Client Briefing: The Terrorist Attacks in Brussels. April 1, 2016

Transcription

1 ! Client Briefing: The Terrorist Attacks in Brussels April 1, 2016

2 Introduction In the wake of the March 22 ISIS terrorist attacks in Brussels, Belgium, the specter of further episodes of violence aimed at so-called soft targets and the rise of jihadi recruitment in Europe and the West looms greater than ever. The latest attacks in Brussels appear increasingly connected to the November 13, 2015, attacks in Paris which means that the ISIS operatives behind them formed a transnational active network, not merely a sleeper cell. The steady flow of online propaganda produced by ISIS has given the group unprecedented reach into Western communities, allowing the recruitment of thousands of European and North American citizens to its ranks, and the rapid adoption of new technology to further its goals. Of specific concern is what this escalation means for the security and stability of Western Europe and the U.S. To understand the comparative urgency of threat particularly faced by various countries in Europe, one need only look to the relative numbers of how many nationals from each of those countries are estimated to have traveled abroad to Syria and Iraq with the intention of joining armed militant groups. While ISIS has certainly succeeded in winning the sympathies of small networks of homegrown extremists in the United States with its viral online propaganda, only a tiny fraction of such American recruits have ever actually made it to the frontlines in the Levant never mind the significant added step of then returning home with the advanced training and expertise necessary to carry out attacks on the scale of Paris or Brussels. Thus, the primary threat to the U.S. homeland from ISIS remains homegrown violent extremists, as evidenced by shootings in Garland, Texas and San Bernardino, California. While these extremists have been heavily influenced and in some cases explicitly directed to take action by ISIS representatives in the Middle East, they are far more dispersed, less organized, and less sophisticated than the broad and complex network responsible for recent events in France and Belgium. Regardless of whether we speak of those recruited directly or indirectly by ISIS, critical communications are now taking place almost exclusively in an online medium whether through commercial social media platforms like Twitter, proprietary password-protected ISIS chat forums, or even more secretive methods like exchanging encrypted messages on Telegram or further, via private server hosting space leased from tech companies in Turkey. Flashpoint s subject matter experts have assessed these concerns in light of the unfolding story, compartmentalizing the discussion based on areas of concern, as follows: " 2 of 7"

3 Chatter and Threats in the Jihadi Deep & Dark Web Flashpoint analysts have noticed an uptick in chatter mentioning Western Europe, including France and Belgium, in jihadi Deep Web forums. Since the November 13, 2015 ISIS attacks in Paris, Belgium was mentioned 400 times in messages on Arabic language jihadi web forums, compared to 220 times in the entire year preceding the day of the attacks. Pro-ISIS jihadists have issued multiple messages throughout the past year, inciting attacks in France and recently in Belgium. Shortly after the attacks in Brussels, users on the top ISIS Deep Web forums posted a range of messages, many reporting the attacks minute by minute from media sources, others praising them and even provoking further attacks on soft targets. One user discussion suggested launching attacks at European hospitals and universities, indicating that they are easier, less scrutinized, and would cause the maximum impact as compared to targeting airports. Thus, the likelihood of these attacks recurring is high. Repercussions and Expectations With three terrorist attacks in Paris and one in Brussels, and a number of foiled plots and counter terrorism raids since last year, jihadi terrorists continue to focus on striking Western Europe. This is especially alarming in European countries that have become a source of ISIS fighters. Belgium reportedly has the highest ratio per capita of fighters who joined ISIS from Western Europe, making it an especially attractive country to strike. The Brussels attacks were followed by counterterrorism raids believed to be linked to the same terror network, leading to further evidence that more plots were in the pipeline. As Belgium continues to deal with the tragedy and sits on high alert, other European countries will implement intensified measures against possible terror plots. Other countries at risk include France (again), Germany, Norway, Holland, and the UK, all of which are sources of thousands of ISIS fighters. Italy and Spain are also at risk. ISIS s faction in Libya would likely focus on attacking in Italy due to the colonial historical links. Spain would likely face jihadist issues from radicalized North Africans. The Element of Foreign Fighters ISIS has attracted thousands of fighters from Europe to its ranks in Iraq and Syria, a number of them committed suicide bombing attacks and others were featured in flashy " 3 of 7"

4 video releases aimed at recruitment. In the wake of the Paris attacks, ISIS released over a dozen videos featuring French militants praising the attacks and vowing to launch more. Similarly, post Brussels, ISIS has followed the same trend launching a coordinated video campaign, in which Belgian fighters were featured praising the attacks and promising more in the future. As of March 28, ISIS has released five videos featuring Belgian fighters in the latest campaign; one of them featured a wanted Belgian known as Abu Hunaifah Al-Beljiki, a co-founder of the radical Islamist group Shariah4Belgium, which has rallied for the implementation of radical Sharia law in the country. This is one piece of evidence linking radical jihadi activists in Belgium to ISIS ranks. Most concerning, there appears to have been a massive intelligence failure in France and Belgium and across other countries which might have helped the Paris-Brussels network operate more freely. In the case of Paris, the ring leader Abdulhamid Abaaoud traveled between Syria and Western Europe twice without the intelligence going through the cables to the right channels. In the case of Brussels, Salah Abdesalam, the last surviving operative from the Paris attacks, drove through the border into Belgium hours after the attacks in Paris unfolded, and hid in that country for over four months. The links between the Belgian and French cells became clearer when authorities indicated that there is evidence linking Abdesalam to the Belgian attacks, and the Belgian alleged bomb-maker to explosives used in Paris. The possibility of further ISIS attacks in Western Europe would likely be facilitated, directed, financed, or linked to ISIS fighters from those countries. They know the language, the sites, the travel routes, and, many times, ways to avoid detection by law enforcement. They are a perfect leader or guide for the Western operatives. New and Encryption Technology and Hacktivism Most of ISIS s Deep Web forums have implemented additional cyber security measures within the past year, such as Cloudflare s services to protect against malicious cyber attacks. To ensure that its message has reached the wider masses more securely versus using Twitter, which amplified suspending jihadi accounts ISIS s media units have resorted to using the encrypted messaging platform Telegram. The end-to-end encrypted software allows users to join channels that distribute propaganda and other material more securely and while on the go. Furthermore, to ensure a higher level of security, the ISIS distribution channels have turned their channels into private mode. In this mode, channels can only be joined via temporary private invitation links. " 4 of 7"

5 Telegram has also become a beacon for private jihadi militant channels, where manuals on bomb-making and weapon training are frequently distributed. Other relevant channels put out guidelines on implementing best OpSec and InfoSec. New-age pro-isis online jihadists are tapping into all the freely available secure online communication tools, from VPNs and proxies, to secure messaging platforms, to encrypted services. On Telegram, in addition to the channel functionality, the platform offers group chat and peer-to-peer conversation functions. Flashpoint analysts have seen firsthand individuals exploiting this option to recruit fighters and facilitate travel to ISIS s main operational territories. In addition to the platform s role in media and online coordination, its lesser advertised functions allow physical coordination, something that could even be used to help coordinate future attacks. We are also seeing how the attacks are shaping the Telegram landscape, with ISIS supportive and official channels starting to cater more heavily to a Belgian/French audience. To this end, ISIS s official Telegram channel just launched its Dutch language version and various other channels are now releasing links to ISIS material that has been translated in to Dutch and French. Other channels are trying to expand upon the battle waged on the ground in Brussels by coordinating an online battle, offering guidance on attacks targeting anti-isis social media accounts (primarily on Facebook and Twitter). In addition to providing specific targets, these channels are posting content for attacks, consisting of lengthy messages to be posted by the group s supporters on anti-isis targeted social media accounts. The majority of these messages express the coordinated ISIS narrative that showcases Belgium as the aggressor, focusing heavily on its role in the U.S.-led coalition. Part of this online battle includes the hijacking of mainstream hashtags associated with the Brussels event, including #Brussels, #BrusselsAttack, and #Bruxelles. ISIS and its supporters have employed a similar strategy in the past, hijacking trending hashtags from the Olympics and World Cup. Directed by the aforementioned Telegram channels, ISIS supporters are encouraged to flood the trending hashtags with ISIS supportive content, namely official propaganda. By doing so, these actors hope to control the narrative and overshadow unflattering reports. Also, on a basic level, utilizing these trending hashtags affords ISIS increased visibility to a wider audience. Expanding upon its existing strategy to evade the platform s scrutiny of its accounts, ISIS official and supportive channels are also changing their names to seemingly mundane titles, in an attempt to bypass those monitoring its activity and avoid suspension. For example, a channel dedicated to coordinating the aforementioned online battle just changed its name to FOOTBALL GAME TIMES. " 5 of 7"

6 Furthermore, pro-isis hacking groups appear to be on the rise, expanding from one group at the end of 2014 to six groups today, including Sons Caliphate Army (SCA), Rabitat Al Ansar, Islamic State Hacking Division (ISHD), and Islamic Cyber Army (ICA). They have set their sights on targeting governmental, financial, and media websites. While the level of sophistication of these groups is not high, they are expressing huge interest in developing their cyber skills. The specter of recruiting external talent overseas is also very plausible. Summary and Conclusion The greatest physical threat of organized ISIS terrorist attacks is centered in countries with comparatively large numbers of nationals per capita who have traveled to Syria and Iraq including Belgium, France, Holland, Austria, Sweden, Denmark, the United Kingdom, and Germany. The primary physical threat in North America posed by ISIS originates from homegrown violent extremists recruited through online social media and propaganda who largely focus on carrying out mass shooting sprees. Both homegrown ISIS supporters as well as trained operatives directly dispatched by the group are primarily focused on carrying out attacks on soft targets, including prominent media personalities and executives, Western companies, transportation, tourist sites, concerts and sports events, and other gatherings of large crowds. Homegrown ISIS activists often focus on specific targets and methods that are highly familiar to them, both in the physical as well as the virtual medium in the form of cyber attacks. Such cyber attacks focus on any available weak targets most often private companies with compromised access credentials that can be tangentially associated with Russia, Europe, or the United States. Pro-ISIS hackers typically deface websites to post messages in support of the group to gain notoriety and spread their propaganda. Small or medium-sized companies should monitor each page to ensure a subsection of the website has not been defaced with pro-isis messages. ISIS supporters online have also spent enormous efforts on doxing and data-mining information on U.S. military servicemen and women that is eventually published as ISIS hit lists on the web. Much of this information is creatively harvested from social media and other open sources. In contrast, ISIS-directed operatives tend to rely heavily on physical attacks using firearms and TATP-based explosive devices concealed in vests, jackets, and suitcases. Only rarely have ISIS homegrown supporters in North America attempted to build such complex devices, and based on known information, never successfully. " 6 of 7"

7 Both homegrown ISIS supporters as well as trained ISIS operatives now significantly rely on various forms of encrypted communication technology in an attempt to guard against outside snooping by law enforcement or intelligence agencies. Measures adopted by Twitter and other prominent online commercial social media platforms have not prevented ISIS from continuing its efforts to hijack the discourse take place on those platforms, nor from using those platforms as a mechanism to further distribute recruitment material and propaganda. " 7 of 7"