Salafi-Jihadi Movement Weekly Update, July 20, 2023

Salafi-Jihadi Movement Weekly Update, July 20, 2023

Authors: Brian Carter, Kathryn Tyson, Liam Karr, and Peter Mills

Data Cutoff: July 20, 2023, at 10 a.m.

Key Takeaways:

Iraq and Syria. The United States’ adversaries in Syria are prioritizing confronting the United States over ISIS, which will give the group space to grow its capabilities, rest, and refit. Iran, Russia, and Syria have deployed forces along the line of control separating parts of Syria held by the regime and US-backed Syrian Democratic Forces (SDF). Russian forces are also harassing US aircraft, which draws limited Russian assets away from counter-ISIS operations. CTP has identified four possible scenarios that will affect ISIS's ability to reconstitute itself in Syria: Iran, Russia and Syria reprioritize ISIS; Russia and Iran continue coordinated coercive pressure aimed at forcing a US withdrawal from Syria; Iran chooses to target US forces or the SDF using explosively formed penetrators (EFP); and Iranian- and regime-backed forces attack SDF territory. 

Ghana. Al Qaeda’s regional associate may use abuses against Fulani refugees to begin conducting attacks in northern Ghana. The group has threatened to attack inside Ghana, has the capabilities to launch an attack should it choose to, and has repeatedly taken advantage of security force abuses and ethnic tensions to recruit and expand among marginalized Fulani communities in the Sahel. However, Burkinabe counterterrorism operations targeting Jama’at Nusrat al Islam wa al Muslimeen (JNIM) havens near the Ghanaian border may disincentivize JNIM from opening new attack zones in Ghana until at least after the pressure subsides.

Somalia. An al Shabaab blockade of a regional capital in southern Somalia will likely strengthen local support for an offensive against the group. While the Somali Federal Government (SFG) may attempt to break the blockade as a launching pad for a broader offensive against al Shabaab in southern Somalia, it likely does not have the capacity to sustain significant activity in the area in the coming months. This limited support will likely prevent the SFG from leveraging the increase in local discontent to counter al Shabaab.

Pakistan. The Tehrik-e-Taliban Pakistan (TTP) is expanding its attack zones in Balochistan Province, which may strain the ability of the Pakistani military to counter the TTP. A TTP front group attacked a Pakistani military garrison in Zhob, Balochistan, on July 12, which was the group’s first offensive attack in Zhob since December 2022. Competing claims for the attack are deepening tensions between hard-line and moderate factions in the TTP. A hard-line TTP faction could defect and support the Islamic State Khorasan Province (ISKP) if fractures worsen.

Afghanistan. The terrorism threat from Afghanistan to the United States and its allies has increased over the past six months. Afghan Taliban members participated in a major terror attack in Pakistan. The Taliban government’s rhetorical response to this attack indicates it does not perceive the same counterterrorism obligation toward Pakistan as it does toward the United States. Iran may already be recruiting from Afghanistan to conduct attacks targeting Israel.

Assessments:

Iraq and Syria.

Iran, Russian proxies, and the Syrian regime have deployed forces along the line of control between Syrian regime forces and the US-backed SDF, likely as part of a coercive campaign to expel the United States from Syria.[1] Iran and the Syrian regime have surged forces and matériel to eastern Syria since July 7 under the auspices of defending against a US-SDF offensive into regime-controlled territory.[2] Iran and Iranian-backed militias have framed the US-led international coalition in Syria as an imminent security threat to local Syrians since late June.[3] The surge has occurred alongside an increase in Russian coordination with Iran on planning and intelligence sharing in Syria.[4]

Iran, Russia, and the Syrian regime are giving lower priority to counter-ISIS operations, which very likely presents ISIS with the space to grow its capabilities and rest and refit. The Russian air force continues to conduct some air strikes targeting ISIS, but the increase in flights aimed at harassing US forces in Syria since March draws Russian resources from counter-ISIS operations.[5] Russia maintains a mixed air regiment in Syria, but the war in Ukraine has imposed some constraints on assets, such as the withdrawal of a squadron of attack aircraft in March 2022.[6] Iranian deployments along the line of control (LOC) also pulls resources from countering ISIS in the regime-controlled Deir ez Zor urban belt. ISIS has stepped up attacks and coercive efforts in the Deir ez Zor urban belt since early 2023, including intimidating locals by establishing shadow governance at night and hanging ISIS flags in Musayrib, north of Deir ez Zor city.

Russia replaced Wagner commanders in Syria posts with Russian Ministry of Defense (MOD) officers on July 8, which may temporarily degrade Russia’s ability to conduct counter-ISIS operations.[7] Wagner defended Al Kawm against a major ISIS offensive in April, and it has repeatedly organized counter-ISIS operations in the central Syrian desert in 2023.[8] Wagner commanders in central Syria benefited from sustained Wagner deployments to central Syria and coordinating operations against ISIS. The new Russian MOD commanders will not have the same knowledge, and therefore they will be more prone to poorer or slower decision-making. The Wall Street Journal reported Iran is attempting to recruit the Wagner-funded “ISIS Hunters,” a Syrian mercenary group whose members are no longer being paid by Wagner and returned to their homes in Palmyra, Syria.[9] The decrease in the available manpower of pro-regime forces suggests negative impacts for counter-ISIS operations.

ISIS may be lying low in Deir ez Zor amid the buildup of Iranian, Syrian regime, and Russian-backed forces along the LOC. ISIS claimed only four attacks in Deir ez Zor since July 5, including when ISIS fighters killed an SDF fighter in Izba after ISIS supporters chanted in support of the organization there on July 4.[10] ISIS is still conducting other attacks, but it is not claiming them.[11] It is also conducting isolated operations to maintain support zones north of the Euphrates River Valley, where ISIS fighters threatened 39 SDF members with death in the Khabour River Valley on July 17.[12]

Figure 1. ISIS Activity in Northeastern Syria Since July 5

Source: Brian Carter and the Institute for the Study of War.

CTP has identified several scenarios in northeastern Syria that may affect ISIS’s ability to reconstitute itself in eastern Syria. The group’s efforts are currently contained by the US presence, though ISIS is setting conditions for a rapid resurgence after the US withdrawal. A change in US presence or activities under these scenarios would accelerate ISIS’s condition setting. The scenarios are not mutually exclusive. Iran, Russia, and Syria have the option to pursue more than one at a time or multiple scenarios sequentially. These scenarios are:

• Iran, Russia, and the Syrian regime retain their forces in eastern Syria but deprioritize expelling the United States from Syria. This would return the situation in Syria to a state in which Iranian and regime-backed forces intermittently clash with the SDF short of an offensive campaign into SDF-controlled territory. This scenario would also entail a low level of Russian harassment against US forces and an effective Russian MOD chain of command for counter-ISIS forces that is capable of making effective and quick decisions.[13] ISIS would restart its attacks on regime forces and the SDF as well as operations to create new support zones and co-opt locals. These efforts are currently experiencing success, and a decrease in the current tensions will contain but not defeat ISIS efforts.[14] The longer the SDF, regime, Iran, and Russia maintain forces along the LOC to pressure the United States and SDF before deprioritizing expelling the United States from Syria, the more ISIS will be able to build its support zones in other areas, such as near Raqqa or the Khabour River.[15]
• Russia and Iran continue coordinated coercive pressure aimed at forcing a US withdrawal from Syria and deprioritize counter-ISIS operations. The SDF would respond by maintaining its forces along the LOC, which would limit ISIS’s ability to conduct operations in the east bank of the Euphrates near Deir ez Zor city. Russia and Iran do not conduct counter-ISIS operations to sufficiently degrade ISIS capabilities in regime-held Syria under this scenario. Limited Russian air support for counter-ISIS forces in central Syria would inhibit counter-ISIS operations. This would enable ISIS to more effectively fight pitched battles against pro-regime forces to deny regime access to key sanctuaries or seize regime supplies in central Syria.[16] It also may enable ISIS to strengthen its presence on both banks of the Euphrates.
• Iran directs or authorizes its proxies in Syria to use EFP against US forces or the SDF in northeastern Syria. The use of EFP would deny the SDF access to certain areas, such as Baqqara tribal territory north of Deir ez Zor city, that Iran and the regime have previously targeted for recruitment efforts. ISIS already uses improvised explosive devices, which can generate similar tactical-level effects to EFPs, to deny SDF access to ISIS support zones.[17] ISIS would be able to take advantage of the denial effects of EFPs, even if it does not detonate them, because Iranian-backed sleeper cells responsible for the EFPs would not be prepared to control or secure the population. Iranian-backed sleeper cells are already present in northeastern Syria.[18]
• In a low probability but dangerous scenario, Iranian- and regime-backed forces attack SDF territory. An assault against the SDF-held areas in Syria would sap SDF bandwidth while pulling pro-regime forces from the west bank of the Euphrates. This would enable ISIS to build support zones in Deir ez Zor, where the population would not be secured by regime or SDF forces due to active combat between the regime and SDF. The high-intensity combat in this scenario and proximity of US forces to the fighting would risk inadvertent or intentional escalation between Iran, Russia, and the United States in Syria. New ISIS support zones caused by an inability for either the regime or the SDF to disrupt the group would allow ISIS to reconstitute key capabilities, such as planning cells and vehicle-borne improvised explosive device manufacturers, to target critical infrastructure. ISIS could use these assets to generate forces by targeting prison facilities.

Figure 1. The Salafi-Jihadi Movement in the Middle East

Source: Kathryn Tyson.

Ghana. Al Qaeda’s regional associate may use abuses against Fulani refugees to begin conducting attacks in northern Ghana. Ghanaian security forces began forcibly deporting Burkinabe refugees living in northern Ghana on July 11, many of which were ethnically Fulani.[19] The UN said on July 13 that Ghana had illegally deported at least 250 Burkinabe refugees.[20] The local media wing of al Qaeda’s regional associate JNIM had circulated an unofficial audio recording calling for jihad against Ghana if “abuses against Fulanis continue” by July 14.[21]

JNIM has not claimed an attack in northern Ghana, but it has the capabilities to launch an attack should it choose to. The group has taken advantage of illicit networks and porous borders to establish rear bases for fighters, access to supplies, and freedom of movement in northern Ghana that support its activities in Burkina Faso.[22] It has also exploited ongoing farmer-herder and chieftaincy clashes and other local grievances to recruit hundreds of Ghanaians that could carry out attacks or start a local insurgency.[23] JNIM transitioned rear zones in Benin and Togo to attack zones in 2022, demonstrating the latent attack potential that is also present in Ghana.[24]

JNIM has repeatedly taken advantage of security force abuses and ethnic tensions to recruit and expand among marginalized Fulani communities in the Sahel. The JNIM subgroups in Burkina Faso and central Mali each exploited local grievances among Fulanis to gain footholds in their respective areas of operation.[25] Both subgroups are using the same strategy as they expand down the eastern and western flanks of Burkina Faso and into the northern regions of the Gulf of Guinea.[26] Various JNIM leaders have also explicitly referenced abuses against Fulani civilians when justifying calls to expand across West Africa, including a shadow governor that said its expansion into neighboring Benin and Togo was a response to Fulani abuses.[27]

Burkinabe counterterrorism operations targeting JNIM havens near the Ghanaian border may disincentivize JNIM from opening new attack zones in Ghana until at least after the pressure subsides. Burkinabe forces have amplified counterterrorism pressure on JNIM havens in Burkina Faso near the Ghanaian border since May 2023.[28] CTP previously assessed that these operations had likely temporarily degraded JNIM’s support zones in the area but that JNIM would use other havens—such as its rear bases in Ghana—to maintain and strengthen the support zones over time, due to Burkina Faso’s capacity limitations.[29]

Opening new attack zones in Ghana would invite pressure on these rear bases and jeopardize their ability to support the group’s response to the growth of Burkinabe counterterrorism pressure. JNIM did not escalate attacks in Benin and Togo despite having rear bases in both countries until Beninese forces and other regional militaries increased efforts to disrupt these rear bases in late 2021 and 2022.[30] This timeline indicates the group primarily uses its littoral bases to support activities in Burkina Faso but will transition them to attack zones if security forces degrade their ability to do so.

Figure 2. JNIM and Burkinabe Forces Contest Southeastern Burkina Faso

Source: Liam Karr and Mike DeAngelo.

Somalia. Al Shabaab has besieged the capital of southern Somalia’s Bay region since July 11, which will likely strengthen local support for an offensive against the group. Al Shabaab began besieging the city after regional police arrested school administrators traveling to a meeting in al Shabaab–controlled areas of Somalia.[31] The siege has caused a humanitarian crisis by increasing the price of supplies in the town exponentially. Al Shabaab punitive measures targeting civilians have backfired previously, such as when the group stopped international aid during the 2011 famine.[32] Al Shabaab recently tried to suppress rebelling clan militias in central Somalia in 2022 by targeting humanitarian convoys in the area.[33] The punitive attacks instead mobilized more militias, which led to the broader central Somalia offensive that liberated villages across multiple regions of central Somalia.[34]

The SFG may use the blockade as a launching pad for an offensive against al Shabaab in southern Somalia. SFG officials have promised to launch an offensive against al Shabaab in southern Somalia throughout 2023 and have reiterated that an offensive is imminent when condemning the blockade.[35] Federal forces made their first effort to break the siege on July 19 when they cleared an area along one of the al Shabaab–controlled roads leading to the regional capital.[36]

The SFG likely does not have the capacity to sustain significant activity in southern Somalia in the coming months, however. That the SFG took more than a week to respond to the siege indicates it was unprepared to confront al Shabaab in this area. The SFG also sent additional reinforcements to central Somalia on July 18 and carried out two large-scale operations there.[37] This indicates that the government is giving priority to clearing al Shabaab’s remaining havens in central Somalia to complete an offensive that began in central Somalia in 2022.[38] This prioritization will limit the resources available to the SFG to combat al Shabaab in southern Somalia. The SFG is trying to bolster its capacity in southern Somalia through its plan to deploy additional troops from neighboring countries, but these forces have not yet arrived.[39]

Limited government support to southern Somalia in the near term will likely prevent the SFG from leveraging an increase in local discontent to counter al Shabaab. Government support is critical to transforming local discontent into locally supported counterinsurgency operations. Ethiopia helped arm the clan militias in central Somalia in 2022 while SFG reinforcements helped the militias take territory from al Shabaab.[40] Local militias in the Bay region conducted counterterrorism operations against al Shabaab in September 2022, but they are less well armed and less confrontational with al Shabaab compared to the clans in central Somalia.[41]

These comparative disadvantages mean the SFG and its partners will need to do more to provide military support and protect civilians before locals will mobilize against al Shabaab. Somali media has said a group of local elders is already negotiating with al Shabaab to end the siege due to the lack of government support. This would undermine the government’s credibility whenever it chooses to start its offensive against al Shabaab’s havens in southern Somalia.[42]

Figure 3. The Salafi-Jihadi Movement in Africa

Source: Kathryn Tyson.

Pakistan. The TTP is expanding its attack zones in Balochistan Province, which may strain the ability of the Pakistani military to counter the TTP. A TTP front group attacked a Pakistani military garrison in Zhob, western Pakistan, on July 12, which was the group’s first offensive attack in Zhob since December 2022.[43] The attack led to an hours-long firefight before a Pakistani corps commander led a clearing operation that secured the garrison and killed the attackers.[44] Several militant groups operate in Balochistan, including the TTP, the Islamic State’s Pakistan affiliate, and multiple Balochi nationalist groups. A new TTP front in Balochistan will strain the capacity of Pakistani security forces, challenging their ability to launch a comprehensive counter-TTP campaign in northwestern Pakistan, where the TTP has established safe havens. Pakistan announced a counter-TTP campaign in northwestern Pakistan in April, but CTP has assessed that this operation is currently on hold.[45]

Figure 4. TTP Attacks and Pakistani Operations Against the TTP

Source: Kathryn Tyson.

The TTP has made efforts to increase attacks and recruitment in Balochistan since 2022. The TTP has expanded its operations in Balochistan since 2022.[46] The TTP is also increasingly appealing to Balochi militant groups. Four Balochistan-based militant groups have joined the TTP since July 2022.[47] A TTP leadership council member said in April 2023 that these four groups were the first ethnic Balochi commanders to join the TTP in Balochistan.[48] TTP also published propaganda in the Baloch language and released rhetoric supporting Balochi civilians against the Pakistani military and government in 2022.[49] The TTP appointed a shadow governor for a region in Balochistan in June, signaling it seeks to expand de facto governance to this region.[50]

The TTP’s expansion into Balochistan reflects its broader goal to emulate Afghan Taliban governance in Pakistan. The TTP seeks to unite Pakistan’s various militant groups under one banner.[51] The TTP has attempted to achieve this by expanding administrative structures in non-Pashtun areas in Punjab and Balochistan and centralizing and formalizing its leadership structure to reflect the Taliban governance model.[52]

The Zhob attack is deepening tensions between hard-line and moderate factions in the TTP. The hard-line TTP faction Jamaat ul Ahrar (JuA) claimed the Zhob attack on July 12. The TTP spokesperson denied participating in the attack and claimed that its “brother organization,” the Tehrik-e-Jihad (TJP), conducted the attack. The TJP claimed credit for the attack on July 12.[53] The TTP dismissed the JuA leader from his post as a shadow governor and replaced the leader on July 12 for falsely claiming the attack.[54] The TJP is a front group for the TTP, which enables the TTP to maintain plausible deniability for attacks and dampening pressure on the Afghan Taliban to reign in the TTP.[55] The Pakistani government has repeatedly pressured the Taliban to address TTP safe havens in Afghanistan, but the Taliban maintains the TTP does not operate from within Afghanistan.[56]

JuA could defect and support the ISKP if fractures worsen. The TTP leader Noor Wali Mehsud was attacked by unknown militants in Jalalabad, Afghanistan, on July 16 after reportedly meeting with JuA leaders.[57] The attack has generated distrust. The TTP announced after the attack that Mehsud would not be holding meetings for the foreseeable future.[58] JuA defected from the TTP in 2014 due to internal disputes.[59] JuA coordinated with ISKP on multiple attacks after it defected.[60]

Afghanistan. The Afghan Taliban’s recent rhetoric and attacks in Pakistan indicate that the terrorism threat from Afghanistan toward neighboring countries has worsened during the past six months. Most of the militants in the July 12 attack in Zhob, Pakistan, were Afghan Taliban members.[61] An Afghan journalist separately reported three-quarters of TTP suicide bombers over the past six months were Afghan Taliban members.[62] CTP has not previously observed evidence of Afghan Taliban members participating in TTP attacks.

The Afghan Taliban continues to support the TTP by providing safe havens and rhetorical support and allowing the TTP to fundraise in Afghanistan.[63] The group claims that the TTP is only based in Pakistan, however.[64] The Taliban responded to Pakistani criticism following the Zhob attack by claiming the Doha Agreement only applies to the United States, not Pakistan.[65] The Doha Agreement obliges the Taliban to prevent terrorism from Afghanistan targeting both the United States and its allies—including Pakistan, a major non-NATO ally. [66] The Taliban statement implies the Taliban do not think they have the same counterterrorism obligations toward Pakistan as they do toward the United States. This is a change from prior Taliban statements that emphasized the Taliban would not allow terrorists to use Afghanistan to conduct attacks abroad.[67]

The Taliban government’s reluctance and inability to restrain the TTP combined with the TTP’s expanding operations could create space for transnational groups to conduct attacks beyond the Afghanistan-Pakistan region. The TTP maintains a relationship with al Qaeda and has previously sheltered other transnational terror groups that seek to conduct attacks abroad.[68] The TTP also shares networks with ISKP, which has repeatedly sought to conduct attacks beyond Afghanistan and Pakistan.[69] TTP safe havens in Pakistan allowed it to support operations abroad, including an attempted attack in New York in 2010.[70] ISKP can also exploit a declining security situation in Pakistan to increase attacks with an aim to carve out safe havens that support its efforts to attack beyond Afghanistan and Pakistan.

An Afghan former BBC journalist reported that the Iranian Islamic Revolutionary Guards Corps is working with Taliban intelligence to facilitate suicide bombers from Afghanistan attacking Israeli targets in the Middle East.[71] CTP cannot independently verify this report. The information is consistent with reports that indicate the threat Iran perceives from Israel through Azerbaijan and Iraq, however. Iranian regime officials have frequently accused the Azerbaijani government of allowing Israel to use Azerbaijani territory to launch operations against Iran, as CTP previously reported.[72]

Israel blamed Iran for an attempted bombing of the Israeli embassy in Azerbaijan by an Afghan man on July 13.[73] This indicates Iran has already recruited Afghans to conduct attacks targeting Israel. Iranian media has also accused Kurdish groups in Iraqi Kurdistan of helping Israel smuggle military equipment into Iran to use against the Iranian government.[74] Taliban cooperation with Iran to move suicide bombers throughout the Middle East would further violate its Doha Agreement obligation to not threaten the security of the US and its allies.

Figure 5. The Salafi-Jihadi Movement in Central and South Asia

Source: Kathryn Tyson.