Tag Archives: terrorism

At least 310 killed in nationwide bombings on April 21; indicative of extensive network, potential transnational link – Sri Lanka Analysis

Please be advised

  • At least 310 people have been killed and hundreds injured in multiple suicide bombings that occurred in Colombo, Negombo, and Batticaloa on April 21, Easter Sunday.
  • Authorities indicated that the attacks involved seven suicide bombers. The targets comprised three churches, including the St. Anthony’s Shrine in Kochchikade, Katuwapitiya Church in Negombo, the Zion Church in Batticaloa, as well as the Shangri-La, Cinnamon Grand, and The Kingsbury hotels in Colombo. Two more explosions took place at a guesthouse near the Dehiwala Zoo and a suspected militant hideout in Dematagoda. At least 39 foreigners are believed to have been killed in the attack.
  • On April 23, the Islamic State (IS)-linked Amaq News Agency reported on the incident, but the group has not released an official claim, as of publication.
  • According to reports from April 23, security forces have arrested at least 40 individuals in connection with the blasts, including a Syrian national. According to sources, at least nine of the suspects were remanded until May 6. The country’s defense minister stated on April 23 that the attacks were in retaliation for the killing of Muslims in the attack in Christchurch, New Zealand in March.
  • One individual was reportedly arrested in the Kandana area in north Colombo along with communication devices, per April 22 reports. No specific information on the nature of the devices has been released. Four others were reportedly arrested from Gampola and Katugastota, located in Kandy District.
  • During the evening hours (local time) on April 22, two suspects were arrested during a security operation at a house located in the vicinity of a church on Enderamulla road in the Wattala area of north Colombo. Security forces closed off Colombo Main Road in Welisara area of Wattala following the reported discovery of a suspicious vehicle parked near Nawaloka ground during that time as well. However, no explosives were found on the site. Meanwhile, the police spokesperson announced that a total of 87 detonators were found at a private bus stand in Pettah within the Fort area of Colombo on April 22.
  • During the afternoon hours on April 22, an explosive device was detonated in the vicinity of St. Anthony’s Church in the Kochchikade North area of Colombo 13. Police reportedly attempted to conduct a controlled detonation of the device, which was placed inside a vehicle, with various reports stating the device exploded before they could do so. No casualties were reported as a result of the operation.
  • Alleged IS supporters posted images of three militants allegedly involved in the explosions on April 21. The images were shared through the pro-IS al-Ghuraba media channel. One of the pictures appears to feature Zahran Hashim, the alleged leader of the National Thowheeth Jama’ath (NTJ).
  • On April 21, police also reportedly discovered an alleged safe house in the Panadura area of south Colombo, in which suspected militants are said to have lived for almost three months prior to the explosions. The police of Wellawatta area, located in south Colombo, also seized a vehicle, along with its driver, on suspicion of transporting some suspects related to the explosions.

Assessments and Forecast

Perpetrators suspected to be local, but likely linked to IS or group’s affiliates

  1. While investigations are currently ongoing, based on the target selection, the attack was perpetrated by an organized group of individuals either inspired by jihadist ideology or with links to transnational jihadist groups such as Islamic State (IS) or al Qaeda (AQ) or their affiliates. Based on the modus operandi used, targets, and ideological spheres of influence, it is more likely to be IS-inspired or led than AQ, as further suggested by the Amaq media report. The travel of 32 Sri Lankan nationals to Syria and Iraq to join the IS in 2016 is indicative of this trend in local Islamist radicalization. Given the absence of previous major jihadist attacks in Sri Lanka, as well as the broad scope of the Easter bombings, we assess that the involvement of an external militant actor in helping sympathetic locals scale up their tactics is highly probable. While the government has attributed the attack to the NTJ, an organization with no confirmed external links, it is important to note that the group has splintered in recent years, based on sources of funding for factions. The Easter attack is likely to have been conducted by one of these factions that may have drawn on IS-inspired tactics and target selection.
  2. At the time of writing, it is unclear what level of cooperation, if any, this may have involved. That said, the orientation of the plot towards Christian targets, despite the predominance of inter-community conflicts between hardline Sinhala Buddhists and Muslim minorities, may indicate the influence of global jihadist ideology in target selection. It also represents a prioritization of symbolism in their target choice, given that attacking Christians and hotels frequented by Western nationals and affluent classes were more likely to draw global media attention. The staging of the attack in the capital was also intended to undermine the Sri Lankan government and stir up inter-religious hostilities with the Sinhala Buddhist majority. The choice of attacks on hotels, in addition to churches, may have been intended to maximize casualties at Easter social events known to take place during the morning-afternoon hours. As regards the defense minister’s assertion that the attack was in response to the Christchurch attacks, since the scale of the operations required greater advance planning, his theory appears to be debatable. However, the incident in New Zealand may have reaffirmed the militants’ commitment to the plots and the targeting of Christians.

Emerging reports from investigations indicate close coordination and planning, as well as extensive network of militant cells

  1. There is little confirmed information regarding the explosives material used, or the profiles of the suspects apprehended. However, the recovery of explosives material and detonators from a suspected militant cell in Puttalam in January appears to have been an early warning sign of growing radicalization. The materials seized in January, such as ammonium nitrate and nitric acid, are characteristic of relatively less sophisticated household-manufactured explosives. Should similar materials have been used in the attack, it may explain the relatively inconsistent death tolls and damage caused, which varied from each individual attack. However, casualties appear to have been maximized by the strategic planning, coordination of multiple plots, logistics, and deployment of operatives to successfully stage the attacks. Some of the attacks also indicate the usage of shrapnel, such as ball bearings or nails placed in the backpack of the suicide bomber who was dispatched to the Kochchikade church, in order to increase secondary casualties. The suspects are also likely to have had bases in the capital, as explained by their familiarity with the targets and access to them.
  2. While it remains to be confirmed that all suspects arrested during security operations were linked to the explosions, the large number of detainees underscores the potential for an extensive network involved in the attacks, ranging across more than one province. The arrests of four suspected operatives in Kandy District are also significant given that the area has witnessed substantial inter-religious tensions between the Muslim minority and hardline Sinhalese Buddhists, which escalated into communal violence in March 2018. The arrests in Kandy may lead police to probe the potential involvement of individuals radicalized following the aforementioned Kandy violence.

Recovery of undetonated explosives, anti-militant raids elevates security risks in the capital in the immediate term

  1. The discovery of an IED inside a vehicle on April 22 near St. Anthony’s Church is also notable given its proximity to the site of the first blast on the day prior. While it is currently unclear at what time the vehicle was parked in the area, its location suggests that it may have been intended as a secondary attack targeting rescue operations attending to the initial blast. The discovery of a large number of detonators, along with the pipe bomb found near the international airport, also indicates that additional attacks may have been planned in a similar fashion. It appears likely that more explosive devices may be discovered during ongoing security operations, increasing the need for situational awareness and heightened vigilance if traveling in Colombo.
  2. FORECAST: There is an elevated potential for additional security incidents in the capital over the coming hours. Security forces are expected to continue to conduct raids, arrests, and security operations across Colombo and in the Central Province over the coming hours, while an enhanced deployment of law enforcement will remain in place in the capital city for the foreseeable future. There is also a potential for ad-hoc road closures and evacuations due to heightened public sensitivities at present, evidenced by the security operation in Wattala. Raids also bear the latent risk of collateral damage to those in the vicinity, as raided safehouses may contain explosives, or suspects may use these devices or gunfire in an armed confrontation. This was indicated in the Dematagoda raid. Further, as security forces are on greater alert, evacuations of public spaces may occur with increased frequency over the coming days, based on the identification of suspicious objects. Intermittent curfews are liable to be enforced, based on concerns of further attacks or the potential for inter-religious clashes between Muslims and hardline Sinhala Buddhist groups. As witnessed since the attack, security will remain heightened in neighboring countries that are at risk of copycat attacks, such as the Maldives and India.


  1. Those operating or residing in Colombo on April 23 and in the coming days are advised to avoid nonessential outdoor travel within the capital and avoid any large gatherings.
  2. Avoid the immediate vicinity of all churches, mosques, or Buddhist temples in the country over the coming hours due to the risk of retaliatory attacks/further detonations.
  3. Given the targeting of religious sites, we advise to avoid the display of religious imagery and avoid overt or critical statements of any religious institutions both in public spaces and online, including social media.
  4. If traveling in the city, use only secure methods of transportation with vetted drivers.
  5. We advise allotting for disruptions to travel across Colombo over the coming hours, due to the heightened security measures and the likely establishment of vehicular checks and road blockades following the blasts.
  6. Given the reported heightened security measures implemented at the Bandaranaike International Airport (CMB), we advise allotting for extra-time to travel by air and reconfirm flight itineraries.
  7. Ensure when traveling that you have sufficient means of identification and can evidence if required, exactly where you are going.
  8. Allot for disruptions to communication due to the impact of curfew measures on social media access and messaging platforms.
  9. Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.
  10. Immediately alert authorities of any suspicious behavior or items. Ensure that places of stay are properly secured, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.
  11. Foreigners, particularly Westerners, should maintain a low profile, and exercise heightened vigilance in the vicinity of locales frequented by foreign, particularly Western nationals, including US and Western diplomatic missions and interests, due to the increased potential for militant attacks.
  12. If scheduled to visit the country, delay travel or reconsider nonessential stay until the situation stabilizes.
  13. For contingency plans and on-ground operational support, contact us at [email protected] or +44 20-3540-0434.

Car Ramming Attack on Parliament Illustrates the Continuing Impact of Declining Islamic State’s Ideology on Disenchanted Migrants – London Alert

Please be advised

At 07:37 (local time) on August 14, an individual drove a vehicle at speed towards a security barrier outside Parliament, Westminster, London. Three people were lightly injured and security forces immediately arrested the individual without further violence. The area was closed to the public for several hours while security forces determined that the vehicle posed no further risk and no weapons were inside.

The Met Police stated later on August 14 that the incident was being considered a militant attack and that the suspect was refusing to cooperate with investigations.

Reports from the morning of August 15 state that the individual is 29-years-old, originally from Sudan, living in Birmingham. Footage from the area reportedly shows the vehicle used in the attack circling Parliament several times before the incident took place.

Security forces reportedly carried out raids on residences in the central UK cities of Birmingham and Nottingham as part of the investigation into a supposed militant attack in London on August 14.

Location of militant incident in London on August 14

Click here to see Map Legend 


The suspect’s lack of resistance to being arrested and absence of weapons inside the car differentiate the incident from recent Islamist militant attacks. Therefore, while he may have been inspired by previous vehicular attacks, it remains unlikely that he had direct links with an Islamist group, such as Islamic State (IS). As with previous similar incidents, it is possible that the attacker was suffering from a psychological disorder, which played a role in motivating the attack.

With that, the raids in Birmingham and Nottingham may have been precautionary and do not necessarily indicate the assailants links to an established or well-coordinated militant cell. However, there is a possibility that the individual was part of a small locally radicalized cell of untrained individuals who subscribe to the ideology of IS.

Given the details released about the suspect, the incident reiterates the risk of incitement to commit attacks among migrant populations who perceive themselves to be disenfranchised. This risk is amplified among young males, who are generally far more susceptible to feelings of frustration over such sentiments and are also more likely to become self-radicalized. Furthermore, the incident underscores that, even with the decline of the Islamic State, the aftereffects of their ideology and modus operandi on the collective consciousness of the West, particularly among disenchanted migrants, continues to inspire attacks.

The incident also reflects the popularity of the vehicular method for those intending to carry out indiscriminate attacks, regardless of ideology. The popularity of the method stems from the ease with which attacks can be carried out and the difficulty for security forces to be warned before the incident

Despite the unlikelihood of the suspect being directly linked to an organized group, militant organizations, like IS, may attempt to claim responsibility or connection to the incident in order to increase perceptions of their threat in the UK and Europe in general.


Travel to London may continue while maintaining vigilance for possible militant related activity.

Alert authorities immediately to any suspicious behavior or items.

Lone-wolf attacks underscore threat from radicals in Europe, despite dwindling connections with militant groups – France Analysis

Executive Summary

The uptick in stabbing and vehicular attacks in France bears a strong resemblance to previous Islamic State (IS)-inspired and linked attacks.

This wave follows the August 22 call to action from IS leader, Abu Bakr al-Baghdadi, who asked supporters to “strike the West” and emphasized vehicular attacks in particular.

IS appears to have been particularly successful in radicalizing young Muslim immigrants in France.

Authorities are likely downplaying the militancy links in order to offset the increasing media attention surrounding such attacks.

Travel to France may continue while remaining cognizant of the increased threat of militant attacks. 

Current Situation

On September 14, a car-ramming attempt was recorded along Rue Racine in Nimes, southern France, during the early morning hours. The assailant reportedly intended to drive his car into pedestrians before being stopped by security barriers at around 01:30 (local time). The suspect was consequently subdued by locals in the area and later arrested by police. Reports quoting local eyewitnesses during the incident stated that the suspect shouted “Allahu Akbar”.

On September 10, an individual was detained for reportedly forcibly driving through multiple barriers and entering the runway of Lyon-Saint-Exupery Airport (LYS) in Lyon. The suspect was subsequently arrested following an extensive police pursuit. The incident caused significant delays and cancellations to flights. Following the arrest, a member of Lyon Prosecutor’s office reportedly stated that the assailant had alluded to a militant motive, claiming he was instructed to carry out the incident by Allah. However, this was later retracted.

The incident followed a September 9 stabbing attack in the 19th Arrondissement of Paris, when an assailant reportedly stabbed and injured at least seven people, including two British tourists, on Quai de Loire Street and Rue Henri Nogueres during the late night hours. The suspect was reportedly an Afghan national.

Authorities appeared reluctant to label all three attacks as being militant-related, calling the Nimes attack a “deliberate homicide”, and saying that the assailant who carried out the September 9 Paris stabbing attack did not appear to have militant motives. All three incidents were carried out by individuals of Muslim backgrounds and all three methods align with modus operandi that has been explicitly and repeatedly called for by the Islamic State jihadist group.


On August 22, the (IS) al-Furqan media released an audio recording of the group’s leader Abu Bakr al-Baghdadi, who called upon the group’s supporters to “strike the West” through stabbings, bombings, and vehicular rammings, particularly emphasizing the last method. Al-Baghdadi then stated that “one such attack equals one thousand attacks in the Middle East and North Africa”.

On August 23, an assailant killed one and injured two in a knife attack in Trappes, Yveline, located 26 km from central Paris. The attacker reportedly shouted ‘Allahu Akbar’ and threatened police officers who arrived at the scene, and was later neutralized. Shortly after, IS-linked media reported that the assailant was a soldier of the Caliphate and conducted the attack in response to the group’s calls to “target the coalition countries”, referring to the US-led coalition of states that orchestrated a number of airstrikes against IS strongholds in 2014. Following the 2014 offensive, an IS spokesman had specifically singled out France as a target for future attacks.

Assessments & Forecast

Series of attacks likely lone-wolf incidents inspired by Islamic State methods and ideology, even if not ordered by IS in Middle East

Despite authorities’ reluctance to label the above-mentioned incidents as being IS-inspired militant attacks, various factors indicate that they may, in fact, have some connection to the group’s ideology and professed methods. In particular, the assailants resorted to stabbing and vehicular attacks in locations with a considerable civilian presence, which, in recent times, have been IS-linked lone-wolf actors’ chosen modus operandi. The assailants also chose to indiscriminately target these civilians and intended to cause widespread harm.

The known profiles of the attackers, who belong to immigrant communities who widely follow Islam, and the chanting of ‘Allahu Akbar’ during the attacks in at least two confirmed cases, is consistent with the details from similar previous IS-linked attacks. This lends credence to the possibility that the attackers’ actions were informed by a religious and ideological motive, in addition, it is equally likely that psychological instability also played a part in their motivations.

The link to IS is also strengthened by Baghdadi’s specific emphasis on the effectiveness of vehicular attacks in the August 22 call to action, which in turn was likely precipitated by the April 2018 airstrikes carried out by France and other countries in Syria, in response to the alleged use of chemical weapons by the state. In this case, the call was rather a wider propaganda piece, which was answered, and there is no evidence to suggest that any of the attackers had specific contact with IS in the Middle East or had been in touch with handlers.

Attacks likely catalyzed by individual feelings of disenfranchisement within community, which benefit IS’ recruitment

Due to the targeted locations being distant from one another, and absence of uncovered network between the suspects, it is likely that the attacks were not related, despite being conducted in quick succession. However, the attacks point to the potential success of IS propaganda and recruiting in France. The group has emerged as a viable outlet for Muslims who feel alienated from the wider community, exploiting feelings of disenfranchisement by offering them an alternative, in terms of belonging to the larger radical Islamist community.

Particularly, feelings of alienation among Muslim immigrants have likely been heightened by government policies such as the 2010 ban on religious face veils and head coverings, seen as being exclusionary, which have consistently prompted a backlash from both minority communities and their supporters, as well as anti-immigrant groups. Domestic factors such as a high unemployment rate and job discrimination against Muslims, religion-based tensions, as well as the general political culture of government criticism, also continue to contribute to making the immigrant population more susceptible to radicalization.

As has been seen in the past, IS also provides a useful narrative to psychologically-disturbed individuals, who then carry out copycat lone-wolf attacks using IS modus operandi, seeking to capitalize on media attention surrounding the IS ideology.

Authorities seeking to minimize impact of attacks through reluctance to make militant connection to avoid further media attention for such groups

Further, it is notable that authorities have not indicated that any of the September attacks were militant-related, despite suggestions, as evidenced above, that the assailants were at least influenced by IS, if not directly linked. This reflects a reluctance to label such lone-wolf attacks as Islamist militancy, possibly to discourage the media narrative against, and resultant disaffection within, Muslim immigrant communities in the country.

This unwillingness to attribute the incidents to militancy could also be a result of a conscious government decision to reduce the inadvertent aiding and abetting of IS’ operations, as the group has been known to use such official statements after attacks to legitimize itself as a threat to the West. Additionally, the government could be seeking to avoid heightened criticism of its security policy, especially amid the current administration’s declining public approval ratings.

FORECAST: IS’ online presence and recruitment methods, in addition to the persistent domestic factors alienating the Muslim community in France, the global trend of young men using mass violence as an outlet for psychological frustration, and IS has tapping into this trend to further its agenda, makes it likely that further such attacks will occur in France over the coming weeks and months. Given the apparent shift in executive security policy towards mitigating the media clout of militant attacks in general, it is likely that authorities will continue miIslamist islamist motives in such attacks.


Travel to France may continue while remaining cognizant of the increased threat of militant attacks.

Recent Hizbul Ahrar militant activity highlights expanding nationwide sphere of operations – Pakistan Alert

Please be advised

On October 3, a police sub-inspector was killed in Ahsanabad area of Karachi by two unidentified assailants riding a motorcycle. The attackers reportedly opened indiscriminate fire, before fleeing the scene. Hizbul Ahrar (HuA), a splinter group from the Tehreek-e-Taliban Pakistan Jamaat-ul-Ahrar (TTP-JA), claimed the attack on social media. Authorities have yet to confirm the identity of the assailants, as well as the veracity of the claim.

On September 20, both the HuA and the TTP-Hafiz faction claimed a bomb blast against security forces in Spinwam, in North Waziristan, Khyber Pakhtunkhwa (KP) Province. The TTP and HuA both claimed an attack in Mastung on August 19, which was one of their earliest conflicting claims.

On June 2, the HuA claimed an attack against a paramilitary checkpost in Hub, Lasbela District of Balochistan, which lies at the border of Karachi, Sindh Province.

In May, the HuA claimed a suicide attack against a bus in Attock in Punjab Province, following which the Counter Terrorism Department (CDT) arrested five militant operatives on September 17 planning to carry an attack in Rawalpindi.

On January 12, the TTP claimed responsibility for the killing of a policeman in North Nazimabad area of Karachi.

Assessments & Forecast

The latest claim by the HuA is highly notable, given that it is the first such claim by the group in Karachi and in Sindh Province. The group has typically confined its operations to northern and western Pakistan, in provinces such as KP, Balochistan, and the former Federally Administered Tribal Areas (FATA), in which the outfit has increased its operations in recent weeks. The latest attack in Karachi, combined with the May attack and the arrest of five of its operatives in Punjab Province, is indicative of the group’s attempt to increase its sphere of operations and to push for a presence in major civilian centers such in Karachi and Rawalpindi.

Over the recent weeks, the HuA also appear to be increasingly challenging the factions of its former patron, TTP, by claiming attacks in TTP-held territories and by challenging the group’s claims. This was witnessed in the Spinwam attack on September 20, which occurred close to Data Khel, an area predominantly controlled by TTP factions. While Karachi has frequently witnessed attacks by TTP and its affiliates against law enforcement, the recent HuA attack of October 3 may be another indicator of the growing competition between the groups in a new sphere. It is also likely that HuA’s operations in Sindh and Punjab are aided by the defections of TTP-JA personnel to the new breakaway group.

The modus operandi used is notable given that HuA methods that primarily use suicide bombings or IED attack. Motorcycle-borne shooter attacks are more characteristic of Karachi-based militants and criminal elements, which may indicate potential cooperation between these elements and the HuA. Should HuA be adding newer modus operandi to their current tactics, there is a threat that such attacks may be replicated by its cells in other parts of the country. Additionally, while the group has previously stated that all attacks will focus on government targets over civilian, the indiscriminate nature of their plot execution increases the risk of collateral damage, as the attacks have taken place in civilian-populated areas. FORECAST: Over the coming months, the authorities are likely to conduct operations in Sindh Province and along the border areas with Balochistan, in attempt to dismantle potential HuA cells and prevent infiltrations from Balochistan and the Afghan border regions into Sindh.


We advise against all nonessential travel to Pakistan given the heightened threat of militant attacks, criminality, kidnappings and sectarian tensions throughout the country.

Throughout Pakistan, we advise [as part of our security consulting services] minimizing non-essential movement given the daily nationwide threat of militant attacks and violent criminality.

As a general precaution, maintain heightened vigilance in the vicinity of security detachments, government buildings, public areas, diplomatic installations, news stations, military bases, restaurants, high-value soft targets like schools, shopping centers, and religious centers including mosques as they remain potential targets for militant attacks.

Those operating or residing in Sindh Province are advised to maintain vigilance in light of the recent HuA plot and the potential for growing competition between militant groups in Karachi, which may result in an increase in plots over the near term.

Boko Haram’s abduction, subsequent release of 104 schoolgirls in Dapchi likely to increase group’s notoriety, legitimacy among locals – Nigeria Analysis

Executive Summary

Militants attacked a government school in Dapchi village, Burasari Local Government Area (LGA) in Yobe State and abducted 110 students and two other children on February 19.

Following extensive negotiations with the Nigerian government that resulted in the safe return of 104 of the schoolgirls and the other two children after one month in captivity, Boko Haram has been able to once again garner international attention and portray themselves as a viable threat in Nigeria’s northeastern region despite extensive counterinsurgency operations.

In light of the upcoming general elections in 2019, the girls’ safe return has been projected by President Muhammadu Buhari’s administration as a triumph, which seems to have paved the way for the government’s appeasement stance toward the insurgency.

However, the incident has highlighted the administration’s propaganda of exaggerated success against the militant group and is poised to create backlash in the form of domestic and international criticism for Buhari’s policies concerning the insurgency.

We continue to advise against all travel to the northeastern Nigerian states of Adamawa, Borno, and Yobe, given the ongoing Boko Haram insurgency and extreme insecurity in the region.

Current Situation

Militants attacked a government school in Dapchi village, Burasari Local Government Area (LGA) in Yobe State and abducted 110 students and two other children on February 19.

President Muhammadu Buhari issued a statement on February 24 expressing his concern about the abduction, claiming that the situation was a “national disaster”. On the same day, the opposition People’s Democratic Party (PDP) issued a counterstatement blaming Buhari for issuing exaggerated statistics suggesting that Boko Haram had been completely decimated, a situation that they claim put unsuspecting citizens in danger.

On March 12, Borno State authorities announced the closure of all boarding schools in 25 out of the 27 state’s LGAs due to the threat of Boko Haram militants conducting additional abductions. This came in wake of President Buhari’s decision to engage in negotiations for the release of the schoolgirls.

During the early morning hours of March 21, 106 abductees, including 104 schoolgirls and the two additional children, were dropped off in the middle of Dapchi by their captors, who also warned the locals against sending the girls to Western-style schools. While five of the remaining abductees reportedly died due to exhaustion, one Christian girl remains in the militants’ custody. The Nigerian government characterized the release as “unconditional”, though some sources citing locals indicate that authorities did free several militants who joined the kidnappers, while other sources suggest that the Nigerian government had paid a ransom to secure the girls’ release.

On March 23, while receiving the released girls in Abuja, President Buhari announced that his government was ready to grant amnesty to Boko Haram members who were ready to accept unconditional surrender.

Meanwhile, on April 1, at least 29 people were killed, including six militants, in a multi-pronged Boko Haram attack on Akikaranti, Bille Shuwa, and Bale-Galtimari communes surrounding Borno State capital, Maiduguri, coinciding with the Christian Easter holiday.

Boko Haram’s abduction, subsequent release of 104 schoolgirls in Dapchi likely to increase group’s notoriety, legitimacy among locals - Nigeria Analysis | MAX Security

Assessments & Forecast

Assessments: Following extensive counterinsurgency operations targeting Boko Haram strongholds, group attempts to reassert presence, garner international, domestic attention

Despite subsequent large-scale security operations targeting well-documented militant strongholds such as the Sambisa Forest and Lake Chad shores in Nigeria’s northeastern region, the militants successfully launched the well-planned abduction of the Dapchi girls. Indeed, this incident resembles Boko Haram’s April 2014 attack on a school in Chibok, Borno State, when 276 girls were kidnapped. The Chibok attack resulted in an extensive international outcry,  triggered by a domestic campaign started by the families of the Chibok girls. The #BringBackOurGirls movement put the Boko Haram conflict in the international spotlight, particularly when the former US First Lady Michelle Obama endorsed the campaign. In this context, the Dapchi attack was likely motivated by the prospect of achieving similar notoriety. Additionally, the attack came in response to security forces’ triumphant claims of the near-destruction of the militant group’s presence in the region. Through the Dapchi attack, the militants debunked such claims and reasserted their continued operational capabilities across the country’s northeast.

The Dapchi abductions rendered a successful outcome for the militants. While the federal government characterized the negotiations and the subsequent release of the hostages as completely “unconditional”, it contradicted local reports of the authorities’ release of several militants. Such conflicting reports align with previous allegations against authorities for releasing militants and paying ransom for militants, with the latest incident being the February 10 release of three lecturers from the University of Maiduguri, along with ten police officers abducted by Boko Haram last year. Under these circumstances, the suspected hefty ransom payment will likely be utilized by the militants to enhance and develop their operational capabilities in the region, which may have been hampered, to some extent, by the counterinsurgency operations.

Indeed, the government’s repeated payment of ransoms without any resistance is poised to encourage the militant group to carry out similar large-scale kidnappings. Such a concern was further emphasized by the Borno State authorities’ decision to shut down boarding schools across 25 of the 27 LGAs. Furthermore, the release of militants as part of the ransom payment reintroduces experienced and well-trained fighters to the ranks of the militant group, increasing their operational capabilities. This is further highlighted in the latest Boko Haram multi-pronged attack on April 1 that was reportedly coordinated by Shuaibu Moni, a top Boko Haram commander who was released by the government to facilitate the return of 82 Chibok girls in May 2017. Moni had previously appeared in a Boko Haram video on March 7 taunting the Nigerian security forces and threatening to launch additional attacks.

The theatrical grandeur of the return of the abductees as the militants drove into the center of Dapchi hailed as heroes by the local population for safely bringing back their girls was likely a symbolic attempt by the group to embolden its authority in the region. This sheds light on the militant group’s propaganda aimed towards gaining the locals’ trust and consolidate their influence in their areas of operation. As the militants shook hands with the locals and warned them against the return of the girls to schools for Western education, they compelled the latter to adhere to the militant group’s Islamist ideologies. Through the dramatic aspects of the event, the militants effectively portrayed themselves as legitimate actors in the region, with more control than the federal government in Abuja. Given the communities’ grievances against Abuja, as they continue to feel disregarded and neglected by the government, such an image of Boko Haram is poised to render the locals more susceptible to getting recruited by the militant group. Amidst the ongoing insurgency, these circumstances increase the possibility of better cooperation between the local communities and the militants, with the former providing shelter and engaging in economic transactions with the militants for their own survival.

Assessments: With 2019 elections nearing, Buhari makes strategic shift toward developing appeasement stance to overcome Boko Haram insurgency

Since President Buhari came into office in 2015, negotiations with Boko Haram in their kidnap-for-ransom schemes have become a recurring phenomenon, which includes the 2016 release of 21 Chibok girls and another 82 released in May 2017. Such a stance toward the militant group likely stems from large-scale international and domestic attention that these incidents received. Buhari has attempted to make good on his electoral promise of combating Boko Haram in contrast to the perceived failure of former President Goodluck Jonathan’s administration to effectively defeat the militant group. However, Buhari’s administration has also projected a stronger government resistance to the insurgency, which has led to a distorted perception of success over Boko Haram militancy in Nigeria. Continued militant attacks have highlighted the government’s propaganda in displaying exaggerated data regarding the success of counterinsurgency operations and falsely claiming the defeat of the militant group. This may, to a certain extent, reduce Buhari’s international and domestic credibility.

With Nigeria’s presidential elections slated to take place in 2019, such an approach by Buhari for the safe release of abductees is poised to become his legacy. To further add to his administration’s successes against the insurgency, following the Dapchi events, Buhari appears to have embarked towards an appeasement stance with the latest amnesty deal. It is likely that through these propositions Buhari seeks to strategically portray to the international community his efforts for a peaceful resolution in parallel to the continuation of counterinsurgency operations. Under these circumstances, it is likely that Buhari will attempt to negotiate with the militant group to reduce attacks in exchange for reduced military actions in the northeastern region.

However, the administration’s conciliatory attitude towards the militants may be perceived by some as weak, with negative implications particularly by security forces, which may have a  detrimental impact on the fighting morale of the soldiers who are endangering their lives in battle. FORECAST: As such, any attempts by Buhari to negotiate with the militants to reduce attacks in light of the upcoming elections, as well as the latest amnesty deal, may add to Nigeria’s security agencies’ frustration concerning the ongoing nine-year long insurgency and weaken their determination to actively combat it. Additionally, Buhari’s administration is poised to receive substantial criticism from opposition political parties for their weakened stance towards the insurgency and their propaganda of exaggerating military successes, as evidenced by the opposition People’s Democratic Party’s (PDP) statement denouncing the Dapchi deal.

FORECAST: Buhari’s latest amnesty deal offered to Boko Haram is quite similar to an opportunity offered by former President Jonathan in 2013, which Boko Haram’s leader Abubakar Shekau outright declined. As such, it seems unlikely that Boko Haram will accept the latest deal, particularly given that the government does not seem to have any substantial negotiating leverage. Furthermore, the latest April 1 multi-pronged Boko Haram attack continues to highlight that the group remains capable of executing sophisticated large scale attacks in their traditional sphere of influence. Given the group’s resilience in remaining a viable threat in Nigeria’s northeastern region despite the large-scale counter-militancy measures, a persistence of the conciliatory approach by the government is liable to be detrimental to their interests.


Travel to Lagos, Abuja and Port Harcourt may continue while maintaining heightened vigilance and following heightened security protocols regarding criminal and militant activity.

We continue to advise against all travel to the northeastern Nigerian states of Adamawa, Borno, and Yobe, given the ongoing Boko Haram insurgency and extreme insecurity in the region.

We advise to avoid all travel to areas of Nigeria, Niger, Cameroon, and Chad within the Lake Chad Region given the high risk of militancy.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security – Spain Analysis


During the afternoon hours of August 17, Spain experienced its first Islamic State claimed attack as a van plowed 500 meters into a crowd of people on the busy La Rambla street in central Barcelona, leaving 13 people killed and over 100 injured. The incident was subsequently claimed by the Islamic State who wrote that it was carried out by “soldiers of the Caliphate in Spain” and was intended to kill “Crusaders and Jews”.

Afterwards, during the evening hours of August 17, police located a second van in the town of Vic (80 km from Barcelona), which was hired at the same time as the van used in the initial attack, and was suspected to be a getaway vehicle.

At around 01:00 (local time) on August 18, a second car ramming incident took place in the city of Cambrils, around 100km southwest of Barcelona, in which one person was killed and six others injured. The attackers attempted to flee the vehicle on foot, allegedly wearing fake suicide belts before all five were killed by police.

More importantly, however, were the events that took place during the evening hours of August 16, less than 24 hours before the first car ramming incident. At this time, a large explosion was recorded in a small house in Alcanar, 160 km southwest of Barcelona and approximately 300 km from Ripoll. A police report, which was later released indicated that the occupants had been preparing a TATP-based explosive device, despite the blast initially being dismissed as a gas leak. The house was reportedly filled with over 100 canisters of propane and butane. Furthermore, sources indicate that the device being prepared in the house may have been intended to target Barcelona’s famous Sagrada Familia church.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Click here to see Map Legend 

Building the Terror Cell

Current reports suggest that the individuals involved in the attack all came from the area around the town of Ripoll, around 90 km north of Barcelona. Particularly, it appears that Abdelbaki Es Satty was the imam in Ripoll and is believed to have been instrumental in the radicalization and encouragement of the other seven younger individuals in carrying out the attack. Es Satty had been the imam since 2015 in Ripoll; however, he allegedly left “abruptly” in June 2017, and is suspected of using the time to start planning a militant attack.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

From 2010-2014 Es Satty served a four-year prison sentence in El Castellon, for a series of drug trafficking charges. It was during this time that he met and became friends with Rachid Aglif, who is serving an 18-year sentence for his role in the 2004 Madrid Train Bombings. Es Satty was also implicated in an operation in which he was involved in recruiting five individuals attempting to travel to fight in Iraq in 2006.

Other than Es Satty, the cell itself was built of young men of Moroccan heritage between the ages of 17 and 24-years-old. Reports indicate that all of them were born in Morocco and came to Spain at various times, all spending time or living in the town of Ripoll, where the cell appears to have been formed. Apart from Es Satty, there is no evidence to suggest that the other cell members had criminal records and no reported relations to other known radicals or militant networks. That said, a number of the members were reported posting increasing material on social media which pertained to topics typically associated with Islamism, including posts which spoke about the death of “infidels”, and contained excerpts of anti-Semitism common among radical Muslims.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Assessments & Forecast

Attack underscores emerging threat of homegrown cells in Europe

This attack is notable for numerous reasons, as despite the eventual act seeming to fit within the general pattern of attacks types (i.e. vehicular ramming) witnessed in Europe over the past year, it had the potential to be one of, if not the, deadliest, most damaging, and symbolic militant attacks by any group in Europe in years.

In this context, the incident on La Rambla on August 17 was clearly not the initial plan of attack. The connection between the attackers and Imam Es Satty, who was killed in the Alcanar explosion, as well as the almost immediate action following the explosion paints a clear picture that the explosives in Alcanar were meant to be used by the cell in a spectacular attack, and that the two eventual incidents were taken as a “plan b” method. Indeed, the use of fake explosive belts are indicative of a degree of organizing such a “plan b” approach. Furthermore, it is likely, given the speed with which they were carried out following the explosion on August 16, that the car ramming attacks were expedited in an attempt by the cell to carry out an attack before police investigations into the explosion foiled their plans and led to their arrests.

More telling, however, is the nature of the cell involved and what it says about the evolution and variety of threats from such militants in Europe. Indeed, we have seen that attacks range from Islamic State and copycat-inspired “lone wolf” attacks to much more organized and planned attacks, at times involving instructions from a central organization, such as the case in the Bataclan attack in Paris and the Brussels Airport attack. It is also important to note, that the lone-wolf attacks in and of themselves can range in death toll from one or a few dead from a stabbing, to scores killed in the Orlando night club shooting or Nice vehicular attack, two of the deadliest, yet simpler attacks by IS supporters.

The recent London Bridge and Boroughs Market attack was a new evolution along the range of lone-wolf Jihadist spectrum, as it involved a group of lone wolves cooperating with one another to form a cell. While the structure and formation of the London attack is not entirely clear, it appears that those involved were self-radicalized but connected to one another either by their own volition, namely via Jihadist messaging channels or were introduced to one another through such a channel or otherwise. That said, these individuals do not appear to have been organized by a central body or particularly experienced individual.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

The attack in Barcelona, for its part, appears to fall into the category of a “Homegrown Cell”, which has been rare in recent years. The origin of a homegrown cell can vary significantly and can be constructed by one radical and charismatic figure acting alone, such an individual working on behalf of a known group, or by a radical Islamist who has a connection to a known group to one degree or another but was not instructed by them.

In the case of the Barcelona cell, Abdelbaki Es Satty was the likely facilitator and builder of the cell. His recruiting background portrays him as someone with an understanding of the process of identifying targets for potential recruitment and likely having the personality to influence others in such a way. Additionally, he likely developed a greater familiarity with various terrorist techniques and principles during through this relationship with Rachid Aglif. We assess that Aglif and the attack he was involved in, in which 192 people were killed, served as an inspiration for Satty.

Beyond that, it is unclear if he did have guidance or instructions from Islamic State although the speed by which Islamic State released the official claim of the attack, may indicate their prior knowledge of his plans.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Homegrown cells allow for greater reach, more sophisticated, destructive attacks

While the individual “lone wolf” attack has the benefit of being much more challenging to predict and thwart, given that it involves only one individual and minimal planning, they are less likely to have as high of an impact as more organized attacks. Other than rare cases, such as Nice and Orlando, the majority of “lone wolf” attacks only involve a small number of casualties before the attacker is neutralized, even in the case of more advanced lone-wolf attacks, such as in London. On the other hand, while a cell composed of more trained and experienced Jihadists is able to carry out highly effective and destructive attacks, due to their expertise and manpower, the accumulation of many affiliated militants, in one area, alongside their communications and activities, is far more likely to arouse the suspicion of security forces and risk being thwarted.

In that regard, the Ripoll cell is an interesting balance in that it can balance the low-key nature of a lone wolf group with the greater planning and organization of a more advanced Jihadist cell. Islamic State can select known and trusted individuals online, or returning foreign fighters, and instruct them on the formation of a homegrown cell, and in some cases lend them material support or connect them with other experienced or useful individuals.

The Spanish cell was able to plan and almost execute what could have been one of the most significant European attacks, without being thwarted by security, because although they were many in number, their relationships seemed organic enough not to arouse suspicion and the fact that the more suspicious activity they did was conducted in a remote location and not in their home environment.  This allowed them to prepare a highly sophisticated attack plan, with multiple layers and back-ups, without outwardly appearing to be a militant cell.

Further attacks from similar cells should be expected across Europe

While the possibility of typical “lone wolf” attacks remains throughout the world, particularly in Europe and the West, the homegrown cell phenomenon is likely to become more common than previously witnessed. Given that IS have penetrated almost every country in Europe and have propaganda and media communications in most major languages it is likely that there are already similarly structured cells across the continent, built of local radicals bound together by online facilitators or one local IS-affiliate or even one individual who has a greater degree of exposure to Islamist methodologies. Additionally, as seen in the past, the “copycat effect” is likely to take hold, with similar cells conducting attacks in the coming months.

Furthermore, IS regularly encourages attacks throughout the continent and adjusts their instructions to the successes of previous attacks. In this context, it is highly likely that Islamic State, whether involved in the Barcelona attack or not, will learn from its successes and failures.

Thus, and as IS continues to lose territory in the Middle East, and tends to want to balance these losses with an appearance of being a global phenomenon, we assess that Islamic State may actively seek to ‘activate’ such cells in Europe. In this way, the organization will likely want to have more control over how, when, and where an attack will take place, and may currently be reaching out to foreign fighters who returned to Europe, or other connections they may have, in order to encourage them to build their own homegrown cells.

Furthermore, Islamic State will likely learn from the failure of being over ambitious. Es Satty likely looked up to Rachid Aglif and his involvement in the deadly Madrid attacks from 2004, and in seeking to match its casualty level, chose to develop an extremely large explosive device by a large number of terrorists rather than launching an attack earlier and at a lower capacity. With this, we expect that IS will encourage smaller attacks by smaller homegrown cells, but ones that have a far greater potential for success.


On the corporate level

We advise raising the awareness of employees and security personnel to unusual activity and behavior of fellow employees. Encourage your employees to report such observations whether at work or in their personal surroundings. Monitor local unusual developments in order to predict emerging threats in the vicinity of your interests, and follow the global terror trends and modi operandi, in order to adapt your security measures and preparations. Conduct surveys to check and evaluate the relevancy of your current security protocols.

On the institutional level

Additionally, identify the social groups and communities in your area that are more susceptible to radicalization, identify the leading individuals, and monitor their activities. Raise the public’s awareness regarding key indicators of unusual activity.

For more information about the terror threat in Europe and what you can do to be prepared, check out our white paper here. 

Strategic Analysis: Consequences of religious influences in the Syrian conflict

Shiite Muslims commemorate the Ashura holiday, the date marking the death of Hussein at the Battle of Karbala.

While discussing the bloodshed in Syria at a September 7 conference held in Turkey, Prime Minister Erdogan drew a chilling parallel. “What happened in Karbala 1,332 years ago is what is happening in Syria today,” he said, comparing the Syrian revolution to the most divisive event in Islamic history, the Battle of Karbala.

Those in the West with any interests in the region have much to learn from Erdogan’s history lesson. What was originally depicted as a popular uprising against tyranny is now undeniably a war for religious supremacy in the Middle East. In this war, those Syrians who originally took to the streets in their aspirations for democracy have become the only guaranteed losers.

In the year 680 AD, Hussein Ibn Ali, grandson of the Prophet Mohammed and 70 of his followers confronted 1,500 fighters from the Umayyad Caliphate in present day Iraq. Hussein had embarked on a crusade to wrest control of the caliphate from his archrival Yazid I, only to be slaughtered along with his family. Hussein’s followers would eventually form the Shiite sect of Islam, and remain locked in a bitter rivalry with Yazid’s fellow Abu Bakr supporters, whose descendants comprise the Sunni sect.
Continue reading Strategic Analysis: Consequences of religious influences in the Syrian conflict

Political Analysis: Israel Looking East

In 1992, Israel broadly expanded its international relations, taking advantage of the fall of the Soviet Union’s Iron Curtain. Notwithstanding, improving ties with the eastern powerhouses of China and India was not a primary focus up until few years ago. Recently, Israeli leaders have made successive high profile visits to China, while engaging in considerable public diplomacy efforts vis-à-vis the Chinese people. Prime Minister Benjamin Netanyahu even greeted the Chinese people in their native Mandarin during their New Year’s Festival.

The growing cooperation with China is based on bilateral agreements in the fields of technology, green energy, agriculture, and water conservation. Enhancing relations with China in these fields is exactly how Minister of Trade and Labor Shalom Simchon planned for Israel to become one of the world’s top-15 economies. Simchon underlined that a Free Trade Agreement with China is currently on the agenda and is expected to be agreed upon in the foreseeable future.

India makes for a natural ally of Israel given joint challenges

Continue reading Political Analysis: Israel Looking East

Strategic Analysis: Don’t Hold Your Breath For Iran Sanctions

On July 25, in a rare public acknowledgement, Iranian Supreme Leader Ayatollah Ali Khamenei shed light on the detrimental impact of international sanctions on Iranian society. During a meeting with President Mahmoud Ahmadinejad and his political rival, Speaker Ali Larijani, Khamenei called for an end to infighting over Iran’s deteriorating economy, stressing the need for national unity.” The reality is that there are problems, however you must not blame them on this or that party,” Khamenei was quoted as saying by Fars News Agency.  “Instead you must solve those problems with unity.”

Iran has continued its nuclear progress despite sanctions.

Pundits and politicians in the West should be in no rush to laud this admittance as a sign that the Iranian regime’s resilience in pursuit of nuclear capability has begun to waver.  For those in Jerusalem grappling with a historic decision, sanctions have failed to achieve their baseline goal- suspension of the Iranian nuclear program. Continue reading Strategic Analysis: Don’t Hold Your Breath For Iran Sanctions

Intelligence Analysis: The Syrian Spillover into Lebanon

A Sunni gunman fires his machine gun during clashes in northern Tripoli (AP)

Nine Lebanese were killed after days of clashes in the northern Lebanese city of Tripoli between long-time bitter foes, the Sunni dominated Bab al-Tabbaneh and the Alawite Jabal Mohsen neighborhoods. Clashes and tensions in Tripoli are not new and represent persistent volatility in Lebanon, as well as in the region, both in terms of politics and security.

The Sunnis of Bab al-Tabbaneh, a hotbed of Salafism, denounce the ‘heretic’ Alawite regime of Assad and decry his killing of their fellow Sunni-Muslims in Syria. The tiny, yet well- armed, Alawite community of Jabal Mohsen however, remains a steadfast supporter of the Syrian president. With just a single street, ironically named the Syria Street, separating them, the current escalation highlights not only a localized  spillover of the Syrian war into Lebanon, but the overarching problem with Lebanon itself – the continued presence of sectarian militias.

Continue reading Intelligence Analysis: The Syrian Spillover into Lebanon