs.

The group stated that it freed security forces’ personnel who were kidnapped during the Bahariya Oasis attack, after lecturing them on the principles of Islam, and explaining that Egypt’s leadership is an enemy of the faith. Previous reports had stated that a police officer who had been kidnapped during the October 20 incident was freed during the October 31 operation.

The group appeals to the Egyptian public, asking the country’s citizens to provide Jamaat Ansar al-Islam with various types of support, urging them to join the group’s ranks, as well as sponsor the group financially.

How Egypt's new militant group will impact the threat landscape - Egypt Analysis | MAX Security

Assessments & Forecast

While Jamaat Ansar al-Islam is a previously unknown group, the claim of responsibility for the attack is likely credible. Although the Islamic State (IS) maintains a significant presence in the Western Desert where the attack occurred, the organization did not claim the attack, even mentioning it in its monthly literature without taking credit for it. Jamaat Ansar al-Islam is widely reported as linked to al-Qaeda, and several indications support such an affiliation. Following the Bahariya Oasis incident, numerous al-Qaeda online profiles on jihadist channels publicized and praised the attack, while Ahmed’s reported association with the al-Qaeda-loyal Ashmawy would lend credence to the al-Qaeda affiliation. The claim of responsibility’s graphics and wording also resemble those of other al-Qaeda affiliates. Jamaat Ansar al-Islam’s announcement corresponds to al-Qaeda’s overall strategy of encouraging its affiliates to pursue local-specific goals, in this case to damage Egyptian leadership for its alleged mistreatment of Egypt’s population, as well as its perceived status as an enemy of Islam. IS, in contrast, targets these same interests, but rather for the purpose of destabilizing the state in order to advance the spread of an Islamic caliphate.

The emergence of an al-Qaeda affiliate in Egypt is highly notable in its own right, as the Sunni jihadist group has not maintained an active presence in the country in recent years. This group’s self-introduction comes amidst IS’s sustained territorial losses yielded in Syria and Iraq, where it only maintains control of a few swaths of land. Jamaat Ansar al-Islam likely chose to reveal its existence at this particular time to present itself an attractive alternative for IS fighters fleeing Syria and Iraq, as IS is increasingly seen as on the decline. The significant length of time that passed before Jamaat Ansar al-Islam claimed responsibility for the attack and unveiled itself as a group is likely due to communications difficulties with al-Qaeda’s central organization, particularly given the group’s presence in Egypt’s remote Western Desert, and that it is a new organization likely in the initial stages of establishing these contacts and communications capabilities. However, this could have been intentional, as the group may have waited to announce its existence to maintain a low profile and avoid drawing authorities’ attention and thus allow its militants to regroup.

As seen in the group’s eulogizing of one of its commanders who had been an officer in the Egyptian military, Ahmed most likely maintained connections with members of the military sympathetic to Islamist militancy, who given the success of the October 20 attack, likely informed the militants that the raid was to take place in advance. This would bolster our previous assessment that the militants likely had prior intelligence of the security operation’s launching from informants within the security forces. Furthermore, while the size of the group’s personnel has not been established as of yet, it displayed high capabilities during the Bahariya Oasis attack, which were likely enhanced by former military officers such as Ahmed. This was witnessed in the group’s strategically entrenched positions during the ambush, which included directing RPG and heavy gunfire from higher ground at both the front and rear of the security convoy, which significantly immobilized its personnel, as well as in the detonation of IEDs that followed. This complex multi-pronged attack, including the use of explosives, displayed high sophistication in both method and technical expertise, and the group’s remaining members likely retain these capabilities and knowledge.

Given Jamaat Ansar al-Islam’s likely affiliation with al-Qaeda, as well as its operations in Egypt’s Western Desert, the group most likely maintains ties with the Mujahideen Shura Council of Derna (MSCD), which is based across the border in Derna. The MSCD militia coalition’s largest faction, the Abu Salim Martyrs Brigade, is aligned with al-Qaeda. Jamaat al-Islam is likely to cooperate with the MSCD towards damaging shared enemies including Egyptian leadership, as well as Cairo’s Libyan ally, the Libyan National Army (LNA), whose dominion extends over much of eastern Libya. Such cooperation will likely include the exchange of weaponry and supplies across the border, as well as personnel on some occasions.

FORECAST: The group’s claim of responsibility will likely prompt a competition amongst militant groups operating in Egypt for manpower, prestige, and legitimacy. In response to Jamaat Ansar al-Islam’s announcement, IS and disenfranchised Muslim Brotherhood militant groups are now likely further motivated to conduct attacks in order to continue to convince Egyptians to join and support them rather than defect to this new organization, raising the potential for attacks in mainland Egypt at this this time. In terms of recruitment and manpower, Jamaat Ansar al-Islam’s call for jihadist-style militancy against Egyptian authorities would appeal to those in line with IS’s doctrine, while the specific local aims of the group to attack Egypt’s leadership for its alleged maltreatment of Egyptians would attract those of the Muslim Brotherhood ideology, including more radical elements part of groups such as the Hasam Movement and Liwaa al-Thawra. Al-Qaeda has also attempted in the past to establish such relationships with disenfranchised Muslim Brotherhood militants. Furthermore, Jamaat Ansar al-Islam likely utilized a recent downtick in activity by both IS and disenfranchised Muslim Brotherhood groups in mainland Egypt in recent weeks to portray itself as strong relative to these other organizations in an attempt to gain support.

FORECAST: In response, Egyptian authorities will prosecute further security raids and direct Egyptian Air Force (EAF) airstrikes targeting the group in Egypt’s Western Desert, aimed in part at preventing Jamaat Ansar al-Islam from strengthening itself through any cooperation with the MSCD and smugglers across the border in Libya. Towards this end, Cairo will likely heighten coordination with the LNA, and in some instances, as seen on May 26 and on a few occasions afterwards, will likely order EAF airstrikes against the MSCD in Derna. Furthermore, Egyptian authorities will seek to identify and arrest militant informers likely maintained by the new group within the military and security services. However, given the challenges inherent in policing the extensive Western Desert and its expansive international borders, Jamaat Ansar al-Islam will likely continue to operate there and will attempt to perpetrate further attacks. Furthermore, it remains possible that the group maintains personnel in other areas of Egypt, including in more heavily-populated areas in its interior cities, which would also be targeted by security forces.


Travel to Cairo and Alexandria may continue while adhering to all security precautions regarding militancy and civil unrest. Consult with us for itinerary-based travel recommendations.

Avoid all travel to the North Sinai Governorate and border areas with Libya, Sudan, and Israel due to the persistent risk for militant attacks, kidnappings, and general lawlessness.

In Cairo, maintain heightened vigilance and continue to allot extra time for travel due to possible delays emanating from increased security deployments, checkpoints, and closures throughout the capital.

As a general security precaution, remain vigilant in areas surrounding and avoid the immediate vicinity of government installations, police stations, and religious centers, particularly churches, as these locations remain under elevated threat of militant attacks. When traveling in central squares, or in areas with persistent police deployments, avoid the immediate vicinity of security forces, particularly fixed traffic booths, as such personnel and facilities have increasingly come under attack by militant elements.



Read more reports in our security blog

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir – India Analysis

Current Situation

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security

Click here to see Map Legend

Between November 22 and December 13, Islamic State (IS) released a series of online messages calling for attacks in India and indicating that the group was soon to develop a presence in the country. Similarly, al-Qaeda in the Indian Subcontinent (AQIS) released anti-India messages and videos during the period, making references to alleged right-wing Hindu violence perpetrated by the state towards its Muslim population.

The messages follow a claim by IS on November 18 for an attack in Srinagar, Kashmir, where one police officer was killed. On November 14, an audio clip purportedly from an Islamic State (IS) operative from Kerala State was circulated online via social media. Police have reportedly identified the speaker as Rashid Abdullah, the leader of a Kerala-based IS cell who is reportedly now in Afghanistan with Islamic State-Khorasan Province (IS-KP). Abdullah calls for truck, knife, and poison attacks against Hindus at major public religious festivals such as the Kumbh Mela and the Thrissur Pooram.

In recent months, AQI  has increased the frequency of its propaganda messages directed towards India. In July, the group additionally received a pledge of support from Ansar Ghazwatul Hind (AGH), a Kashmiri militant group that broke away from the Hizbul Mujahideen (HM).

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security


The recent trend of increasing messaging by transnational groups IS and AQIS targeting India appears to be driven by an underlying competition between the groups to expand their spheres of influence in the country. Since its formation in 2014, AQIS has been dormant operationally in India, largely due to the movement of most of the group’s operatives towards the Afghanistan-Pakistan region, where they have embedded themselves with local militant groups fighting those respective governments. This revival of propaganda activity directed towards India was likely triggered by the pledge of the Kashmiri militant offshoot, AGH, to the group in July. Islamist militancy in Kashmir state has traditionally been non-aligned with global jihadist groups, and its primary intention has been the pursuit of a political, separatist agenda instead of an overtly religious motivation. Given this historic trend, AGH’s pledge of allegiance is a notable departure. It would appear the growing friction over leadership struggles within the local militant group HM has likely resulted in factions such as the AGH attempting to set up their own interests. To this end, their pledge to AQIS was likely in order to gain credibility for itself during its formative months specifically through association with a major jihadist organization.

Meanwhile, IS interest in the Kashmir conflict, from which it has previously stayed away, is likely based on the growing online interest in the group’s banner in the state. Youth in Kashmir appear increasingly disaffected with traditional militant groups such as HM. This sentiment likely extends towards groups that operate across the India-Pakistan border as well, such as Lashkar-e-Taiba (LeT) and Jaish-e-Mohammed (JeM), who they maintain are driven by political interests and do not represent the true Islamic character of their movement. Specifically, the reported images of the perpetrator with IS insignia prior to the attack likely resulted in their claim of the November attack in Srinagar. The details of the claim were faulty, stating that a Pakistani and not an Indian officer was killed; this throws into question the degree of contact between the perpetrator and IS leadership prior to the attack. However, it is nevertheless reflective of the group’s interests in reaching out to sympathetic locals and existing militant groups in Kashmir.  This interest appears to be growing as IS takes increasing losses in Syria and Iraq, and consequently pivots to newer territories.

Apart from Kashmir, a degree of support for IS also appears to be developing across the country, as witnessed in the recent arrests, primarily in states with notable Hindu-Muslim community tensions. For instance, Kerala and Uttar Pradesh states, where a majority of the arrested suspects were originally from, have witnessed a notable increase in conflicts between Hindu and Muslim communities and political groups. This has especially been the case since the growing presence of the perceived right-wing Bharatiya Janata Party (BJP) in these states and its association with pro-Hindu organizations.

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security


At the present time, we assess that the operational capabilities of both IS and AQIS across India’s major cities and central areas remain low. Despite sympathies for IS, local cells have failed to actualize any major attacks across the country, due to their inability to reduce their exposure to security force investigations. While local cells in recent times have previously attempted to build explosives or plan attacks, they have been unsuccessful due to raids and arrests that have foiled their plots. It is worth noting that these cells located until now have largely been isolated from each other and there is no evidence of a coordinated leadership hierarchy to guide recruitment and plot development. These solitary efforts are a likely cause for the inconsistencies in the abilities of these cells, and the overall lack of actionable capabilities. In addition, more established local militant groups such as the Indian Mujahideen, which may have been able to assist these efforts, have largely been neutralized in recent years through targeted operations and the arrests of their leaders. That said, the latent potential for less-sophisticated lone-wolf attacks remain, given the low operational threshold required to plan and carry out these attacks.

In Kashmir however, capabilities for transnational jihadist groups remain more potent. This is due to the established presence of militant groups, and the consequent access to weapons and explosives. To this end, AQIS appears to have an advantage over IS, given its established relationship with an on-ground proxy AGH, which is known to have trained operatives capable of staging ambushes on security force convoys and military camps. IS, on the other hand, has only been loosely linked to the November attack, and their connection to local militant groups remains underdeveloped at the present time.

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security


In the immediate term, we assess that both IS and AQIS are likely to continue their push to increase spheres of influence in India. Their primary focus is likely to be Kashmir, given the marked escalation of civil unrest since 2016 over the continued military presence and the opportunities this presents for recruitment. Meanwhile, both groups will likely seek to capitalize on the increasing factionalism within established local militant groups such as HM and draw disaffected factions towards their banner. AQIS is likely to attempt this through their local affiliate AGH, whose leader Zakir Musa remains popular among locals in southern Kashmir. Meanwhile, IS interests are likely to be coordinated by their affiliate in the Afghanistan-Pakistan region, IS Khorasan Province (ISKP). The group may seek to replicate their model of engagement in Pakistan, which has involved carrying out attacks through local low-level militant groups and claiming them as IS attacks, without any formal pledges of allegiance from their proxies.

For the rest of the country, both groups’ prospects will likely remain lower in the immediate term, given that the Indian military has largely sequestered the Kashmir conflict away from the country’s center. However, recent messages have called for Kashmiri militants to attack Delhi, indicating strong intent to expand beyond the state. Such attempts, while rare, are not unprecedented and security forces will likely remain vigilant for this threat.

Instead, in the country’s major cities and central regions, the more immediate threat stems from potential lone-wolf militancy. There remains a palpable intent among certain radicalized sections of the Muslim community, and sympathizers may increasingly take inspiration from IS’s recent calls for lone wolf attacks in places like Europe and North America. In addition, local cells may also increasingly orient their operations towards these forms of attacks should more sophisticated modus operandi continue to yield limited results. This would likely place Hindu religious targets, such as festivals and temples at a specific risk. Attacks against other targets such as synagogues and Western diplomatic or business interests also remain a possibility, given that local radicalized individuals are equally engaged with global jihadist propaganda, which advocates attacking these targets.

Increase in jihadist messaging reflects competition between IS, AQIS; immediate operational focus likely to be in Kashmir - India Analysis | MAX Security


Travel to Delhi and other major Indian cities can continue, while travelers are advised to maintain vigilance for security risks associated with frequent, large demonstrations as well as potential militant threats targeting government buildings, security installations, large crowded public places, or religious sites.

We advise against all travel to Jammu and Kashmir State, with the exception of Jammu and Srinagar cities.  Any overland travel west or south of Srinagar, towards areas such as Tral, Baramulla, Sopore, Shopian, and Anantnag is advised against.

Given the continued militant threat in India, maintain heightened vigilance for suspicious individuals and unattended baggage, particularly in public places including major hotels, government installations, transport hubs, markets, restaurants, entertainment venues, and places of worship.

MAX Analysis Egypt: January attack by militant group Wilayat Sinai underscores increased capabilities February 24, 2015

Executive Summary

  • The January 29 coordinated and simultaneous attack against multiple targets in northern Sinai, by the militant organization Wilayat Sinai, highlights an ongoing shift in militant tactics, as well as an upgrading of their capabilities and the potential for additional attacks.
  • Meanwhile, renewed accusations that the Muslim Brotherhood was involved in the attack and subsequent crackdowns on the group will likely continue to create a divide in the organization over the use of violence to “retaliate” against alleged police and military brutality.
  • This divide will likely perpetuate near-daily militant attacks across Egypt, while carrying with it the risk of further expanding the operational areas of “Wilayat Sinai” to Muslim Brotherhood strongholds and other regions across the country.
  • We advise against nonessential travel to Cairo and Alexandria at the time due to the persistent risk of militant attacks and civil unrest in major cities. Consult with us for itinerary-based travel recommendations.

Current Events in Egypt
On January 29, the Islamic State (IS) affiliate in Sinai, Wilayat Sinai (formerly known as Ansar Bayt al-Maqdis), carried out multiple coordinated attacks on several targets in Sheikh Zuweid, Rafah, and al-Arish, with the main attack carried out in the latter. In al-Arish, reports indicate that militants attacked the Egyptian Armed Forces’ 101 Battalion headquarters, as well as multiple other targets, including a local hotel, various checkpoints, and the security directorate. Militants used multiple car bombs, in addition to mortars and gunfire to overwhelm local security forces. Reports indicate that at least 32 people were killed and 100 injured. Wilayat Sinai claimed to have used more 100 fighters in the attack, as well as three explosives-laden vehicles, while claiming to have staged the attack during the night hours so as to “minimize” civilian casualties.

  • Additionally Egyptian President Abdel Fattah al-Sisi made a public statement regarding the January 29 attacks and unrest, vowing to defend Egypt’s Sinai against “terror” and stating, “I have said it before and I will say it again, we are fighting the strongest secret organization of the last two centuries,” likely referring to the Muslim Brotherhood. Reports indicate that al-Sisi also created a new military entity to combat militancy in Sinai, following a meeting held by the Supreme Council of the Armed Forces (SCAF). Al-Sisi reportedly named General Osama Roshdy, the current head of the Third Army, as the head of the entity and promoted him to Lieutenant-General.
  • Meanwhile, following the attack in Sinai, the Muslim Brotherhood issued a statement in English declaring, “We unequivocally condemn all acts of violence” and reaffirming the group’s “commitment to peaceful and political civil resistance”. However, the group also released an article on January 27, quoting Muslim Brotherhood founder Hassan al-Banna, urging its supporters to “prepare” for a new phase where “we summon all our strength and evoke the meaning of Jihad”. The statement also refers to the Secret Apparatus, a paramilitary operation created by al-Banna to fight the British mandate in the 1920s. The Muslim Brotherhood distanced itself from the organization on several occasions, and the existence of the organization remains subject to controversy. The Egyptian Ministry of Foreign Affairs released a document using the statement to show the Muslim Brotherhood’s alleged “double speak”.
  • A Turkish-based television channel, affiliated with the Egyptian Muslim Brotherhood movement, aired a statement coming from the “Revolutionary Youth” issuing an ultimatum to all foreign nationals in Egypt during the morning hours of January 31. According to the ultimatum, all foreign citizens should leave Egypt by February 11, all foreign companies operating in Egypt should close down by February 20, and all foreign diplomats should leave and close down their embassies by February 28. In addition, the warning was extended to all tourists planning to visit Egypt, saying they should cancel their plans as they are not welcome. According to the broadcast, whoever chooses to ignore the warning will be targeted.
  • The statement was then condemned by the Muslim Brotherhood in English; however, no such condemnation was issued in Arabic. The Egyptian authorities have reportedly requested that Turkey halt broadcasting the channel; however, unconfirmed reports suggest that no official complaint was lodged in Turkey at this time.

Assessments: Attack in al-Arish underscores heightened militant capabilities, while highlighting possibility for additional attacks in coming months

  • While attacks in the Sinai Peninsula have been carried out on a near-daily basis, the recent attack in al-Arish is notable as it underscores militants’ increased capabilities despite ongoing military operations and the deployment of troops in the Sinai Peninsula. A similar attack was carried out in Sheikh Zuweid on October 24, with militants detonating a car bomb at a heavily protected checkpoint near the city, placing roadside bombs near the site to prevent reinforcements from arriving and then storming the checkpoint with several vehicles and simultaneously firing rocket propelled grenades (RPG). Such attacks underscore militants’ ability to gather intelligence, predict Egyptian military tactics, and carry out multi-stage attacks meant to overwhelm the main military strongholds in the peninsula.
  • In this context, the October 24 and January 29 attacks underscore a shift in militant tactics. Militants had thus far used “hit-and-run” attacks against the Egyptian military, using either car bombs, roadside bombs, localized mortar or rocket attacks, or RPG and shooting attacks. However, the October 24 and January 29 attacks demonstrate  militants’ ability to efficiently use a combination of all of these techniques to maximize casualties. Furthermore, the attack on January 29 underscores militants’ ability to drag the Egyptian military into hours-long ground clashes, as well as their willingness to directly confront the military. Such tactics, which are also riskier for militants, are likely a direct result of the increased militarization of northern Sinai, as militants need to use heavier firepower to attack highly defended military positions. Furthermore, it is possible, in light of the group’s allegiance to IS, that several tactics developed and used in Syria and Iraq were learned by Wilayat Sinai from IS.
  • Despite statements from the military promising a harsh response and claiming the attack was the result of military successes in Sinai, the multi-layered attack likely raised doubts over the efficiency of the Egyptian military’s counterinsurgency campaign in Sinai. In this context, the attack followed a January announcement of the extension of the three-month long state of emergency in Sinai, which was initially declared in the aftermath of the October 24 attack, for an additional three months, as well the launching of the “second phase” in the establishment of a buffer zone with Gaza. With this in mind, the timing of the attack highlights the possibility that militants sought to demonstrate the failure of such measures, while further capitalizing on discontent among locals stemming from these measures. Finally, in light of the main target of the attack, the 101 Battalion headquarters, considered to be one of the most secured and fortified military bases in Sinai, the militants may have sought to “shame” the Egyptian military, and thus heighten the chances for a disproportionate crackdown on the peninsula, and on Islamists in general in the country. Such a crackdown is further likely, in turn, to alienate the local population and legitimize further attacks.
  • Overall, we assess that the militancy threat will likely remain elevated in northern Sinai, in light of the persistent clashes reported after the attack. However, heavy military deployments in this specific area of the Sinai Peninsula, may also encourage militants to relocate and stage attacks in other locations of the peninsula and, to a lesser extent, of the country. In this context, while the positioning of militants in the triangle between al-Arish, Rafah, and Sheikh Zuweid was likely strategic for the group in light of the smuggling of weapons to and from the Gaza Strip, increased military pressure on smuggling activities likely have prompted the group to develop other tactics.
  • These may include, for instance, the use of boats to smuggle weapons and militants, given that despite the maritime blockade on the peninsula, the Egyptian navy’s capacities remain limited when compared to its ground counterpart. The group may thus attempt to develop ties with Bedouin tribes in the southern part of the Sinai Peninsula, while previous upticks in military activities in northern Sinai have also resulted in militants fleeing to other parts of the country. As a result, we assess that in addition to the militancy threat in northern Sinai, the coming months may see an uptick in Wilayat’s Sinai activity in southern Sinai, as well as in the Nile Delta and potentially at the border with Libya.

Assessments:  Sinai attack, resulting crackdowns on Brotherhood likely to perpetuate divide in organization

  • In light of the declarations made by President Abdel Fattah al-Sisi, as well as past attacks in Egypt since the ouster of former President Mohammed Morsi, the crackdown against the Muslim Brotherhood will likely be widened following the attack in Sinai, as has previously been witnessed. In this context, while this trend is not new, the continuing accusation and crackdown has likely created a divide inside the organization between those who continue to advocate for peaceful protests to denounce the regime and those who advocate “self-defense” in light of the security forces’ use of violence to disperse the protesters.
  • In addition, to increase pressure for the group to legitimize “self-defense”, several elements, namely the mass arrest of most of the Brotherhood’s leadership in Egypt, its relocation outside the country, and changes inside the organization, have further intensified this divide. This is further underscored by unconfirmed reports that the Brotherhood held two-month worldwide elections that led to leaders of the youth movement as well as reformist movements assuming a broader role, suggesting that new leaders are seeking to reform the group.
  • Should the group’s leadership in Turkey or in other countries maintain its policy of nonviolence, it bears the risk of being increasingly sidelined and losing its remaining influence over the group’s supporters on the ground. On the other hand, should it  decide to shift its stance and overtly promote violent actions, even those deemed to be “self-defense”, the group will likely face increased pressure both inside and outside Egypt, as the military-backed regime will likely use such statements against it. This likely explains the current ambiguity of the Brotherhood’s statements, and the fact that condemnations of violence have been made in English but not in Arabic. The recent statement on the Brotherhood-affiliated channel as well as the article advocating violence likely stem from this divide. Such a divide may further increase the chances that members of the group will leave if they do not agree with the group’s line, or that they will feel that attacks are justified, in light of recent aforementioned statements.

Assessments: Near-daily militant attacks likely to continue, while IS-affiliated group may take advantage of internal Brotherhood divide to further expand operational areas

  • Overall, we assess the attack in al-Arish will likely prompt an uptick in violence in Egypt, both in Sinai and across the country, as a result of the likely impending crackdown on the Muslim Brotherhood, and, as aforementioned, in light of precedent. Such violence will likely continue to materialize in continued IED attacks against the country’s security forces, infrastructure, and transportation system. However, as indicated by an uptick in attacks and threats against foreign companies, such attacks may increasingly expand to civilian targets deemed to be legitimate if they are deemed as “collaborating” with the regime.
  • Moreover, we assess that low-level militant groups may increasingly serve as a gateway for disenchanted and former members of the organization to join the other more radicalized groups. While prior to the ouster of Mohammed Morsi, the ideological gap between the Muslim Brotherhood and militants groups, such as Ansar Bayt al-Maqdis at the time, was significant, disillusioned members of the organization can now gradually radicalize by passing from group to another, given the wide variety of groups using violence, including local Popular Resistance Committees that often claim IED attacks against security forces, the Ajnad Misr militant group, and finally Wilayat Sinai.
  • Furthermore, as several elements of the Brotherhood may leave it and become increasingly radicalized, the operational areas of Wilayat Sinai in Egypt may expand to officially include a group in mainland Egypt. Regardless, the recruitment of disillusioned former members of the Brotherhood, as well as the fact that several members of the group may flee from Sinai to the Nile Delta, the border with Libya, or Libya itself, may increase the potential for sophisticated attacks to be witnessed in these areas other the coming months, as well as in major cities such as Cairo and Alexandria.