Threat Networks employing IEDs in North Africa C I E D C O E JUNE 2016

Transcription

1 Threat Networks employing IEDs in North Africa C I E D JUNE 2016 C O E

2 This report can be downloaded from: BICES NATO CIED PORTAL BICES COE CIED PORTAL Disclaimer: This Report is designed to provide specific information on IED incidents in North Africa. The content of this Report has been extracted from the information gathered from C-IED CoE collaborators and open sources. Consequently, the C-IED CoE claims no liability for such information and does not identify with the opinions expressed and held by those sources. The CoE does not accept any responsibility for use of the information made by those who have obtained it from this Report. The Report should not be regarded as an official NATO Document.

3 INDEX INDEX 3 Introduction 5 Main threat groups employing IEDs 8 Al Qaeda and proxies 8 DAESH (IS ISIS ISIL) 8 Muslim Brotherhood 8 Other Jihadist groups 8 Government (Libya) 9 Anti-Government (Libya) 9 IED Activity 11 IED Types and Components 12 Egypt 12 Libya 13 Algeria, Morocco, Tunisia 13 Most common TTPs and targets 14 SLVBIED used to breach defenses and start attack 14 Complex attacks and/or coordinated assaults on secured locations 16 Sieges/Hostage taking/high casualty attacks 16 Targeted suicide attacks 16 Attacks on aircraft 17 Targeted assassinations 17 Female operatives 17 EXPLOSIVES 18

4 CONCLUSIONS 19 Algeria 19 Egypt 19 Libya 19 Morocco 20 Tunisia 20 REFERENCES 21

5 Introduction The purpose of this study is to present an analysis related threat networks using IEDs in the region comprising North of Africa (from Morocco to Egypt). This activity is linked with conflicts between different religious and ethnic groups in this geographical area. We can divide this area in three subareas sharing similar characteristics. From west to east, we can start with Morocco, Tunisia and Algeria (West subarea), after this, the second place belongs to Libya (Central subarea) and finally Egypt (East subarea). Morocco, Algeria and Tunisia have had less terrorist attacks than Libya or Egypt. By the present moment all of them have strong governments in power, taking control of the situation. Tunisia and in a minor scale Morocco had suffered some terrorist attacks, with a big impact in their tourism industry. Libya is still in a civil war after the collapse at the end of Regime of Colonel Muamar el-gadafi. Some groups are struggling for the power, Al Qaeda proxies, DAESH, other jihadists groups, ethnical groups (Toubou Militias, Amazigh Militias, Tuaregs), Government and Army, and anti-government forces. In Egypt the Arab Spring ended the Mubarak era, after some weeks of revolts and demonstrations in several cities, being Tahrir Square at Cairo the most popular. After the changes in the government there were elections and Mursi (from Muslim Brotherhood) was elected President. After one year in government he was overthrown by another revolt and General al-sisi took the power. Apart from attacks in some areas in the desert, and Cairo, terrorist attacks usually concentrates in Sinai Peninsula, focusing in military and police installations. From these five countries, only Egypt use to be a kingdom under the rule of Pharaohs in history. The rest of the area has been occupied from different people and tribes along history. The ancient Carthage Empire covered parts of Libya, Algeria, Tunisia and Morocco (and also Spain). From that time until now, most of these countries were colonies of Powers (from Europe or Turkey), being part

6 of the Roman Empire, under the control of the Ottoman Empire, under the rule of Spain, United Kingdom, France or Italy, especially during the XIX century. Some parts of the area, mainly Morocco and Algeria have another common characteristic which is a strong migration towards Europe (France in particular). These migrants send money back home, but also ideas, and sometimes a feeling of rejection to western values. Parts of this area also (in particular outside main cities) have a strong tribal structure and culture. This tribal structure alongside the ideas supported by some Muslim religion currents collides with western feelings (women liberation and democracy). Country Flag Area (Km2) Demographic data: Berbers 71% Tuareg 10% Arabs 19% Religion: Muslims 97% Christians 2% Jews 1% Population (est. 2016) Statistical Data Capital city Languages Hab/Km GDP GDP per capita Algeria 2,381,741 40,400,000 Algiers Arab and Berber billion $ 7400 $ Egypt 1,001,451 90,031,000 Cairo Arab billion $ 6200$ Libya 1,759,540 5,448,000 Tripoli Arab billion $ $ Morocco 458,730 33,890,000 Rabat Arab, Tamazight, French billion $ 4900 $ Tunisia 163,610 11,176,000 Tunisia Arab billion $ $ TOTAL 5,765, ,945, Northern part of the continent, Sahara Desert included, is predominantly occupied by Caucasian peoples, mainly Berbers and Arabs. Its population is 25% of the continent. Tribal structures are very important in the sociological organization of these countries. Men will go battle with their fellow tribesmen, if the leader change side, all tribe will do. Most of the militias are organized by tribes. Finally other crucial characteristic is that the war is not between two sides but among as much sides as groups and tribes. In one of the attacks made by groups belonging to Wilayat Sinai (local branch of DAESH for Egypt), one of the sons of a local tribe leader was killed. As a result of that the tribesmen attacked the group, by their own, not in collaboration with Egyptian police or armed forces. As in other geographical areas, DAESH affiliated groups can fight against governmental

7 forces, and also against Al Qaeda affiliated groups. But we must keep in mind that also they can do business with enemies and make temporary alliances from time to time.

8 Main threat groups employing IEDs Al Qaeda and proxies DAESH (IS ISIS ISIL) Muslim Brotherhood Other Jihadist groups - Al Qaeda in Islamic Maghreb (AQIM) - Al-Murabitoun (Mokhtar Belmokhtar) - Ansar Dine and Front de Liberation du Macina (FLM) - Mujahedeen Shura Council - Abu Salim Martyrs Brigade - Benghazi Revolutionaries Shura Council - Moroccan Islamic Combatant group - Salafia Jihadia - Katibat Uqba ibn Nafi s (KUIN) - Ansar al-sharia (some branches also with Al Qaeda) Ansar al-sharia Benghazi Ansar al-sharia Derna Ansar al-sharia Tobruk Ansar al-sharia Sebratha - Wilayat al Sinai (Ansar Beit al Maqdis) - Wilayat Cairo - Wilayat al Barqah (Benghazi) - Wilayat al Tarabulus (Tripoli) - Wilayat al Fezzan (Sabha) - Wilayat Ifriqiya - Jund al Khilafah, (Califate Soldiers) Wilayat al-jazair - Ajnad al Khilafah, Ajnad al-khilafah bi-ifriqiya - Wilayat al Jazair - Muslim Brotherhood Egypt - Muslim Brotherhood Libya - Ajnad Misr (Egypt) - Abu Salim Martyrs Brigade (Libya) - Free Lybian Martyrs Brigade - Martyr Omar Mukhtar Brigade (Libya) - Al-Farouk Brigade (Libya)

9 Government (Libya) Anti-Government (Libya) - Zintan Martyrs Brigade (Libya) - Libyan Army - Zintan Brigades - Tebu Militias - Tuareg Militias - Lybian Dawn - Amazigh Militias For Al Qaeda and proxies, his traditional presence in the area has been thru Al Qaeda in Islamic Maghreb (AQIM), with attacks in Mauritania, Algeria, Mali and other areas. Some groups get away from AQIM, returning later (like the group headed by Mokhtar Belmokhtar). Other groups like Ansar Dine has also subgroups, like FLM (Front de Liberation du Macina). The activities of these groups used to be not centered in the use of IEDs. They usually employ IEDs mainly in suicide belts or vests (or hand grenades) in some assault type attacks (Bardo Museum, Tunisia, 2015), and also in complex attacks (Casa España restaurant, Casablanca, Morocco, 2003). Historically their attacks were hostage or siege situations (hostage for ransom as one of the main sources of income). Groups like Ansar al-sharia (in their different local branches) are between Al-Qaeda and DAESH pledging allegiance to one or the other, asking for resources or support. Meanwhile, other groups clash with DAESH or Al-Qaeda for the control of areas in Libya. DAESH militants presence has grown in multiple areas (Egypt, Libya and Tunisia), although how directly linked to DAESH core apparatus is still unclear. Some information speaks about loose affiliation occasional limited direct contact, but other sources links forces building and command directly with Raqqa, for example in Libya. Due to the wide use of social media and Internet for propaganda, there are also cases when people starts with indoctrination and finally commits a terrorist attack following general lines of action of DAESH, but not under its direct command, following a process of self-radicalization. In Tunisia, several significant attacks have been carried out in the name of DAESH, including two on foreign tourists in Tunis and near Sousse, and a PBIED attack on a bus carrying security forces in Tunis. In the attacks on tourists IED usage appears to have been limited to several basic improvised grenades while the attack on the bus in Tunis was tactically reminiscent of a number of incidents in Syria at the start of the conflict there, with a lone individual boarding the vehicle when it was stopped. In Egypt there is evidence to suggest that Wilayat Sinai, the most prominent and active DAESH affiliate that was previously known as Ansar Beit al Maqdis, is supplemented by a further grouping

10 linked to DAESH that is focused on Cairo and is known as the Islamic State of Egypt. The relationship between these two groups remains unclear. In Libya DAESH is involved in direct conflict with multiple opposition groups, including the conventional forces associated with General Haftar, as well as AQ-affiliated militant groups and nonaligned militias. It has strongholds in Sirte and Benghazi, and is influential in multiple locations including near the oil center of Ras Lanuf. Assassinations and numerous VBIED attacks have taken place and incident numbers are undoubtedly higher than reported in open sources. Other IS-linked affiliates include Ajnad al-khilafa in Tunisia and Jund al-khilafa in Algeria although directly linking them to activity remains difficult. Currently the Muslim Brotherhood has an anti-government agenda in Egypt, and is widely believed to be involved in militancy and operating a permissive environment for militant cells throughout Egypt but mainly in more populated areas. IED activity is often intended to cause disruption and chaos rather than mass casualty or significant destruction. Seen as a terrorist organization by some countries, its subsidiaries are believed to possess widespread if basic IED capability although some reporting from 2015 suggested an interest in expanding its technical capability to include such things as UAV-delivered IEDs. Ajnad Misr, active in Egypt in 2014 and 2015, this Islamist group generally targeted security forces and sought to avoid civilian casualties. From mid-2015 to present the group has been relatively inactive and has possibly stopped operations, or merged its efforts with other militants.

11 IED Activity African Mediterranean countries IED Activity Evolution Country Mar-2014 / Feb-2015 Mar-2015 / Feb-2016 Evolution Incidents Casualties Incidents Casualties Incidents Casualties Egypt % +125% Libya * 464* -42% +21% Tunisia % +78% Algeria Morocco * (Low reporting activity due to general unrest and Civil war situation) Allen Vanguard. 2016

12 Allen Vanguard IED Types and Components Egypt Egypt has climbed two positions in the top ten IED countries ranking the sixth with 513 incidents and 1135 casualties from March 2015 to February The previous year there were 328 incidents and 505 casualties. These mean an increase of 56% in incidents and 125% in casualties in one year. Many explosive devices used in Egypt, and especially those deployed in populated areas by groups linked to the Muslim Brotherhood, tend to follow fairly rudimentary designs. However several IED production facilities were overrun in 2015 and materials recovered demonstrated a capability to produce a range of devices including low metal content IEDs, directionally focused fragmentation charges, EFPs and RCIEDs. Multiple attacks utilizing what were usually believed to be RC-initiated roadside IEDs have targeted security forces in the Sinai area; although at least one command wire initiated attack on an ECM equipped vehicle was claimed via militant media sources. The continued use of quite basic IEDs by Muslim Brotherhood associated militants suggests that the level of technology employed is often sufficient to serve the intended purpose of causing disruption. This is further supported by the evidence of a capability to produce more complex IEDs when and if required, although the impact of removal of IED construction facilities cannot be underestimated.

13 The use of command wire initiation against security forces who are using ECM demonstrates a capability to vary tactics depending on the situation and that the IS militancy in the Sinai is technically and tactically capable, and possibly also utilizes command initiation to ensure targeted rather than random casualties. Libya There has been a demonstrated capability to produce and utilize a range of IEDs and components, from small VO devices to large SVBIEDs, including more advanced methods such as RC initiation alongside simple VO switches using clothes pegs and medical syringes. Reporting from areas where the Libyan National Army has retaken ground from mainly DAESHlinked militants claims that numerous devices, including VO-initiated, have been left in urban areas, similar to TTPs employed in Iraq and Syria. The deployment of multiple VO initiated devices as booby traps and for area denial has several effects, including an increased burden on security forces recapturing and securing ground, and also a prolonged impact on both civilian and security force morale. There have been reports of devices hidden inside children s toys and within reoccupied homes in Iraq and Syria, and it is likely similar methods are being used in Libya. Algeria, Morocco, Tunisia There has been little detailed reporting of IEDs found within these countries although repeated security force operations regularly result in the recovery of quantities of materials intended for the production of HME. Reports of occasional landmine incidents may refer to VOIEDs or command initiated IEDs, although again there is insufficient detail to confirm this. Groups active in Mali, with easy access to extend capabilities into these countries, utilize landmines and emplace IEDs along routes with some regularity against security forces.

14 Most common TTPs and targets Massive SLVBIED used to breach defenses and start attack Complex attacks and/or coordinated assault on secured locations Sieges/Hostage taking/high casualty attacks Targeted suicide attacks Attacks on aircraft Targeted assassinations Female operatives SLVBIED 1 used to breach defenses and start attack This TTP has been widely used by DAESH militants in Iraq and Syria. Several LNA (Libyan National Army) units have reported findings of garbage trucks (or other with similar capacity) fitted with extensive homemade armor plating loaded with explosives. Also in Egypt there have been reports about similar attacks (police station in al-arish April 2015). Initially the armor plating covered only the driver or the cabin, but later it has been extended to cover the motor, the wheels and the charge. The intention is to provide maximum armor protection for the SVBIED, enabling it to penetrate any obstacles in its route to the target and be initiated by the suicide bomber driver right on target, achieving the maximum effect possible from the SVBIED attack. Normally defending forces will need more than small arms to stop the vehicle. An RPG or guided missile will do it. Related to explosives, everything can be used, from aerial bombs to artillery shells, land mines or HME. Even SA-2 SAM warheads has been used. Usually devices incorporate adapted munitions and an AN-based HME in large containers, everything linked together with detonating cord or electrical wire. The containers used for HME or other kinds of explosive substances runs from metal homemade containers (transformed gas canisters or metal cylinders) to long missile storage tubes. There is a wide range of initiation methods in constructing SVBIEDS, with varying levels of technical expertise. Errors such as insufficient power source to ensure successful initiation demonstrate some key weakness in IED manufacturing knowledge and capacity. There are also attacks similar in execution but not linked with military operations, like the one against the police training academy in Zliten (Libya), killing between 50 and 60 people. In Egypt, the interdiction of several cells and subsequent drop-offs in activity levels, suggest IED construction competence is limited. And successful security force action can have a noticeable 1 SLVBIED Suicide Large Vehicle Borne IED (from LVBIED An IED built into any large ground-based vehicle (e.g., dump truck, panel truck, bongo truck, commercial bus, tanker, etc.) and/or serves as the concealment means for a large amount of explosives (2000 lbs). (Weapons Technical Intelligence Handbook Edition September 2009)

15 impact on the IED capabilities of cells, especially in theatres where the militancy is less well established. Armored garbage truck SVBIED near Abugrein, northern Libya. Aerial bombs in the trunk of the SVBIED

16 Complex attacks and/or coordinated assaults on secured locations This TTP is widely used, from Taliban in Kabul to Al-Shabbaab in Mogadishu. Usually first part of the attack is performed by a VBIED or SVBIED (sometimes a PBIED) in order to enable the access of an assault team to the compound or secure location. Other times the intention of the first attack is the evacuation of the building, followed by a second explosion outside. The target of these attacks could be hotels with reinforced security or even police/military posts isolated. This tactic is used mainly in two ways, one inside out, taking advantage of the evacuation to increase the death toll of the attack. The second one is to ease the access to an outpost, first attack kills the security control personnel and afterwards the assault takes place. Groups affiliated to both Al-Qaeda and DAESH use this TTP. Usually PBIEDS appear to be manufactured using adapted body belts, smaller than older devices vest type. The explosive used is TNT, often with a fragmentation matrix. And the initiation system generally is a mechanical pull switch utilizing an adapted grenade fuze. In the past only suicide militants wear these belts or vests, now as most of the commanders are wearing them, the practice has been extended to all level militants. The intention is to show their will to fight till death. The intention is to use the device in an offensive manner (to inflict mass casualties or remove defenders from key positions) or defensively to kill themselves and avoid capture. Sieges/Hostage taking/high casualty attacks Similar to the previous TTP, several militant groups, in particular those linked with Al Qaeda and DAESH, have a known history of carrying out attacks on vulnerable locations often targeting foreigners. Incidents like Bardo Museum in Tunis, the beach resort near Sousse, or the kidnapping of NGO members for ransom are part of them. Generally IEDs use in this kind of attacks is limited to hand made grenades and suicide belts or vests. Sometimes the intention of the attack is the kidnaping of foreigners (in order to get a ransom, or just publicity), but other times the idea is provoke as much damage as possible (and casualties), also to get international publicity thru news and to damage tourism industry. The once strong tourism industry in these five countries has suffered a big blown, especially Egypt, Libya and Tunisia. The damage to the economy is later on transferred to families and people, bringing better conditions for social unrest. Targeted suicide attacks The DAESH suicide attack on a bus carrying security forces in Tunis was reminiscent of several seen in Syria at the start of the current crisis with a single operative approaching or boarding a bus carrying or wearing a PBIED. The success of such attacks often appears to be exacerbated by poor security regimes, with a lack of route variation, and the setting of easy to target patterns. Often the attacker may also be wearing a uniform as a form of disguise or even be a soldier or police officer.

17 Attacks on aircraft Regionally there have now been several recent instances of IED attacks on civilian aircraft with the 31 October 2015 attack in Sinai on a Russian airliner with the loss of all on board, being the most prominent and effective. The recent loss of an Egyptair aircraft over the Mediterranean Sea with no clues about the reason (but also not claimed by any group) opens the possibility of a second successful attack. Close to the area of study there was a recent failed attempt to down an aircraft in Somalia on 2 February 2016 appears to have exploited vulnerabilities in airport security. The execution of such attacks suggests a possible outside influence in both IED construction and tactics, and given the spread of IS influence in Africa the presence of more experienced and technically capable IED facilitators who have relocated from other theatres is likely and further such attacks possible. This threat appears limited to DAESH or Al Qaeda linked groups, with Al Shabaab (which claimed the recent airliner attack at Mogadishu) only having undertaken such an attack since recent DAESH influence has caused some members to drift from the traditional AQ ties. Targeted assassinations A number of senior militants and officers in Libya have been assassinated with IEDs. These can of course be initiated by a number of different methods, but it is believed the majority are initiated by RC. Evidence of this can be seen in the reports covering the assassination attempt of Colonel Mehdi Bargathi, the Brigade Commander of 204 Brigade, and another commander of a 204-supporting militia, belonging to Libyan National Army, instigated by Wissam Ben Hamid, the leader of the Islamist militant group FLMB (Free Libya Martyrs Brigade), an affiliate of the Benghazi Revolutionaries Shura Council. He bribed a LNA soldier to place an IED in their vehicle. Also the VBIED attack that killed the Egyptian Prosecutor General in Cairo in June 2015 is an example of a well planned and executed attack that used a known part of a route where the road conditions would cause the target vehicle to slow down or stop. It is speculated that a number of such attacks exploit either poor route security regimes, or that the militants act on leaked information from within the local security apparatus. In general such attacks demonstrate effective coordination and planning. All threat groups are capable of using such methods to target individuals. Female operatives In general all the groups have avoided using female operatives for ideological reasons, and there is little indication this will change soon. This is one of the main differences with similar groups south of Sahara desert (Boko Haram).

18 EXPLOSIVES Explosive used in this area runs from military stocks and ammunitions to HME at industrial scale. Aerial bombs, SA-2 SAM,s warheads, artillery rounds, old anti-personnel landmines, old antitank landmines or weapons, every kind of explosive material is useful for IED makers. Also they take advantage from experience in HME at industrial scale from other theatres. In some images we have seen cylindrical metal containers (some similar to gas canisters) stuck together with foam adhesive. Same method is used with aerial bombs. The containers or bombs are connected with detonating cord. The quality and characteristics of the containers suggest an industrial capacity also in this area.

19 CONCLUSIONS Algeria Reporting of ongoing security forces operations and subsequent detention of large numbers of militants suggests a strong militant presence, especially in the mountainous and less accessible border regions. Reporting of actual attacks remains relatively rare although it is unclear if this is due to government restrictions on media access the number of reported cache finds and arrests suggests that actual clashes between security forces and militants are probably more frequent than is reported and minor IED activity is probably widespread. Given the usual evolution of such insurgencies more spectacular incidents are likely in Algeria, and considering the relative strengths of AQIM and its operational capabilities a similar scenario to that seen at the In Amenas gas facility in 2013, where the facility was attacked and hostages taken, is perhaps as likely as a mass casualty attack in a large city. The continued recovery of arms and materials suggests a desire to manufacture and employ IEDs, and given the ongoing undercurrent of violence in Mali the further spread of such activity into Algeria by groups operating there appears likely. Egypt There appears a consistent undercurrent of IED-based militancy in Egypt and especially the Sinai. While reporting in open sources is relatively sparse, there are indications from government sources of multiple IED incidents daily in the Sinai region targeting security forces. There are also attacks across the border to Israel, trying to get a reaction from them to capitalize it. Some of these attacks are from Hezbollah. Activity in more populated areas remains sporadic, and is perhaps as limited by security forces operations against IED production facilities as by militant intentions. More spectacular IED incidents such as the actual and attempted downing of aircraft may continue to occur, especially given apparent and significant gaps in security at airports in multiple countries and an apparent intention to pursue such means. Additionally occasional attacks on tourists at popular locations remain a distinct possibility especially considering the significant media exposure, and potential impact on economies, such incidents can have. Government action, including the clearance of border areas in Rafah, will likely continue to increase resentment from local people who will in turn become vulnerable to radicalization and exploitation. Libya The clashing factions are generally domestically focused on the struggle to establish their own positions within the country rather than projecting efforts outside of Libya, and IEDs are likely to

20 continue to be used as local force multipliers or to target specific individuals or locations rather than for more spectacular purposes. IEDs also compensate for a lack of conventional munitions. Multiple IEDs, often VO initiated, have been reported in urban areas that have been retaken from DAESH control. The use of suicide operatives by DAESH-linked groups appears constrained compared to the levels of such activity in Iraq and Syria, possibly reflecting a relative lack of such operatives and a tendency for the fighting to be more conventional in nature. Fighting between the various factions continues on a daily basis with little sign of cessation and, despite political moves towards establishing a more stable situation, in reality the country is likely to continue in its current restive state. DAESH is losing control of some key locations and apparently being defeated. Morocco There has been a persistent undercurrent of militancy in Morocco. Arrests of militant cells are reported with some regularity, although actual militant activity is rare. As yet there is little indication that the militancy will become more violent in Morocco, although the country may serve as a conduit for militants and materials passing to other areas. Tunisia As in other countries in the region the main focus of militant presence is in remote mountainous areas. Consistent reporting of security force actions against militant cells indicates a persistent threat although at the moment this seems relatively contained. Being the home country of many FTF (Foreign Terrorist Fighters), should have a reflection in terrorist activity sooner or later. Occasional attacks such as that in Tunis on security forces are highly likely, while the threat against tourists remains with the DAESH-linked Ajnad al-khilafah having a resilient presence. Additionally social conditions within the country remain perilous, with youth vulnerable to radicalization and exploitation.

21 REFERENCES AVCTS Triton RFI related with North Africa (UN Final Report) Terrogence, IS Armored Truck SVBIEDs Libya, May 2016