The Criminal-Jihadist: Insights into Modern Terrorist Financing

3 Gaps in State Power

The opportunistic ability of criminal-terrorist groups to take over geographic areas is due to declining state power in some regions. In the Middle East and North Africa, for example, the instability in the wake of the Arab Spring has undermined state control in several countries, resulting in weak services, chronic conflict, lawlessness, and increasing poverty. This has created an opportunity for radical religious extremists, terrorists, and criminal groups to prosper. Several states in the region can now no longer fully control and contain criminality and violent terror within their borders, especially in prisons, urban areas, and cyberspace.

3.1 Prison networking

State power has retreated in prisons, which should constitute one of the pillars of a functioning state’s criminal justice system. Currently, prison has become the place where terrorists and criminals meet, plan, plot, and recruit. The most prominent example is Abu-Bakhr al-Baghdadi, the leader and self-declared caliph of IS, who spent formative time at Camp Bucca, a US-controlled prison in Iraq. Camp Bucca provided an extraordinary opportunity for senior Islamist extremists to meet in private, which would have been too dangerous on the outside. At Camp Bucca, Baghdadi met Samir Abd Muhammad al-Khlifawi, a former colonel in the intelligence service of Saddam Hussein’s air defence forces. Better known by his nom de guerre, Haji Bakr, he was the architect of the IS strategy for the takeover of towns, focusing heavily on surveillance and espionage. In prison, terrorists had valuable time to organise, appoint leaders, design operations, launch attacks, and make plans to reconnect once they were released. The Iraqi government estimated that 17 of the 25 most important IS leaders spent time in US prisons in Iraq, where they planned the creation of IS and its ideology.⁶

In the West, prisons have also become a networking and learning environment where terrorists and criminals can share tradecraft. A large percentage of terrorist recruits – some estimates are as high as 80 per cent – have criminal records varying from petty to serious crimes.⁷ The recruitment of criminals provides terrorists with the necessary skill sets needed to succeed: a propensity to carry out violent acts, as well as access to criminal markets for weapons and bomb-building resources. A study conducted on extremists who plotted attacks in Western Europe found that 90 per cent of the cells studied were involved in income-generating criminal activities and half were entirely self-financed: only one in four received funding support from international terrorist organisations.⁸

For many Islamist extremist groups prison has become an important recruitment location, where they especially target young petty criminals with Middle Eastern backgrounds. In an interview in IS’s online magazine Dabiq, Franco-Tunisian Salafist Boubacar al-Hakim stated that putting Muslims in prisons is actually serving IS’s cause, because it gives it an opportunity to spread its message.⁹

This strategy seems to have borne fruit. Charlie Hebdo attackers Amedy Coulibaly and Cherif Kouachi met while serving prison sentences. They also met with al-Qaeda’s top operative in France, Djamel Beghal, who was serving a prison sentence for attempting to bomb the US Embassy in Paris in 2001. Abdelhamid Abaaoud, the mastermind of the Paris plot, and Salah Abdeslam, his co-conspirator, also followed a trajectory from petty crime to armed robbery, both ending up in prison. There they were in contact with and were radicalised by Fouad Belkacem, the former leader of the Brussels terrorist recruiting organisation Sharia4Belgium.

3.2 Cities

State power is also progressively being weakened in large cities. Some urban centres are becoming lawless enclaves that are increasingly exploited by criminals, terrorists, militants, and bandits. In so-called feral cities such as Mogadishu, Caracas, Ciudad Juárez, Raqqa, and Mosul, governments have lost their ability to govern or maintain the rule of law.

Such areas are conducive to criminal-terrorist joint enterprises. At a market situated behind Brussels’ main railway station, Kalashnikov assault rifles can be bought for under USD 1,000. The Charlie Hebdo attackers are thought to have sourced their guns there, while some 4,000 machine guns are thought to be in circulation just in the banlieues (suburbs) of French cities.¹⁰

In order to build up more resilience in cities, the UN launched the Strong Cities Network in September 2015 in New York. Managed by the London-based Institute for Strategic Dialogue, its purpose is to create an innovative platform to help empower civil society and municipal bodies to counter the challenge of violent extremism.

3.3 Cyberspace

Terrorists and militants have created insecurity in the real world for decades. However, in the last 15 years there has been a paradigm shift, and these actors are now also engaged in military, criminal, and psychological operations in the world’s greatest open space: the internet. For example, a group calling itself the Syrian Electronic Army gained control of the Associated Press Twitter account and published a hoax message about an attack on the White House that caused the Dow Jones stock exchange index to fall by 1 per cent, wiping USD 200 billion off the market. Al-Qaeda’s Electronic Army and the Tunisian Cyber Army have also attacked the US Office of Personnel Management.¹¹

Cyberspace is used for economic gain and to attract new supporters. IS uses the digital environment to create an idealised version of itself, a reality show that is designed to find resonance and meaning among its diverse supporters. For the adventure seeker, it broadcasts its military power and bloodthirsty violence; for those looking for a home, job, refuge, religious fulfilment, or meaning in life, it uses this medium to present an idyllic world by depicting the caliphate as a peaceful, benevolent state committed to helping the poor. For the fence sitters, IS actively engages recruiters who are generously compensated for their services online and offline.

IS has a successful media wing, al-Furqan, which includes over 36 separate media offices with affiliates in West Africa, Libya, and Afghanistan. Together they produce hundreds of videos in over six languages, as well as Dabiq, IS’s glossy online propaganda magazine. IS’s multimedia products receive as many as two million mentions per month on Twitter.

IS’s growing global influence marks the first time in history that a terrorist group has held sway in both the real and virtual worlds. In cyberspace, extremist groups’ greatest success is their ability to use propaganda in a strategic way to entice fighters to Syria. More than 40,000 foreign fighters from over 120 countries have flooded into Syria since the start of the country’s civil war, including 6,900 from the West, the vast majority of whom have joined IS.¹²

3.3.1 Cybercrime and fraud

With its skill at using the internet for propaganda and recruiting, it is no surprise that IS has also been successful at using cybercrime to fund itself. One IS supporter created a guide on how to use Dark Wallet, a dark web app that claims to anonymise bitcoin transactions. IS advises fighters on how to transfer funds, bringing it money through money service businesses, pre-paid debit cards, AppleWallet, informal money transfer systems (hawala), and cash couriers.

IS is not only dependent on hackers, but also on recruits from Europe for significant funding. It advises aspiring fighters to raise funds before leaving to join IS. The greater the funding, the higher their status is upon arrival in the caliphate. European recruits’ moneymaking schemes include petty theft, as well as defrauding public institutions and service providers. Amedy Coulibaly, who attacked the kosher grocery market in Paris, took out a EUR 6,000 bank loan. British foreign fighters committed large-scale fraud by pretending to be police officers and by targeting UK pensioners for their bank details, earning more than USD 1.8 million before being apprehended.¹³

IS also instructs its followers to use the internet to acquire weapons. While guns are easily obtainable in the areas being held hostage by IS, cells planning attacks in Europe are increasingly turning to the dark web to obtain weapons: 57 people were arrested in France in 2015 for buying firearms over the internet.¹⁴

3.3.1 Cyber terror

The internet is becoming a tool to mount attacks against governments and institutions. IS recently united five distinct hacking groups into a “United Cyber Caliphate”. Its purpose is to build a cyber army and create forums to provide followers with the tools they need to wage cyber-terror campaigns. Al-Qaeda has urged cyber jihad as a sacred duty for every Muslim in one of its documents entitled “The 39 Principles of Jihad”.

IS is working with criminal hackers who provide it with resources. A Kosovan, Ardit Ferizi, was accused of stealing personal information on over 1,350 US military and government personnel. To avoid detection, IS coaches its followers and provides them with a 34-page security manual containing guidelines on how to keep e-mails private and how to use the anonymous browser Tor to avoid detection.¹⁵

The most disturbing feature is that, if criminal or terrorist groups do not have the necessary in-house hacking talents, they can buy these skills on the dark web. Everything is for sale, from zombie computers that can swamp a network with traffic to sophisticated cyber malware – including the services of criminal hackers.

Today, IS will only needs to use a fraction of its wealth to buy largely inexpensive cyber weapons. Stuxnet, which is believed to have been designed to attack Iranian nuclear facilities, cost approximately USD 100 million to develop; a recent malware program, IceFog, designed to attack government agencies in Japan and South Korea, cost a mere USD 10,000 to develop. Malware is used to conduct advanced, persistent attacks on critical national infrastructure and financial systems that were previously designed and financed by governments for exorbitant fees. Today cyber weapons are cheap and accessible, not only for states, but for non-state actors as well.¹⁶

In order to stop this terrorist-criminal hacker threat, governments are investing heavily in their cyber defences. The UK announced its  total cyber spending to be more than GBP 3.2 billion.¹⁷ Several governments, including those of the UK, the US, and Japan, believe that IS has the organisational capacity to carry out a cyber attack that could physically disrupt, damage, or destroy critical infrastructure. So far IS’s cyber achievements have been limited, although Caitlin Durkovich, US Assistant Secretary for Infrastructure Protection, has maintained that IS has recently launched cyberattacks on the nation’s electricity grid.¹⁸

4 Criminal-Terror Relationships

There is a clear convergence between terrorists and criminal groups, but it is usually a marriage of convenience or a strategic partnership, perhaps even a cohabitation, but in most cases it is an open marriage that allows both parties a great deal of room to manoeuvre. This paper argues that three main types of relationships characterise terrorist groups’ links with criminal enterprises and organised crime: direct involvement between terrorists and criminal groups; strategic alliances with criminal groups; and exploitative authority over vulnerable groups and businesses.

4.1 Direct involvement

A number of terrorist groups engage directly in criminal activities with criminal groups. Kidnapping for ransom is a key source of funding for AQIM, al-Qaeda in the Arabian Peninsula (AQAP), the Abu Sayyaf Group, and Boko Haram. Al-Qaeda and its affiliates obtained at least USD 125 million though kidnapping for ransom since 2008. Al-Qaeda leader Ayman al-Zawahiri has called for supporters worldwide to kidnap Westerners, most recently in 2014, maintaining that they could be exchanged for jailed jihadists. Some groups engage in the kidnapping of local officials and their families, which involves small and quickly paid ransoms. Kidnapping for ransom earned IS USD 45 million in 2014: it has a special department dedicated to this activity. Kidnapping serves as a source of income, a resource for obtaining new recruits, and a way of securing women for its fighters.¹⁹

At times terrorist groups work in close cooperation with criminal groups who carry out the kidnapping and then exchange the hostages for a percentage of the profits. In Yemen, locals work for AQAP by searching for foreigners to abduct in Sana’a. AQAP, AQIM, and al-Shabaab have coordinated their efforts and established a common kidnapping protocol.

Organised criminals and terrorists are also active in the illicit trade of counterfeit goods, which is the largest black market, larger than the global narcotics trade.²⁰ Contraband tobacco is a USD 1 billion trade in North Africa, run directly by terrorists who find it highly profitable and very low risk. Mokhtar Belmokhtar’s extensive trade in contraband earned him the sobriquet “Mr Marlboro”. Experts maintain that the profits from cigarette smuggling fuel other criminal activities, including drug-, oil- and human-trafficking activities that often use the same distribution networks. The Taliban are also actively involved in cigarette smuggling, which is second only to their heroin trade.

4.2 Strategic alliances

A second type of relationship occurs in the form of strategic alliances with criminal groups. Although terrorist groups are eager to capitalise on criminal proceeds, not all groups are willing to engage full time in criminal activities. This has led terrorists to form strategic alliances, allowing them to profit from criminal activities by buying and selling goods through crime groups or by taxing the transport of goods across areas under their control.

An example of such an alliance is al-Shabaab’s involvement in the illegal wildlife trade in East Africa. Al-Shabaab obtains significant revenue from elephant poaching, but this is a resource-intensive activity that detracts from the group’s primary objectives. Al-Shabaab thus only leverages the business. A report by the UN and INTERPOL assesses the illegal wildlife trade to be worth up to USD 7-23 billion per year.²¹ This illegal market is shared by militias and terrorist and criminal groups.

Illegal logging is another example of such an alliance. According to the UN, the annual spoils of the illegal logging market amount to USD 100 billion. In Somalia, charcoal exports are a significant source of revenue for al-Shabaab. In 2012 this was recognised by UN Security Council Resolution 2036, which banned the import and export of charcoal from Somalia. Despite the ban, the UN has estimated the annual earnings of the Somali charcoal trade at more than USD 250 million. The UN Environment Programme (UNEP) estimates that al-Shabaab earns USD 38-68 million a year from charcoal sales and the taxes it collects on the transport of the illegal commodity.²²

4.2 Exploitative authority

A third way in which terrorists are profiting from organised crime is by taxing and extorting individuals who are under their control or by joining forces with corrupt government officials. Abu Musa’b al-Zarqawi, the former head of al-Qaeda in Iraq (AQI), received most of his funding from criminal activities. In Anbar province, Zarqawi and Abu Omar al-Baghdadi were part of several smuggling rackets. In 2006 a leaked US intelligence assessment reported in the New York Times estimated that insurgents in Iraq raised USD 70-200 million a year from oil smuggling in collusion with corrupt Iraqis and USD 36 million from kidnapping for ransom. The report presciently stated that this capital would allow the organisation to be self-sufficient and could be used to support other terrorist organisations outside Iraq.²³

IS was also founded on criminal revenue. Prior  to declaring an Islamic caliphate, Baghdadi’s organisation raised money through extortion, collecting funds from Shia and other minorities through protection rackets, gaining control of  oil fields, and blackmailing companies. IS had already exercised a criminal hold on Mosul long before seizing it. IS members acted like “mafias managing organised crime and controlling all economic resources of the province”, according to an Iraqi parliamentary inquiry into what led to the city’s fall.²⁴

IS has become the richest and most violent terrorist group in modern history, with an estimated wealth in 2015 of over USD 2 billion from oil sales, smuggling, sale of stolen goods, extortion, and looted banks and antiquities.

IS branches are also filling its coffers. IS’s “Khorosan” branch, which emerged in Afghanistan in mid-2014, is earning revenue from its control of heroin trading and processing, as well as timber smuggling. IS currently earns over half of its income from taxation, imposing levies on everyone and everything that crosses its territories and from expropriating real estate and property from those who have fled. IS taxes education, the provision of service, and agriculture, and fines what it considers to be unacceptable social behaviour; see Table 1.

It imposes road taxes and custom taxes on vehicles crossing its territory, as well as taxes on the smuggling of drugs, people, and goods. Table 2 shows IS’s principal sources of income.

IS has also acquired an estimated USD 500 million-1 billion from pillaging banks in the territory it controls.

For more information on a selection of Salafi-jihadist terrorist groups and their sources of funding, see Table 3.

Table 1: Islamic State’s multiple levels of taxation.

Table 2: Islamic State’s principal sources of income.

Table 3: Sources of funding of terrorist organisations.

5 The Way Forward

Important work still needs to be done to understand exactly how modern terrorist and criminal groups cooperate in both the real and virtual worlds. As has been demonstrated by the longevity of groups like Hezbollah, the Taliban, the Farc, and the Provisional Irish Republican Army, terrorist groups who engage in criminal funding can be extremely resilient and long lasting. Even the French military presence in the Sahel region has had a limited effect in preventing criminal-terrorist cooperation. Despite the fact that with Operation Barkhan France was able to negotiate an agreement to strike jihadist terror groups in five Sahel countries, it has been unable to stop Mokhtar Belmokhtar from conducting his business (see above). Al-Marabitou, AQIM, and MUJAO are still benefitting from their links to drug cartels and criminal groups engaged in kidnapping for ransom and smuggling. It is therefore essential that anti-terror strategies address the nexus of crime and terror, and terrorist financing.

5.1 At the international level

Countering terrorist financing is not a linear problem: it can only be understood by compiling and continuously updating a comprehensive intelligence picture, and this needs information sharing and international cooperation. It is important to meet the challenge with a shared global response, as underlined in recent UN Security Council resolutions (see Table 4). The work and recommendations of the Financial Action Task Force (FATF) should also be included. Finance ministers should focus their work on preventing IS from accessing the international financial system. Currently, IS is still able to move payments for smuggled oil and antiquities through the banking system. According to a 2015 FATF report, 20 Syrian financial institutions continue to operate in IS-held territory and IS continues to use banks just outside the territories it controls. Forty countries are still able to finance IS, including G20 members.²⁵

5.2 At the national level

Countering terrorist financing must also be addressed at the national level. In December 2015 the Central Bank of Iraq (CBI) banned 142 money-exchange houses from participating in the bank’s currency auctions. IS was exploiting these auctions to obtain cash on exchange and to send and receive electronic transfers. In November 2015 the Wall Street Journal reported that IS was using these exchange auctions to gain access to US dollars. The US Federal Reserve responded by suspending currency shipments to Iraq in 2015.²⁶ The CBI instructed financial institutions in Iraq to prevent wire transfers to and from banks located in areas under IS control. The US Federal Reserve, together with the CBI, has put in place information exchanges and safeguards to protect banks and exchange houses alike from abuse and deny IS access to US banknotes.²⁷

The US and members of the Global Coalition are actively launching air strikes against IS’s oil infrastructure and cash storage sites. The US Treasury maintains that IS oil revenues are down by 30 per cent.²⁸ However, the global coalition’s response of using military power against IS by targeting “cash collection and distribution points” and oil trucks should not be seen as a long-term solution. IS will simply find new ways of earning money by taxing the eight to ten million people in the areas that it controls or by selling cement, wheat, phosphates, cotton, and oil to its neighbours. As long as the UN Security Council cannot agree to an embargo that punishes those who are conducting business with IS, the latter will continue to acquire funds.

5.3 At the global financial level

At the global financial level it is important to enforce global governance regimes that do not allow criminal states or kleptocracies to function with impunity. Sewall has stated that we “must do more than simply buttress a government in order to legitimise a state. [We] must buttress multiple failing state structures to legitimise the interstate system.”²⁹

States near IS-controlled areas should help to prevent money transfers from the Persian Gulf countries through Turkey and Lebanon and should work harder to prevent IS operatives from accessing their banks. However, preventing backdoor banking is difficult when bank branches remain connected to jurisdictions that are weak  or non-existent and that do not yet criminalise financing an individual for a purpose unrelated to committing a terrorist act. Reclaiming “black holes”, as counter-terrorism officials hope to do, is difficult when financing remains mostly siloed and highly restricted by domestic data-protection and privacy laws. In 2015 the Global Coalition initiated Operation Tidal Wave II, an air campaign to strike IS oil and gas sectors and infrastructure. However, the coalition is also hampered by humanitarian concerns over destroying ordinary civilians lives and livelihoods. It cannot bomb banks knowing that this will undermine or destroy the livelihoods of millions of people in urban centres such as Mosul and Raqqa. For a more detailed overview of the various operational responses to threat financing, see Table 4.

6 Conclusions

As Forest has argued, terrorism does not emerge in a vacuum, but is the result of complex interactions among individuals, organisations, and environments.³⁰ Terrorist and criminal groups cooperate in complex environments that are marked by their ambiguity, uncertainty, and fluidity. They survive in trans-regional, decentralised, and ungoverned spaces populated by people who no longer trust or even hope to receive services from any type of governance structure. The significant gaps in legislative, law enforcement, and criminal justice systems help to sustain these groups’ criminal markets worldwide. Only by closing the gaps that smugglers, traffickers, and terrorists are exploiting can there be any real reduction of their illegal trade and financial power.

The recent increase in global terrorism can be explained by several converging factors: war, religious and ethnic conflict, corrosive governments, weak and failing states, and the growth of information technology. However, one of the most important developments is the increasing collaboration of criminal and terrorist networks. This new hybrid threat has brought both types of networks historically unparalleled wealth and power. The consequence of this expanding threat can be measured by the way in which both al-Qaeda and IS have increased their sphere of influence worldwide. In the span of 18 months IS has amassed 34 affiliates worldwide and from June 2014 to December 2015 has conducted or inspired at least 50 terrorist attacks in 18 countries.³¹

While criminals used to focus only on revenue generation and terrorists were driven by political motives, we are witnessing a convergence of terrorism and crime, because these new hybrid groups are driven by both revenue generation and political motives, resulting in terrorist groups with historically unprecedented resources and transgressive aims.

Despite countless global summits, international task forces, working groups, special enquiries, UN Security Council resolutions, and research, fundamental flaws remain in our understanding of crime and terror. In order to bridge this divide the international community, regional actors, states, and corporates must work closer together to prevent threat financing and recognise the important inter-linkages between terrorism and crime. While drying up terrorist finance will not eradicate terrorism altogether, it will effectively stem the growth and global reach of the unprecedentedly successful terrorist groups that are currently plaguing the world.

Table 4: Operational Responses to threat financing.