The Islamic State in Khorasan’s “expansion” towards Europe

by Antonio Giustozzi.

Article published on #ReaCT2024 5th Report on Terrorism and Radicalism (order your copy or download the Report in Pdf).

Abstract

In 2023, Da’esh (ISIS) continued to carry out isolated attacks in Europe, generally with limited organisational support limited. The article notes the increasing effectiveness of European counter-terrorism measures European counterterrorism measures that would likely have made it less convenient for ISIS leaders deploy scarce human resources in such attacks. The author, in his article explores how the Islamic State group seems to favour the preservation of its organisational structures in Europe, delegating action to a few individuals or isolated cells. In addition, the growing involvement of the Khorasan (IS-K) branch of ISIS in planning attacks in Europe or against European targets abroad, as demonstrated by a 2020 plot against NATO bases in Germany. Despite the numerous plots identified in 2023, there is some discretion in attributing these plans exclusively to IS-K, suggesting wider intra-ISIS cooperation. The article notes that, despite appearances, Da’esh Khorasan is not necessarily expanding, but rather taking on new tasks assigned to it by the central leadership, pressed by resource scarcity.

The Islamic State (IS) continued in 2023 to occasionally carry out isolated attacks in Europe, usually with seemingly little organisational backup. As European counter-terrorism has become increasingly effective, the cost effectiveness of committing rare human resources to isolated attacks must have appeared questionable to IS leaders and police sources around Europe tend to think that IS indeed prefers to safeguard whatever organisational structure it still has in Europe, leaving the task of flying the flag to a few isolated individuals or cells. Indeed, as late as early 2022 police sources in Europe did not see an impending IS threat, its presence being limited to online propagandists, recruiters, and fundraisers. Taliban sources confirmed the detention of an IS-K operative in Afghanistan, who had raised thousands of euros in Germany and Spain (Giustozzi, 2022). Taliban intelligence sources also note that that much of IS-K online propaganda is now being produced outside Afghanistan, including Europe. After the fall of Kabul in August 2021, IS-K started releasing a significant portion of this propaganda in English. There might be multiple reasons for this, not all related to Europe. A possible reason that is relevant for European security is the intent to stimulate recruitment in Europe, perhaps in order to replace the loss of many Da’esh media operators due to the police crackdown in recent years. Even when in July 2023 the police detained several IS plotters in Germany and the Netherlands and described them as being “in contact with members” of the IS-K branch, it also noted that they were engaged in fund raising and there was no indication that they were actively preparing a terrorist attack (Stewart ASyI, 2023).

1. IS-K and the Ambition to Strike Europe.

Some observers have however noted a recent trend, concerning the growing organisational involvement of the Khorasan branch (IS-K) in planning attacks in Europe, or against European targets in Turkey. The German authorities alleged in 2020 that the cell behind a plot to attack NATO bases in Germany, thwarted by the police in April 2020, had received the order to act from an IS Khorasan cadre in Afghanistan.[1] This episode, however, was barely noticed and the evidence shared by the German authorities remains fuzzy. What really caught the eyes of many observers was the US intelligence report that turned up among the Discord leaks, showing that as of February 2023 15 different IS-K linked plots to carry out attacks against western interests in Europe, Turkey, the Middle East and elsewhere had been identified by the US military.[2] While these figures seem impressive, they contrast oddly with the fact that in March 2023 the US Central Command assessed was that IS-K was within 6 months of having the capacity to organise attacks against western interests in Asia or Europe. The discrepancy is difficult to explain, unless for the military the 15 plots mentioned above were not to be taken too seriously, or not to be attributed exclusively or even primarily to IS-K. Indeed, Turkish sources describe some of these plots, such as those aimed against Swedish and Dutch consulates on Turkish territory, as involving Central Asians linked to IS-K and members of the Turkish branch of IS. Apart from reportedly issuing the order, IS-K seemingly relied on assets and personnel that were already on location. Indeed, even the leaked US intelligence report itself noted that IS-K “relied on resources from outside Afghanistan”.

2. Afghanistan and the Developed Structure of IS.

In 2023 IS-K sources in Afghanistan confirmed to the author’s research team that the group coordinated operations in Turkey and Europe with other branches of the Islamic State, stressing however that this happened under the leadership of the central leadership of the ‘Caliphate”. This implies at least that IS-K as such was not determining the overall strategy presiding over the planning of these attacks. Sources within IS-K confirmed that Afghanistan hosted several military commissions for neighbouring countries, such as Iran and Central Asia, but did not mention any such entity focusing on Europe, Turkey or the Middle East. Sources contacted by the International Crisis Group in Syria indicated in 2023 that the Central Asians who used to operate under IS in Syria had been transferred under the responsibility of IS-K (International Crisis Group, 2023). According to the IS-K sources, at least initially this was meant to prelude to their transfer to Afghanistan, which however occurred considerably more slowly than planned.

The picture that these sources portray is one of a relatively developed IS-K structure in Turkey and Syria, with 200+ working in the financial hub of IS-K in Turkey, plus 400-500 Central Asians spread between Syria and Turkey, ex members of ISIL who either switched their allegiance or were reassigned to IS-K (the sources are not clear on this point), waiting to be transferred to Khorasan or in any case to be told what to do.  In Europe, the presence of IS-K is much more modest, with 60 members. According to the same sources, as of September 2022 there were 30 Europeans belonging to IS-K in Afghanistan and Pakistan. Of these, 16 were from Germany, ten were from France and four from Belgium. There were also four Americans, as well as a few Turks. These individuals with passports from European and North American countries were described as having been evacuated from the Middle East after the collapse of the Caliphate, rather than having been dispatched to IS-K for organising long-range attacks in Europe. While all these numbers cannot be verified, they seem compatible with the information summarised above and provided by Europol, ICG and others.

This picture suggests constant exchanges of members between the IS-K and other IS branches in Turkey, Europe and Syria (which occur incidentally, elsewhere as well), even if the speed and size of these exchanges have been declining over time. There was always considerable integration between IS branches, despite speculation early in the existence of IS-K that it was an opportunistic set up, with little organic relationship with the “Caliphate”. More than of IS-K expanding operations to Europe, therefore, one should speak of intra-IS branches cooperation. Such cooperation seems undoubtedly to have expanded in 2022-23, which begs the question of why this is the case

3. Is IS waiting?

In this regard, it is worth noticing that IS-K is not claiming or advertising its alleged “expansion”. Even when solicited, IS-K sources in Afghanistan have stayed well clear of boasting about such expansion. Quite the contrary, they tend to minimise its importance. This appears odd, given that

1. IS-K has been running a sophisticated media campaign, whose main future is magnifying its limited achievements and making unwarranted claims .

2. It would be committing a considerable portion of its limited resources, if the “expansion” were really such, and

3. Private IS-K social media chatter and interviews with members clearly show that the organisation struggles to explain to its own members and sympathisers why its activities have been so limited during 2023.

Perhaps IS-K might just be waiting to glorify its “expansion” and brand attacks outside the remit of Khorasan province (Afghanistan, Khyber Pakhtunkhwa of Pakistan, Central Asia, China, Iran) as “made in Afghanistan” until it succeeds in carrying out a successful one. However, IS-K shows no similar shyness in claiming its intent of bringing jihad to China (where despite years of propaganda, it could achieve nothing) or Central Asia, where its achievements have been minimal (firing rockets across the border into Tajikistan and Uzbekistan). If the primary purpose of IS-K were making a claim to having opened new fronts of its own in Europe, Turkey and Middle East, why wouldn’t it adopt tactics similar to those deployed in Khorasan province and carry out random attacks against the softest targets, then produce widely inflated claims of the damage inflicted?

4. The strength of IS.

In sum, the most logical explanation is that the “Caliphate”, which is at its weakest since its inception, has summoned IS-K’s help to reclaim the headlines with some high profile attack against European targets. One possibility is that the “Caliphate” might now be so weak in and around Europe that it simply does not have the strength anymore to systematically intensify operations there. Another possibility is that, in line with what noted at the beginning of this article, the central leadership of IS might have decided to raise its profile through intensified terrorist operations, while at the same time safeguarding its surviving structure in Europe and rely instead on IS-K elements, who are not part of the same structure and do not risk compromising it if caught.

Why IS-K and not other branches of IS? As mentioned above, IS-K has had a significant presence in Turkey for years, with safe houses and networks dedicated to supporting financial operations. This financial hub now struggles to carry out its original task, due to the Turkish authorities strongly increasing their pressure, so its conversion to more operational roles could well have appeared logical. Furthermore, as mentioned, the Central Asians were getting ready to be transferred to Afghanistan, having outlived their usefulness in Syria, where operating underground is much harder for them than for native Syrians or even Iraqis. As only a few tens were able to make the trip each month, those laying idle in Turkey and Syria could conceivably be mobilised for other duties. In short, IS-K happened to be readily available and well placed to provide support to the central leadership, whose Syrian and Iraqi branches have been greatly weakened in recent years. No other branch of IS was in a similar position.

Conclusions.

In conclusion, IS-K is not really “expanding”. The members involved in the planned attacks were already in IS-K, or had been scheduled to be transferred to it (in the case of the Central Asians). What appears to have changed is that IS-K was given additional tasks by a central leadership, which is low on money and human resources and needs to raise its media profile to have a chance of re-emerging from its crisis. This would also explain why IS-K members in Afghanistan and not particularly enthusiastic about this development, which at least in the short term is drawing scarce human resources away from them.

[1] https://ctc.westpoint.edu/the-april-2020-islamic-state-terror-plot-against-u-s-and-nato-military-bases-in-germany-the-tajik-connection

[2] https://www.washingtonpost.com/national-security/2023/04/22/afghanistan-terrorism-leaked-documents/

Article published on #ReaCT2024 5th Report on Terrorism and Radicalism (order your copy or download the Report in Pdf).