security policy related to a bomb threat

CONGRESSIONAL TESTIMONY: FOUNDATION FOR DEFENSE OF DEMOCRACIES

House Committee on Oversight and Government Reform Subcommittee on National Security, Subcommittee on Government Operations

Radicalization in the U.S. and the Rise of Terrorism

DAVEED GARTENSTEIN-ROSS

Senior Fellow Foundation for Defense of Democracies

Chief Executive Officer Valens Global

Washington, DC September 14, 2016

www.defenddemocracy.org

Daveed Gartenstein-Ross September 14, 2016

1

Foundation for Defense of Democracies www.defenddemocracy.org

Chairman DeSantis, Chairman Meadows, Ranking Member Lynch, and Ranking Member

Connolly, and distinguished members of both subcommittees, on behalf of the Foundation for

Defense of Democracies, it’s an honor to appear before you to discuss today’s topic.

This country is in the midst of the largest spike in homegrown jihadist terrorist activity that it has

ever seen, both in the overall number of cases and also the number of fatalities caused by

terrorists claiming to act in service of the jihadist cause. While I assess jihadism to remain the

top domestic terrorist threat, adherents to several other U.S.-based movements have also engaged

more frequently in terrorist violence in recent years, including members of the anti-government

Sovereign Citizens movement, and both white nationalists and black nationalists.

This testimony will first show that the problem of terrorism is growing in scale. It then argues

that both analysts and the media have an unjustifiable default assumption that relatively small-

scale attacks have likely been carried out by “lone wolves.” This prevalence of this assumption

was crystal clear in the wake of Omar Mateen’s bloody June 2016 attack in Orlando.

The Growing Threat of Terrorism

By the end of last year, it was demonstrable that the United States was in the midst of an

unprecedented surge in jihadist militant activity. This pattern could also be discerned in other

Western countries.

By now, federal prosecutors have charged over 100 people in the U.S. in connection with Islamic

State (ISIS) activity.1 But when looking beyond criminal charges, the magnitude of the problem

becomes more clear. In one of the most rigorous studies examining ISIS’s presence and activities

in America, Lorenzo Vidino and Seamus Hughes of George Washington University’s Program

on Extremism wrote:

In June 2015 the FBI states that “upwards of 200 Americans have traveled or

attempted to travel to Syria to participate in the conflict.” A few weeks later, the

Office of the Director of National Intelligence estimated that more than 250

individuals from the U.S. had traveled or attempted to travel to the conflict area, a

few dozen had joined the ranks of ISIS, and some 20 had died.

Moreover, the surge in the number of American foreign fighters is small

compared to those who sympathize with and embrace ISIS’s ideology. American

authorities have consistently said that the popularity of ISIS’s propaganda, driven

largely by its savvy social media tactics, wholly overshadows that of al Qaeda.

Tellingly, in May 2015 FBI Director James Comey spoke of “hundreds, maybe

thousands” of ISIS sympathizers and potential recruits across the country,

disclosing that the Bureau had related investigations running in all 50 states. A

1 See Adam Goldman, Jia Lynn Yang and John Muyskens, “The Islamic State’s Suspected Inroads into America,”

Washington Post, updates August 8, 2016, https://www.washingtonpost.com/graphics/national/isis-suspects/.

Daveed Gartenstein-Ross September 14, 2016

2

Foundation for Defense of Democracies www.defenddemocracy.org

few months later, in October 2015, Comey revealed that the FBI had a staggering

900 active investigations against homegrown violent extremists.2

These trends have remained consistent since. The amount of domestic jihadist activity is far

greater than it has been in any previous period, including the spike in homegrown terrorist cases

in 2009-10. The number of attacks is also growing across various Western countries, as this

graphic recently produced by terrorism researcher Sam Mullins makes clear:

It has become an item of received wisdom that the jihadist threat we face in the United States is

not the same as that which confronts the Europeans. This is true for a variety of reasons—

including the American Muslim community’s level of integration and affluence—but these are

not normal times in terms of the domestic threat of jihadism. Several factors are pushing the

level of risk steeply upward. First, the explosion of jihadist social media usage, and the

proficiency with which these groups use the online space, has created far more mobilization than

we have seen in any previous period.3 Second, the bloody Syria conflict—in which jihadists have

managed to become a significant power on the battlefield—has had a tremendously galvanizing

impact. Third, the growing pressure put on Muslims’ place in American society, including the

2 Lorenzo Vidino and Seamus Hughes, ISIS in America: From Retweets to Raqqa (Washington, DC: Program on

Extremism, George Washington University, 2015), p. 4. 3 For more on jihadist use of social media, see, e.g., Daveed Gartenstein-Ross & Nathaniel Barr, “The Social

Science of Online Radicalization,” War on the Rocks, October 29, 2015; J.M. Berger and Jonathon Morgan, The

ISIS Twitter Census: Defining and Describing the Population of ISIS Supporters on Twitter (Washington, DC: The

Brookings Institution, 2015) (describing ISIS’s use of Twitter at the group’s height on that platform); J.M. Berger

and Heather Perez, The Islamic State’s Diminishing Returns on Twitter: How Suspensions Are Limiting the Social

Networks of English-Speaking ISIS Supporters (Washington, DC: George Washington University Program on

Extremism, 2016) (describing ISIS’s growing challenges on Twitter after the platform focused on account

takedowns).

Daveed Gartenstein-Ross September 14, 2016

3

Foundation for Defense of Democracies www.defenddemocracy.org

focus put on the issue in this year’s presidential campaign, may further the sense of grievance

within this community.

And jihadism is far from the only domestic terrorist challenge that we face. Anti-government

violence has been growing as well. Here are some examples from the past several years:

 2010: Man flies plane into IRS building in Texas; police officers killed by Sovereign Citizens in Arkansas.

 2011: Alaska Peacemakers Militia members arrested and charged with plotting to kill or kidnap state troopers and a Fairbanks judge; Georgia militia members arrested in an

alleged plot to bomb federal buildings, attack Atlanta and other cities with ricin, and

murder law enforcement officials.

 2012: Sovereign Citizens ambush and murder police in Louisiana.

 2013: Sovereign Citizens arrested in Las Vegas allegedly had plans to execute random police officers.

 2014: Robert Talbot, Jr. arrested for alleged scheme to launch “American Insurgent Movement”; antigovernment extremists murder two police officers in Las Vegas.

 2015: Antigovernment Sovereign Citizen arrested prior to alleged coup plot in West Virginia.

 2016: Armed occupation of the Malheur National Wildlife Refuge.

There has also been disturbing racially-motivated violence in recent years that can be

characterized as terrorism. Recent examples of white nationalist/racist violence include:

 2011: David Pedersen and Holly Grigsby engaged in a multi-state killing spree, killing four in three states.

 2012: Wade Michael Page murdered six people during an attack on a Sikh temple in Oak Creek, Wisconsin.

 2014: Frazier Glenn Miller opened fire at Jewish institutions in Overland Park, Kansas, killing three.

 2015: Dylann Storm Roof, hoping to incite a race war, killed nine African-American churchgoers at a bible study; a group of white separatists shot five African-Americans at

a Black Lives Matter protest.

 2016: Three people were stabbed during clashes at a Ku Klux Klan rally in Anaheim.

There have also been black nationalist-related acts of terrorism, often related to the shootings of

African Americans by police officers that have also helped to spur the Black Lives Matter

movement. Gavin Long and Micah Johnson are recent examples of this phenomenon.

As we see sub-state violence growing across several countries, including our own, one factor I

would point to as particularly significant is social media, which I mentioned previously. Social

media can make fringe causes embraced by disparate individuals more popular, and can hasten

mobilization. This is true of both non-violent protests and also sub-state violence.

The Orlando Attack and the Over-Categorization of Lone Wolf Terrorism

Daveed Gartenstein-Ross September 14, 2016

4

Foundation for Defense of Democracies www.defenddemocracy.org

Omar Mateen, who struck the Pulse nightclub in Orlando on June 12, 2016, wanted the world to

associate his attack with ISIS. Mateen felt so strongly about this that he took time out of his

rampage to call 911 and swear allegiance to ISIS leader Abu Bakr al-Baghdadi. For its own part,

ISIS was happy to associate itself with his attack. The group’s Amaq News Agency has

described Mateen as a “fighter from the Islamic State.”

But should the Pulse attack be considered an “ISIS attack”? Almost immediately, commentators

and experts referred to it as an act of lone wolf terrorism, the implication being that both Mateen

and ISIS overstated his connection to the jihadist organization. The rush to label Orlando an act

of lone wolf terrorism is part of a broader trend, one that has proven costly in the recent past.4

We can see the tendency to quickly label attacks as lone wolf in other recent incidents. On July

14, Mohamed Lahouaiej Bouhlel, a Tunisian national residing in France, killed over 80 and

wounded hundreds when he ploughed a 19-ton cargo truck through crowds celebrating Bastille

Day in the southern French city of Nice. Mere days after the Nice massacre, a 17-year-old

Afghan migrant seeking asylum in Germany attacked passengers on a train in Würzburg with an

axe and a knife, wounding four before police killed him. A suicide bombing on July 24 injured

15 in the German city of Ansbach, and on July 26, two attackers claiming allegiance to ISIS

stormed a church in a suburb of the French city of Rouen, slit an 84-year-old priest’s throat, and

took hostages.

These incidents are part of the aforementioned trend of increasing violence carried out by lone

individuals. Analysts, journalists, and scholars were quick to label each perpetrator of these

recent attacks as lone wolves: individuals who lacked substantial connections to ISIS or other

jihadist groups, and who carried out their operations without the assistance of others. The

designation has generally been applied within 24 hours of these attacks, before significant

intelligence about an incident’s planning and execution has emerged—and long before

authorities have concluded their investigation. Observers have repeatedly erred by definitively

categorizing attacks as lone-wolf operations when they would later turn out to be connected to

broader cells or networks.

The tendency to view lone attackers as unconnected to the broader ISIS organization prevented

observers from fully comprehending the magnitude of the network that was behind the complex

coordinated attacks in Paris and Brussels. In April 2015, Sid Ahmed Ghlam, an Algerian national

studying in France, called for medical help after accidentally shooting himself in the leg while

handling a firearm. Authorities’ investigation revealed that Ghlam, who was in possession of

several guns, was planning to attack churches in the Paris area, and may have been involved in

the murder of a woman found dead in a Paris suburb. In August 2015, three Americans restrained

Ayoub El-Khazzani, a 25-year old Moroccan national, before he could open fire on passengers

traveling by train from Amsterdam to Paris.

At the time, the two attacks were seen as disconnected, with Khazzani generally labeled a lone

wolf. And the bumbling incompetence of both incidents—Ghlam shot himself, while Khazzani’s

weapon jammed before he could get off a shot—made the attacks seem like the work of

amateurs. Meanwhile, ISIS fueled perceptions that it was primarily interested in inspiring lone-

4 For more on this point, see Daveed Gartenstein-Ross & Nathaniel Barr, “The Myth of Lone Wolf Terrorism,”

Foreign Affairs, July 26, 2016, from which parts of this section are adapted.

Daveed Gartenstein-Ross September 14, 2016

5

Foundation for Defense of Democracies www.defenddemocracy.org

wolf attacks rather than guiding them, with a pro-ISIS media outlet producing a propaganda

video shortly after Khazzani’s botched attack calling on “lone lions” to kill the group’s enemies.

But after the devastating November 2015 attacks in Paris, it became clear that initial judgments

had been wrong. A March 2016 New York Times article by Rukmini Callimachi detailed how

Abdelhamid Abaaoud, the ground commander of the Paris attacks, had directed Ghlam,

Khazzani, and several others to carry out attacks in Europe, even as he was preparing the Paris

operation.5 Although he of course wanted these small-scale plots to succeed, they also helped

deflect attention from ISIS’s more sophisticated operational planning, serving as a “smoke

screen” that allowed the group to “calmly prepare” its future operations, in the words of one

French official. Because counterterrorism analysts and officials viewed Ghlam, Khazzani, and

other attackers as unrelated to one another, they did not identify the operational infrastructure

involved in coordinating ISIS’s various attacks in Europe.

The failure to identify common ties between supposed lone wolves and ISIS is part of a broader

and long-standing pattern of underestimating the scope of jihadist networks in the West. An

official inquiry into the July 7, 2005, terrorist attacks in London, for example, described the cell

that carried it out as autonomous and self-actuating rather than tied to al-Qaeda.6 The idea that

the London bombings were unrelated to al-Qaeda was definitively refuted by a commemorative

video the group released in July 2006, which showed a martyrdom tape recorded by cell leader

Mohammad Sidique Khan. Al Qaeda’s then-deputy emir, Ayman al-Zawahiri, revealed that

Khan and fellow plotter Shehzad Tanweer had visited al-Qaeda’s training camps in Pakistan

“seeking martyrdom,” an account that has been corroborated by Western intelligence agencies.

Bob Ayers, a security expert at London’s Chatham House, commented when the new video was

released, “It makes the police look pretty bad. It means the investigation was either wrong, or

they identified links but were reluctant to reveal them.”7

Since then, officials and analysts have often continued to ignore attackers’ ties with broader

networks. Part of the reason for the consistent failure may lie in a desire to avoid culpability;

observers may perceive attacks carried out by networks as something officials should have

prevented, but potential lone attackers are notoriously difficult to spot. Another reason may be a

desire to downplay networks due to policy preferences, such as wanting to avoid taking kinetic

action against the networks driving these attacks. But it is a mistake to conflate facts with policy

preferences, and the truth is that terrorists’ ties to broader networks are frequently overlooked.

The idea that lone-attacker plots carried out in 2016 were the work of individuals is already

being discredited. When ISIS claimed responsibility for the July 2016 Würzburg train attack, the

group released a video featuring the perpetrator that demonstrated ISIS had advance knowledge

of his strike. Less than a week after the Nice attack, French authorities revealed that Lahouaiej

Bouhlel may not have acted alone, as several individuals were detained. One suspect had posed

5 Rukmini Callimachi, “How ISIS Built the Machinery of Terror under Europe’s Gaze,” New York Times, March 29,

2016. 6 House of Commons, Report of the Official Account of the Bombings in London on 7th July 2005 (May 11, 2006),

available at http://news.bbc.co.uk/2/shared/bsp/hi/pdfs/11_05_06_narrative.pdf. 7 Sean Alfano, “Video: 2 London Bombers Were Qaeda,” CBS News, July 7, 2006,

http://www.cbsnews.com/news/video-2-london-bombers-were-qaeda/.

Daveed Gartenstein-Ross September 14, 2016

6

Foundation for Defense of Democracies www.defenddemocracy.org

for pictures in the truck that Lahouaiej Bouhlel drove through a celebrating crowd. The

perpetrator had sent a text message to an alleged coconspirator minutes before the attack

requesting “more weapons.”

The nature of radicalization and operational planning in the digital age has complicated efforts to

interpret and analyze attacks perpetrated by single individuals. Jihadists plotting murders in the

West used to congregate in person, meeting in small groups in underground mosques, houses, or

other discrete locations. Radicalization occurred through in-person contact. Counterterrorism

officials looked for physical hubs of recruitment, tapping phones and scanning surveillance

videos for evidence that cells were meeting.

But with the social media boom and the growth in encrypted communications, radicalization and

operational planning can easily take place entirely online. ISIS has capitalized on evolving

communications technologies, building cohesive online communities that facilitate

radicalization. The group has also established a team of “virtually planners” who use the Internet

to identify recruits, and to coordinate and direct attacks, often without meeting the perpetrators in

person. Junaid Hussain, a British ISIS operative who was killed in August 2015, played the role

of virtual planner for the May 2015 strike against the Draw Muhammad contest in Garland,

Texas. Hussain had communicated online with attacker Elton Simpson beforehand, and was the

first to celebrate it on social media. It may take months—or longer—to detect the role of virtual

planners in attacks.

The changing nature of operational planning underscores the need for a new paradigm for

understanding the relationship between single attackers and networks. It no longer makes sense

to apply pre-digital-age thinking to jihadist attacks perpetrated in the age of Twitter, Telegram,

and end-to-end encryption.

Instead, it is useful to think of four categories of attacks, with descending connections to a

network. The first category consists of operations in which the attacker was trained and

dispatched by an organization. Reda Hame, who traveled to Syria and received weapons training

from Abaaoud before being sent back to Europe, fits this mold. The second category is attackers

in touch via social media with virtual planners such as Hussain, who help set targets, determine

the timing of the attack, and provide technical assistance. The third category is operatives who

are in contact with a militant group via online communications but do not receive specific

instructions about carrying out an attack. Finally, the fourth category comprises the true lone

wolves, individuals who strike without ever communicating with jihadist networks.

It is clear that few of the jihadists labeled lone wolves truly fit that definition. Recently, it seems

that Europeans have been quicker to absorb that lesson. For example, after the recent gas

canisters plot was foiled in France, it took little time for prosecutors to determine that the

attackers had been directed by ISIS.8 It’s not clear that we have absorbed that lesson in the U.S.,

but there are also networks at play in this country.

8 Camille Verdier, Steve Visser and Margot Haddad, “French Prosecutor: Women Who Planned Attack Were

Directed by ISIS,” CNN, September 9, 2016, http://www.cnn.com/2016/09/08/world/france-arrests-gas-cylinders-

notre-dame/.

Daveed Gartenstein-Ross September 14, 2016

7

Foundation for Defense of Democracies www.defenddemocracy.org

ISIS’s External Operations and the State of Networked Terrorism

Currently networked terrorism is a far more powerful threat to Western countries than it has been

in years, due to both a rise in mobilization to violence as well as a remarkable improvement in

terrorist tradecraft due to numerous factors, including the explosion in end-to-end encryption.

This section first looks at the network that recently carried out the Paris and Brussels attacks as

an example of how networks function in 2016.9

The recent attacks in Paris and Brussels represent a watershed moment not just for ISIS, but for

the entire jihadist movement. The attacks mark the first time that a single jihadist network

succeeded in carrying out two separate mass casualty attacks in Europe. In the past, when

jihadist networks struck in Europe, they were pursued with the full weight of European security

and intelligence services, and relevant perpetrators were neutralized before they could mount a

second attack.

ISIS’s successes are the result of a complex strategy executed by officials in the Amn al-Kharji,

a shadowy wing of ISIS’s bureaucracy responsible for selecting and training external operatives

and for planning terrorist attacks in areas outside of ISIS’s core territory, including those in

Europe. Though ISIS’s attacks and plots in Europe have received a great deal of media attention,

the Amn al-Kharji has largely stayed out of the spotlight. This aversion to publicity is deliberate,

and demonstrates the Amn al-Kharji’s importance to ISIS. While ISIS’s military branches in

Syria and Iraq readily advertise their exploits, the Amn al-Kharji is shrouded in secrecy,

sometimes employing disinformation to mislead intelligence agencies. Nonetheless, enough

information now has emerged in open-source reporting to paint a picture—however

incomplete—of the Amn al-Kharji.

The most detailed information on the Amn al-Kharji comes from an interview given by an ISIS

defector, known only as “Abu Khaled.”10 According to Abu Khaled, the Amn al-Kharji is one of

four agencies that fall under ISIS’s amniyat, or security apparatus. The other three agencies are

the Amn al-Dawla, which is responsible for internal security within ISIS’s territory; the Amn al-

Dakhili, which is akin to an interior ministry; and the Amn al-Askari, or the military intelligence

wing. Abu Khaled, a former member of the Amn al-Dawla, explained that the Amn al-Kharji

was responsible for conducting espionage and terrorist attacks in enemy territory, and that the

agency had developed intricate tactics enabling its operatives’ infiltration. Indeed, long before

the Amn al-Kharji put its attack plans for Brussels and Paris into motion, the branch spearheaded

operations behind enemy lines in Syria and Iraq. By the time ISIS began investing serious

resources in European operations, the Amn al-Kharji had already refined its tradecraft for attacks

outside ISIS-controlled territory.

Abu Khaled’s testimony sheds light on key players within the Amn al-Kharji’s opaque structure.

According to Abu Khaled, Abu Muhammad al-Adnani, ISIS’s late spokesman who served as one

of the organization’s top officials until his death, appointed the commanders of each of the

9 For more on this point, see Daveed Gartenstein-Ross & Nathaniel Barr, “Recent Attacks Illuminate the Islamic

State’s Europe Attack Network,” Jamestown Foundation, April 27, 2016, from which parts of this section are

adapted. 10 Michael Weiss, “Confessions of an ISIS Spy,” Daily Beast, November 15, 2015.

Daveed Gartenstein-Ross September 14, 2016

8

Foundation for Defense of Democracies www.defenddemocracy.org

amniyat’s four branches. Other reports identified the Syria-born Adnani as the operational

commander of the Amn al-Kharji. However, given Adnani’s role in managing multiple agencies

within ISIS, it is highly likely that his position in the Amn al-Kharji had been largely

bureaucratic. That is, Adnani likely signed off on external operations, but was not involved in

operational planning.

Rather, responsibility for directing

ISIS’s external operations falls to

an elusive figure known by his

kunya (nom de guerre), Abu

Sulayman al-Faransi. Despite his

prominent role in ISIS, little

personal information about al-

Faransi is available. It is believed

that—as his kunya suggests—

Faransi is a French national.

According to French sources, he

now resides in northern Syria with

his wife—also a French national—

and two children. Reports allege

that al-Faransi was promoted to

external operations chief following

the Paris attacks, suggesting that

the Frenchman was rewarded for

overseeing one of ISIS’s most

high-profile attacks. Al-Faransi’s

name also surfaced in

investigations into the Brussels

attacks. Belgian authorities

investigating the contents of a

computer owned by Ibrahim El

Bakraoui, one of the two suicide

bombers who struck the Zaventem

airport, concluded that Bakraoui

had been in contact with al-Faransi, and that other cell members may have been, as well.

Bakraoui had submitted attack plans to the Frenchman.

Below al-Faransi in the Amn al-Kharji are the theater commanders, responsible for planning

operations in various regions that ISIS wants to target. Theater commanders are perhaps the most

pivotal actors in ISIS’s external operations structure, as they serve as a bridge between strategic

planners and tactical operators. It appears that ISIS appoints theater commanders who originate

from the regions over which they are given authority. For instance, ISIS’s external operations in

Southeast Asia are likely led by Bahrun Naim, an Indonesian militant now based in Syria who

was responsible for coordinating the January 2016 attacks in Jakarta. ISIS has also likely

appointed theater commanders for external operations in both Turkey and North Africa.

Daveed Gartenstein-Ross September 14, 2016

9

Foundation for Defense of Democracies www.defenddemocracy.org

The theater commander for Europe is believed to be Salim Benghalem, another French national

whose involvement in jihadism predates ISIS’s emergence. Benghalem became radicalized in a

French prison when serving an earlier sentence for attempted murder. He soon fell in with a

network commonly known as the Buttes-Chaumont group, a Paris-based jihadist network

involved in recruiting individuals to fight U.S. forces in Iraq in the mid-2000s. This group also

included Cherif and Said Kouachi, the brothers who carried out the Charlie Hebdo massacre in

January 2015. In 2011, Benghalem and Cherif Kouachi traveled to Yemen, where they received

training from al-Qaeda in the Arabian Peninsula.

Soon after traveling to Syria to join ISIS in early 2013, Benghalem was tapped to serve as a

prison guard for French hostages whom ISIS had kidnapped. Several former prison guards from

this group have emerged as key actors in ISIS’s European external operations efforts. For

instance, Mehdi Nemmouche, a fellow French national who guarded French hostages alongside

Benghalem, returned to Europe and carried out an attack on the Brussels Jewish Museum in May

2014 that killed four. Naajim Laachraoui, a Belgian national who served as one of the suicide

bombers at the Zaventem airport, had also been a guard. Benghalem now outranks all of his

former prison guard colleagues.

As the theater commander for ISIS’s European operations, Benghalem oversees several

commanders responsible for training operatives, and planning and coordinating operations at the

ground level. These tactical commanders play a hands-on role in ISIS’s Europe operations, and

sometimes participate in attacks. Given their more public role, these commanders often attract

greater media scrutiny than their more discrete superiors. Such was the case for Abdelhamid

Abaaoud, who was killed by French authorities several days after the Paris attacks. In January

2015, Abaaoud deployed to Athens, where he directed a cell based in the Belgian city of

Verviers that was disrupted when Belgian authorities intercepted telephone calls between

Abaaoud and the plotters.

Between the Verviers plot and the Paris attacks, Abaaoud spent his time training operatives and

planning unsophisticated, low-cost operations in Europe. In the summer of 2015, Abaaoud

trained Paris native Reda Hame and at least one other operative to carry out mass casualty

attacks on soft targets in France and Spain. This plan was disrupted when authorities arrested

Hame’s counterpart in Spain. Abaaoud was also in contact with Ayoub El Khazzani, who was

tackled by passengers when he tried to open fire during an August 2015 train ride from

Amsterdam to Paris. Khazzani never traveled to Syria, suggesting that, in addition to training

operatives already in ISIS-controlled territory, Abbaoud sought to inspire radicalized individuals

based in Europe to carry out attacks on their own.

These small-scale plots distracted authorities, who, as I warned in the first part of this testimony,

never looked beyond the lone-wolf paradigm to find the terrorist networks of which the plotters

were a part. All the while, Abaaoud was planning the Paris attacks, his jihadist magnum opus. In

a move uncharacteristic of a commander of his stature, Abaaoud traveled to Paris to oversee and

coordinate the operation personally. Though there is little information on Abaaoud’s activities in

Europe in the months and weeks before the Paris attacks, multiple news outlets reported that he

traveled to the United Kingdom in the summer of 2015, possibly to case potential targets or to

coordinate with other militants. Abaaoud then personally coordinated and participated in the

Daveed Gartenstein-Ross September 14, 2016

10

Foundation for Defense of Democracies www.defenddemocracy.org

Paris operations, dropping off one of the suicide bombers, opening fire on civilians in several

different locations, and later driving to an area near the Bataclan and contacting militants inside

the concert hall. Unlike the Verviers plot, Abaaoud was committed to personally seeing the Paris

attacks through to completion.

Abaaoud planned additional attacks after the Paris massacre, but French authorities caught and

killed him in a raid on an apartment in a Paris suburb. Though Abaaoud’s death eliminated one

of ISIS’s most skilled external operatives, it is believed that ISIS quickly replaced him with

Fabien Clain, a French convert whose voice was featured in the audio message in which ISIS

claimed responsibility for the Paris attacks.

A look at the networks involved in the Paris and Brussels attacks provides further evidence of the

sophistication of ISIS’s external operations, and some indication of how jihadist networks will

look in the United States (though U.S. networks are not be as sprawling, and are often somewhat

less interlinked). ISIS utilized a networked approach in executing the two attacks. That is, the

group built a vast network in Europe to prepare for the Paris attacks, with some militants serving

in an operational capacity while others played a support and logistics role. That ISIS was able to

sustain such a vast support infrastructure in Europe is striking, considering the challenges of

evading European intelligence agencies. Even more remarkable is that ISIS was able to keep its

support network largely intact following the Paris attacks, and then subsequently mobilize this

network to strike again in Brussels just months later amid a heightened security atmosphere. This

feat reflects both the magnitude of ISIS’s European network and the quality of its tradecraft.

The graphic above reveals the scope of the networks involved in the Paris and Brussels attacks.

Abaaoud sits at the center of the network, attesting to his role as the overall coordinator of the

Daveed Gartenstein-Ross September 14, 2016

11

Foundation for Defense of Democracies www.defenddemocracy.org

Paris attacks. Another key actor is Khalid Zerkani, an integral jihadist player in the Brussels

neighborhood of Molenbeek, a hotbed of militancy that has served as a safe haven for ISIS

operatives. Though Zerkani—who has been sentenced to 15 years in prison for his role as a

jihadist recruiter—was not involved in either the Paris or Brussels attacks, the foreign fighter

recruitment networks he established from 2012 to 2014 have been at the center of ISIS’s ongoing

operations in Europe. Several key individuals involved in the Paris and Brussels attacks,

including Abaaoud, Naajim Laachraoui and Salah Abdeslam, are directly linked to Zerkani, as

was Reda Kriket, who had amassed an “unprecedented” weapons arsenal and was in the final

stages of operational planning when French authorities arrested him shortly after the Brussels

attacks.

ISIS operatives in Europe linked with Zerkani have also relied on other members of the Zerkani

network as they sought to evade European authorities and plan future attacks. After the Paris

attacks, Salah Abdeslam contacted Abid Aberkan, the nephew of Fatima Aberkan, who has been

described as the “mother” of the Zerkani network. Abdeslam hid at the house of Aberkan’s

mother, where he was eventually discovered and arrested.

The graphic also reveals the extensive overlap between the Paris and Brussels attack networks.

Key individuals involved in providing logistical support for the Paris attacks rapidly transitioned

to an operational role in Brussels. For instance, Naajim Laachraoui helped construct explosives

for the Paris attacks before donning his own suicide vest in Brussels. Mohamed Belkaid, who

was believed to have been in contact with several of the Paris attackers via phone, housed Salah

Abdeslam while Abdeslam was on the run from Belgian authorities. Belkaid was likely involved

in planning attacks with Abdeslam when Belkaid was killed by Belgian forces in a raid several

days before the Brussels attacks. Mohamed Abrini is yet another individual who played a support

role in Paris before mobilizing in Brussels; he rented an apartment that was used by several Paris

attackers and later tried to plant a bomb at the Zaventem airport, though he failed to detonate his

explosives. This pattern suggests that ISIS’s strategy in Europe involves building dual-purpose

cells that can be converted from a support to attack role in order to maximize the utility of its

network.

The U.S. has also had domestic terrorist networks in recent years, though they are not as robust

as the European networks. For example, indictments and other publicly-available sources of

information reveal a remarkably dense ISIS network clustered around the Minneapolis-St. Paul

area. Almost every actor in this network is linked with one another.

As we talk about lone wolf terrorism, let’s not lose sight of the role that networks will continue

to play, especially in this age of improved tradecraft.

Thank you again for inviting me to testify today. I look forward to answering your questions.

Committee on Oversight and Government Reform Witness Disclosure Requirement – “Truth in Testimony”

Required by House Rule XI, Clause 2(g)(5)

Name:

1. Please list any federal grants or contracts (including subgrants or subcontracts) you have received since October 1, 2012. Include the source and amount of each grant or contract.

2. Please list any entity you are testifying on behalf of and briefly describe your relationship with these entities.

3. Please list any federal grants or contracts (including subgrants or subcontracts) received since October 1, 2012, by the entity(ies) you listed above. Include the source and amount of each grant or contract.

I certify that the above information is true and correct. Signature: Date:

www.defenddemocracy.org

Daveed Gartenstein-Ross is a Senior Fellow at the Foundation for Defense of Democracies. His professional focus is on understanding how violent non-state actors (VNSAs) are transforming the world, and he specializes in jihadist movements, including undertaking detailed research into al-Qaeda, the Islamic State (ISIS), Ansar al-Sharia in Tunisia, Boko Haram, and ISIS’s Wilayat Sinai. He is also the Chief Executive Officer of Valens Global, a Fellow with Google’s think tank Jigsaw, an Associate Fellow at the International Centre for Counter-Terrorism – The Hague, and an Adjunct Assistant Professor in Georgetown University’s Security Studies Program.

Known for his rigorous scholarship, and putting ideas into action as a practitioner, Gartenstein-Ross is the author or volume editor of twenty-one books and monographs. He has published

widely in the popular and academic press, including in The New York Times, The Washington Post, Foreign Affairs, Foreign Policy, The Atlantic, and Terrorism & Political Violence. He is also a member of the Editorial Board of the leading peer-reviewed journal Studies in Conflict & Terrorism. As a practitioner, some of Gartenstein-Ross’s recent projects have included:

• Delivering briefings and assessments to U.S. government agencies on such topics as ISIS’s European attack network, the implications of the failed coup in Turkey on counterterrorism efforts, and the strategic implications of the Libyan civil war;

• Organizing and facilitating a conference in Nigeria as an EU-appointed Strategic Communication Expert, where he helped civil society activists understand militant groups’ use of social media and forge a strategic action plan for countering it;

• Mapping the online counter-ISIS narrative space for a leading tech firm designing a project to divert users who may be susceptible to the group’s propaganda;

DAVEED GARTENSTEIN-ROSS

Senior Fellow Foundation for Defense of Democracies

Chief Executive Officer Valens Global

www.defenddemocracy.org

• Serving as a subject-matter consultant on militant groups during live hostage negotiations;

• Designing and delivering lectures and training for U.S. government personnel through such programs as the U.S. Army Corps of Engineers’ Individual Terrorism Awareness Course and the Naval Postgraduate School’s Leader Development and Education for Sustained Peace (LDESP) program;

• Designing and leading strategic simulations exploring the competition between VNSAs and state actors for major academic institutions such as Johns Hopkins University.

Gartenstein-Ross has testified on his areas of core competency before the U.S. House and Senate a dozen times, as well as before the Canadian House of Commons. He is frequently a featured speaker at events and conferences throughout the globe, including delivering keynote speeches at the U.S. Army Special Operations Command Commander’s Conference, the University of Southern California’s National Center for Risk and Economic Analysis of Terrorism Events (CREATE), and the Global Futures Forum.

Gartenstein-Ross holds a Ph.D. in world politics from the Catholic University of America and a J.D. from the New York University School of Law. He can conduct research in five languages.

DAVEED GARTENSTEIN-ROSS

Senior Fellow Foundation for Defense of Democracies

Chief Executive Officer Valens Global