[Hot Issue] Recent Attacks Illuminate the Islamic State’s Europe Attack Network

The recent major terrorist attacks in Paris and Brussels represent a watershed moment not just for the Islamic State (IS), but for the entire jihadist movement. The attacks mark the first time that a single jihadist network has succeeded in carrying out two separate mass casualty attacks in Europe. In the past, when jihadist networks struck in Europe, they were pursued with the full weight of European security and intelligence services and all relevant perpetrators were neutralized before they could mount a second attack.

IS’s successes are the result of a complex strategy executed by officials in the Amn al-Kharji, a shadowy wing of IS’s bureaucracy responsible for selecting and training external operatives and for planning terrorist attacks in areas outside of IS’s core territory, including those within European borders. This article delves into the structure of IS’s external operations branch and explores this branch’s strategy and on-the-ground network in Europe.

The Amn al-Kharji

Although IS’s attacks and plots in Europe have received a great deal of media attention, the Amn al-Kharji has largely stayed out of the spotlight. This aversion to publicity is deliberate, and demonstrates the Amn al-Kharji’s strategic importance to IS. While IS’s military branches in Syria and Iraq readily advertise their exploits, the Amn al-Kharji is shrouded in secrecy, sometimes employing disinformation to mislead intelligence agencies. Nonetheless, enough information now has emerged in open-source reporting to paint a picture—however incomplete—of the Amn al-Kharji.

The most detailed information on the Amn al-Kharji comes from an interview that an IS defector, known only as “Abu Khaled” (The Daily Beast, November 15, 2015). According to Abu Khaled, the Amn al-Kharji is one of four agencies that fall under IS’s amniyat, or security apparatus. The other three agencies are the Amn al-Dawla, which is responsible for internal security within IS’s territory; the Amn al-Dakhili, which is akin to an interior ministry; and the Amn al-Askari, or the military intelligence wing. Abu Khaled, a former member of the Amn al-Dawla, explained that the Amn al-Kharji was responsible for conducting espionage and terrorist attacks in enemy territory, and that the agency had developed intricate tactics enabling its operatives’ infiltration. Indeed, long before the Amn al-Kharji put its attack plans for Brussels and Paris into motion, the branch spearheaded operations behind enemy lines in Syria and Iraq. By the time IS began investing serious resources in European operations, the Amn al-Kharji had already refined its tradecraft for attacks outside IS-controlled territory.

Abu Khaled’s testimony sheds light on key players within the Amn al-Kharji’s opaque structure. According to Abu Khaled, Abu Muhammad al-Adnani, IS’s chief spokesman and one of the organization’s top officials, appoints the commanders of each of the amniyat’s (security services) four branches. Other reports have identified the Syria-born Adnani as the operational commander of the Amn al-Kharji (The Hindu, February 9). However, given Adnani’s role in managing multiple agencies within IS, it is highly likely that his position in the Amn al-Kharji is largely bureaucratic in nature. That is, Adnani likely signs off on external operations, but is not involved in operational planning.

Rather, responsibility for directing IS’s external operations falls to an elusive figure known only by his kunya (nom de guerre), Abu Sulayman al-Faransi. Despite his prominent role in IS, little personal information about al-Faransi is available. It is believed that—as his kunya suggests—Faransi is a French national. According to French sources, he now resides in northern Syria with his wife—also a French national—and two children (TTU, April 18). Reports allege that al-Faransi was promoted to external operations chief following the Paris attacks, suggesting that the Frenchman was rewarded for overseeing one of IS’s most high-profile attacks. Al-Faransi’s name also surfaced in investigations into the Brussels attacks. Belgian authorities investigating the contents of a computer owned by Ibrahim El Bakraoui, one of the two suicide bombers who struck the Zaventem airport, concluded that Bakraoui had been in contact with al-Faransi, and that other cell members may have been, as well. Bakraoui had submitted attack plans to the Frenchman (TTU, April 18).

Below al-Faransi in the Amn al-Kharji are the theater commanders, responsible for planning operations in various regions that IS wants to target. Theater commanders are perhaps the most pivotal actors in IS’s external operations structure, as they serve as a bridge between strategic planners and tactical operators. Several individuals have emerged as possible theater commanders—though it is not clear how many such positions exist within the Amn al-Kharji—and it appears that IS appoints theater commanders who originate from the regions over which they are given authority.

For instance, IS’s external operations in Southeast Asia are likely led by Bahrun Naim, an Indonesian militant now based in Syria who was responsible for coordinating the January 2016 attacks in Jakarta (The Sun Daily, April 3). IS has also likely appointed theater commanders for external operations in both Turkey and North Africa, though it is not clear who currently holds these positions. [1]

The theater commander for Europe is believed to be Salim Benghalem, another French national whose involvement in jihadism predates IS’s emergence. Benghalem became radicalized in a French prison when serving an earlier sentence for attempted murder. He soon fell in with a network commonly known as the Buttes-Chaumont group, a Paris-based jihadist network involved in recruiting individuals to fight against U.S. forces in Iraq in the mid-2000s. This group also included Cherif and Said Kouachi, the brothers who carried out the Charlie Hebdo massacre in January 2015. In 2011, Benghalem and Cherif Kouachi traveled to Yemen, where they received training from al-Qaeda in the Arabian Peninsula (Agence France Presse, October 18, 2015).

Soon after traveling to Syria to join IS in early 2013, Benghalem was tapped to serve as a prison guard for several French hostages whom IS had kidnapped (Agence France Presse, October 18, 2015). Several former prison guards from this group have emerged as key actors in IS’s European external operations efforts. For instance, Mehdi Nemmouche, a fellow French national who guarded French hostages alongside Benghalem, returned to Europe and carried out an attack on the Brussels Jewish Museum in May 2014 that killed four. Naajim Laachraoui, a Belgian national who served as one of the suicide bombers at the Zaventem airport, had also been a guard (Le Point, April 25, 2016. Benghalem now outranks all of his former prison guard colleagues; indeed, he has become so influential that in October 2015, French planes conducted a rare targeted airstrike specifically aimed at Benghalem (The Irish Times, October 20, 2015).

As the theater commander for IS’s European operations, Benghalem oversees several commanders responsible for training operatives, and planning and coordinating operations at the ground level. These tactical commanders play a hands-on role in IS’s Europe operations, and sometimes even participate in attacks themselves. Given their more public role, these commanders often attract greater media scrutiny than their more discrete superiors.

Such was the case for Abdelhamid Abaaoud, who was killed by French authorities several days after the Paris attacks. In January 2015, Abaaoud deployed to Athens, where he directed a cell based in the Belgian city of Verviers that was disrupted when Belgian authorities intercepted telephone calls between Abaaoud and the plotters (Times of Change, November 16, 2015). Though the Verviers plot failed, Abaaoud may have learned a valuable lesson: relying on telephone communications to manage Europe-based cells was too risky. A woman who spoke with Abaaoud after the Paris attacks said that he had explained he traveled to Europe to “avoid the failure” of previous operations (The Irish Times, March 20).

Between the Verviers plot and the Paris attacks, Abaaoud spent his time training operatives and planning unsophisticated, low-cost operations in Europe. In the summer of 2015, Abaaoud trained Paris native Reda Hame and at least one other operative to carry out mass casualty attacks on soft targets in France and Spain. This plan was disrupted when authorities arrested Hame’s counterpart in Spain (Le Monde), November 16, 2015). Abaaoud was also in contact with Ayoub El Khazzani, who was tackled by passengers when he tried to open fire during an August 2015 train ride from Amsterdam to Paris. Khazzani never traveled to Syria, suggesting that, in addition to training operatives already in IS-controlled territory, Abbaoud sought to inspire radicalized individuals based in Europe to carry out attacks on their own.

While these small-scale plots distracted authorities, Abaaoud was planning the Paris attacks, his jihadist magnum opus. In a move uncharacteristic of a commander of his stature, Abaaoud traveled to Paris to oversee and coordinate the operation. Though there is little information on Abaaoud’s activities in Europe in the months and weeks before the Paris attacks, multiple news outlets reported that he traveled to the United Kingdom in the summer of 2015, possibly to case potential targets or to coordinate with other militants (France 24, January 11). Abaaoud then personally coordinated and participated in the Paris operations, dropping off one of the suicide bombers, opening fire on civilians in several different locations, and later driving to an area near the Bataclan and contacting militants inside the concert hall (BFMTV, November 25, 2015). Unlike the Verviers plot, Abaaoud was committed to personally seeing the Paris attacks through to completion.

Abaaoud seemingly planned additional attacks after the Paris massacre, but French authorities caught and killed him in a raid on an apartment in a Paris suburb. Though Abaaoud’s death eliminated one of IS’s most skilled external operatives, it is believed that IS quickly replaced him with Fabien Clain, a French convert whose voice was featured in the audio message in which IS claimed responsibility for the Paris attacks.

Clain boasts his own jihadist pedigree. He was deeply involved in French jihadist networks in the early 2000s, and in 2009 was sentenced to five years in prison for his role in recruiting French nationals to fight in Iraq (Le Monde, November 18, 2015). He traveled to Syria in early 2014, and even before he was promoted to fill Abaaoud’s position, Clain was involved in coordinating attacks in Europe. Clain likely served as the primary point of contact for Sid Ahmed Ghlam, a French Algerian who tried to carry out an April 2015 attack on a church in a Paris suburb, but instead made the humiliating decision to call police after he shot himself in the leg (Agence France Presse, November 23, 2015). Clain may also have played a minor role in the Paris attacks: in 2009, French authorities learned that Clain and several other French militants had discussed attacking the Bataclan, whose owners at the time were Jewish supporters of Israel (Le Monde, November 18, 2015). Clain may have suggested the Bataclan as a target for the Paris attacks.

The fact that IS was able to replace Abaaoud with a jihadist of Clain’s caliber indicates that the group possesses a deep and capable bench of experienced militants from Europe. But IS’s strengths extend beyond its experienced personnel. IS’s investment in external operations has allowed the group to build a robust infrastructure dedicated to training, planning, and conducting complex attacks outside of its own territory.

The Paris and Brussels Networks

A look at the networks involved in the Paris and Brussels attacks provides further evidence of the sophistication of IS’s external operations. IS utilized a networked approach in executing the two attacks. That is, the group built a vast network in Europe to prepare for the Paris attacks, with some militants serving in an operational capacity while others played a support and logistics role. That IS was able to sustain such a vast support infrastructure in Europe is itself striking, considering the challenges of evading European intelligence agencies. Even more remarkable is the fact that IS was able to keep its support network largely intact following the Paris attacks, and subsequently mobilize this network to strike again in Brussels just months later amid a heightened security atmosphere in Europe. This feat reflects both the magnitude of IS’s European network and the quality of its tradecraft.

The graphic above reveals the scope of the networks involved in the Paris and Brussels attacks. Abaaoud sits at the center of the network, attesting to his role as the overall coordinator of the Paris attacks. Another key actor is Khalid Zerkani, whom Guy Van Vlierden previously pinpointed as an integral jihadist player in the Brussels neighborhood of Molenbeek, a hotbed of militancy that has served as a safe haven for IS operatives (Jamestown Foundation Hot Issue, April 12). Though Zerkani—who has been sentenced to 15 years in prison for his role as a jihadist recruiter—was not involved in either the Paris or Brussels attacks, the foreign fighter recruitment networks he established from 2012 to 2014 have been at the center of IS’s ongoing operations in Europe. Several key individuals involved in the Paris and Brussels attacks, including Abaaoud, Naajim Laachraoui and Salah Abdeslam, are directly linked to Zerkani, as was Reda Kriket, who had amassed an “unprecedented” weapons arsenal and was in the final stages of operational planning when French authorities arrested him shortly after the Brussels attacks (Le Parisien, April 3, 2016 ).

IS operatives in Europe linked with Zerkani have also relied on other members of the Zerkani network as they sought to evade European authorities and plan future attacks. After the Paris attacks, Salah Abdeslam contacted Abid Aberkan, the nephew of Fatima Aberkan, who has been described as the “mother” of the Zerkani network (RTL, March 20, 2016). Abdeslam hid at the house of Aberkan’s mother, where he was eventually discovered and arrested (RTL, March 20).

The graphic also reveals the extensive overlap between the Paris and Brussels attack networks. Key individuals involved in providing logistical support for the Paris attacks rapidly transitioned to an operational role in Brussels. For instance, Naajim Laachraoui helped construct explosives for the Paris attacks before donning his own suicide vest in Brussels (Le Monde, April 23, 2016). Mohamed Belkaid, who was believed to have been in contact with several of the Paris attackers via phone, housed Salah Abdeslam while Abdeslam was on the run from Belgian authorities. Belkaid was likely involved in planning attacks with Abdeslam when Belkaid was killed by Belgian forces in a raid several days before the Brussels attacks (Le Monde, March 19). Mohamed Abrini is yet another individual who played a support role in Paris before mobilizing in Brussels; he rented an apartment that was used by several Paris attackers and later tried to plant a bomb at the Zaventem airport, though he failed to detonate his explosives (Brussels Times, April 22). This pattern suggests that IS’s strategy in Europe involves building dual-purpose cells that can be converted from a support to attack role in order to maximize the utility of its network.

A Professional Operation

The structure of IS’s Amn al-Kharji and the group’s tactics in the Paris and Brussels attacks make immediately clear that IS has fully professionalized its external operations. IS militants operating in Europe are well-trained and are commanded by veteran jihadists with years of experience. Indeed, IS’s activities in Europe are more akin to those of a state sponsor of terrorism than to those of a non-state actor.

Daveed Gartenstein-Ross is a senior fellow at the Foundation for Defense of Democracies and the chief executive officer of Valens Global, a D.C.-based consulting firm that focuses on the threats posed by violent non-state actors. Nathaniel Barr is the research manager at Valens Global.

The authors would like to thank Daniel Scarnecchia and Alan Gordon for producing the graphics for this article.

The authors would also like to thank Cassandra McClellan, a research analyst and business development associate at Valens Global, for assisting in mapping the Zerkani network.

Notes:

[1] While it appears that most theater commanders are based in Syria, it is possible that IS’s North African operations are directed out of Libya, which has become the group’s command hub in Africa.