Signs of Resurgence from the Islamic State
Despite markedly less frequent reports of attacks from the Islamic State (IS) in the past year, a recent UN report indicates that the extremist organization may be primed for a resurgence. A breakdown of attack data shows that the group is reorganizing in two main regions: Iraq/Syrian Arab Republic (ISAR), which is considered the IS core due to the large amount of fighters and resources in the region, and Western Africa. The former is a consolidation of what remains of their territorial control established at their peak 5 years ago, the latter represents a new focus of the group and exists as a safety net in the event that they are ever forcefully driven from the ISAR region. The organization also exists in a significant capacity in Southeast Asia and sporadically in Europe. Each of these regions provide distinct advantages to the IS core (ISAR). Any number of these regions can be fought directly, but due to the web-like nature of support they each receive, a stronger method of attack may be to instead sever the ties connecting each region before targeting the regions directly.
A report from the United Nations Security Council published on January 20, 2020 describes more activity from IS in the ISAR region in the past few months. Attacks have been bolder and there have been a number of calls to organize breakouts of detention facilities in the area. Further, it is expected that the recent change in leadership, as discussed in a previous CTG report, is unlikely to affect any propaganda, recruitment, or attack efforts. IS is estimated to retain financial reserves of $50 million-$300 million and will likely use these funds to continue supporting its ties to affiliates abroad.
An examination of the geographical location of IS attacks since 2016 illuminates the shifts in their territorial control in the past few years. In 2016, the extremist organization exhibited control over a large swatch of the Middle East, claiming control of a large number of areas from Turkey, to Iran, to Saudi Arabia. Their strongest presence in 2020 is still in the same location, but is concentrated into a much smaller area, namely the North Eastern peak of Syria and nearby localities in Iraq. In 2016, IS also had a considerable presence in Northern Africa, but this has since shifted further Southwest in the continent.
In the ISAR region, where much of IS’s core fighters and resources exist, a number of methodology shifts are being observed, and such changes shed considerable light on the future impact and capabilities of the organization. In the past, IS has vehemently discouraged the employment of women among their ranks, but this ideology has begun to fall out of favor in the ISAR region (and this shift has subsequently spread to some foreign affiliates as well). In this area, women associated with IS are often used to transport gemstones and gold since they are less likely to arouse suspicion. In addition, attacks in this region have increasingly utilized remote IEDs. Leadership in this area frequently makes payments to the widows and orphans of deceased fighters. In doing so, they demonstrate the loyalty espoused by the group, and sow support from future generations of fighters. In concert, these changes are resulting in lowered rates of detection, attacks with fewer IS fatalities, and increased recruitment. There are a number of additional distinctions that merit further discussion, however it would be a disservice (from this point forward) to not distinguish between the aspects relevant to the Syrian Arab Republic versus those pertinent to Iraq.
Between July and September of 2019, IS strongly reconstituted their forces in the Northeastern portion of Syria, known as the Syrian Arab Republic (SAR), in a manner very similar to what was observed in Iraq in 2017. This reconstitution followed an audio message released on September 16, 2019 from IS leader al-Baghdadi which stated the need to focus more on this core region and, more importantly, the paramount importance of freeing detained IS fighters. Perhaps counterintuitively, despite being condensed into a smaller area than they have been in the past, the rate of attacks has risen. It seems likely that this is due to the decreased need to expend fighters on defending territory, allowing for more attacks. Within the SAR, many relocated fighters reside in the Idlib province, and due to security and counterterrorism deficiencies in the Anbar province, fighters are allotted a greater degree of movement. This freedom has only been compounded by the removal of US troops from the region. In the absence of US forces, security personnel in the SAR are experiencing an increasing challenge in maintaining control over the near 10,000 IS fighters and family members who are currently detained in a number of improvised and overcrowded holding facilities in the area. In October 2019 alone, several hundred individuals associated with IS escaped their accommodations. Of the 100,000 individuals in these facilities, 10,000 are estimated to be male fighters. The largest facility, Hawl Camp, contains over 70,000 individuals, and therefore presents itself as a critical target for IS operations. As of November 2019, IS is operating far more openly in this area and has even conducted extortion operations in daylight hours. These audacious actions suggest an increased confidence, likely backed by a stronger presence, and therefore underscore the need of heightened security among detention facilities. Visual evidence obtained in the SAR demonstrates the long-distance ties that IS maintains around the globe; the organization boasts access to an array of small arms including Steyr AUG assault rifles, Dragunov sniper rifles, AGS-17 automatic grenade launchers, TOW anti-tank missiles and 82-mm mortar shells manufactured in Serbia.
As of July 2019, an estimated 1,000 IS fighters resided in Western Iraq, the area closest to the SAR. In fact, the borders between these areas are poorly secured, which has allowed for increased IS activity in areas such as Dayr al-Zawr and Hasakah Governorates. In Iraq, IS is mainly financed through their involvement in legitimate businesses and commercial fronts, though as their numbers grow they have been engaging in bolder methods (such as establishing fake checkpoints and disguising themselves as Iraqi military). As this area plays such a critical role in IS financing, the destabilization of the region as a result of recent US-Iran tensions is of particular concern. The actions taken in Iraq by both the United States and Iran have disrupted certain areas of the country which allows for openings that IS can capitalize on.
Outside of the core area of ISAR there are an estimated 20,000-27,000 additional fighters. Not only does IS maintain a presence in conflict zones such as areas of Africa and the Arabian Peninsula, but they also exist in locations across Europe and Southeast Asia.
The main goal of IS in Africa appears to be the development of operational command centres in order to ensure their survival following the contingency of a defeat in ISAR. Of all the IS African branches, the Islamic State in the West African Province (ISWAP) in the Lake Chad Basin is the most successful. Their strong presence along the tri-border of Burkina Faso, Mali, and Niger is bolstered by the weapons and supplies that they have obtained from raids on Nigerian security forces as well as arms obtained from the Libyan conflict. This has allowed ISWAP to exert a great deal of pressure on security forces south of routes nationales 16 and 20 in Mali. As a result, since July 2019, over 100 security personnel have been killed in Mali, as well as 85 in Niger and 30 in Burkina Faso. Due to the strength posed by ISWAP they have been able to stage sieges on large military camps in order to maintain and even grow their supplies of weapons, ammunition, and vehicles. The presence of IS in Northern Africa is far less prominent and only 100-200 fighters are estimated to remain in Libya following the airstrikes in Sabha Province in early November. This is a strong pressure point for counterterrorism forces since this will be the necessary path of retreat for IS forces as they are driven out of ISAR. However, the lessened number of fighters in this region also means that they demand a proportionally lower financial burden. In turn this allows for greater operational freedom and the remaining extremists have frequently engaged in small hit and run operations in coastal cities. It is hypothesized that the decreased presence in Libya may motivate attacks on oil facilities in Murzuq in order to gain publicity. East Africa is largely dominated by Al-Qaeda associated extremists, but reports of the lower wages and limited privileges given to these members may lead to dissention to IS. Finally, the Islamic State in the Central African Province (ISCAP) is estimated to have 2,000 members. ISCAP activity has, until recently, been insignificant in comparison to other branches. However as of late there has been an observable improvement in ISCAP propaganda materials which alludes to an increase in funding.
In the Arabian Peninsula IS has frequently clashed with Al-Qaeda in the Arabian Peninsula (AQAP), and despite frequent defeats they continue to be supported by Houthi militants in Yemen who benefit from any further destabilization of the country. This assistance presents largely in the form of tactical help, prisoner exchanges, and the handover of military camps. On November 7, IS media outlets published photos of members graduating from sniper and explosives courses in Bayda’, but their presence in Yemen still remains tremendously narrow.
Outside of such conflict zones, IS has largely been unable to re-establish a strong presence, and so these branches are expected to be financially self sufficient (though financial support does flow outward from the IS core) and often rely on inspired attacks (which are notably lower impact). For example, attacks in Europe have been largely crippled by the Europol November 2019 operation which removed a significant portion of online IS material. This severely lowered the capability of the organization to radicalize online and use online tutorials. That said, Europe has many radicalized prisoners and therefore the facilities that house them present themselves as advantageous targets. In fact, over 1000 returnees are due for release in 2020. Additionally, European foreign terrorist fighters have established a robust financing network which pumps assets to ISAR through Turkey. IS in Southeast Asia contributes significantly to the recruitment efforts; new recruits have historically been sent to ISAR but recently have been sent instead to Afghanistan which has an estimated 2500 fighters (2100 of which are concentrated in the Kunar Province). In this area recruitment is largely done through the internet. In the Southern Philippines space is often used for training, planning, and recruitment. Counterterrorism efforts in this region are often made difficult as a result of fighters that return from ISAR since these extremists often bring with them improved capabilities and unfamiliar attack methodologies. In addition, the aforementioned usage of female participation has extended to this area as well, leading to their use for transactions and fundraising under the guise of charity. Outside of this, funds are occasionally obtained through kidnapping for ransom, extortion, and smuggling.
Given this tenacious network of global affiliates, it is unsurprising that the UN report warned of an IS resurgence. It’s for this reason that timely intervention is essential to quashing the revival of the organization. The largest priority should be the rebuilding of any holding arrangements that contain extremist fighters. As they currently exist, most of these facilities are overcrowded and are therefore a breeding ground for animosity and radicalization. Regardless of past actions, the humanitarian conditions of these facilities must be improved for all residents because repatriation is the single best option for combatting the extremist threat in the long term. IS has already announced that their primary goal is the freeing of prisoners from such facilities, and so increased security and rehabilitation within these facilities should be the first priority of counterterrorism operations. On top of this, while large strides have been made to target online extremism, there much more that can be done. Especially in Southeast Asia, Facebook groups are used to fund ISIL through antiquity trafficking. Finally, an emphasis should be placed on cutting the ties between ISAR and affiliate branches instead of focusing on the extremist hotspots themselves. In effect, each of the affiliate branches contribute to a critical aspect of IS’s survival; IS in Africa is where IS will reform following a defeat in ISAR, IS in Europe contributes largely to the organizations funding, and IS and Southeast Asia feeds largely into the recruitment efforts of the extremist group. In turn, IS in ISAP is able to provide these affiliate branches with anything needed to further their efforts. This bidirectional flow of support makes it very difficult to target any location directly and so efforts would more effectively be used to secure borders and common transportation and travel routes in order to isolate each branch before dismantling the individual operations.
An examination of the IS attack and fatality data over the past two years presents a noteworthy trend. The number of attacks each month has decreased substantially but the number of fatalities has not followed a comparable trend. Instead, the number of fatalities per attack has actually been increasing. The development of smaller IS splinter cells that have less territory to defend allows for more independent attacks that are, as a result, more spontaneous and harder to preemptively intercept.
CTG’s primary role in combating the IS threat lies in our Threat Hunter division, which constantly monitors online communications and social media. When a threat is detected, it is immediately reported to the proper authorities. Since social media plays a large role in IS radicalization and funding, it is vital to target online communications in order to defeat the extremist threat. CTG’s Behavior and Leadership Team has also established a behavioral and tactical profile of IS activity in order to better predict future actions and to identify fundamental aspects of the organization that must be targeted in order to disassemble it in the most efficient way possible.
The Counterterrorism Group (CTG)
 Twenty-fifth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities, United Nations Security Council, January 2020, https://www.un.org/en/ga/search/view_doc.asp?symbol=S/2020/53
 A map of terrorist attacks, Esri, 2020, https://storymaps.esri.com/stories/terrorist-attacks/
 Islamic State Poised for Comeback, US Defense Officials Report, VOA News, February 2020, https://www.voanews.com/middle-east/islamic-state-poised-comeback-us-defense-officials-report
 Map of detention facilities and camps for internally displaced persons in the north-east of the
Syrian Arab Republic by United Nations Security Council,
 Trump's dangerous stand-off with Iran is allowing ISIS to plan more attacks in the ensuing chaos, Business Insider, January 2020, https://www.businessinsider.com/fighting-between-iran-us-may-help-isis-revival-in-iraq-2020-1
 EUROPOL AND TELEGRAM TAKE ON TERRORIST PROPAGANDA ONLINE, Europol, November 2019, https://www.europol.europa.eu/newsroom/news/europol-and-telegram-take-terrorist-propaganda-online