The Swarm: Terrorist Incidents in France

The terrorist threat from Sunni jihadists connected to France presents multiple challenges to the French authorities due to the number of distinct entities involved and the volume of events generated by their activities. The threat comes from returning foreign fighters, supporters of the Islamic State, individuals loosely connected to the group and persons with an on-going engagement in jihadist activity pre-dating the Syria conflict and the rise of the Islamic State.

If the January 2015 Paris attacks are treated as separate incidents—given the attackers claimed their attacks for different terrorist entities—since September 2012, there have been public reports of 17 plots and attacks in France:

1. In September 2012, French authorities investigated the Cannes-Torcy group over members’ involvement in a grenade attack on a Jewish grocery. The investigation led to the discovery of explosives and the killing of one of the members in Strasbourg (Le Figaro, July 5, 2013; Le Figaro, March 26, 2014).

2. In March 2013, French authorities arrested three males in the Marignane area in possession of 50 grams of the explosive acetone peroxide, precursor chemicals for another 600 grams and firearms (Le Monde, March 11, 2013). The three were active on social media and had sent a threatening letter to the White House (Le Parisien, March 11, 2013).

3. In October 2013, Lyes Darani, a returnee from Syria, was arrested in Lille on suspicion of preparing a possible suicide attack (La Voix du Nord, November 3, 2014).

4. In February 2014, Ibrahim Boudina, linked to the Cannes-Torcy group, was arrested in Nice, and was allegedly planning an attack using explosives against the city’s carnival. He had spent 15 months in Syria, first with Jabhat al-Nusra and then with the Islamic State of Iraq and Syria (ISIS—the previous name of the Islamic State) (Le Figaro, March 26, 2014; L’Express, June 26, 2014).

5. In May 2014, Mehdi Nemmouche, an ISIS-affiliated returnee, was arrested in Marseilles following his attack in Brussels. He reportedly told his hostages that he wanted to carry out an attack in Paris (Libération, September 28, 2014).

6. In July 2014, the French arrested another Islamic State-linked returnee, Mohamed Ouharani. It is believed that he was initially tasked with carrying out an attack in Lebanon; however, he desisted and instead returned to France, where he began to try and identify Shi’a-related targets (TF1, April 23).

7. In August 2014, two adolescent females allegedly intending to join the Islamic State were arrested in Lyon; press reports said they expressed interest in attacking a synagogue with firearms. One was reported to have had access to weapons (TF1, April 23; Le Télégramme, May 3).

8. In September 2014, a group was disrupted in Lyon. Numerous firearms were recovered, and the authorities were concerned they were on the point of carrying out an attack (AFP, September 19, 2014).

9. In December 2014, Bertrand Nzohabonayo, attacked and wounded police officers in Joué-lès-Tours with a knife. He is reported to have cried “Allah Akbar,” although some witnesses dispute this account (AFP, December 20, 2014). The prosecutor chose to investigate it as a terrorist incident, and Dabiq, the Islamic State’s propaganda magazine, cited Nzohabonayo as an example to follow. [1]

10. In January 2015, Cherif and Said Kouachi carried out an attack against the Charlie Hebdo magazine, claiming their act for al-Qaeda in the Arabian Peninsula (AQAP) (Le Monde, February 17). The brothers were linked with an Iraq war-era network, as well as a group involved in planning a prison break in 2010 that included Amedy Coulibaly (Le Figaro, March 1).

11. Shortly after the Kouachis initiated their attack, Amedy Coulibaly carried out a series of attacks and stated that he was acting for the Islamic State (Le Monde, February 17). The attack was executed using firearms. Coulibaly’s wife and a number of individuals associated with his wider network left France prior to the attacks; some were arrested en route, while others successfully joined the Islamic State (Le Parisien-Aujourd’hui en France, May 16).

12. In February 2015, Moussa Coulibaly (no relation to Amedy), who had tried to travel to Turkey and is suspected of wanting to enter Syria or Iraq, attacked three soldiers near a Jewish community center in Nice (Le Monde, February 5, Le Monde, February 9).

13. In April 2015, Sid Ahmed Ghlam was arrested after having contacted the police because of a gunshot wound. He was covered in blood and is a suspect in the murder of a female, although the motive for the killing remains unclear. He is suspected of being in the process of planning an attack against a church in the Paris region. He appears to have been in contact with Islamic State-affiliated entities. He had travelled to Turkey for a week in February 2015, but the purpose of this visit remains unclear (Le Figaro, June 25; Le Monde, August 3).

14. In June 2015, Yassine Salhi beheaded his employer and then attempted to ram the main gate of a gas storage facility south of Lyon with his car. He sent pictures via Whatsapp to Syria. The Islamic State mentioned the attack in Dabiq’s tenth issue. [2] Salhi is alleged to have told the police that he tried to cover the murder of his employer as a terrorist incident (AFP, June 29).

15. In July 2015, French authorities arrested four persons, charging three for their involvement in planning to carry out an attack against a military target in the south of France. At least one of the individuals had intended to travel to Syria, but had been unable to do so. The authorities said he had been encouraged by a member of the Islamic State in Syria to conduct an attack in France (Parquet du Tribunal de Grande Instance de Paris, July 17).

16. In August 2015, passengers on a train between Amsterdam and Paris neutralized a Moroccan national, Ayoub al-Khazzani, as he attempted to use an AK-47. The individual denies attempting to carry out a terrorist attack and says he was trying to commit a robbery. He was previously the subject of exchanges of information between Spain, France and Belgium and had been entered into information systems as a suspect (EuroNews, August 25).

17. In September 2015, the French press reported that an individual had been arrested by the authorities on August 11, and that he had spent one week in Raqqa, Syria, where he had been instructed to carry out an attack to kill as many persons as possible. The reports suggested that a possible target was a concert venue (Le Monde, September 18).

Of the 17 above events, three were successful: the two January 2015 Paris attacks and the June 2015 beheading in Lyon. Another five attacks were partially successful as the perpetrators carried out an attack and either wounded or killed persons, but they did not attack their primary target. Of the above, the French authorities disrupted 52.9 percent (9) of the plots prior to any kind of execution, while 29.4 percent (5) of the plots were partially completed, and a further 17.6 percent (3) have been successful.

To date six returnees have been involved in plots, an approximate ratio of 1 to 40 returning fighters engaging in attacks for a returnee population of 250 in France or a 1 in 86 ratio for the current in-country contingent. [3] Based on the number of French fighters currently in Syria and Iraq (about 520), this suggests the possibility of another six plots emerging from the present foreign fighter contingent. [4]

The proportion of returnee involved in attacks in this dataset suggests a peak in 2013-2014, and then an absence of their involvement until late summer 2015. The drivers of the attack tempo are not entirely clear, but there has been an acceleration following Islamic State spokesperson Abu Muhammad al-Adnani’s call for attacks, with ten of the 17 events occurring post September 2014. [5] The most recent events—conducted by Ghlam, al-Khazzani and Reda—appear to have indications of direction from the Islamic State. For instance, Ghlam is reported to have links to an Islamic State-affiliated cluster of French foreign fighters with connections to the Artigat group. This suggests the presence of a nascent external operations capacity among the French Islamic State adherents in Iraq. A French returnee has also reportedly told the authorities that Syria was a “terrorist factory” where individuals were being trained to attack Europe in the near future, and it has also been reported that returnees would attack not in their countries of origin, but elsewhere to lessen the risk of detection upon return (Le Monde, October 20).

Given that there is approximately a 3 to 1 ratio of sympathizer events versus returnee attacks, there could also potentially be at least another 18 events generated by the non-traveling population given the current plot and attack tempo. Based on the past two years, French authorities could be expected to disrupt ten of these plots; however, precedents suggest that three could be successful and a further five partially executed. Obviously, terrorist attack cycles are not linear, but the current surge in events suggests that more incidents are likely; most could emerge from the non-traveling population, and the authorities will not successfully disrupt all of the eventual plots. The threat is also durable in terms of the length of time it is likely to take for the threat to fully manifest and then exhaust itself. For example, by comparison, individuals involved in foreign fighter networks linked to the first Iraq conflict remained engaged for nearly a decade before executing their attacks (Caderol, May 16). The same may be true for the current Syrian conflict.

Timothy Holman is a Ph.D. candidate at the S. Rajaratnam School of International Studies in Singapore.

Notes

1. See page 4, https://azelin.files.wordpress.com/2015/02/the-islamic-state-e2809cdc481biq-magazine-622.pdf.

2. See https://azelin.files.wordpress.com/2015/07/the-islamic-state-e2809cdc481biq-magazine-1022.pdf.

3. The returnee figure has been used to calculate the ratio as opposed to the sum of fighters present, deceased or returned, as the fighters currently in place may not all return and the deceased fighters will obviously not return. For the returnee figure, see: Le Monde, “Pas de risque zéro pour l’antiterrorisme,” August 3, https://www.sen360.com/sport/en-france-pas-de-risque-zero-pour-l-antiterrorisme-320211.html.

4. Figures from French Ministry of the Interior via Jean Charles-Brisard, October 14, https://twitter.com/JcBrisard/status/654194866705068032.

5. Silber, Mitchell D. 2015, “Crowdsourced Jihad: a New Framework for Understanding ISIS Plots Against the West,” The Cipher Brief, July 9, 2015, https://thecipherbrief.com/articles/crowdsourced-jihad-new-framework-understanding-isis-plots-against-west. The article has subsequently been taken down.