Hot Issue: How DAESH’s Lone Wolf Guidance Increases the Group’s Threat to the United States

Executive Summary

On October 18, 2015, a DAESH promoter posted a 63-page English-language manual entitled Safety and Security Guidelines for Lone Wolf Mujahideen on Twitter. [1] Reportedly, three former members of Saddam Hussein’s intelligence service now with this jihadist organization in Raqqa, Syria, produced the document, which was adapted from an older al-Qaeda online Arabic language course. [2] The new manual advises clandestine small-cell and individual jihadist terrorists operating in Western countries on how to maintain security. Although these guidelines are based on al-Qaeda doctrine and tactics, they have been updated to include the latest technology and thinking. With the manual’s publication, DAESH has demonstrated its intention to create a new hybrid war weapon in its arsenal against the United States—a hidden weapon designed to be difficult to trace operationally back to the jihadist organization or to detect before an operation is executed. In the wake of the DAESH attacks on Paris on November 13, 2015, the United States and other English-speaking allies would do well to consider the instructions contained in this terrorist manual as another significant warning.

Introduction

DAESH and al-Qaeda both claim the same Salafist-Jihadist ideology, and the leaders of both organizations have often called for attacks inside the United States. The two groups also share many of the same terrorist and small-group guerrilla tactics. However, before the terrorist attacks in Paris on November 13, one of the key differences often noted between DAESH and al-Qaeda was the former’s strategic priority on the “near” enemy, while al-Qaeda is known for its attacks on the United States and its European allies, which are considered “far” enemies. After Paris, that distinction between al-Qaeda’s and DAESH’s strategic targets is no longer valid, if indeed it ever was.

Although al-Qaeda today engages mainly in regional insurgencies and terrorism against the near enemy, it has always asserted that attacking and actually defeating the United States is inseparable from achieving victory in the greater Middle East. In keeping with this strategy, al-Qaeda has consistently attempted to attack the U.S. homeland. Al-Qaeda has also promoted what has become known popularly in North America as random “lone wolf” and “home-grown” terrorism, but is closer to the theories espoused by jihadist strategist Abu Mus‘ab al-Suri for establishing small clandestine sleeper cells in enemy countries. [3] Selections from al-Suri’s writings were translated serially in al-Qaeda in the Arabian Peninsula’s (AQAP) online magazine Inspire, which became infamous as a training aid to the Tsarnaev brothers for their April 15, 2013 Boston Marathon attack. [4]

Most DAESH attacks on U.S. citizens and interests in the Middle East have been opportunistic. Analysts and policymakers have therefore tended to see the organization as focused mainly on the near enemy, such as the governments, people and other jihadist groups of Syria and Iraq, despite its occasional call for attacks on the far enemy such as France, the United States or the UK. The prominent al-Qaeda online pundit, Abu Sa‘d al Amili, however, dismisses the usual discussion about these two types of enemies (Militant Leadership Monitor, October 2013). As early as 2010, he argued that the near enemy is part of the concept of the far enemy, and the two concepts depend upon one another in a “dialectical” relationship. [5] Based on his argument, DAESH probably always intended to attack the “far enemy” when the time was judged right for such an attack, which was after they established an Islamic emirate in the heart of traditional Muslim lands, not before as in al-Qaeda doctrine. DAESH has also unilaterally declared its emirate to be the caliphate for all Muslims, which has strengthened its ability to recruit adherents beyond the territory it holds.

Now, with the online publication of the English language manual, Safety and Security Guidelines for Lone Wolf Mujahideen, DAESH may have turned the concept of the near enemy on its head. [6] By adapting al-Qaeda’s doctrine of individual and small cell terrorism to its own strategy, DAESH may be laying the groundwork for terrorist attacks within the United States, Canada and other English speaking countries using local recruits—for whom the United States is the near enemy. In short, they appear to be planning to attack their main far enemy, the United States, under the operational cover of home grown attacks by Americans or Canadians, instead of sending individual terrorists and small groups to fight against the United States and its allies from overseas.

Safety and Security Guidelines

The new security manual’s title indicates that it is intended for lone wolves in English speaking countries. However, the “translator’s forward” clarifies that his small book is intended for “lone wolf mujahideen and small cells.” [7] He also points out that the work was originally entitled Course on Security and Intelligence, which al-Qaeda prepared for traditional jihadist groups. The author has adapted the original for the occasional lone wolf and clandestine small cells in the West, whose attacks could differ significantly from the Paris attacks. For example, the killers in Paris appeared to expect to end their attacks in suicide, either by detonating suicide vests before capture or by what is sometimes called suicide by police. Although many recruits are drawn to DAESH as a religious death cult, this manual urges clandestine “brothers” to stay alive to continue operations. As the author points out: “A lot of the brothers come here and their only concern is how they are going to get killed.” He goes on to provide a religious justification for surviving to fight on and cites a basic rule not heard from those who promote suicide operations: “Individual safety is more important than the operation.” [8]

Many of the basic guidelines offered to clandestine cells in the West are universal rules well known to national intelligence, police and military services worldwide. For example, constant vigilance against host country security must be paramount; prevention through planning is better than trying to fix mistakes after the fact; clandestine actors must avoid negligence and not succumb to crippling paranoia; cells must practice information security on a strict need-to-know basis; mistakes come in groups, as one begets another; and sound security practices, such as varying everyday routines, must be faithfully adhered to. [9]

The manual also covers how to devise a cover story; how to set up and maintain safe houses; how to hold meetings safely or attend conferences without revealing one’s intentions; how to maintain weapons security and safely transport weapons and other operatives; and how to perform surveillance of a target and detect surveillance by others. Covert operatives are cautioned to be wary when recruiting members to a cell and to use family members or individuals with whom they have a lifelong acquaintance. Covert operatives should not keep weapons or incriminating documents in their homes. The security advice is specific. Individuals should disguise their Muslim identity by wearing a Christian cross. Clandestine jihadists should make sure they have no Quran apps on their cellphones, no prayer beads and no beard. They are also counseled to shave a beard well before going operational so that an individual’s face will be of one color. They should dress in harmony with their surroundings. They should stay away from mosques. In general, operatives must blend in with their surroundings and not draw attention to themselves in any way. Clandestine operatives should always use encryption online. The author goes on to name specific apps and operating systems that operatives should not use because they have been “compromised” while recommending other apps and devices; the author advises would-be jihadists to study certain computer protocols and generally keep up to date on the latest technology. [10]

The manual’s clearest message is that the United States and its allies, like Canada, have extremely competent security and intelligence services that routinely uncover clandestine groups within their countries. Without vigilance and operational and information security, any cell should expect to be discovered. The security guidelines are timeless, and “any brother working in covert operations” should follow them. [11] Furthermore, in a “unipolar world,” groups cannot expect to perform an operation in a country like the United States and return to a safe haven as they could have done during the Cold War. In the current environment, the clandestine individual cell is more effective than a group with a pyramidal structure. Cells, moreover, should not have any contact with or knowledge of other cells in a given country, so that discovery of one cell does not lead to discovery of others.

Despite this manual’s title (Safety and Security Guidelines for Lone Wolf Mujahideen), it is likely not intended for the true lone wolf. Abu Mus‘ab al-Suri’s theories, on which most of the manual is based, begin with the lone wolf, but argue that while lone wolf attacks may raise jihadist morale, they do not move toward a useful political outcome. To be effective, clandestine terrorists need to be connected to jihadist goals and doctrine, but unconnected organizationally from anyone except members of their own cell. Ideally—according to al-Suri but not mentioned in the manual—one individual builder unit would create a number of operational cells in a given country, providing them with rudimentary training and perhaps some funding. [12] Only the builder knows about the cells’ existence and location, and he would instruct them to start operations only after he has departed the country in which they reside. There could also be a propaganda cell, which has no direct connection with the operational cells and could even be located in another country.

Conclusion

The known clandestine cell that most closely approximates the intended audience for this security manual is that of the Tsarnaev brothers, who were behind the 2013 Boston Marathon bombing. The major difference is that the Islamic State clearly wants their clandestine proxies to be able to survive to fight another day and, therefore, spend as much time designing an exit plan as they do designing the operation itself. The manual instructs its audience to read AQAP’s English magazine Inspire, much like Tamerlane Tsarnaev. The magazine has instructions about bomb making and al-Suri’s theories, both beyond the scope of the Islamic State manual. The manual also recommends reading Dabiq, the magazine in which the Islamic State publishes propaganda and policy goals along with regular criticism of al-Qaeda’s current leadership. Nevertheless, a potential clandestine jihadist terrorist in the United States does not have to choose between al-Qaeda and the Islamic State in order to serve the latter group’s purpose. Clearly, creating such cells at long distance is extremely difficult, but the Islamic State has signaled its intention to try because such cells are so hard to detect before they act. Thus, the challenge to U.S law enforcement, intelligence agencies and the general public, ideally working together, is clearly laid out in this latest jihadist manual.

Michael W. S. Ryan is an independent consultant and researcher on Middle Eastern security issues and a senior fellow at The Jamestown Foundation.

Notes

1. DAESH is the abbreviation of al-Dawla al-Islamiya fi al-Iraq wal-Sham, the Arabic name for the group referred to as the Islamic State, the Islamic State of Iraq and the Levant or the Islamic State of Iraq and Sham. DAESH is the Arabic acronym equivalent of ISIS in English.

2. See John Rossomando, “New Islamic State Document Shows U.S. Still In the Crosshairs,” IPT News, November 9, 2015, https://www.investigativeproject.org/5021/new-islamic-state-document-shows-us-still-in#.

3. For a description of al-Suri’s theory of “individual and small group terrorism,” see Michael W. S. Ryan, Decoding Al-Qaeda’s Strategy: The Deep Battle Against America, (New York: Columbia University Press, 2013), pp. 235-251.

4. Michael W. S. Ryan, “Hot Issue: The Boston Marathon Bombing: Radicalization Process and the Tsarnaev Brothers,” May 9, 2013, https://www.jamestown.org/programs/hotissues/single-hot-issues/article_id=40849&tx_ttnews%5BbackPid%5D=593&cHash=fe630860336b711ee10cd88888fbd866.

5. See Abu Sa‘d al-Amili, “The Reality and Future of the Jihadi Current” (Waqi wa Mustaqbal al-Tayyar al-Jihadi), (Minbar al-Tawhid wa’l-Jihad website, 2010/2011). The author dated the composition November 7, 2010, but the website simply gave the date as simply 2011. Citing different dates probably reflects the lag between the author completing the clandestinely produced article and its publication on the openly available jihadist website. In context “regional jihad” (jihad qutri) refers to a country-based clandestine insurrectionist group fighting the government while “global jihad” (jihad alami) refers to its networked international counterpart fighting the United States and its allies, some of whom are local.

6. See MEMRI, “Cyber and Jihad Lab”: https://cjlab.memri.org/lab-projects/tracking-jihadi-terrorist-use-of-social-media/safety-security-guidelines-for-lone-wolf-mujahideen-distributed-on-twitter/; or The Site Intelligence Group, https://news.siteintelgroup.com/Jihadist-News/jihadist-publishes-english-adaptation-for-lone-wolves-of-al-qaeda-security-expert-s-audio-series-on-security.html. The document has also appeared on a number of jihadist websites after the Twitter account in which it first appeared was taken down because of its content. Site Intelligence Group identified the author of the al-Qaeda lecture series.

7. SITE, op. cit.

8. Ibid.

9. Ibid.

10. Ibid.

11. Ibid.

12. Michael W. S. Ryan, op. cit.