Bloody Ramadan: How the Islamic State Coordinated a Global Terrorist Campaign
28 Jul 2016
By Daveed Gartenstein-Ross, Nathaniel Barr for War on the Rocks
This article was external pageoriginally publishedcall_made by external pageWar on the Rockscall_made on 20 July 2016.
In late May 2016, the Islamic State (ISIL) external pagereleased an audio statementcall_made featuring Abu Muhammad al-Adnani, the group’s chief spokesman, celebrating the upcoming lunar month of Ramadan. Adnani exhorted ISIL’s supporters to make Ramadan “a month of calamity everywhere for the non-believers” and urged everyone considering migrating to the caliphate to instead carry out attacks in their home countries. Adnani’s statement proved to be an ugly portent of things to come. Militants acting in ISIL’s name struck in over 10 countries during the group’s Ramadan offensive. Highly visible attacks in Istanbul, Dhaka, Orlando, and Baghdad together left hundreds of civilians dead as operatives targeted airports, restaurants, night clubs, and shopping centers.
While almost all of these attacks were claimed by ISIL, observers have external pageexpressed skepticismcall_made about the extent of the organization’s involvement. Some argued that ISIL’s role in most attacks during Ramadan was external pagelimited to providing ideological inspiration and encouragementcall_made to so-called lone wolves or wolf packs, who may have mobilized in response to Adnani’s call to arms but did not coordinate with ISIL operatives.
Yet, a growing body of evidence suggests that the Ramadan offensive was largely a coordinated and deliberate ISIL campaign. Though some militants may have acted of their own accord, it is probable that ISIL as an organization played a pivotal role in organizing and directing the majority of attacks that occurred during Ramadan. Some attacks, such as the Istanbul and Baghdad bombings, were centrally directed by ISIL attack networks, with the organization deploying trained operatives. Other operations were the product of collaboration between local networks and ISIL operatives based in Syria and Iraq, who helped to organize and coordinate the attacks remotely. Through this combination of both central and virtual planning, ISIL mounted an external pageunprecedented wave of attackscall_made.
This is a model that ISIL is likely to replicate in the future.
The Tip of the Spear
The Ramadan offensive bears the hallmark of the Amn al-Kharji, the Islamic State’s secretive external operations wing, which is responsible for external pageplanning espionage activities and terrorist operationscall_made outside the caliphate’s core territory. Under the guidance of an enigmatic Frenchman known by his nom de guerre, Abu Sulayman al-Faransi, the Amn al-Kharji external pagebuilt a robust infrastructurecall_made that enables it to coordinate and direct attacks across the globe. Faransi, who is believed to have external pageplayed an integral rolecall_made in planning the November 2015 Paris attacks, directs a cadre of theater commanders who are responsible for coordinating terrorist operations in different regions, including those as far afield as Southeast Asia and Europe. These theater commanders are the center of gravity within the Amn al-Kharji and featured prominently in the Ramadan campaign, directing operations and providing guidance to local networks.
Relatively little was known about the Amn al-Kharji’s structure in various theaters until the March 2016 attacks in Brussels. Subsequent investigations helped peel back the layers on ISIL’s European network. At the helm of the European network is Salim Benghalem, who external pageserved as an ISIL prison guard in Syriacall_made before ascending the Amn al-Kharji’s ranks. Benghalem’s highest profile deputy is Fabien Clain, a French convert to Islam who external pagelikely selected the Bataclan theatercall_made as one of the targets of the November 2015 Paris attacks. These two operatives, who are believed to be in Syria or Iraq, have been remarkably successful at running operatives and networks into Europe.
The Ramadan campaign pulled back the curtain on ISIL’s external operations networks in other parts of the world. The June 28 assault on the Istanbul airport, like the Paris and Brussels attacks, external pageappears to have organized and coordinatedcall_made by an experienced Syria-based external operations planner. According to Turkish police, the external pageattack’s mastermindcall_made was Ahmet Chatayev, a Chechen-born militant and former member of the Caucasus Emirate who now resides in ISIL-controlled territory. In October 2015, the United Nations concluded that Chatayev was external pageinvolved in training and deployingcall_made Russian-speaking militants to Russia to conduct terrorist attacks there. Meanwhile, the three attackers who perpetrated the Istanbul attack are external pagebelieved to have traveled from Raqqa to Turkeycall_made about a month before that attack, reportedly bringing suicide vests and bombs with them. This evidence leaves little doubt that the Islamic State centrally planned the Istanbul airport attack.
Chatayev’s role in the Istanbul attack signals a shift in the Islamic State’s external operations in Turkey. Previous Islamic State attacks in Turkey had been coordinated by the external pagegroup’s Turkish networkcall_made, which is led by Turkish citizens, including the former al-Qaeda operative external pageHalis Bayancukcall_made (a.k.a. Abu Hanzala) and external pageMustafa Dokumacıcall_made, who ran a network out of the southeastern Turkish province of Adıyaman. Chatayev’s involvement in the Istanbul airport attack suggests that ISIL is now using Russian-speaking units to perpetrate attacks in Turkey. Turkish intelligence officials similarly concluded that external pageISIL instructed militants from the Caucasus region and Azerbaijancall_made to conduct operations in both Turkey and Azerbaijan.
Statements from security officials indicate that other attacks in ISIL’s “near abroad” (the region surrounding ISIL-controlled territory) during Ramadan were similarly directed by operatives inside the caliphate. A spokesman for the Saudi interior ministry asserted that the external pagethree suicide attacks that struck Saudi Arabia on July 4 were planned in Syriacall_made, and he suggested that the suicide vests for the attacks may have also been built abroad. Similarly, external pageLebanon’s interior minister concludedcall_made that the eight suicide bombers who attacked the northern Lebanese town of al-Qaa on June 27 came from Syria.
The attacks in Lebanon, Saudi Arabia, and Turkey paint a clear picture of ISIL’s external operations capabilities in its near abroad. ISIL has developed robust networks in countries across the Middle East by both tapping into local recruitment pools and deploying operatives from inside the caliphate to set up shop in neighboring states. The leadership of the Amn al-Kharji has maintained direct contact with its cells abroad, and the Ramadan campaign highlighted ISIL’s ability to mobilize these networks as a part of a coordinated campaign.
The Virtual Planners
The Ramadan campaign also shed light on the Islamic State’s approach to coordinating and directing attacks elsewhere in the world. In regions far from ISIL’s territorial stronghold, the group’s ability to play a hands-on role in operational planning may be somewhat limited. Thus, ISIL engaged in what can be described as virtual planning: having Syria-based foreign fighters coordinate attacks via online communications with local networks in the fighters’ countries or regions of origin. Though ISIL sacrifices some command and control over attacks through this approach, the virtual planning model greatly expands the group’s operational reach. Virtual planning has become a cornerstone of the Amn al-Kharji’s strategy and a key element of the Ramadan campaign.
ISIL’s unsuccessful attempt to coordinate an attack in India during Ramadan provides an example of how the group has used virtual planning. In late June, Indian security services external pagedisrupted an ISIL cellcall_made in Hyderabad, arresting five individuals and recovering weapons, ammunition, and chemicals. Following the arrests, Indian officials learned that the cell had been external pageplanning to conduct a series of attackscall_made on external pagepolice stationscall_made, malls, places of worship, and other targets.
Investigators soon learned that the cell had been in contact (possibly via external pageencrypted email softwarecall_made) with Shafi Armar (a.k.a. Yusuf al-Hindi), a former member of Indian Mujahideen and the current head of Ansar-ut Tawhid, ISIL’s South Asian wing. According to Indian authorities, Armar, who is believed to be in Syria or Iraq, external pageinstructed the cell to use TATPcall_made, the same explosive used in both the Paris and Brussels attacks, and to external pagedevelop an escape plancall_made. Members of the Hyderabad cell also reportedly external pagesent a scanned letter to Armarcall_made pledging allegiance to ISIL’s caliph, Abu Bakr al-Baghdadi.
Armar’s involvement in the Hyderabad plot illustrates how virtual planners can direct attacks in the far abroad. His external pageconnections with ISIL recruiters in Indiacall_made likely enabled him to identify a pool of operatives. He provided operational and technical assistance to the cell, instructing the group on the construction of explosives and shaping the group’s attack plan. The cell’s failure to carry out the attack highlights a major obstacle of virtual planning: Local networks that have not received in-person training may not possess the expertise to perfectly follow their handlers’ instructions. (Virtual planning also leaves cells more at risk of being detected by SIGINT efforts.) Still, Armar’s ability to run networks inside India illustrates the potency of the virtual planning model. And since Armar is responsible for the Amn al-Kharji’s South Asia portfolio, he may have been involved in the external pageearly July assault on the Holey Artisan Bakerycall_made in Dhaka. ISIL claimed the Dhaka attack while it was still in progress, the first time the group has done so, suggesting that ISIL may have been aware of the attack before it occurred.
ISIL used the virtual planning model to activate networks elsewhere in Asia during the Ramadan campaign. According to Malaysian security officials, two militants who threw a hand grenade into a nightclub in the western Malaysian state of Selangor in late June external pagereceived orders from Muhammad Wanndy Mohamed Jedicall_made, a Malaysian ISIL operative based in Syria. He has been featured in numerous propaganda videos, including one where he external pagebeheaded a Syrian mancall_made. Similarly, a suicide bomber who struck a police station in the Indonesian city of Solo in early July reportedly external pagereceived instructions, via an unspecified mobile messaging application, on building explosivescall_made from Bahrun Naim, an Indonesian militant based in Syria. Naim is one of the top officials in the Islamic State’s Southeast Asian wing, Katibah Nusantara. He was previously involved in external pagedirecting the January 2016 Jakarta attackcall_made, highlighting his proficiency as a virtual planner. Neither the Malaysia operation nor Indonesia suicide attack resulted in fatalities, again illustrating the limitations of virtual planning. But ISIL’s success in mobilizing cells in countries thousands of miles from the caliphate underscores the utility of the virtual planning model. Not all such attacks will similarly fail.
A Professional Network
The Ramadan campaign consisted of a series of coordinated and premeditated attacks. Obviously, there are fundamental differences between centrally planned operations (such as the Istanbul airport attack) and attacks coordinated by virtual planners, with the latter generally being less sophisticated and less lethal. But it is remarkable, and worrisome, how many of the Ramadan attacks are clearly linked to the Amn al-Kharji. And the group’s ability to use encrypted online communications to interact with operatives abroad leaves open the possibility of links that have not yet been discovered.
In essence, ISIL operates a professionalized external operations wing that is capable of directing and coordinating operations across the globe. external pageAttacks that seem disparate or disconnected may actually be part of a broader campaigncall_made. Attackers who appear, at first glance, to have acted alone may be linked with a clandestine network.
As we investigate the heinous assault in Nice, we should keep this in mind.
About the Authors
Daveed Gartenstein-Ross is a senior fellow at the Foundation for Defense of Democracies and the chief executive officer of Valens Global, a consulting firm that focuses on the challenges posed by violent non-state actors.
Nathaniel Barr is the research manager at Valens Global.