Don't underestimate the terrorism threat

Key evolutions of a warning:

The white powder on the toner cartridge in the bomb scare Photo: CBS

Oct 3 - The United States and Britain warned their citizens of an increased risk of terrorist attacks in Europe, with Washington saying al Qaeda might target transport infrastructure. Western intelligence sources said militants in hide-outs in northwest Pakistan had been plotting coordinated attacks on European cities.

Oct 5 - French police arrested 12 people in early morning raids the interior minister said were directly linked to a campaign to counter an elevated terrorism threat in Europe. France was on high alert after seven hostages, including five French citizens, were kidnapped by the North African wing of al Qaeda last month.

Oct 5 - The French government warned citizens travelling to Britain to exercise caution due to a very high risk of terrorist action in the country that could target public transport and tourist sites.

Oct 6 - Suspected al Qaeda militants attacked two Western targets in Yemen, firing a rocket at a senior British diplomat's car and killing a Frenchman at a gas and oil installation.

Oct 17 - French Interior Minister Brice Hortefeux said France had been warned by Saudi Arabia that al Qaeda was targeting Europe and especially France.

Oct 27 - A Virginia man who allegedly believed he was helping al Qaeda plan bombings at Washington area Metrorail stations was arrested, the U.S. Justice Department said.

Oct 28 - Britain's top spy, in the first public speech by a serving UK espionage chief, said terrorists might hit the West again "at huge human cost" but nuclear proliferation by states was a more far-reaching danger.

Oct 29 - Security officials in Britain and Dubai intercepted parcel bombs being sent from Yemen to the United States in a "credible terrorist threat," President Barack Obama said.

The Jewish organizations in the area and from the US are under alert.

Several high level meetings are expecting to be held today, analyzing the impact and the emergency measures to be taken immediately.

The Death of a Top Indonesian Militant

Scott Stewart

Stratfor

September 23

On Saturday, Sept. 19, the Indonesian National Police announced that a DNA test has positively identified a man killed Sept. 17 as Noordin Mohammad Top. Top was killed in a raid on a safe-house in the outskirts of Solo, Central Java, that resulted in a prolonged firefight between Indonesian authorities and militants. Police said four militants were killed in the incident and three more were taken into custody. (Two of them were arrested before the raid.) Authorities also recovered a large quantity of explosives during the raid that they believe the militant group was preparing to use in an attack on Indonesian President Susilo Bambang Yudhoyono.

Indonesian National Police had reported Sept. 17 that the dead man’s fingerprints matched Top’s. But given several inaccurate reports of Top’s demise in the past, combined with reports that the body believed to be Top’s was headless — perhaps due to the explosion of a suicide belt — most observers were waiting for DNA confirmation before removing Top’s name from the pinnacle of the organizational chart of Tanzim Qaedat al-Jihad.

Now that Top’s name officially has been scratched off the list, big questions emerge: Can Tanzim Qaedat al-Jihad continue without him? Can the group be effective as a militant organization? And who will step up to fill the void left by Top?

The Importance of Leadership

All three of these questions touch on the issue of leadership. Without leadership, militant groups wither and/or disintegrate. Without skilled leadership, militant groups lose their ability to conduct effective attacks. Quite simply, leadership, skill and professionalism make the difference between a militant group wanting to attack something — i.e., possessing intent — and the group’s ability to successfully carry out its intended attack — i.e., its capability.

Although on the surface it might seem like a simple task to find a leader for a militant group, in practice, effective militant leaders are hard to come by. This is because militant leadership requires a rather broad skill set. In addition to personal attributes such as ruthlessness, aggressiveness and fearlessness, militant leaders also must be charismatic, intuitive, clever and inspiring. This last attribute is especially important in an organization that seeks to recruit operatives to conduct suicide attacks. Additionally, an effective militant leader must be able to recruit and train operatives, enforce operational security, raise funds, plan operations, and then methodically execute the plan while avoiding the security forces constantly hunting the militants down.

The importance of leadership to a militant organization has been wonderfully illustrated by the trajectory of al Qaeda’s franchise in Saudi Arabia. Under the leadership of Abdel Aziz al-Muqrin the Saudi al Qaeda franchise was extremely busy in 2003 and 2004. It carried out a number of high-profile attacks inside the kingdom and put everyone from the Saudi monarchy to multinational oil companies in a general state of panic. With bombings, ambushes and beheadings, it seemed as if Saudi Arabia was on its way to becoming the next Iraq. Following the June 2004 death of al-Muqrin, however, the organization began to flounder. The succession of leaders appointed to replace al-Muqrin lacked his operational savvy, and each one proved ineffective at best. (Saudi security forces quickly killed several of them.) Following the February 2006 attack against the oil facility at Abqaiq, the group atrophied even further, succeeding in carrying out one more attack, an amateurish small-arms assault in February 2007 against a group of French tourists.

The disorganized remaining jihadist militants in Saudi Arabia ultimately grew frustrated at their inability to operate on their own. Many of them traveled to places like Iraq or Pakistan to train and fight. In January 2009, many of the militants who remained in the Arabian Peninsula joined with al Qaeda’s franchise in Yemen to form a new group called al Qaeda in the Arabian Peninsula (AQAP) under the leadership of Nasir al-Wahayshi, the leader of al Qaeda in Yemen who served under Osama bin Laden in Afghanistan before being arrested in Iran. Al-Wahayshi was returned to Yemen in 2003 through an extradition deal between the Yemeni and Iranian governments and subsequently escaped from a high-security prison outside Sanaa in 2006.

Al Qaeda in Yemen’s operational capability improved under al-Wahayshi’s leadership, and its operational tempo increased (even though those operations were not terribly effective.) In the wake of this momentum, it is not surprising that the frustrated members of the all-but-defunct Saudi franchise agreed to swear loyalty to him. The first real fruit of this merger was seen inside Saudi Arabia in the Aug. 28 attempted assassination of Saudi Deputy Interior Minister Prince Mohammed bin Nayef. That the plot had to be planned and launched from Yemen reveals AQAP’s weakness inside the kingdom, and the plot’s failure demonstrates that, overall, AQAP is far from an effective organization.

Like the Saudi node, the fortunes of other al Qaeda regional franchises have risen or fallen based upon the ability of the franchise’s leadership. For example, in August 2006 al Qaeda announced with great fanfare that a splinter of the Egyptian jihadist group Gamaah al-Islamiyah had become al Qaeda’s franchise in Egypt. Likewise, in November 2007 al Qaeda announced that the Libyan Islamic Fighting group (LIFG) had joined its constellation of regional groups.

But neither of these new franchise groups ever really got off the ground. While a great degree of the groups’ lack of success may have resulted from the oppressive natures of the Egyptian and Libyan governments — and the aggressive efforts those governments undertook to control the new al Qaeda franchises following the announcements of their creation — we believe the groups’ near total lack of success also stems in large part from the lack of dynamic leadership. Recently, LIFG leaders have issued statements speaking out against al Qaeda’s operational principles and general methodology.

Dynamic leaders are indeed hard to find. Even though Indonesia has an estimated population of more than 240 million, Top — considered the most dangerous and most wanted man in Indonesia before his death — hailed from Malaysia, not Indonesia. He was an outsider like the Jordanian-born Abu Musab al-Zarqawi, who brought al Qaeda in Iraq into the global spotlight.

Of course, not every leadership change is disastrous to a militant group. Sometimes a new leader breathes new life and energy into a group (like al-Wahayshi in Yemen), or the group has competent lieutenants able to continue to operate effectively after the death of the leader (like al Qaeda in Iraq after the death of al-Zarqawi). Top’s replacement, and how the leadership transition affects the group, must therefore be closely monitored.

Topping Top

Top was an accomplished operational commander. He was responsible for a number of terrorist attacks in Indonesia, including the 2002 and 2005 Bali bombings, the 2003 JW Marriott bombing in Jakarta, the 2004 attack on the Australian Embassy in Jakarta, and most recently, the July 17 bombings of the JW Marriott and the Ritz-Carlton in Jakarta.
Because of these attacks, Top and his militant colleagues were under extreme pressure from the Indonesian authorities, who were aided by the Australian and American intelligence services. Many of Top’s closest associates, like Ridhwan Isam al-Deen al-Hanbali and Azahari bin Husin, were arrested or killed, and operations launched by Indonesian authorities thwarted several of the group’s planned attacks between 2005 and 2009.

But external pressure was not the only challenge facing Top. He was also forced to deal with mounting ideological opposition to high-profile terror attacks from within Jemaah Islamiyah itself, a difference of opinion that led to Top’s split with Jemaah Islamiyah and his decision to form the new group Tanzim Qaedat al-Jihad in early 2006.

Yet in spite of all this external and internal pressure, Top was still able to recruit new operatives, secure funding and maintain tight operational security. Top’s penchant for security even sparked rumors that he had some sort of mystical protection, rumors fanned by the many false reports of his capture or death. The ability to operate under such trying circumstances is the mark of a seasoned leader.

In a further challenge to Tanzim Qaedat al-Jihad, two of Top’s key lieutenants also died in the Sept. 17 operation. These were Maruto Jati Sulistyo, thought to have been one of Top’s main bombmakers; and Bagus Budi Pranoto, who had previously served a three-and-one-half-year prison sentence for hiding Top and Azahari. (Pranoto, aka Urwah, was thought to have been a polished recruiter.)

Despite the deaths of Maruto and Pranoto, there are a number of potential successors to Top. Among these are Reno, aka Teddy, the reported deputy of Tanzim Qaedat al-Jihad; Saifuddin Jaelani, who reportedly recruited the suicide bombers responsible for the July hotel attacks in Jakarta; and Jaleni’s brother, Muhammad Syahrir. Of course, someone outside Top’s immediate circle could take up the fallen militant leader’s mantle. Scores of Jemmah Islamiyah militants have been released from prison in recent years, and several skilled militants like Dulmatin and Umar Patek, who have fled to the Philippines, could return. And senior Jemmah Islamiyah militants like Zulkarnaen, who enjoy respect within the group, also remain at large.

No matter who replaces Top, the follow-on investigation to the operation that resulted in the death of Top will surely prove challenging to the future leadership of Tanzim Qaedat al-Jihad. Operations like the one that resulted in Top’s death offer not only the opportunity for capturing or killing militants but also the potential for a huge harvest of intelligence. Indonesian authorities (aided by their allies) are surely attempting to exploit any information gained in the raid in an effort to locate other operatives, safe-houses and weapons caches. Indeed, Top himself was found due to intelligence gathered from the arrest of an associate named Rohmat on the same day as the raid in which Top died. Because of this intelligence windfall, we can anticipate a string of raids by the Indonesian government in the following days and weeks.

And while Top was able to weather such operations in the past, now that he is gone, it remains to be seen if his replacement is capable of withstanding the pressure and keeping the group together and operationally effective.

Disruption vs. Prosecution and the Manchester Plot

Fred Burton and Scott Stewart
Stratfor
April 22

On April 8, British authorities mounted a series of raids in Merseyside, Manchester and Lancashire that resulted in the arrest of 12 men suspected of being involved in a plot to conduct attacks over the Easter holiday weekend. In a press conference the following day, Prime Minister Gordon Brown noted that the men arrested were allegedly involved in “a very big terrorist plot.” British authorities have alleged that those arrested sought to conduct suicide bombing attacks against a list of soft targets that included shopping centers, a train station and a nightclub.

The searches and arrests targeting the suspects purportedly involved in the plot, which was dubbed Operation Pathway, had to be accelerated after Bob Quick, the assistant commissioner of the Metropolitan Police in charge of terrorism investigations, inadvertently allowed reporters to see a classified document pertaining to the operation as he was entering 10 Downing Street to brief Brown and Home Secretary Jacqui Smith on April 8. An embarrassed Quick resigned April 9 over the gaffe.

In spite of the leak, the British authorities were successful in detaining all of the targeted suspects, though the authorities have reportedly not been able to recover explosive material or other bomb-making evidence they were seeking. British authorities arrested 12 suspects, 11 of whom were Pakistani citizens. Smith told British Parliament on April 20 that all 11 of the Pakistani nationals entered the United Kingdom on student visas. The youngest of the Pakistani suspects, who is reportedly still a teenager, was remanded to the custody of British immigration authorities to face deportation proceedings April 9. The rest of the 11 suspects were released by British authorities April 21, though ten reportedly were placed in the custody of immigration officials.

Many of the specific details of the plot have not yet come out, and due to the sensitive nature of the intelligence sources and methods involved in these types of investigations, more details may never be fully divulged now that there will be no criminal trial. However, when viewed in the historical and tactical context of other terror plots and attacks (in the United Kingdom and elsewhere), there are some very interesting conclusions that can be drawn from this series of events and the few facts that have been released to the public so far.

This case also highlights the tension that exists within the counterterrorism community between advocates of strategies to disrupt terrorist attacks and those who want to ensure that terror suspects can be convicted in a court of law.

Targets

Among of the most significant things that have come to light so far regarding the thwarted plot are the alleged targets. According to press reports, the British MI5 surveillance teams assigned to monitor the activities of the purported plotters observed some of them videotaping themselves outside of the Arndale and Trafford shopping centers in Manchester, as well as at St. Ann’s Square, which lies in the center of Manchester’s main shopping district. Other reports suggest that the plotters had also conducted surveillance of Manchester’s Piccadilly train station, an intercity train station that is one of the busiest in the United Kingdom outside London, and Manchester’s Birdcage nightclub.

These targets are significant for several reasons. First, they are all soft targets — that is, targets with very little security. As STRATFOR has pointed out for several years now, since counterterrorism efforts have been stepped up in the wake of the 9/11 attacks, and as the tactical capability of groups like al Qaeda has been degraded, jihadist operatives have had less success targeting hardened targets and have turned instead to striking soft targets.

While authorities have moved to protect high-value targets, there simply are far too many potential targets to protect them all. Governments are stretched thin just trying to protect important government buildings, bridges, dams, nuclear power plants, airports and mass-transit systems in their jurisdiction. The reality on the ground is that there are not nearly enough resources to protect them all, much less every potential location where people concentrate in large groups — like shopping centers and nightclubs. This means that some targets are unprotected and are therefore, by definition, soft.

The selection of soft targets in this case indicates that the alleged Manchester plotters did not possess the operational capability to strike more strategic, high-value targets. While attacks against soft targets can be tragic and quite bloody, they will not have the same effect as a successful attack on high-value targets such as Parliament, the London Stock Exchange or a nuclear power station.

It is also very interesting that the plotters were purportedly looking to hit soft targets in Manchester and not soft targets in London. London, as the capital and a city that has been the center of several plots and attacks, is generally on a higher alert than the rest of the country and therefore would likely be seen as more difficult to target. Additionally, many of the suspects lived in the Manchester area, and as we have previously discussed, grassroots operatives, who are not as well-trained as their transnational brethren, tend to “think globally and act locally,” meaning that they tend to plan their attacks in familiar places where they are comfortable operating, rather than in strange and potentially more hostile environment.

In addition to targeting locations like shopping centers and the train station, where there were expected to be large crowds over the holiday weekend, the alleged plotters also apparently looked at the Birdcage nightclub, an establishment that is famous for its “flamboyant and spectacular” shows featuring female impersonators. This is a location the alleged plotters likely considered a symbol of Western decadence (like establishments that serve alcohol in Muslim countries).

Flawed Tradecraft

As noted above, the alleged plotters had been under surveillance by MI5. This indicates that their operational security had been compromised, either via human or technical means. Furthermore, the suspects did not appear to possess any surveillance detection capability — or even much situational awareness — as they went out into Manchester to conduct pre-operational surveillance of potential targets while under government surveillance themselves. Furthermore, the suspects’ surveillance techniques appear to have been very rudimentary in that they lacked both cover for action and cover for status while conducting their surveillance operations.

This aspect of the investigation reinforces two very important points that STRATFOR has been making for some time now. First, most militant groups do not provide very good surveillance training and as a result, poor surveillance tradecraft has long proven to be an Achilles’ heel for militants. Second, because of this weakness, countersurveillance operations can be very effective at catching militant operatives when they are most vulnerable — during the surveillance phase of the terrorist attack cycle.

Media reports indicated that during Operation Pathway, British authorities intercepted a series of Internet exchanges between the suspects suggested a terror strike was imminent. Furthermore, among the locations raided April 8 was the Cyber Net Cafe in Cheetham Hill, an establishment where British authorities observed the suspects using computers to communicate. Not only is this electronic surveillance significant in that it allowed the authorities to surmise the approximate timing of the attack, but perhaps just as important, this ability to monitor the suspects’ communications will allow the authorities to identify other militants in the United Kingdom and beyond.

Indeed, in several previous cases related to the United Kingdom, such as the investigations involving the U.S. arrest of Mohammed Junaid Babar and the U.K. arrest of Younis Tsouli, authorities were able to use communications from militant suspects to identify and roll up militant cells in other countries. Therefore, we will not be at all surprised to hear at some point in the future that British authorities were be able use the communications of the recently arrested suspects to tip off authorities in the United States, Canada, other European countries or elsewhere about the militant activities of people the suspects were in contact with.

Links to Pakistan

And speaking of elsewhere, as noted above, 11 of the arrested suspects were Pakistani nationals who entered the U.K. on student visas. At this point it is not exactly clear if the British believe the 11 suspects were radical militants specifically sent to the United Kingdom to conduct attacks or if they arrived without malicious intent and were then radicalized in the Petri dish of Islamist extremism that so rapidly replicates inside the British Muslim community — what we have come to refer to as Londonistan.

Many British lawmakers and media reports have made a huge issue out of the fact that 11 of the alleged plotters entered the United Kingdom on student visas, but even if the suspects were radicals who used student visas as a way to enter the United Kingdom, this is by no means a new tactic as some are reporting. STRATFOR has long discussed the use of student visas, bogus political asylum claims and other forms of immigration fraud that have commonly been used by militants. In fact, there have been numerous prior examples of jihadist operatives using student visas, such as the following:

• While Sept. 11 hijackers Mohamed Atta and Marwan al-Shehhi initially entered the United States on tourist visas, they were approved for M-1 student visas shortly before carrying out their attacks.

• Youssef Samir Megahed, who was arrested in possession of an improvised explosive device (IED) in August 2007 and later sentenced to a 15-year prison sentence, was a Kuwaiti engineering student who entered the United States on a student visa.

• Mohammed Aatique, a convicted member of the “Virginia Jihad Network” who was sentenced to 10 years in prison for conspiracy and weapons violations, also entered the United States from Pakistan as an engineering student.

In some ways, connections between the alleged plotters and militant groups in Pakistan such as al Qaeda or the Tehrik-i-Taliban Pakistan (TTP) would be more analytically significant than if they turn out to be grassroots operatives. The operational security, skills and terrorist tradecraft exhibited by the plotters are about what one would expect to see in a grassroots militant organization. This level of sophistication is, however, far less than one would expect from a transnational organization. Therefore, if this was an al Qaeda operation, it shows how far the group has fallen in the past eight years. If it was the TTP, it means that our previous estimate of their operational ability outside of Pakistan was fairly accurate.

Lack of Evidence

To date, the British authorities have not been able to find the explosive material and IED components they were expecting to find. This might mean that the materials may still be hidden somewhere and could be used in a future attack. It is also quite possible, and perhaps more likely, that this lack of evidence is an indication that the plot was not quite as far along as the British authorities believed. Perhaps the references the suspects allegedly made to launching the attack on a bank holiday pertained to a holiday later in the year.

While the plot as described by the British authorities would not have been a significant, strategic threat to the United Kingdom, it could have been quite deadly and could very well have surpassed the July 7, 2005, attacks in terms of final body count. Because of this potential destruction, it is quite possible that the British government decided to err on the side of disruption rather than on the side of prosecution. This is something we have seen in the investigation of several other plots in recent years in the United Kingdom and elsewhere, perhaps most notably in the August 2006 Heathrow plot, in which a cell of operatives was preparing to bomb a series of trans-Atlantic airline flights using liquid explosives.

It is much more difficult to obtain a conviction for a conspiracy to commit an act of terrorism than it is to obtain a conviction for an attack that was successfully conducted. Once the attack is executed, there is no longer much room to wrangle in court over things such as intent or capability. Governments also frequently know things via intelligence they cannot prove to the standards required for a conviction in a court of law.

This was seen in the Heathrow case, where only three of the eight suspects were convicted of the main charges during that trial, which ended in September 2008. (The other five suspects had pled guilty to lesser charges.) During that case there was reportedly some tension between the U.S. and British authorities over when to wrap up the Heathrow plotters — some of the British apparently wanted to wait a while longer to secure more damning evidence, while the Americans were reportedly more interested in ensuring that the plot was disrupted than they were in obtaining convictions. It is likely the same dynamic was at play during the investigation of the Manchester case.

Although Quick’s disclosure did hasten the launch of Operation Pathway by a few hours, it did not significantly alter the timing of the investigation — the British authorities were preparing to execute an array of searches and arrests. From an ethical standpoint (and, not insignificantly in this day and age, a political aspect) it is deemed better by many to disrupt a plot early and risk the terror suspects being acquitted than it is to accidentally allow them to conduct an attack while waiting to gather the evidence required for an ironclad court case. Disruption can have an impact on the success of prosecutions, but in the eyes of a growing number of policymakers, that impact is offset by the lives it saves.